@confighub/react-auth 0.5.4 → 0.6.1

package/README.md

@@ -50,7 +50,7 @@ organization's own IdP for Enterprise).
 ## `useAuth()`
 
 ```ts
-const { status, user, error, login, logout, switchOrganization, reauthenticate, getToken } = useAuth();
+const { status, user, error, login, logout, reauthenticate, signInWithTicket, getToken } = useAuth();
 ```
 
 - `login(options?)` — redirects to the IdP. `returnTo` picks the landing path
@@ -59,20 +59,28 @@ const { status, user, error, login, logout, switchOrganization, reauthenticate,
   out, the alias of the last successful login in this browser is used (remembered
   per client in `localStorage`; a short public name, not a credential), so a new
   tab or a login after logout lands in the same organization silently. `null`
-  sends no hint on purpose, so Keycloak prompts: that is "switch organization".
-  `prompt: 'none' | 'login'` is passed through.
+  sends no hint on purpose, so Keycloak prompts. Either is how an app switches
+  organization: a fresh login through the IdP, which is where membership is
+  decided. `prompt: 'none' | 'login' | 'create'` is passed through; `'create'` opens
+  the IdP's registration form, so a sign-up link is `login({ prompt: 'create' })`.
 - `logout(options?)` — forgets the session in this tab. `endSession: true` also ends
   the IdP session (RP-initiated logout with `id_token_hint`), landing on
   `postLogoutRedirectUri` (default: the callback URI), which must be registered
-  for the client. Without it the next login rides the SSO cookie silently.
-- `switchOrganization(organizationId)` — `POST /auth/switch-organization` with the
-  bearer token, re-minting for another org the user belongs to. Requires a server
-  that offers the bearer form; a fresh `login()` with no organization hint is the
-  portable alternative, since the IdP then prompts for the organization.
+  for the client. Without it the next login rides the SSO cookie silently. While the
+  page navigates to the IdP, status stays `loading`, so an app that logs in
+  automatically on `unauthenticated` does not start a login that races the logout.
 - `reauthenticate()` — the token stopped working: a `prompt=none` round trip for the
   organization the session already had. Status is `loading` meanwhile, not
   `unauthenticated`, so an app that auto-logs-in on `unauthenticated` does not race
-  it. If the IdP session is gone too, the page comes back `unauthenticated`.
+  it. If the IdP session is gone too, the page comes back `unauthenticated`. On an
+  instance with no identity provider there is nothing to ask, and status goes
+  straight to `unauthenticated`.
+- `signInWithTicket(ticket)` — redeems a single-use ticket from
+  `cub auth browser-session` (`POST /auth/browser-session`) for a session. This is how
+  a browser signs in to an instance with no identity provider, which `/api/info`
+  shows by advertising no `AuthIssuer`; `login()` rejects with `NoIdentityProvider`
+  there. The session has no IdP behind it, so when it expires the user runs the
+  command again.
 
 ## Outside React
 

package/dist/index.cjs

@@ -14,6 +14,12 @@ var OrganizationMissing = class extends Error {
     this.name = "OrganizationMissing";
   }
 };
+var NoIdentityProvider = class extends Error {
+  constructor() {
+    super("this instance has no identity provider; sign in with `cub auth browser-session`");
+    this.name = "NoIdentityProvider";
+  }
+};
 var PKCE_KEY = "confighub_pkce";
 var LAST_ORG_KEY = "confighub_last_org";
 var lastOrgKey = (clientId) => `${LAST_ORG_KEY}:${clientId}`;
@@ -71,6 +77,7 @@ async function oidcMetadata(issuer) {
 }
 async function startLogin(base, clientId, login = {}, flow = {}, retry = {}) {
   const info = await discover(base);
+  if (!info.AuthIssuer && !info.TokenExchangeEndpoint) throw new NoIdentityProvider();
   if (!info.AuthIssuer || !info.TokenExchangeEndpoint) {
     throw new Error(
       "this instance is not configured for token-exchange auth (server needs CONFIGHUB_IDP_ISSUER)"
@@ -173,18 +180,15 @@ async function exchange(exchangeEndpoint, subjectToken) {
   const minted = await exResp.json();
   return { accessToken: minted.access_token, organizationId: minted.organization_id };
 }
-async function switchOrganization(base, accessToken, organizationId) {
-  const r = await fetch(trimSlash(base) + "/auth/switch-organization", {
+async function redeemBrowserTicket(base, ticket) {
+  const r = await fetch(trimSlash(base) + "/auth/browser-session", {
     method: "POST",
-    headers: {
-      Authorization: `Bearer ${accessToken}`,
-      "Content-Type": "application/x-www-form-urlencoded"
-    },
-    body: new URLSearchParams({ organization_id: organizationId })
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ ticket })
   });
-  if (!r.ok) throw new Error(`/auth/switch-organization ${r.status}: ${await r.text()}`);
+  if (!r.ok) throw new Error(`/auth/browser-session ${r.status}: ${await r.text()}`);
   const minted = await r.json();
-  return { accessToken: minted.access_token, organizationId: minted.organization_id };
+  return { accessToken: minted.access_token, organizationId: minted.organization_id, idpClaims: {} };
 }
 async function endSession(base, clientId, idToken, postLogoutRedirectUri) {
   const info = await discover(base);
@@ -331,27 +335,29 @@ function ConfigHubAuthProvider({
   const logout = react.useCallback(
     async (options) => {
       const idToken = sessionRef.current?.idToken;
-      clearSession();
-      if (options?.endSession) {
+      if (!options?.endSession) {
+        clearSession();
+        return;
+      }
+      sessionRef.current = void 0;
+      setAccessToken(void 0);
+      persistSession(void 0);
+      resetPending();
+      setUser(null);
+      setStatus("loading");
+      try {
         await endSession(
           baseUrl,
           clientId,
           idToken,
           options.postLogoutRedirectUri ?? callbackUri(flow)
         );
+      } catch (e) {
+        setError(e instanceof Error ? e : new Error(String(e)));
+        setStatus("error");
       }
     },
-    [baseUrl, clientId, clearSession, flow]
-  );
-  const switchOrganization2 = react.useCallback(
-    async (organizationId) => {
-      const current = sessionRef.current;
-      if (!current) throw new Error("not authenticated");
-      const minted = await switchOrganization(baseUrl, current.accessToken, organizationId);
-      rememberOrganization(clientId, void 0);
-      applySession({ ...current, ...minted });
-    },
-    [applySession, baseUrl, clientId]
+    [baseUrl, clientId, clearSession, flow, persistSession]
   );
   const getToken = react.useCallback(() => sessionRef.current?.accessToken, []);
   const reauthenticate = react.useCallback(async () => {
@@ -364,10 +370,20 @@ function ConfigHubAuthProvider({
     try {
       await startLogin(baseUrl, clientId, { prompt: "none", organization }, flow);
     } catch (e) {
+      if (e instanceof NoIdentityProvider) {
+        setStatus("unauthenticated");
+        return;
+      }
       setError(e instanceof Error ? e : new Error(String(e)));
       setStatus("error");
     }
   }, [baseUrl, clientId, flow, persistSession]);
+  const signInWithTicket = react.useCallback(
+    async (ticket) => {
+      applySession(await redeemBrowserTicket(baseUrl, ticket));
+    },
+    [applySession, baseUrl]
+  );
   const handleUnauthorized2 = react.useCallback(() => {
     if (!sessionRef.current) return;
     if (onUnauthorized === "login") void reauthenticate();
@@ -388,12 +404,12 @@ function ConfigHubAuthProvider({
       error,
       login,
       logout,
-      switchOrganization: switchOrganization2,
       reauthenticate,
+      signInWithTicket,
       getToken,
       client
     }),
-    [status, user, error, login, logout, switchOrganization2, reauthenticate, getToken, client]
+    [status, user, error, login, logout, reauthenticate, signInWithTicket, getToken, client]
   );
   return /* @__PURE__ */ jsxRuntime.jsx(ConfigHubAuthContext.Provider, { value, children });
 }
@@ -410,6 +426,7 @@ function useConfigHub() {
 
 exports.ConfigHubAuthContext = ConfigHubAuthContext;
 exports.ConfigHubAuthProvider = ConfigHubAuthProvider;
+exports.NoIdentityProvider = NoIdentityProvider;
 exports.OrganizationMissing = OrganizationMissing;
 exports.callbackUri = callbackUri;
 exports.decodeJwtClaims = decodeJwtClaims;

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/core.ts","../src/tokenStore.ts","../src/provider.tsx","../src/hooks.ts"],"names":["createContext","useState","useRef","useMemo","useCallback","useEffect","switchOrganization","handleUnauthorized","createConfigHubClient","jsx","useContext"],"mappings":";;;;;;;;;AAiGO,IAAM,mBAAA,GAAN,cAAkC,KAAA,CAAM;AAAA,EAC7C,YAA4B,QAAA,EAAkB;AAC5C,IAAA,KAAA,CAAM,2DAA2D,CAAA;AADvC,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAE1B,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AAAA,EACd;AACF;AAOA,IAAM,QAAA,GAAW,gBAAA;AACjB,IAAM,YAAA,GAAe,oBAAA;AAIrB,IAAM,aAAa,CAAC,QAAA,KAA6B,CAAA,EAAG,YAAY,IAAI,QAAQ,CAAA,CAAA;AAGrE,SAAS,uBAAuB,QAAA,EAAsC;AAC3E,EAAA,IAAI;AACF,IAAA,OAAO,YAAA,CAAa,OAAA,CAAQ,UAAA,CAAW,QAAQ,CAAC,CAAA,IAAK,KAAA,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAGO,SAAS,oBAAA,CAAqB,UAAkB,KAAA,EAAiC;AACtF,EAAA,IAAI;AACF,IAAA,IAAI,OAAO,YAAA,CAAa,OAAA,CAAQ,UAAA,CAAW,QAAQ,GAAG,KAAK,CAAA;AAAA,SACtD,YAAA,CAAa,UAAA,CAAW,UAAA,CAAW,QAAQ,CAAC,CAAA;AAAA,EACnD,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAMO,SAAS,oBAAoB,SAAA,EAAwD;AAC1F,EAAA,MAAM,MAAM,SAAA,CAAU,YAAA;AACtB,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,UAAU,OAAO,MAAA;AAC5C,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,IAAA,CAAK,GAA8B,CAAA;AAC1D,EAAA,OAAO,OAAA,CAAQ,MAAA,KAAW,CAAA,GAAI,OAAA,CAAQ,CAAC,CAAA,GAAI,MAAA;AAC7C;AAEA,IAAM,YAAY,CAAC,CAAA,KAAsB,CAAA,CAAE,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAGtD,IAAM,cAAc,CAAC,IAAA,KAC1B,OAAO,QAAA,CAAS,MAAA,IAAU,MAAM,YAAA,IAAgB,GAAA;AAElD,IAAM,WAAA,GAAc,MAClB,MAAA,CAAO,QAAA,CAAS,WAAW,MAAA,CAAO,QAAA,CAAS,MAAA,GAAS,MAAA,CAAO,QAAA,CAAS,IAAA;AAEtE,IAAM,MAAA,GAAS,CAAC,GAAA,KACd,IAAA,CAAK,OAAO,YAAA,CAAa,GAAG,IAAI,UAAA,CAAW,GAAG,CAAC,CAAC,CAAA,CAC7C,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,OAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAEtB,IAAM,YAAA,GAAe,CAAC,CAAA,GAAI,EAAA,KACxB,MAAA,CAAO,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,CAAC,CAAC,CAAA,CAAE,MAAM,CAAA;AAEzD,eAAe,OAAO,CAAA,EAA4B;AAChD,EAAA,OAAO,MAAA,CAAO,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AAClF;AAGO,SAAS,gBAAgB,KAAA,EAAwC;AACtE,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC/B,EAAA,IAAI,CAAC,IAAA,EAAM,OAAO,EAAC;AACnB,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAC,CAAC,CAAA;AAAA,EACpE,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAGO,SAAS,SAAA,CAAU,KAAA,EAAe,WAAA,GAAc,EAAA,EAAa;AAClE,EAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,KAAK,CAAA,CAAE,GAAA;AACnC,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,KAAA;AACpC,EAAA,OAAO,GAAA,GAAM,GAAA,IAAQ,IAAA,CAAK,GAAA,KAAQ,WAAA,GAAc,GAAA;AAClD;AAEA,eAAsB,SAAS,IAAA,EAAkC;AAC/D,EAAA,MAAM,IAAI,MAAM,KAAA,CAAM,SAAA,CAAU,IAAI,IAAI,WAAW,CAAA;AACnD,EAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,oBAAA,GAAuB,EAAE,MAAM,CAAA;AAC1D,EAAA,OAAO,EAAE,IAAA,EAAK;AAChB;AAQA,eAAe,aAAa,MAAA,EAAuC;AACjE,EAAA,MAAM,IAAI,MAAM,KAAA,CAAM,SAAA,CAAU,MAAM,IAAI,mCAAmC,CAAA;AAC7E,EAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,yBAAA,GAA4B,EAAE,MAAM,CAAA;AAC/D,EAAA,OAAO,EAAE,IAAA,EAAK;AAChB;AAOA,eAAsB,UAAA,CACpB,IAAA,EACA,QAAA,EACA,KAAA,GAAsB,EAAC,EACvB,IAAA,GAAoB,EAAC,EACrB,KAAA,GAAsB,EAAC,EACR;AACf,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAI,CAAA;AAChC,EAAA,IAAI,CAAC,IAAA,CAAK,UAAA,IAAc,CAAC,KAAK,qBAAA,EAAuB;AACnD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAO,MAAM,YAAA,CAAa,IAAA,CAAK,UAAU,CAAA;AAC/C,EAAA,MAAM,WAAW,YAAA,EAAa;AAC9B,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,QAAQ,CAAA;AACvC,EAAA,MAAM,KAAA,GAAQ,aAAa,EAAE,CAAA;AAC7B,EAAA,MAAM,WAAA,GAAc,YAAY,IAAI,CAAA;AAGpC,EAAA,MAAM,KAAA,GACJ,MAAM,YAAA,KAAiB,IAAA,GACnB,SACC,KAAA,CAAM,YAAA,IAAgB,uBAAuB,QAAQ,CAAA;AAC5D,EAAA,MAAM,QAAA,GAAW,KAAA,GAAQ,CAAA,aAAA,EAAgB,KAAK,CAAA,CAAA,GAAK,cAAA;AACnD,EAAA,MAAM,IAAA,GAAkB;AAAA,IACtB,QAAA;AAAA,IACA,KAAA;AAAA,IACA,QAAA;AAAA,IACA,eAAe,IAAA,CAAK,cAAA;AAAA,IACpB,kBAAkB,IAAA,CAAK,qBAAA;AAAA,IACvB,WAAA;AAAA,IACA,QAAA,EAAU,KAAA,CAAM,QAAA,IAAY,WAAA,EAAY;AAAA,IACxC,MAAA,EAAQ,MAAM,MAAA,KAAW,MAAA;AAAA,IACzB,kBAAA,EAAoB,KAAA;AAAA,IACpB,wBAAwB,KAAA,CAAM;AAAA,GAChC;AACA,EAAA,cAAA,CAAe,OAAA,CAAQ,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AACrD,EAAA,MAAM,MAAA,GAAiC;AAAA,IACrC,aAAA,EAAe,MAAA;AAAA,IACf,SAAA,EAAW,QAAA;AAAA,IACX,YAAA,EAAc,WAAA;AAAA,IACd,KAAA,EAAO,wBAAwB,QAAQ,CAAA,CAAA;AAAA,IACvC,cAAA,EAAgB,SAAA;AAAA,IAChB,qBAAA,EAAuB,MAAA;AAAA,IACvB;AAAA,GACF;AACA,EAAA,IAAI,KAAA,CAAM,MAAA,EAAQ,MAAA,CAAO,MAAA,GAAS,KAAA,CAAM,MAAA;AAExC,EAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,IAAA,CAAK,sBAAsB,CAAA;AACnD,EAAA,OAAA,CAAQ,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAM,EAAE,QAAA,EAAS;AACtD,EAAA,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,OAAA,CAAQ,QAAA,EAAU,CAAA;AAC3C;AAGA,IAAI,OAAA,GAAgD,IAAA;AAU7C,SAAS,yBAAA,GAA2D;AACzE,EAAA,IAAI,CAAC,OAAA,EAAS,OAAA,GAAU,eAAA,EAAgB;AACxC,EAAA,OAAO,OAAA;AACT;AAEA,IAAM,kCAAkB,IAAI,GAAA,CAAI,CAAC,gBAAA,EAAkB,sBAAA,EAAwB,kBAAkB,CAAC,CAAA;AAE9F,eAAe,eAAA,GAAiD;AAC9D,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAA,CAAO,SAAS,MAAM,CAAA;AACzD,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AAC9B,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA;AAChC,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,KAAA,EAAO,OAAO,IAAA;AAE5B,EAAA,MAAM,QAAA,GAAW,cAAA,CAAe,OAAA,CAAQ,QAAQ,CAAA;AAChD,EAAA,cAAA,CAAe,WAAW,QAAQ,CAAA;AAClC,EAAA,MAAM,KAAA,GAA0B,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA,GAAI,IAAA;AAIlE,EAAA,OAAA,CAAQ,aAAa,EAAC,EAAG,IAAI,KAAA,EAAO,QAAA,IAAY,aAAa,CAAA;AAE7D,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,IAAI,OAAO,MAAA,IAAU,eAAA,CAAgB,GAAA,CAAI,KAAK,GAAG,OAAO,IAAA;AACxD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,KAAK,CAAA,CAAA,EAAI,OAAO,GAAA,CAAI,mBAAmB,CAAA,IAAK,EAAE,CAAA,CAAE,CAAA;AAAA,EACzF;AAOA,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,IAAI,MAAA,CAAO,IAAI,OAAO,CAAA,KAAM,MAAM,KAAA,EAAO,MAAM,IAAI,KAAA,CAAM,0BAA0B,CAAA;AAGnF,EAAA,MAAM,SAAA,GAAY,MAAM,KAAA,CAAM,KAAA,CAAM,aAAA,EAAe;AAAA,IACjD,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,oBAAA;AAAA,MACZ,IAAA;AAAA,MACA,cAAc,KAAA,CAAM,WAAA;AAAA,MACpB,WAAW,KAAA,CAAM,QAAA;AAAA,MACjB,eAAe,KAAA,CAAM;AAAA,KACtB;AAAA,GACF,CAAA;AACD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,SAAA,CAAU,MAAM,KAAK,MAAM,SAAA,CAAU,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EACrF;AACA,EAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,IAAA,EAAK;AAGtC,EAAA,MAAM,SAAA,GAAY,eAAA,CAAgB,QAAA,CAAS,YAAY,CAAA;AACvD,EAAA,IAAI,CAAC,mBAAA,CAAoB,SAAS,CAAA,IAAK,CAAC,MAAM,sBAAA,EAAwB;AAIpE,IAAA,IAAI,KAAA,CAAM,kBAAA,EAAoB,oBAAA,CAAqB,KAAA,CAAM,UAAU,MAAS,CAAA;AAC5E,IAAA,MAAM,IAAI,mBAAA,CAAoB,KAAA,CAAM,QAAQ,CAAA;AAAA,EAC9C;AACA,EAAA,MAAM,SAAS,MAAM,QAAA,CAAS,KAAA,CAAM,gBAAA,EAAkB,SAAS,YAAY,CAAA;AAC3E,EAAA,oBAAA,CAAqB,KAAA,CAAM,QAAA,EAAU,mBAAA,CAAoB,SAAS,CAAC,CAAA;AACnE,EAAA,OAAO;AAAA,IACL,GAAG,MAAA;AAAA,IACH,SAAA;AAAA,IACA,SAAS,OAAO,QAAA,CAAS,QAAA,KAAa,QAAA,GAAW,SAAS,QAAA,GAAW;AAAA,GACvE;AACF;AAEA,eAAe,QAAA,CACb,kBACA,YAAA,EACgE;AAChE,EAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,gBAAA,EAAkB;AAAA,IAC3C,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,iDAAA;AAAA,MACZ,aAAA,EAAe,YAAA;AAAA,MACf,kBAAA,EAAoB;AAAA,KACrB;AAAA,GACF,CAAA;AACD,EAAA,IAAI,CAAC,MAAA,CAAO,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,MAAA,CAAO,MAAM,CAAA,EAAA,EAAK,MAAM,MAAA,CAAO,IAAA,EAAM,CAAA,CAAE,CAAA;AACzF,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,EAAK;AACjC,EAAA,OAAO,EAAE,WAAA,EAAa,MAAA,CAAO,YAAA,EAAc,cAAA,EAAgB,OAAO,eAAA,EAAgB;AACpF;AAOA,eAAsB,kBAAA,CACpB,IAAA,EACA,WAAA,EACA,cAAA,EACgE;AAChE,EAAA,MAAM,IAAI,MAAM,KAAA,CAAM,SAAA,CAAU,IAAI,IAAI,2BAAA,EAA6B;AAAA,IACnE,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACP,aAAA,EAAe,UAAU,WAAW,CAAA,CAAA;AAAA,MACpC,cAAA,EAAgB;AAAA,KAClB;AAAA,IACA,MAAM,IAAI,eAAA,CAAgB,EAAE,eAAA,EAAiB,gBAAgB;AAAA,GAC9D,CAAA;AACD,EAAA,IAAI,CAAC,CAAA,CAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,CAAA,CAAE,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,CAAA;AACrF,EAAA,MAAM,MAAA,GAAS,MAAM,CAAA,CAAE,IAAA,EAAK;AAC5B,EAAA,OAAO,EAAE,WAAA,EAAa,MAAA,CAAO,YAAA,EAAc,cAAA,EAAgB,OAAO,eAAA,EAAgB;AACpF;AAOA,eAAsB,UAAA,CACpB,IAAA,EACA,QAAA,EACA,OAAA,EACA,qBAAA,EACe;AACf,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAI,CAAA;AAChC,EAAA,MAAM,OAAO,IAAA,CAAK,UAAA,GAAa,MAAM,YAAA,CAAa,IAAA,CAAK,UAAU,CAAA,GAAI,MAAA;AACrE,EAAA,IAAI,CAAC,MAAM,oBAAA,EAAsB;AAC/B,IAAA,MAAA,CAAO,QAAA,CAAS,OAAO,qBAAqB,CAAA;AAC5C,IAAA;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAiC;AAAA,IACrC,SAAA,EAAW,QAAA;AAAA,IACX,wBAAA,EAA0B;AAAA,GAC5B;AACA,EAAA,IAAI,OAAA,SAAgB,aAAA,GAAgB,OAAA;AACpC,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,IAAA,CAAK,oBAAoB,CAAA;AAC7C,EAAA,GAAA,CAAI,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAM,EAAE,QAAA,EAAS;AAClD,EAAA,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,GAAA,CAAI,QAAA,EAAU,CAAA;AACvC;AAGO,SAAS,YAAA,GAAqB;AACnC,EAAA,OAAA,GAAU,IAAA;AACZ;;;ACrZA,IAAI,YAAA;AACJ,IAAI,mBAAA;AAEJ,IAAI,UAAA,GAAa,KAAA;AAGV,SAAS,eAAe,KAAA,EAAiC;AAC9D,EAAA,YAAA,GAAe,KAAA;AACf,EAAA,IAAI,KAAA,KAAU,QAAW,UAAA,GAAa,KAAA;AACxC;AAGO,SAAS,uBAAuB,OAAA,EAAyC;AAC9E,EAAA,mBAAA,GAAsB,OAAA;AACtB,EAAA,UAAA,GAAa,KAAA;AACf;AAYO,SAAS,cAAA,GAAqC;AACnD,EAAA,IAAI,YAAA,KAAiB,MAAA,IAAa,SAAA,CAAU,YAAY,CAAA,EAAG;AACzD,IAAA,kBAAA,EAAmB;AACnB,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,YAAA;AACT;AASO,SAAS,kBAAA,GAA2B;AACzC,EAAA,IAAI,UAAA,IAAc,CAAC,mBAAA,EAAqB;AACxC,EAAA,UAAA,GAAa,IAAA;AACb,EAAA,mBAAA,EAAoB;AACtB;ACsBO,IAAM,oBAAA,GAAuBA,oBAAgD,IAAI;AA4BxF,IAAM,WAAA,GAAc,mBAAA;AAEpB,SAAS,aAAA,GAAsC;AAC7C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,cAAA,CAAe,OAAA,CAAQ,WAAW,CAAA;AAC9C,IAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,IAAA,MAAM,OAAA,GAAyB,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7C,IAAA,IAAI,CAAC,OAAA,CAAQ,WAAA,IAAe,SAAA,CAAU,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC1D,MAAA,cAAA,CAAe,WAAW,WAAW,CAAA;AACrC,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,OAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAQO,SAAS,qBAAA,CAAsB;AAAA,EACpC,OAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA,GAAU,SAAA;AAAA,EACV,cAAA,GAAiB,OAAA;AAAA,EACjB;AACF,CAAA,EAA4C;AAC1C,EAAA,MAAM,CAAC,MAAA,EAAQ,SAAS,CAAA,GAAIC,eAAqB,SAAS,CAAA;AAC1D,EAAA,MAAM,CAAC,IAAA,EAAM,OAAO,CAAA,GAAIA,eAA+B,IAAI,CAAA;AAC3D,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAIA,eAAuB,IAAI,CAAA;AAIrD,EAAA,MAAM,UAAA,GAAaC,aAAkC,MAAS,CAAA;AAC9D,EAAA,MAAM,IAAA,GAAOC,cAAQ,OAAO,EAAE,cAAa,CAAA,EAAI,CAAC,YAAY,CAAC,CAAA;AAE7D,EAAA,MAAM,cAAA,GAAiBC,iBAAA;AAAA,IACrB,CAAC,OAAA,KAAuC;AACtC,MAAA,IAAI,YAAY,SAAA,EAAW;AAC3B,MAAA,IAAI;AACF,QAAA,IAAI,SAAS,cAAA,CAAe,OAAA,CAAQ,aAAa,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAAA,aACnE,cAAA,CAAe,WAAW,WAAW,CAAA;AAAA,MAC5C,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF,CAAA;AAAA,IACA,CAAC,OAAO;AAAA,GACV;AAEA,EAAA,MAAM,YAAA,GAAeA,iBAAA;AAAA,IACnB,CAAC,OAAA,KAA2B;AAC1B,MAAA,UAAA,CAAW,OAAA,GAAU,OAAA;AACrB,MAAA,cAAA,CAAe,QAAQ,WAAW,CAAA;AAClC,MAAA,cAAA,CAAe,OAAO,CAAA;AACtB,MAAA,OAAA,CAAQ,EAAE,cAAA,EAAgB,OAAA,CAAQ,gBAAgB,SAAA,EAAW,OAAA,CAAQ,WAAW,CAAA;AAChF,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,SAAA,CAAU,eAAe,CAAA;AAAA,IAC3B,CAAA;AAAA,IACA,CAAC,cAAc;AAAA,GACjB;AAEA,EAAA,MAAM,YAAA,GAAeA,kBAAY,MAAM;AACrC,IAAA,UAAA,CAAW,OAAA,GAAU,MAAA;AACrB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,YAAA,EAAa;AACb,IAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,IAAA,SAAA,CAAU,iBAAiB,CAAA;AAAA,EAC7B,CAAA,EAAG,CAAC,cAAc,CAAC,CAAA;AAEnB,EAAAC,eAAA,CAAU,MAAM;AACd,IAAA,IAAI,SAAA,GAAY,KAAA;AAChB,IAAA,yBAAA,EAA0B,CACvB,IAAA,CAAK,CAAC,OAAA,KAAY;AACjB,MAAA,IAAI,SAAA,EAAW;AACf,MAAA,IAAI,OAAA,EAAS,OAAO,YAAA,CAAa,OAAO,CAAA;AACxC,MAAA,MAAM,SAAA,GAAY,OAAA,KAAY,SAAA,GAAY,aAAA,EAAc,GAAI,IAAA;AAC5D,MAAA,IAAI,SAAA,EAAW,OAAO,YAAA,CAAa,SAAS,CAAA;AAC5C,MAAA,SAAA,CAAU,iBAAiB,CAAA;AAAA,IAC7B,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,CAAA,KAAe;AACrB,MAAA,IAAI,SAAA,EAAW;AACf,MAAA,IAAI,aAAa,mBAAA,EAAqB;AAEpC,QAAA,KAAK,UAAA;AAAA,UACH,OAAA;AAAA,UACA,QAAA;AAAA,UACA,EAAE,QAAA,EAAU,CAAA,CAAE,QAAA,EAAU,cAAc,IAAA,EAAK;AAAA,UAC3C,IAAA;AAAA,UACA,EAAE,wBAAwB,IAAA;AAAK,SACjC;AACA,QAAA;AAAA,MACF;AACA,MAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,MAAA,SAAA,CAAU,OAAO,CAAA;AAAA,IACnB,CAAC,CAAA;AACH,IAAA,OAAO,MAAM;AACX,MAAA,SAAA,GAAY,IAAA;AAAA,IACd,CAAA;AAAA,EACF,GAAG,CAAC,YAAA,EAAc,SAAS,OAAA,EAAS,QAAA,EAAU,IAAI,CAAC,CAAA;AAEnD,EAAA,MAAM,KAAA,GAAQD,iBAAA;AAAA,IACZ,OAAO,OAAA,KAA2B;AAChC,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,IAAI;AACF,QAAA,MAAM,UAAA,CAAW,OAAA,EAAS,QAAA,EAAU,OAAA,EAAS,IAAI,CAAA;AAAA,MACnD,SAAS,CAAA,EAAY;AACnB,QAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,QAAA,SAAA,CAAU,OAAO,CAAA;AAAA,MACnB;AAAA,IACF,CAAA;AAAA,IACA,CAAC,OAAA,EAAS,QAAA,EAAU,IAAI;AAAA,GAC1B;AAEA,EAAA,MAAM,MAAA,GAASA,iBAAA;AAAA,IACb,OAAO,OAAA,KAA4B;AACjC,MAAA,MAAM,OAAA,GAAU,WAAW,OAAA,EAAS,OAAA;AACpC,MAAA,YAAA,EAAa;AACb,MAAA,IAAI,SAAS,UAAA,EAAY;AACvB,QAAA,MAAM,UAAA;AAAA,UACJ,OAAA;AAAA,UACA,QAAA;AAAA,UACA,OAAA;AAAA,UACA,OAAA,CAAQ,qBAAA,IAAyB,WAAA,CAAY,IAAI;AAAA,SACnD;AAAA,MACF;AAAA,IACF,CAAA;AAAA,IACA,CAAC,OAAA,EAAS,QAAA,EAAU,YAAA,EAAc,IAAI;AAAA,GACxC;AAEA,EAAA,MAAME,mBAAAA,GAAqBF,iBAAA;AAAA,IACzB,OAAO,cAAA,KAA2B;AAChC,MAAA,MAAM,UAAU,UAAA,CAAW,OAAA;AAC3B,MAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,mBAAmB,CAAA;AACjD,MAAA,MAAM,SAAS,MAAM,kBAAA,CAAuB,OAAA,EAAS,OAAA,CAAQ,aAAa,cAAc,CAAA;AAGxF,MAAA,oBAAA,CAAqB,UAAU,MAAS,CAAA;AACxC,MAAA,YAAA,CAAa,EAAE,GAAG,OAAA,EAAS,GAAG,QAAQ,CAAA;AAAA,IACxC,CAAA;AAAA,IACA,CAAC,YAAA,EAAc,OAAA,EAAS,QAAQ;AAAA,GAClC;AAEA,EAAA,MAAM,WAAWA,iBAAA,CAAY,MAAM,WAAW,OAAA,EAAS,WAAA,EAAa,EAAE,CAAA;AAEtE,EAAA,MAAM,cAAA,GAAiBA,kBAAY,YAAY;AAC7C,IAAA,MAAM,eAAe,mBAAA,CAAoB,UAAA,CAAW,OAAA,EAAS,SAAA,IAAa,EAAE,CAAA;AAG5E,IAAA,UAAA,CAAW,OAAA,GAAU,MAAA;AACrB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,YAAA,EAAa;AACb,IAAA,SAAA,CAAU,SAAS,CAAA;AACnB,IAAA,IAAI;AACF,MAAA,MAAM,UAAA,CAAW,SAAS,QAAA,EAAU,EAAE,QAAQ,MAAA,EAAQ,YAAA,IAAgB,IAAI,CAAA;AAAA,IAC5E,SAAS,CAAA,EAAY;AACnB,MAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,MAAA,SAAA,CAAU,OAAO,CAAA;AAAA,IACnB;AAAA,EACF,GAAG,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,EAAM,cAAc,CAAC,CAAA;AAK5C,EAAA,MAAMG,mBAAAA,GAAqBH,kBAAY,MAAM;AAC3C,IAAA,IAAI,CAAC,WAAW,OAAA,EAAS;AACzB,IAAA,IAAI,cAAA,KAAmB,OAAA,EAAS,KAAK,cAAA,EAAe;AAAA,SAC/C,YAAA,EAAa;AAAA,EACpB,CAAA,EAAG,CAAC,YAAA,EAAc,cAAA,EAAgB,cAAc,CAAC,CAAA;AAIjD,EAAAC,eAAA,CAAU,MAAM;AACd,IAAA,sBAAA,CAAuBE,mBAAkB,CAAA;AACzC,IAAA,OAAO,MAAM,uBAAuB,MAAS,CAAA;AAAA,EAC/C,CAAA,EAAG,CAACA,mBAAkB,CAAC,CAAA;AAGvB,EAAA,MAAM,MAAA,GAASJ,aAAA;AAAA,IACb,MAAMK,yBAAA,CAAsB,EAAE,SAAS,QAAA,EAAU,cAAA,EAAgBD,qBAAoB,CAAA;AAAA,IACrF,CAAC,OAAA,EAAS,QAAA,EAAUA,mBAAkB;AAAA,GACxC;AAEA,EAAA,MAAM,KAAA,GAAQJ,aAAA;AAAA,IACZ,OAAO;AAAA,MACL,MAAA;AAAA,MACA,IAAA;AAAA,MACA,KAAA;AAAA,MACA,KAAA;AAAA,MACA,MAAA;AAAA,MACA,kBAAA,EAAAG,mBAAAA;AAAA,MACA,cAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF,CAAA;AAAA,IACA,CAAC,QAAQ,IAAA,EAAM,KAAA,EAAO,OAAO,MAAA,EAAQA,mBAAAA,EAAoB,cAAA,EAAgB,QAAA,EAAU,MAAM;AAAA,GAC3F;AAEA,EAAA,uBACEG,cAAA,CAAC,oBAAA,CAAqB,QAAA,EAArB,EAA8B,OAAe,QAAA,EAAS,CAAA;AAE3D;ACxSO,SAAS,OAAA,GAAqC;AACnD,EAAA,MAAM,GAAA,GAAMC,iBAAW,oBAAoB,CAAA;AAC3C,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,EACzE;AACA,EAAA,OAAO,GAAA;AACT;AAYO,SAAS,YAAA,GAAgC;AAC9C,EAAA,OAAO,SAAQ,CAAE,MAAA;AACnB","file":"index.cjs","sourcesContent":["// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n//\n// Framework-neutral browser-auth engine for ConfigHub. Productionized from the\n// reference harness `test/browser-auth/src/confighubAuth.ts` in the ConfigHub\n// monorepo, which is validated end to end against staging and prod.\n//\n// Flow (design: third-party-browser-app-auth.md §6):\n//   GET {base}/api/info                 -> discovery { AuthIssuer, TokenExchangeEndpoint }\n//   OIDC discovery on AuthIssuer        -> authorize/token/end_session endpoints\n//   PKCE authorize + code->token        -> IdP token\n//   POST {TokenExchangeEndpoint} (8693) -> minted ConfigHub token\n//\n// The minted token then rides `Authorization: Bearer` against `/api`. The flow is\n// edition-agnostic: `AuthIssuer` is whatever discovery names (ConfigHub's bundled\n// Keycloak for Cloud, the org's own IdP for Enterprise), so the same code runs\n// against both. Tokens are held by the caller; only the transient PKCE state is\n// parked in sessionStorage across the authorize redirect.\n\nexport interface Discovery {\n  AuthIssuer?: string;\n  TokenExchangeEndpoint?: string;\n  TokenExchangeAudience?: string;\n}\n\nexport interface MintedSession {\n  accessToken: string;\n  organizationId: string;\n  /** Claims of the validated IdP token (owning-org, audience, organization shape). */\n  idpClaims: Record<string, unknown>;\n  /**\n   * The IdP's ID token, kept only so logout can pass it as `id_token_hint` to the\n   * end-session endpoint. Absent for sessions that did not come from an OIDC login.\n   */\n  idToken?: string;\n}\n\nexport interface LoginOptions {\n  /**\n   * Where to land after login, as a same-origin path (`/space/x?tab=units`). Carried\n   * through the authorize round trip in the PKCE state, never in the redirect URI:\n   * OAuth clients register exact redirect URIs, so the URI itself must not vary with\n   * the page the user started from. Defaults to the current path and query.\n   */\n  returnTo?: string;\n  /**\n   * Which organization to sign in to, as the Keycloak organization alias sent in\n   * the `organization:<alias>` scope.\n   *\n   * - a string: that organization, no prompt;\n   * - `undefined` (default): the organization of the last successful login in this\n   *   browser, remembered per client in `localStorage`, so a new tab or a login after\n   *   logout lands in the same organization without a prompt; with nothing\n   *   remembered, Keycloak decides (prompt for a multi-org user, or the org matching\n   *   the email domain on a fresh authentication);\n   * - `null`: no hint on purpose, so Keycloak prompts. This is \"switch organization\".\n   */\n  organization?: string | null;\n  /**\n   * `'none'` asks the IdP to re-authenticate without any UI, failing with\n   * `login_required` if the SSO session is gone -- the way to refresh an expired\n   * ConfigHub token when the user is still signed in at the IdP. `'login'` forces the\n   * login form even with a live SSO session.\n   */\n  prompt?: 'none' | 'login';\n}\n\nexport interface FlowOptions {\n  /**\n   * Same-origin path the IdP redirects back to, and therefore the redirect URI to\n   * register for the client: `{origin}{callbackPath}`. Defaults to `/`.\n   */\n  callbackPath?: string;\n}\n\ninterface PkceState {\n  verifier: string;\n  state: string;\n  clientId: string;\n  tokenEndpoint: string;\n  exchangeEndpoint: string;\n  redirectUri: string;\n  returnTo: string;\n  silent: boolean;\n  /** The organization alias the authorize request hinted, if any. */\n  hintedOrganization?: string;\n  /** This login is already the retry after a token without an organization. */\n  retriedForOrganization?: boolean;\n}\n\n/**\n * Thrown by `completeLoginFromRedirect` when the IdP token names no organization,\n * which the exchange would refuse. Seen on a fresh brokered (Google) login, where\n * Keycloak's organization step does not run; on the next login the SSO session is\n * alive and it does, so the caller logs in again, once, with no hint. Any\n * remembered alias has already been forgotten.\n */\nexport class OrganizationMissing extends Error {\n  constructor(public readonly returnTo: string) {\n    super('the identity provider issued a token with no organization');\n    this.name = 'OrganizationMissing';\n  }\n}\n\nexport interface RetryOptions {\n  /** @internal set by the provider on the one retry after OrganizationMissing. */\n  retriedForOrganization?: boolean;\n}\n\nconst PKCE_KEY = 'confighub_pkce';\nconst LAST_ORG_KEY = 'confighub_last_org';\n\n// The alias is a short public identifier, not a credential, so localStorage is the\n// right place: it must outlive the tab, which is exactly what the token must not.\nconst lastOrgKey = (clientId: string): string => `${LAST_ORG_KEY}:${clientId}`;\n\n/** The organization alias of the last successful login for this client, if any. */\nexport function rememberedOrganization(clientId: string): string | undefined {\n  try {\n    return localStorage.getItem(lastOrgKey(clientId)) ?? undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/** @internal */\nexport function rememberOrganization(clientId: string, alias: string | undefined): void {\n  try {\n    if (alias) localStorage.setItem(lastOrgKey(clientId), alias);\n    else localStorage.removeItem(lastOrgKey(clientId));\n  } catch {\n    // Storage unavailable: the next login gets no hint.\n  }\n}\n\n/**\n * The alias in an IdP token's `organization` claim (`{ \"<alias>\": { id } }`), or\n * undefined when the claim is absent or names more than one organization.\n */\nexport function organizationAliasOf(idpClaims: Record<string, unknown>): string | undefined {\n  const org = idpClaims.organization;\n  if (!org || typeof org !== 'object') return undefined;\n  const aliases = Object.keys(org as Record<string, unknown>);\n  return aliases.length === 1 ? aliases[0] : undefined;\n}\n\nconst trimSlash = (s: string): string => s.replace(/\\/+$/, '');\n\n/** The fixed callback URI: the page origin plus the configured callback path. */\nexport const callbackUri = (opts?: FlowOptions): string =>\n  window.location.origin + (opts?.callbackPath ?? '/');\n\nconst currentPath = (): string =>\n  window.location.pathname + window.location.search + window.location.hash;\n\nconst b64url = (buf: ArrayBuffer): string =>\n  btoa(String.fromCharCode(...new Uint8Array(buf)))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '');\n\nconst randomString = (n = 64): string =>\n  b64url(crypto.getRandomValues(new Uint8Array(n)).buffer);\n\nasync function sha256(s: string): Promise<string> {\n  return b64url(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(s)));\n}\n\n/** Decode a JWT's claims without verifying it. Returns {} for anything malformed. */\nexport function decodeJwtClaims(token: string): Record<string, unknown> {\n  const part = token.split('.')[1];\n  if (!part) return {};\n  try {\n    return JSON.parse(atob(part.replace(/-/g, '+').replace(/_/g, '/')));\n  } catch {\n    return {};\n  }\n}\n\n/** Whether a JWT's `exp` is in the past (with a small skew allowance). */\nexport function isExpired(token: string, skewSeconds = 30): boolean {\n  const exp = decodeJwtClaims(token).exp;\n  if (typeof exp !== 'number') return false;\n  return exp * 1000 <= Date.now() + skewSeconds * 1000;\n}\n\nexport async function discover(base: string): Promise<Discovery> {\n  const r = await fetch(trimSlash(base) + '/api/info');\n  if (!r.ok) throw new Error('/api/info failed: ' + r.status);\n  return r.json();\n}\n\ninterface OidcMetadata {\n  authorization_endpoint: string;\n  token_endpoint: string;\n  end_session_endpoint?: string;\n}\n\nasync function oidcMetadata(issuer: string): Promise<OidcMetadata> {\n  const r = await fetch(trimSlash(issuer) + '/.well-known/openid-configuration');\n  if (!r.ok) throw new Error('OIDC discovery failed: ' + r.status);\n  return r.json();\n}\n\n/**\n * Discover, build a PKCE request, and navigate to the IdP authorize endpoint.\n * Returns only by redirecting the page; `completeLoginFromRedirect()` finishes on\n * the way back.\n */\nexport async function startLogin(\n  base: string,\n  clientId: string,\n  login: LoginOptions = {},\n  flow: FlowOptions = {},\n  retry: RetryOptions = {},\n): Promise<void> {\n  const info = await discover(base);\n  if (!info.AuthIssuer || !info.TokenExchangeEndpoint) {\n    throw new Error(\n      'this instance is not configured for token-exchange auth (server needs CONFIGHUB_IDP_ISSUER)',\n    );\n  }\n  const meta = await oidcMetadata(info.AuthIssuer);\n  const verifier = randomString();\n  const challenge = await sha256(verifier);\n  const state = randomString(16);\n  const redirectUri = callbackUri(flow);\n  // The \"organization\" scope makes Keycloak emit the org claim the exchange resolves;\n  // \"organization:<alias>\" selects one without prompting.\n  const alias =\n    login.organization === null\n      ? undefined\n      : (login.organization ?? rememberedOrganization(clientId));\n  const orgScope = alias ? `organization:${alias}` : 'organization';\n  const pkce: PkceState = {\n    verifier,\n    state,\n    clientId,\n    tokenEndpoint: meta.token_endpoint,\n    exchangeEndpoint: info.TokenExchangeEndpoint,\n    redirectUri,\n    returnTo: login.returnTo ?? currentPath(),\n    silent: login.prompt === 'none',\n    hintedOrganization: alias,\n    retriedForOrganization: retry.retriedForOrganization,\n  };\n  sessionStorage.setItem(PKCE_KEY, JSON.stringify(pkce));\n  const params: Record<string, string> = {\n    response_type: 'code',\n    client_id: clientId,\n    redirect_uri: redirectUri,\n    scope: `openid email profile ${orgScope}`,\n    code_challenge: challenge,\n    code_challenge_method: 'S256',\n    state,\n  };\n  if (login.prompt) params.prompt = login.prompt;\n\n  const authURL = new URL(meta.authorization_endpoint);\n  authURL.search = new URLSearchParams(params).toString();\n  window.location.assign(authURL.toString());\n}\n\n// Memoize so React StrictMode's double-mount can't redeem the one-time code twice.\nlet pending: Promise<MintedSession | null> | null = null;\n\n/**\n * If the page is the IdP redirect (`?code=...`), exchange the code for an IdP token\n * and then exchange that for a minted ConfigHub token, and restore the URL the\n * login started from. Returns null on a normal load, when a `prompt=none` attempt\n * came back with `login_required` (the SSO session is gone; the caller should offer\n * an interactive login), and when the redirect carries a code this tab has no PKCE\n * state for (an IdP email flow landed here; the caller should start a login).\n */\nexport function completeLoginFromRedirect(): Promise<MintedSession | null> {\n  if (!pending) pending = doCompleteLogin();\n  return pending;\n}\n\nconst SILENT_FAILURES = new Set(['login_required', 'interaction_required', 'consent_required']);\n\nasync function doCompleteLogin(): Promise<MintedSession | null> {\n  const params = new URLSearchParams(window.location.search);\n  const code = params.get('code');\n  const error = params.get('error');\n  if (!code && !error) return null;\n\n  const savedRaw = sessionStorage.getItem(PKCE_KEY);\n  sessionStorage.removeItem(PKCE_KEY);\n  const saved: PkceState | null = savedRaw ? JSON.parse(savedRaw) : null;\n\n  // Put the URL back to where the user started before anything else can fail, so\n  // neither the code nor an error string lingers in the address bar or history.\n  history.replaceState({}, '', saved?.returnTo ?? callbackUri());\n\n  if (error) {\n    if (saved?.silent && SILENT_FAILURES.has(error)) return null;\n    throw new Error(`IdP returned error: ${error} ${params.get('error_description') ?? ''}`);\n  }\n  // A code with no PKCE state means this tab did not start the login: the IdP's\n  // email flows (password reset, verify email) finish the authentication in the tab\n  // the mail link opened and redirect it here, while the verifier sits in the tab\n  // that began. The code is unusable without it, so drop it and report a normal\n  // load; the caller starts a login, which the now-live IdP session completes\n  // without a prompt.\n  if (!saved) return null;\n  if (params.get('state') !== saved.state) throw new Error('state mismatch; aborting');\n\n  // Exchange the authorization code for an IdP token (PKCE, public client).\n  const tokenResp = await fetch(saved.tokenEndpoint, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({\n      grant_type: 'authorization_code',\n      code: code!,\n      redirect_uri: saved.redirectUri,\n      client_id: saved.clientId,\n      code_verifier: saved.verifier,\n    }),\n  });\n  if (!tokenResp.ok) {\n    throw new Error(`IdP token endpoint ${tokenResp.status}: ${await tokenResp.text()}`);\n  }\n  const idpToken = await tokenResp.json();\n\n  // RFC 8693 token exchange against ConfigHub -> minted ConfigHub token.\n  const idpClaims = decodeJwtClaims(idpToken.access_token);\n  if (!organizationAliasOf(idpClaims) && !saved.retriedForOrganization) {\n    // The exchange would refuse this token. Rather than surface that, log in\n    // once more: with the SSO session now alive the IdP runs its organization\n    // step. A hint that was sent evidently did not help, so forget it.\n    if (saved.hintedOrganization) rememberOrganization(saved.clientId, undefined);\n    throw new OrganizationMissing(saved.returnTo);\n  }\n  const minted = await exchange(saved.exchangeEndpoint, idpToken.access_token);\n  rememberOrganization(saved.clientId, organizationAliasOf(idpClaims));\n  return {\n    ...minted,\n    idpClaims,\n    idToken: typeof idpToken.id_token === 'string' ? idpToken.id_token : undefined,\n  };\n}\n\nasync function exchange(\n  exchangeEndpoint: string,\n  subjectToken: string,\n): Promise<Pick<MintedSession, 'accessToken' | 'organizationId'>> {\n  const exResp = await fetch(exchangeEndpoint, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({\n      grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',\n      subject_token: subjectToken,\n      subject_token_type: 'urn:ietf:params:oauth:token-type:access_token',\n    }),\n  });\n  if (!exResp.ok) throw new Error(`/auth/exchange ${exResp.status}: ${await exResp.text()}`);\n  const minted = await exResp.json();\n  return { accessToken: minted.access_token, organizationId: minted.organization_id };\n}\n\n/**\n * Trade the current minted token for one scoped to another organization the user\n * belongs to (`POST {base}/auth/switch-organization`, bearer-authenticated). The\n * IdP session is untouched; only the ConfigHub token changes.\n */\nexport async function switchOrganization(\n  base: string,\n  accessToken: string,\n  organizationId: string,\n): Promise<Pick<MintedSession, 'accessToken' | 'organizationId'>> {\n  const r = await fetch(trimSlash(base) + '/auth/switch-organization', {\n    method: 'POST',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/x-www-form-urlencoded',\n    },\n    body: new URLSearchParams({ organization_id: organizationId }),\n  });\n  if (!r.ok) throw new Error(`/auth/switch-organization ${r.status}: ${await r.text()}`);\n  const minted = await r.json();\n  return { accessToken: minted.access_token, organizationId: minted.organization_id };\n}\n\n/**\n * End the IdP session (RP-initiated logout) and land on `postLogoutRedirectUri`,\n * which must be registered for the client. Returns only by redirecting. If the\n * issuer publishes no end-session endpoint, navigates to the redirect URI directly.\n */\nexport async function endSession(\n  base: string,\n  clientId: string,\n  idToken: string | undefined,\n  postLogoutRedirectUri: string,\n): Promise<void> {\n  const info = await discover(base);\n  const meta = info.AuthIssuer ? await oidcMetadata(info.AuthIssuer) : undefined;\n  if (!meta?.end_session_endpoint) {\n    window.location.assign(postLogoutRedirectUri);\n    return;\n  }\n  const params: Record<string, string> = {\n    client_id: clientId,\n    post_logout_redirect_uri: postLogoutRedirectUri,\n  };\n  if (idToken) params.id_token_hint = idToken;\n  const url = new URL(meta.end_session_endpoint);\n  url.search = new URLSearchParams(params).toString();\n  window.location.assign(url.toString());\n}\n\n/** Discard the in-progress login memo (used on logout so a later login re-runs). */\nexport function resetPending(): void {\n  pending = null;\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\n// A module-level holder for the current minted token, so non-React consumers can read\n// it. RTK Query's `prepareHeaders` (in @confighub/rtk-query) is not a hook and cannot\n// read React context, so it calls getAccessToken() instead. The provider keeps this in\n// sync with its React state, and registers its 401 handling here for the same reason.\nimport { isExpired } from './core';\n\nlet currentToken: string | undefined;\nlet unauthorizedHandler: (() => void) | undefined;\n// Set while a recovery is under way, so a burst of failing requests starts one.\nlet recovering = false;\n\n/** @internal — called by the provider; not part of the public surface. */\nexport function setAccessToken(token: string | undefined): void {\n  currentToken = token;\n  if (token !== undefined) recovering = false;\n}\n\n/** @internal — the mounted provider's reaction to a rejected token. */\nexport function setUnauthorizedHandler(handler: (() => void) | undefined): void {\n  unauthorizedHandler = handler;\n  recovering = false;\n}\n\n/**\n * The current minted ConfigHub token, or undefined when unauthenticated. Pass this as\n * the `getToken` for `@confighub/rtk-query`'s `configureConfigHub`, or read it anywhere\n * you need the token outside React.\n *\n * A token past its `exp` is never handed out: the server would reject it. Instead the\n * provider's recovery starts (a silent re-authentication, or a logout, per its\n * `onUnauthorized`) and the request goes without a token; the page is about to\n * navigate to the IdP and back to where it was.\n */\nexport function getAccessToken(): string | undefined {\n  if (currentToken !== undefined && isExpired(currentToken)) {\n    handleUnauthorized();\n    return undefined;\n  }\n  return currentToken;\n}\n\n/**\n * Tell the mounted provider the API rejected the token (401). Pass this as the\n * `onUnauthorized` for `@confighub/rtk-query`'s `configureConfigHub` to recover from a\n * token rejected before its expiry, e.g. after a server key rotation; expiry itself is\n * handled by `getAccessToken`. A no-op with no provider mounted, and while a recovery\n * is already under way.\n */\nexport function handleUnauthorized(): void {\n  if (recovering || !unauthorizedHandler) return;\n  recovering = true;\n  unauthorizedHandler();\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\nimport { createConfigHubClient, type ConfigHubClient } from '@confighub/api';\nimport {\n  createContext,\n  useCallback,\n  useEffect,\n  useMemo,\n  useRef,\n  useState,\n  type ReactNode,\n} from 'react';\nimport {\n  OrganizationMissing,\n  callbackUri,\n  completeLoginFromRedirect,\n  endSession,\n  isExpired,\n  organizationAliasOf,\n  rememberOrganization,\n  resetPending,\n  startLogin,\n  switchOrganization as switchOrganizationCore,\n  type LoginOptions,\n  type MintedSession,\n} from './core';\nimport { setAccessToken, setUnauthorizedHandler } from './tokenStore';\n\nexport type AuthStatus = 'loading' | 'authenticated' | 'unauthenticated' | 'error';\n\nexport interface ConfigHubUser {\n  organizationId: string;\n  idpClaims: Record<string, unknown>;\n}\n\nexport interface LogoutOptions {\n  /**\n   * Also end the IdP session (RP-initiated logout), so the next login asks for\n   * credentials instead of riding the SSO cookie. Redirects the page; the landing\n   * URI must be registered for the client. Default: false, which only forgets the\n   * token in this tab.\n   */\n  endSession?: boolean;\n  /** Where to land after IdP logout. Defaults to the callback URI. */\n  postLogoutRedirectUri?: string;\n}\n\nexport interface ConfigHubAuthContextValue {\n  status: AuthStatus;\n  user: ConfigHubUser | null;\n  error: Error | null;\n  /** Begin login: redirects the page to the IdP. */\n  login: (options?: LoginOptions) => Promise<void>;\n  /** Forget the session in this tab and, optionally, end the IdP session too. */\n  logout: (options?: LogoutOptions) => Promise<void>;\n  /**\n   * Re-mint the ConfigHub token for another organization the user belongs to. The\n   * IdP session is untouched. Rejects with the server's error if the user is not a\n   * member; the current session stays as it was.\n   */\n  switchOrganization: (organizationId: string) => Promise<void>;\n  /**\n   * The ConfigHub token stopped working (a 401). Try to get a new one without any\n   * UI: a `prompt=none` round trip through the IdP, for the organization the session\n   * already had. Status goes to `loading` meanwhile, not `unauthenticated`, so an\n   * app that auto-logs-in on `unauthenticated` does not race this with an\n   * interactive login. If the IdP session is gone too, the page comes back\n   * `unauthenticated`. Redirects the page.\n   */\n  reauthenticate: () => Promise<void>;\n  /** Current bearer token, or undefined when unauthenticated. */\n  getToken: () => string | undefined;\n  /** A typed API client pre-wired with the current token. Stable across renders. */\n  client: ConfigHubClient;\n}\n\nexport const ConfigHubAuthContext = createContext<ConfigHubAuthContextValue | null>(null);\n\nexport interface ConfigHubAuthProviderProps {\n  /** Absolute base URL of the ConfigHub instance, e.g. `https://hub.confighub.com`. */\n  baseUrl: string;\n  /** This app's registered OAuth `client_id` (from `cub oauthclient create`). */\n  clientId: string;\n  /**\n   * Same-origin path the IdP redirects back to; `{origin}{callbackPath}` is the\n   * redirect URI to register. Defaults to `/`. Fixed on purpose: the page a user\n   * starts login from travels in the PKCE state, not in the redirect URI.\n   */\n  callbackPath?: string;\n  /**\n   * `'session'` (default) keeps the minted token in `sessionStorage` so a reload or an\n   * in-tab navigation does not round-trip through the IdP. Tab-scoped and gone when the\n   * tab closes. `'none'`: memory only, every page load starts unauthenticated.\n   */\n  persist?: 'none' | 'session';\n  /**\n   * What a 401 from the API means. `'login'` (default): the token is stale, try a\n   * silent re-authentication (`prompt=none`) and fall back to unauthenticated if the\n   * IdP session is gone too. `'logout'`: just drop the session.\n   */\n  onUnauthorized?: 'login' | 'logout';\n  children: ReactNode;\n}\n\nconst SESSION_KEY = 'confighub_session';\n\nfunction readPersisted(): MintedSession | null {\n  try {\n    const raw = sessionStorage.getItem(SESSION_KEY);\n    if (!raw) return null;\n    const session: MintedSession = JSON.parse(raw);\n    if (!session.accessToken || isExpired(session.accessToken)) {\n      sessionStorage.removeItem(SESSION_KEY);\n      return null;\n    }\n    return session;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Runs the browser-direct auth flow and manages the token lifecycle. On mount it\n * completes a redirect if the page is the IdP callback, restores a persisted\n * session if there is one, and otherwise starts unauthenticated until `login()`\n * is called.\n */\nexport function ConfigHubAuthProvider({\n  baseUrl,\n  clientId,\n  callbackPath,\n  persist = 'session',\n  onUnauthorized = 'login',\n  children,\n}: ConfigHubAuthProviderProps): JSX.Element {\n  const [status, setStatus] = useState<AuthStatus>('loading');\n  const [user, setUser] = useState<ConfigHubUser | null>(null);\n  const [error, setError] = useState<Error | null>(null);\n\n  // The session lives in a ref so getToken() reads the latest value synchronously\n  // without re-creating the API client on every render.\n  const sessionRef = useRef<MintedSession | undefined>(undefined);\n  const flow = useMemo(() => ({ callbackPath }), [callbackPath]);\n\n  const persistSession = useCallback(\n    (session: MintedSession | undefined) => {\n      if (persist !== 'session') return;\n      try {\n        if (session) sessionStorage.setItem(SESSION_KEY, JSON.stringify(session));\n        else sessionStorage.removeItem(SESSION_KEY);\n      } catch {\n        // Storage unavailable (private mode, quota): memory-only for this tab.\n      }\n    },\n    [persist],\n  );\n\n  const applySession = useCallback(\n    (session: MintedSession) => {\n      sessionRef.current = session;\n      setAccessToken(session.accessToken); // keep the non-React accessor in sync (rtk-query)\n      persistSession(session);\n      setUser({ organizationId: session.organizationId, idpClaims: session.idpClaims });\n      setError(null);\n      setStatus('authenticated');\n    },\n    [persistSession],\n  );\n\n  const clearSession = useCallback(() => {\n    sessionRef.current = undefined;\n    setAccessToken(undefined);\n    persistSession(undefined);\n    resetPending();\n    setUser(null);\n    setStatus('unauthenticated');\n  }, [persistSession]);\n\n  useEffect(() => {\n    let cancelled = false;\n    completeLoginFromRedirect()\n      .then((session) => {\n        if (cancelled) return;\n        if (session) return applySession(session);\n        const persisted = persist === 'session' ? readPersisted() : null;\n        if (persisted) return applySession(persisted);\n        setStatus('unauthenticated');\n      })\n      .catch((e: unknown) => {\n        if (cancelled) return;\n        if (e instanceof OrganizationMissing) {\n          // Once, with no hint, flagged so a second miss surfaces as an error.\n          void startLogin(\n            baseUrl,\n            clientId,\n            { returnTo: e.returnTo, organization: null },\n            flow,\n            { retriedForOrganization: true },\n          );\n          return;\n        }\n        setError(e instanceof Error ? e : new Error(String(e)));\n        setStatus('error');\n      });\n    return () => {\n      cancelled = true;\n    };\n  }, [applySession, persist, baseUrl, clientId, flow]);\n\n  const login = useCallback(\n    async (options?: LoginOptions) => {\n      setError(null);\n      try {\n        await startLogin(baseUrl, clientId, options, flow);\n      } catch (e: unknown) {\n        setError(e instanceof Error ? e : new Error(String(e)));\n        setStatus('error');\n      }\n    },\n    [baseUrl, clientId, flow],\n  );\n\n  const logout = useCallback(\n    async (options?: LogoutOptions) => {\n      const idToken = sessionRef.current?.idToken;\n      clearSession();\n      if (options?.endSession) {\n        await endSession(\n          baseUrl,\n          clientId,\n          idToken,\n          options.postLogoutRedirectUri ?? callbackUri(flow),\n        );\n      }\n    },\n    [baseUrl, clientId, clearSession, flow],\n  );\n\n  const switchOrganization = useCallback(\n    async (organizationId: string) => {\n      const current = sessionRef.current;\n      if (!current) throw new Error('not authenticated');\n      const minted = await switchOrganizationCore(baseUrl, current.accessToken, organizationId);\n      // The session's IdP claims still name the previous org, so its alias must not\n      // be remembered as the default for the next login.\n      rememberOrganization(clientId, undefined);\n      applySession({ ...current, ...minted });\n    },\n    [applySession, baseUrl, clientId],\n  );\n\n  const getToken = useCallback(() => sessionRef.current?.accessToken, []);\n\n  const reauthenticate = useCallback(async () => {\n    const organization = organizationAliasOf(sessionRef.current?.idpClaims ?? {});\n    // Forget the token but stay 'loading': the page is about to navigate away,\n    // and 'unauthenticated' would invite an interactive login in the meantime.\n    sessionRef.current = undefined;\n    setAccessToken(undefined);\n    persistSession(undefined);\n    resetPending();\n    setStatus('loading');\n    try {\n      await startLogin(baseUrl, clientId, { prompt: 'none', organization }, flow);\n    } catch (e: unknown) {\n      setError(e instanceof Error ? e : new Error(String(e)));\n      setStatus('error');\n    }\n  }, [baseUrl, clientId, flow, persistSession]);\n\n  // A 401 means the minted token no longer works. Silent re-auth keeps the user's\n  // place if the IdP session is still alive; otherwise the page comes back\n  // unauthenticated and the app offers a real login.\n  const handleUnauthorized = useCallback(() => {\n    if (!sessionRef.current) return;\n    if (onUnauthorized === 'login') void reauthenticate();\n    else clearSession();\n  }, [clearSession, reauthenticate, onUnauthorized]);\n\n  // Non-React callers (getAccessToken on an expired token, handleUnauthorized from a\n  // data client's 401) reach this provider's handling through the token store.\n  useEffect(() => {\n    setUnauthorizedHandler(handleUnauthorized);\n    return () => setUnauthorizedHandler(undefined);\n  }, [handleUnauthorized]);\n\n  // One client for the provider's lifetime. getToken reads the session ref.\n  const client = useMemo(\n    () => createConfigHubClient({ baseUrl, getToken, onUnauthorized: handleUnauthorized }),\n    [baseUrl, getToken, handleUnauthorized],\n  );\n\n  const value = useMemo<ConfigHubAuthContextValue>(\n    () => ({\n      status,\n      user,\n      error,\n      login,\n      logout,\n      switchOrganization,\n      reauthenticate,\n      getToken,\n      client,\n    }),\n    [status, user, error, login, logout, switchOrganization, reauthenticate, getToken, client],\n  );\n\n  return (\n    <ConfigHubAuthContext.Provider value={value}>{children}</ConfigHubAuthContext.Provider>\n  );\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\nimport type { ConfigHubClient } from '@confighub/api';\nimport { useContext } from 'react';\nimport { ConfigHubAuthContext, type ConfigHubAuthContextValue } from './provider';\n\n/**\n * Access the ConfigHub auth state and actions. Must be called under a\n * `<ConfigHubAuthProvider>`.\n *\n * ```ts\n * const { status, user, login, logout } = useAuth();\n * ```\n */\nexport function useAuth(): ConfigHubAuthContextValue {\n  const ctx = useContext(ConfigHubAuthContext);\n  if (!ctx) {\n    throw new Error('useAuth must be used within a <ConfigHubAuthProvider>');\n  }\n  return ctx;\n}\n\n/**\n * The typed ConfigHub API client, pre-wired with the current token. This is the\n * seam between `@confighub/react-auth` and `@confighub/api`: you never pass a\n * token by hand.\n *\n * ```ts\n * const api = useConfigHub();\n * const { data } = await api.GET('/space/{space_id}/unit', { params: { path: { space_id } } });\n * ```\n */\nexport function useConfigHub(): ConfigHubClient {\n  return useAuth().client;\n}\n"]}
+{"version":3,"sources":["../src/core.ts","../src/tokenStore.ts","../src/provider.tsx","../src/hooks.ts"],"names":["createContext","useState","useRef","useMemo","useCallback","useEffect","handleUnauthorized","createConfigHubClient","jsx","useContext"],"mappings":";;;;;;;;;AAoGO,IAAM,mBAAA,GAAN,cAAkC,KAAA,CAAM;AAAA,EAC7C,YAA4B,QAAA,EAAkB;AAC5C,IAAA,KAAA,CAAM,2DAA2D,CAAA;AADvC,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAE1B,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AAAA,EACd;AACF;AAOO,IAAM,kBAAA,GAAN,cAAiC,KAAA,CAAM;AAAA,EAC5C,WAAA,GAAc;AACZ,IAAA,KAAA,CAAM,iFAAiF,CAAA;AACvF,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AAAA,EACd;AACF;AAOA,IAAM,QAAA,GAAW,gBAAA;AACjB,IAAM,YAAA,GAAe,oBAAA;AAIrB,IAAM,aAAa,CAAC,QAAA,KAA6B,CAAA,EAAG,YAAY,IAAI,QAAQ,CAAA,CAAA;AAGrE,SAAS,uBAAuB,QAAA,EAAsC;AAC3E,EAAA,IAAI;AACF,IAAA,OAAO,YAAA,CAAa,OAAA,CAAQ,UAAA,CAAW,QAAQ,CAAC,CAAA,IAAK,KAAA,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAGO,SAAS,oBAAA,CAAqB,UAAkB,KAAA,EAAiC;AACtF,EAAA,IAAI;AACF,IAAA,IAAI,OAAO,YAAA,CAAa,OAAA,CAAQ,UAAA,CAAW,QAAQ,GAAG,KAAK,CAAA;AAAA,SACtD,YAAA,CAAa,UAAA,CAAW,UAAA,CAAW,QAAQ,CAAC,CAAA;AAAA,EACnD,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAMO,SAAS,oBAAoB,SAAA,EAAwD;AAC1F,EAAA,MAAM,MAAM,SAAA,CAAU,YAAA;AACtB,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,UAAU,OAAO,MAAA;AAC5C,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,IAAA,CAAK,GAA8B,CAAA;AAC1D,EAAA,OAAO,OAAA,CAAQ,MAAA,KAAW,CAAA,GAAI,OAAA,CAAQ,CAAC,CAAA,GAAI,MAAA;AAC7C;AAEA,IAAM,YAAY,CAAC,CAAA,KAAsB,CAAA,CAAE,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAGtD,IAAM,cAAc,CAAC,IAAA,KAC1B,OAAO,QAAA,CAAS,MAAA,IAAU,MAAM,YAAA,IAAgB,GAAA;AAElD,IAAM,WAAA,GAAc,MAClB,MAAA,CAAO,QAAA,CAAS,WAAW,MAAA,CAAO,QAAA,CAAS,MAAA,GAAS,MAAA,CAAO,QAAA,CAAS,IAAA;AAEtE,IAAM,MAAA,GAAS,CAAC,GAAA,KACd,IAAA,CAAK,OAAO,YAAA,CAAa,GAAG,IAAI,UAAA,CAAW,GAAG,CAAC,CAAC,CAAA,CAC7C,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,OAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAEtB,IAAM,YAAA,GAAe,CAAC,CAAA,GAAI,EAAA,KACxB,MAAA,CAAO,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,CAAC,CAAC,CAAA,CAAE,MAAM,CAAA;AAEzD,eAAe,OAAO,CAAA,EAA4B;AAChD,EAAA,OAAO,MAAA,CAAO,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AAClF;AAGO,SAAS,gBAAgB,KAAA,EAAwC;AACtE,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC/B,EAAA,IAAI,CAAC,IAAA,EAAM,OAAO,EAAC;AACnB,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAC,CAAC,CAAA;AAAA,EACpE,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAGO,SAAS,SAAA,CAAU,KAAA,EAAe,WAAA,GAAc,EAAA,EAAa;AAClE,EAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,KAAK,CAAA,CAAE,GAAA;AACnC,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,KAAA;AACpC,EAAA,OAAO,GAAA,GAAM,GAAA,IAAQ,IAAA,CAAK,GAAA,KAAQ,WAAA,GAAc,GAAA;AAClD;AAEA,eAAsB,SAAS,IAAA,EAAkC;AAC/D,EAAA,MAAM,IAAI,MAAM,KAAA,CAAM,SAAA,CAAU,IAAI,IAAI,WAAW,CAAA;AACnD,EAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,oBAAA,GAAuB,EAAE,MAAM,CAAA;AAC1D,EAAA,OAAO,EAAE,IAAA,EAAK;AAChB;AAQA,eAAe,aAAa,MAAA,EAAuC;AACjE,EAAA,MAAM,IAAI,MAAM,KAAA,CAAM,SAAA,CAAU,MAAM,IAAI,mCAAmC,CAAA;AAC7E,EAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,yBAAA,GAA4B,EAAE,MAAM,CAAA;AAC/D,EAAA,OAAO,EAAE,IAAA,EAAK;AAChB;AAOA,eAAsB,UAAA,CACpB,IAAA,EACA,QAAA,EACA,KAAA,GAAsB,EAAC,EACvB,IAAA,GAAoB,EAAC,EACrB,KAAA,GAAsB,EAAC,EACR;AACf,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAI,CAAA;AAChC,EAAA,IAAI,CAAC,KAAK,UAAA,IAAc,CAAC,KAAK,qBAAA,EAAuB,MAAM,IAAI,kBAAA,EAAmB;AAClF,EAAA,IAAI,CAAC,IAAA,CAAK,UAAA,IAAc,CAAC,KAAK,qBAAA,EAAuB;AACnD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAO,MAAM,YAAA,CAAa,IAAA,CAAK,UAAU,CAAA;AAC/C,EAAA,MAAM,WAAW,YAAA,EAAa;AAC9B,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,QAAQ,CAAA;AACvC,EAAA,MAAM,KAAA,GAAQ,aAAa,EAAE,CAAA;AAC7B,EAAA,MAAM,WAAA,GAAc,YAAY,IAAI,CAAA;AAGpC,EAAA,MAAM,KAAA,GACJ,MAAM,YAAA,KAAiB,IAAA,GACnB,SACC,KAAA,CAAM,YAAA,IAAgB,uBAAuB,QAAQ,CAAA;AAC5D,EAAA,MAAM,QAAA,GAAW,KAAA,GAAQ,CAAA,aAAA,EAAgB,KAAK,CAAA,CAAA,GAAK,cAAA;AACnD,EAAA,MAAM,IAAA,GAAkB;AAAA,IACtB,QAAA;AAAA,IACA,KAAA;AAAA,IACA,QAAA;AAAA,IACA,eAAe,IAAA,CAAK,cAAA;AAAA,IACpB,kBAAkB,IAAA,CAAK,qBAAA;AAAA,IACvB,WAAA;AAAA,IACA,QAAA,EAAU,KAAA,CAAM,QAAA,IAAY,WAAA,EAAY;AAAA,IACxC,MAAA,EAAQ,MAAM,MAAA,KAAW,MAAA;AAAA,IACzB,kBAAA,EAAoB,KAAA;AAAA,IACpB,wBAAwB,KAAA,CAAM;AAAA,GAChC;AACA,EAAA,cAAA,CAAe,OAAA,CAAQ,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AACrD,EAAA,MAAM,MAAA,GAAiC;AAAA,IACrC,aAAA,EAAe,MAAA;AAAA,IACf,SAAA,EAAW,QAAA;AAAA,IACX,YAAA,EAAc,WAAA;AAAA,IACd,KAAA,EAAO,wBAAwB,QAAQ,CAAA,CAAA;AAAA,IACvC,cAAA,EAAgB,SAAA;AAAA,IAChB,qBAAA,EAAuB,MAAA;AAAA,IACvB;AAAA,GACF;AACA,EAAA,IAAI,KAAA,CAAM,MAAA,EAAQ,MAAA,CAAO,MAAA,GAAS,KAAA,CAAM,MAAA;AAExC,EAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,IAAA,CAAK,sBAAsB,CAAA;AACnD,EAAA,OAAA,CAAQ,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAM,EAAE,QAAA,EAAS;AACtD,EAAA,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,OAAA,CAAQ,QAAA,EAAU,CAAA;AAC3C;AAGA,IAAI,OAAA,GAAgD,IAAA;AAU7C,SAAS,yBAAA,GAA2D;AACzE,EAAA,IAAI,CAAC,OAAA,EAAS,OAAA,GAAU,eAAA,EAAgB;AACxC,EAAA,OAAO,OAAA;AACT;AAEA,IAAM,kCAAkB,IAAI,GAAA,CAAI,CAAC,gBAAA,EAAkB,sBAAA,EAAwB,kBAAkB,CAAC,CAAA;AAE9F,eAAe,eAAA,GAAiD;AAC9D,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAA,CAAO,SAAS,MAAM,CAAA;AACzD,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AAC9B,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA;AAChC,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,KAAA,EAAO,OAAO,IAAA;AAE5B,EAAA,MAAM,QAAA,GAAW,cAAA,CAAe,OAAA,CAAQ,QAAQ,CAAA;AAChD,EAAA,cAAA,CAAe,WAAW,QAAQ,CAAA;AAClC,EAAA,MAAM,KAAA,GAA0B,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA,GAAI,IAAA;AAIlE,EAAA,OAAA,CAAQ,aAAa,EAAC,EAAG,IAAI,KAAA,EAAO,QAAA,IAAY,aAAa,CAAA;AAE7D,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,IAAI,OAAO,MAAA,IAAU,eAAA,CAAgB,GAAA,CAAI,KAAK,GAAG,OAAO,IAAA;AACxD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,KAAK,CAAA,CAAA,EAAI,OAAO,GAAA,CAAI,mBAAmB,CAAA,IAAK,EAAE,CAAA,CAAE,CAAA;AAAA,EACzF;AAOA,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,IAAI,MAAA,CAAO,IAAI,OAAO,CAAA,KAAM,MAAM,KAAA,EAAO,MAAM,IAAI,KAAA,CAAM,0BAA0B,CAAA;AAGnF,EAAA,MAAM,SAAA,GAAY,MAAM,KAAA,CAAM,KAAA,CAAM,aAAA,EAAe;AAAA,IACjD,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,oBAAA;AAAA,MACZ,IAAA;AAAA,MACA,cAAc,KAAA,CAAM,WAAA;AAAA,MACpB,WAAW,KAAA,CAAM,QAAA;AAAA,MACjB,eAAe,KAAA,CAAM;AAAA,KACtB;AAAA,GACF,CAAA;AACD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,SAAA,CAAU,MAAM,KAAK,MAAM,SAAA,CAAU,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EACrF;AACA,EAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,IAAA,EAAK;AAGtC,EAAA,MAAM,SAAA,GAAY,eAAA,CAAgB,QAAA,CAAS,YAAY,CAAA;AACvD,EAAA,IAAI,CAAC,mBAAA,CAAoB,SAAS,CAAA,IAAK,CAAC,MAAM,sBAAA,EAAwB;AAIpE,IAAA,IAAI,KAAA,CAAM,kBAAA,EAAoB,oBAAA,CAAqB,KAAA,CAAM,UAAU,MAAS,CAAA;AAC5E,IAAA,MAAM,IAAI,mBAAA,CAAoB,KAAA,CAAM,QAAQ,CAAA;AAAA,EAC9C;AACA,EAAA,MAAM,SAAS,MAAM,QAAA,CAAS,KAAA,CAAM,gBAAA,EAAkB,SAAS,YAAY,CAAA;AAC3E,EAAA,oBAAA,CAAqB,KAAA,CAAM,QAAA,EAAU,mBAAA,CAAoB,SAAS,CAAC,CAAA;AACnE,EAAA,OAAO;AAAA,IACL,GAAG,MAAA;AAAA,IACH,SAAA;AAAA,IACA,SAAS,OAAO,QAAA,CAAS,QAAA,KAAa,QAAA,GAAW,SAAS,QAAA,GAAW;AAAA,GACvE;AACF;AAEA,eAAe,QAAA,CACb,kBACA,YAAA,EACgE;AAChE,EAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,gBAAA,EAAkB;AAAA,IAC3C,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,iDAAA;AAAA,MACZ,aAAA,EAAe,YAAA;AAAA,MACf,kBAAA,EAAoB;AAAA,KACrB;AAAA,GACF,CAAA;AACD,EAAA,IAAI,CAAC,MAAA,CAAO,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,MAAA,CAAO,MAAM,CAAA,EAAA,EAAK,MAAM,MAAA,CAAO,IAAA,EAAM,CAAA,CAAE,CAAA;AACzF,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,EAAK;AACjC,EAAA,OAAO,EAAE,WAAA,EAAa,MAAA,CAAO,YAAA,EAAc,cAAA,EAAgB,OAAO,eAAA,EAAgB;AACpF;AASA,eAAsB,mBAAA,CAAoB,MAAc,MAAA,EAAwC;AAC9F,EAAA,MAAM,IAAI,MAAM,KAAA,CAAM,SAAA,CAAU,IAAI,IAAI,uBAAA,EAAyB;AAAA,IAC/D,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB,EAAE,QAAQ;AAAA,GACrC,CAAA;AACD,EAAA,IAAI,CAAC,CAAA,CAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,CAAA,CAAE,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,CAAA;AACjF,EAAA,MAAM,MAAA,GAAS,MAAM,CAAA,CAAE,IAAA,EAAK;AAC5B,EAAA,OAAO,EAAE,aAAa,MAAA,CAAO,YAAA,EAAc,gBAAgB,MAAA,CAAO,eAAA,EAAiB,SAAA,EAAW,EAAC,EAAE;AACnG;AAOA,eAAsB,UAAA,CACpB,IAAA,EACA,QAAA,EACA,OAAA,EACA,qBAAA,EACe;AACf,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAI,CAAA;AAChC,EAAA,MAAM,OAAO,IAAA,CAAK,UAAA,GAAa,MAAM,YAAA,CAAa,IAAA,CAAK,UAAU,CAAA,GAAI,MAAA;AACrE,EAAA,IAAI,CAAC,MAAM,oBAAA,EAAsB;AAC/B,IAAA,MAAA,CAAO,QAAA,CAAS,OAAO,qBAAqB,CAAA;AAC5C,IAAA;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAiC;AAAA,IACrC,SAAA,EAAW,QAAA;AAAA,IACX,wBAAA,EAA0B;AAAA,GAC5B;AACA,EAAA,IAAI,OAAA,SAAgB,aAAA,GAAgB,OAAA;AACpC,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,IAAA,CAAK,oBAAoB,CAAA;AAC7C,EAAA,GAAA,CAAI,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAM,EAAE,QAAA,EAAS;AAClD,EAAA,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,GAAA,CAAI,QAAA,EAAU,CAAA;AACvC;AAGO,SAAS,YAAA,GAAqB;AACnC,EAAA,OAAA,GAAU,IAAA;AACZ;;;AChaA,IAAI,YAAA;AACJ,IAAI,mBAAA;AAEJ,IAAI,UAAA,GAAa,KAAA;AAGV,SAAS,eAAe,KAAA,EAAiC;AAC9D,EAAA,YAAA,GAAe,KAAA;AACf,EAAA,IAAI,KAAA,KAAU,QAAW,UAAA,GAAa,KAAA;AACxC;AAGO,SAAS,uBAAuB,OAAA,EAAyC;AAC9E,EAAA,mBAAA,GAAsB,OAAA;AACtB,EAAA,UAAA,GAAa,KAAA;AACf;AAYO,SAAS,cAAA,GAAqC;AACnD,EAAA,IAAI,YAAA,KAAiB,MAAA,IAAa,SAAA,CAAU,YAAY,CAAA,EAAG;AACzD,IAAA,kBAAA,EAAmB;AACnB,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,YAAA;AACT;AASO,SAAS,kBAAA,GAA2B;AACzC,EAAA,IAAI,UAAA,IAAc,CAAC,mBAAA,EAAqB;AACxC,EAAA,UAAA,GAAa,IAAA;AACb,EAAA,mBAAA,EAAoB;AACtB;ACsBO,IAAM,oBAAA,GAAuBA,oBAAgD,IAAI;AA4BxF,IAAM,WAAA,GAAc,mBAAA;AAEpB,SAAS,aAAA,GAAsC;AAC7C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,cAAA,CAAe,OAAA,CAAQ,WAAW,CAAA;AAC9C,IAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,IAAA,MAAM,OAAA,GAAyB,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7C,IAAA,IAAI,CAAC,OAAA,CAAQ,WAAA,IAAe,SAAA,CAAU,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC1D,MAAA,cAAA,CAAe,WAAW,WAAW,CAAA;AACrC,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,OAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAQO,SAAS,qBAAA,CAAsB;AAAA,EACpC,OAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA,GAAU,SAAA;AAAA,EACV,cAAA,GAAiB,OAAA;AAAA,EACjB;AACF,CAAA,EAA4C;AAC1C,EAAA,MAAM,CAAC,MAAA,EAAQ,SAAS,CAAA,GAAIC,eAAqB,SAAS,CAAA;AAC1D,EAAA,MAAM,CAAC,IAAA,EAAM,OAAO,CAAA,GAAIA,eAA+B,IAAI,CAAA;AAC3D,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAIA,eAAuB,IAAI,CAAA;AAIrD,EAAA,MAAM,UAAA,GAAaC,aAAkC,MAAS,CAAA;AAC9D,EAAA,MAAM,IAAA,GAAOC,cAAQ,OAAO,EAAE,cAAa,CAAA,EAAI,CAAC,YAAY,CAAC,CAAA;AAE7D,EAAA,MAAM,cAAA,GAAiBC,iBAAA;AAAA,IACrB,CAAC,OAAA,KAAuC;AACtC,MAAA,IAAI,YAAY,SAAA,EAAW;AAC3B,MAAA,IAAI;AACF,QAAA,IAAI,SAAS,cAAA,CAAe,OAAA,CAAQ,aAAa,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAAA,aACnE,cAAA,CAAe,WAAW,WAAW,CAAA;AAAA,MAC5C,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF,CAAA;AAAA,IACA,CAAC,OAAO;AAAA,GACV;AAEA,EAAA,MAAM,YAAA,GAAeA,iBAAA;AAAA,IACnB,CAAC,OAAA,KAA2B;AAC1B,MAAA,UAAA,CAAW,OAAA,GAAU,OAAA;AACrB,MAAA,cAAA,CAAe,QAAQ,WAAW,CAAA;AAClC,MAAA,cAAA,CAAe,OAAO,CAAA;AACtB,MAAA,OAAA,CAAQ,EAAE,cAAA,EAAgB,OAAA,CAAQ,gBAAgB,SAAA,EAAW,OAAA,CAAQ,WAAW,CAAA;AAChF,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,SAAA,CAAU,eAAe,CAAA;AAAA,IAC3B,CAAA;AAAA,IACA,CAAC,cAAc;AAAA,GACjB;AAEA,EAAA,MAAM,YAAA,GAAeA,kBAAY,MAAM;AACrC,IAAA,UAAA,CAAW,OAAA,GAAU,MAAA;AACrB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,YAAA,EAAa;AACb,IAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,IAAA,SAAA,CAAU,iBAAiB,CAAA;AAAA,EAC7B,CAAA,EAAG,CAAC,cAAc,CAAC,CAAA;AAEnB,EAAAC,eAAA,CAAU,MAAM;AACd,IAAA,IAAI,SAAA,GAAY,KAAA;AAChB,IAAA,yBAAA,EAA0B,CACvB,IAAA,CAAK,CAAC,OAAA,KAAY;AACjB,MAAA,IAAI,SAAA,EAAW;AACf,MAAA,IAAI,OAAA,EAAS,OAAO,YAAA,CAAa,OAAO,CAAA;AACxC,MAAA,MAAM,SAAA,GAAY,OAAA,KAAY,SAAA,GAAY,aAAA,EAAc,GAAI,IAAA;AAC5D,MAAA,IAAI,SAAA,EAAW,OAAO,YAAA,CAAa,SAAS,CAAA;AAC5C,MAAA,SAAA,CAAU,iBAAiB,CAAA;AAAA,IAC7B,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,CAAA,KAAe;AACrB,MAAA,IAAI,SAAA,EAAW;AACf,MAAA,IAAI,aAAa,mBAAA,EAAqB;AAEpC,QAAA,KAAK,UAAA;AAAA,UACH,OAAA;AAAA,UACA,QAAA;AAAA,UACA,EAAE,QAAA,EAAU,CAAA,CAAE,QAAA,EAAU,cAAc,IAAA,EAAK;AAAA,UAC3C,IAAA;AAAA,UACA,EAAE,wBAAwB,IAAA;AAAK,SACjC;AACA,QAAA;AAAA,MACF;AACA,MAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,MAAA,SAAA,CAAU,OAAO,CAAA;AAAA,IACnB,CAAC,CAAA;AACH,IAAA,OAAO,MAAM;AACX,MAAA,SAAA,GAAY,IAAA;AAAA,IACd,CAAA;AAAA,EACF,GAAG,CAAC,YAAA,EAAc,SAAS,OAAA,EAAS,QAAA,EAAU,IAAI,CAAC,CAAA;AAEnD,EAAA,MAAM,KAAA,GAAQD,iBAAA;AAAA,IACZ,OAAO,OAAA,KAA2B;AAChC,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,IAAI;AACF,QAAA,MAAM,UAAA,CAAW,OAAA,EAAS,QAAA,EAAU,OAAA,EAAS,IAAI,CAAA;AAAA,MACnD,SAAS,CAAA,EAAY;AACnB,QAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,QAAA,SAAA,CAAU,OAAO,CAAA;AAAA,MACnB;AAAA,IACF,CAAA;AAAA,IACA,CAAC,OAAA,EAAS,QAAA,EAAU,IAAI;AAAA,GAC1B;AAEA,EAAA,MAAM,MAAA,GAASA,iBAAA;AAAA,IACb,OAAO,OAAA,KAA4B;AACjC,MAAA,MAAM,OAAA,GAAU,WAAW,OAAA,EAAS,OAAA;AACpC,MAAA,IAAI,CAAC,SAAS,UAAA,EAAY;AACxB,QAAA,YAAA,EAAa;AACb,QAAA;AAAA,MACF;AAKA,MAAA,UAAA,CAAW,OAAA,GAAU,MAAA;AACrB,MAAA,cAAA,CAAe,MAAS,CAAA;AACxB,MAAA,cAAA,CAAe,MAAS,CAAA;AACxB,MAAA,YAAA,EAAa;AACb,MAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,MAAA,SAAA,CAAU,SAAS,CAAA;AACnB,MAAA,IAAI;AACF,QAAA,MAAM,UAAA;AAAA,UACJ,OAAA;AAAA,UACA,QAAA;AAAA,UACA,OAAA;AAAA,UACA,OAAA,CAAQ,qBAAA,IAAyB,WAAA,CAAY,IAAI;AAAA,SACnD;AAAA,MACF,SAAS,CAAA,EAAY;AAEnB,QAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,QAAA,SAAA,CAAU,OAAO,CAAA;AAAA,MACnB;AAAA,IACF,CAAA;AAAA,IACA,CAAC,OAAA,EAAS,QAAA,EAAU,YAAA,EAAc,MAAM,cAAc;AAAA,GACxD;AAEA,EAAA,MAAM,WAAWA,iBAAA,CAAY,MAAM,WAAW,OAAA,EAAS,WAAA,EAAa,EAAE,CAAA;AAEtE,EAAA,MAAM,cAAA,GAAiBA,kBAAY,YAAY;AAC7C,IAAA,MAAM,eAAe,mBAAA,CAAoB,UAAA,CAAW,OAAA,EAAS,SAAA,IAAa,EAAE,CAAA;AAG5E,IAAA,UAAA,CAAW,OAAA,GAAU,MAAA;AACrB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,YAAA,EAAa;AACb,IAAA,SAAA,CAAU,SAAS,CAAA;AACnB,IAAA,IAAI;AACF,MAAA,MAAM,UAAA,CAAW,SAAS,QAAA,EAAU,EAAE,QAAQ,MAAA,EAAQ,YAAA,IAAgB,IAAI,CAAA;AAAA,IAC5E,SAAS,CAAA,EAAY;AAEnB,MAAA,IAAI,aAAa,kBAAA,EAAoB;AACnC,QAAA,SAAA,CAAU,iBAAiB,CAAA;AAC3B,QAAA;AAAA,MACF;AACA,MAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,MAAA,SAAA,CAAU,OAAO,CAAA;AAAA,IACnB;AAAA,EACF,GAAG,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,EAAM,cAAc,CAAC,CAAA;AAE5C,EAAA,MAAM,gBAAA,GAAmBA,iBAAA;AAAA,IACvB,OAAO,MAAA,KAAmB;AACxB,MAAA,YAAA,CAAa,MAAM,mBAAA,CAAoB,OAAA,EAAS,MAAM,CAAC,CAAA;AAAA,IACzD,CAAA;AAAA,IACA,CAAC,cAAc,OAAO;AAAA,GACxB;AAKA,EAAA,MAAME,mBAAAA,GAAqBF,kBAAY,MAAM;AAC3C,IAAA,IAAI,CAAC,WAAW,OAAA,EAAS;AACzB,IAAA,IAAI,cAAA,KAAmB,OAAA,EAAS,KAAK,cAAA,EAAe;AAAA,SAC/C,YAAA,EAAa;AAAA,EACpB,CAAA,EAAG,CAAC,YAAA,EAAc,cAAA,EAAgB,cAAc,CAAC,CAAA;AAIjD,EAAAC,eAAA,CAAU,MAAM;AACd,IAAA,sBAAA,CAAuBC,mBAAkB,CAAA;AACzC,IAAA,OAAO,MAAM,uBAAuB,MAAS,CAAA;AAAA,EAC/C,CAAA,EAAG,CAACA,mBAAkB,CAAC,CAAA;AAGvB,EAAA,MAAM,MAAA,GAASH,aAAA;AAAA,IACb,MAAMI,yBAAA,CAAsB,EAAE,SAAS,QAAA,EAAU,cAAA,EAAgBD,qBAAoB,CAAA;AAAA,IACrF,CAAC,OAAA,EAAS,QAAA,EAAUA,mBAAkB;AAAA,GACxC;AAEA,EAAA,MAAM,KAAA,GAAQH,aAAA;AAAA,IACZ,OAAO;AAAA,MACL,MAAA;AAAA,MACA,IAAA;AAAA,MACA,KAAA;AAAA,MACA,KAAA;AAAA,MACA,MAAA;AAAA,MACA,cAAA;AAAA,MACA,gBAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF,CAAA;AAAA,IACA,CAAC,QAAQ,IAAA,EAAM,KAAA,EAAO,OAAO,MAAA,EAAQ,cAAA,EAAgB,gBAAA,EAAkB,QAAA,EAAU,MAAM;AAAA,GACzF;AAEA,EAAA,uBACEK,cAAA,CAAC,oBAAA,CAAqB,QAAA,EAArB,EAA8B,OAAe,QAAA,EAAS,CAAA;AAE3D;ACxTO,SAAS,OAAA,GAAqC;AACnD,EAAA,MAAM,GAAA,GAAMC,iBAAW,oBAAoB,CAAA;AAC3C,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,EACzE;AACA,EAAA,OAAO,GAAA;AACT;AAYO,SAAS,YAAA,GAAgC;AAC9C,EAAA,OAAO,SAAQ,CAAE,MAAA;AACnB","file":"index.cjs","sourcesContent":["// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n//\n// Framework-neutral browser-auth engine for ConfigHub. Productionized from the\n// reference harness `test/browser-auth/src/confighubAuth.ts` in the ConfigHub\n// monorepo, which is validated end to end against staging and prod.\n//\n// Flow (design: third-party-browser-app-auth.md §6):\n//   GET {base}/api/info                 -> discovery { AuthIssuer, TokenExchangeEndpoint }\n//   OIDC discovery on AuthIssuer        -> authorize/token/end_session endpoints\n//   PKCE authorize + code->token        -> IdP token\n//   POST {TokenExchangeEndpoint} (8693) -> minted ConfigHub token\n//\n// The minted token then rides `Authorization: Bearer` against `/api`. The flow is\n// edition-agnostic: `AuthIssuer` is whatever discovery names (ConfigHub's bundled\n// Keycloak for Cloud, the org's own IdP for Enterprise), so the same code runs\n// against both. Tokens are held by the caller; only the transient PKCE state is\n// parked in sessionStorage across the authorize redirect.\n\nexport interface Discovery {\n  AuthIssuer?: string;\n  TokenExchangeEndpoint?: string;\n  TokenExchangeAudience?: string;\n}\n\nexport interface MintedSession {\n  accessToken: string;\n  organizationId: string;\n  /** Claims of the validated IdP token (owning-org, audience, organization shape). */\n  idpClaims: Record<string, unknown>;\n  /**\n   * The IdP's ID token, kept only so logout can pass it as `id_token_hint` to the\n   * end-session endpoint. Absent for sessions that did not come from an OIDC login.\n   */\n  idToken?: string;\n}\n\nexport interface LoginOptions {\n  /**\n   * Where to land after login, as a same-origin path (`/space/x?tab=units`). Carried\n   * through the authorize round trip in the PKCE state, never in the redirect URI:\n   * OAuth clients register exact redirect URIs, so the URI itself must not vary with\n   * the page the user started from. Defaults to the current path and query.\n   */\n  returnTo?: string;\n  /**\n   * Which organization to sign in to, as the Keycloak organization alias sent in\n   * the `organization:<alias>` scope.\n   *\n   * - a string: that organization, no prompt;\n   * - `undefined` (default): the organization of the last successful login in this\n   *   browser, remembered per client in `localStorage`, so a new tab or a login after\n   *   logout lands in the same organization without a prompt; with nothing\n   *   remembered, Keycloak decides (prompt for a multi-org user, or the org matching\n   *   the email domain on a fresh authentication);\n   * - `null`: no hint on purpose, so Keycloak prompts. This is \"switch organization\".\n   */\n  organization?: string | null;\n  /**\n   * `'none'` asks the IdP to re-authenticate without any UI, failing with\n   * `login_required` if the SSO session is gone -- the way to refresh an expired\n   * ConfigHub token when the user is still signed in at the IdP. `'login'` forces the\n   * login form even with a live SSO session. `'create'` opens the IdP's registration\n   * form instead of its login form (OpenID Connect Prompt Create; Keycloak honours it),\n   * so a \"sign up\" link can be an ordinary PKCE login that lands the new user in the\n   * app signed in.\n   */\n  prompt?: 'none' | 'login' | 'create';\n}\n\nexport interface FlowOptions {\n  /**\n   * Same-origin path the IdP redirects back to, and therefore the redirect URI to\n   * register for the client: `{origin}{callbackPath}`. Defaults to `/`.\n   */\n  callbackPath?: string;\n}\n\ninterface PkceState {\n  verifier: string;\n  state: string;\n  clientId: string;\n  tokenEndpoint: string;\n  exchangeEndpoint: string;\n  redirectUri: string;\n  returnTo: string;\n  silent: boolean;\n  /** The organization alias the authorize request hinted, if any. */\n  hintedOrganization?: string;\n  /** This login is already the retry after a token without an organization. */\n  retriedForOrganization?: boolean;\n}\n\n/**\n * Thrown by `completeLoginFromRedirect` when the IdP token names no organization,\n * which the exchange would refuse. Seen on a fresh brokered (Google) login, where\n * Keycloak's organization step does not run; on the next login the SSO session is\n * alive and it does, so the caller logs in again, once, with no hint. Any\n * remembered alias has already been forgotten.\n */\nexport class OrganizationMissing extends Error {\n  constructor(public readonly returnTo: string) {\n    super('the identity provider issued a token with no organization');\n    this.name = 'OrganizationMissing';\n  }\n}\n\n/**\n * Thrown by `startLogin` when the instance advertises no identity provider. Such an\n * instance signs a browser in with a ticket from `cub auth browser-session` instead\n * (see `redeemBrowserTicket`), so there is no login to start.\n */\nexport class NoIdentityProvider extends Error {\n  constructor() {\n    super('this instance has no identity provider; sign in with `cub auth browser-session`');\n    this.name = 'NoIdentityProvider';\n  }\n}\n\nexport interface RetryOptions {\n  /** @internal set by the provider on the one retry after OrganizationMissing. */\n  retriedForOrganization?: boolean;\n}\n\nconst PKCE_KEY = 'confighub_pkce';\nconst LAST_ORG_KEY = 'confighub_last_org';\n\n// The alias is a short public identifier, not a credential, so localStorage is the\n// right place: it must outlive the tab, which is exactly what the token must not.\nconst lastOrgKey = (clientId: string): string => `${LAST_ORG_KEY}:${clientId}`;\n\n/** The organization alias of the last successful login for this client, if any. */\nexport function rememberedOrganization(clientId: string): string | undefined {\n  try {\n    return localStorage.getItem(lastOrgKey(clientId)) ?? undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/** @internal */\nexport function rememberOrganization(clientId: string, alias: string | undefined): void {\n  try {\n    if (alias) localStorage.setItem(lastOrgKey(clientId), alias);\n    else localStorage.removeItem(lastOrgKey(clientId));\n  } catch {\n    // Storage unavailable: the next login gets no hint.\n  }\n}\n\n/**\n * The alias in an IdP token's `organization` claim (`{ \"<alias>\": { id } }`), or\n * undefined when the claim is absent or names more than one organization.\n */\nexport function organizationAliasOf(idpClaims: Record<string, unknown>): string | undefined {\n  const org = idpClaims.organization;\n  if (!org || typeof org !== 'object') return undefined;\n  const aliases = Object.keys(org as Record<string, unknown>);\n  return aliases.length === 1 ? aliases[0] : undefined;\n}\n\nconst trimSlash = (s: string): string => s.replace(/\\/+$/, '');\n\n/** The fixed callback URI: the page origin plus the configured callback path. */\nexport const callbackUri = (opts?: FlowOptions): string =>\n  window.location.origin + (opts?.callbackPath ?? '/');\n\nconst currentPath = (): string =>\n  window.location.pathname + window.location.search + window.location.hash;\n\nconst b64url = (buf: ArrayBuffer): string =>\n  btoa(String.fromCharCode(...new Uint8Array(buf)))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '');\n\nconst randomString = (n = 64): string =>\n  b64url(crypto.getRandomValues(new Uint8Array(n)).buffer);\n\nasync function sha256(s: string): Promise<string> {\n  return b64url(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(s)));\n}\n\n/** Decode a JWT's claims without verifying it. Returns {} for anything malformed. */\nexport function decodeJwtClaims(token: string): Record<string, unknown> {\n  const part = token.split('.')[1];\n  if (!part) return {};\n  try {\n    return JSON.parse(atob(part.replace(/-/g, '+').replace(/_/g, '/')));\n  } catch {\n    return {};\n  }\n}\n\n/** Whether a JWT's `exp` is in the past (with a small skew allowance). */\nexport function isExpired(token: string, skewSeconds = 30): boolean {\n  const exp = decodeJwtClaims(token).exp;\n  if (typeof exp !== 'number') return false;\n  return exp * 1000 <= Date.now() + skewSeconds * 1000;\n}\n\nexport async function discover(base: string): Promise<Discovery> {\n  const r = await fetch(trimSlash(base) + '/api/info');\n  if (!r.ok) throw new Error('/api/info failed: ' + r.status);\n  return r.json();\n}\n\ninterface OidcMetadata {\n  authorization_endpoint: string;\n  token_endpoint: string;\n  end_session_endpoint?: string;\n}\n\nasync function oidcMetadata(issuer: string): Promise<OidcMetadata> {\n  const r = await fetch(trimSlash(issuer) + '/.well-known/openid-configuration');\n  if (!r.ok) throw new Error('OIDC discovery failed: ' + r.status);\n  return r.json();\n}\n\n/**\n * Discover, build a PKCE request, and navigate to the IdP authorize endpoint.\n * Returns only by redirecting the page; `completeLoginFromRedirect()` finishes on\n * the way back.\n */\nexport async function startLogin(\n  base: string,\n  clientId: string,\n  login: LoginOptions = {},\n  flow: FlowOptions = {},\n  retry: RetryOptions = {},\n): Promise<void> {\n  const info = await discover(base);\n  if (!info.AuthIssuer && !info.TokenExchangeEndpoint) throw new NoIdentityProvider();\n  if (!info.AuthIssuer || !info.TokenExchangeEndpoint) {\n    throw new Error(\n      'this instance is not configured for token-exchange auth (server needs CONFIGHUB_IDP_ISSUER)',\n    );\n  }\n  const meta = await oidcMetadata(info.AuthIssuer);\n  const verifier = randomString();\n  const challenge = await sha256(verifier);\n  const state = randomString(16);\n  const redirectUri = callbackUri(flow);\n  // The \"organization\" scope makes Keycloak emit the org claim the exchange resolves;\n  // \"organization:<alias>\" selects one without prompting.\n  const alias =\n    login.organization === null\n      ? undefined\n      : (login.organization ?? rememberedOrganization(clientId));\n  const orgScope = alias ? `organization:${alias}` : 'organization';\n  const pkce: PkceState = {\n    verifier,\n    state,\n    clientId,\n    tokenEndpoint: meta.token_endpoint,\n    exchangeEndpoint: info.TokenExchangeEndpoint,\n    redirectUri,\n    returnTo: login.returnTo ?? currentPath(),\n    silent: login.prompt === 'none',\n    hintedOrganization: alias,\n    retriedForOrganization: retry.retriedForOrganization,\n  };\n  sessionStorage.setItem(PKCE_KEY, JSON.stringify(pkce));\n  const params: Record<string, string> = {\n    response_type: 'code',\n    client_id: clientId,\n    redirect_uri: redirectUri,\n    scope: `openid email profile ${orgScope}`,\n    code_challenge: challenge,\n    code_challenge_method: 'S256',\n    state,\n  };\n  if (login.prompt) params.prompt = login.prompt;\n\n  const authURL = new URL(meta.authorization_endpoint);\n  authURL.search = new URLSearchParams(params).toString();\n  window.location.assign(authURL.toString());\n}\n\n// Memoize so React StrictMode's double-mount can't redeem the one-time code twice.\nlet pending: Promise<MintedSession | null> | null = null;\n\n/**\n * If the page is the IdP redirect (`?code=...`), exchange the code for an IdP token\n * and then exchange that for a minted ConfigHub token, and restore the URL the\n * login started from. Returns null on a normal load, when a `prompt=none` attempt\n * came back with `login_required` (the SSO session is gone; the caller should offer\n * an interactive login), and when the redirect carries a code this tab has no PKCE\n * state for (an IdP email flow landed here; the caller should start a login).\n */\nexport function completeLoginFromRedirect(): Promise<MintedSession | null> {\n  if (!pending) pending = doCompleteLogin();\n  return pending;\n}\n\nconst SILENT_FAILURES = new Set(['login_required', 'interaction_required', 'consent_required']);\n\nasync function doCompleteLogin(): Promise<MintedSession | null> {\n  const params = new URLSearchParams(window.location.search);\n  const code = params.get('code');\n  const error = params.get('error');\n  if (!code && !error) return null;\n\n  const savedRaw = sessionStorage.getItem(PKCE_KEY);\n  sessionStorage.removeItem(PKCE_KEY);\n  const saved: PkceState | null = savedRaw ? JSON.parse(savedRaw) : null;\n\n  // Put the URL back to where the user started before anything else can fail, so\n  // neither the code nor an error string lingers in the address bar or history.\n  history.replaceState({}, '', saved?.returnTo ?? callbackUri());\n\n  if (error) {\n    if (saved?.silent && SILENT_FAILURES.has(error)) return null;\n    throw new Error(`IdP returned error: ${error} ${params.get('error_description') ?? ''}`);\n  }\n  // A code with no PKCE state means this tab did not start the login: the IdP's\n  // email flows (password reset, verify email) finish the authentication in the tab\n  // the mail link opened and redirect it here, while the verifier sits in the tab\n  // that began. The code is unusable without it, so drop it and report a normal\n  // load; the caller starts a login, which the now-live IdP session completes\n  // without a prompt.\n  if (!saved) return null;\n  if (params.get('state') !== saved.state) throw new Error('state mismatch; aborting');\n\n  // Exchange the authorization code for an IdP token (PKCE, public client).\n  const tokenResp = await fetch(saved.tokenEndpoint, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({\n      grant_type: 'authorization_code',\n      code: code!,\n      redirect_uri: saved.redirectUri,\n      client_id: saved.clientId,\n      code_verifier: saved.verifier,\n    }),\n  });\n  if (!tokenResp.ok) {\n    throw new Error(`IdP token endpoint ${tokenResp.status}: ${await tokenResp.text()}`);\n  }\n  const idpToken = await tokenResp.json();\n\n  // RFC 8693 token exchange against ConfigHub -> minted ConfigHub token.\n  const idpClaims = decodeJwtClaims(idpToken.access_token);\n  if (!organizationAliasOf(idpClaims) && !saved.retriedForOrganization) {\n    // The exchange would refuse this token. Rather than surface that, log in\n    // once more: with the SSO session now alive the IdP runs its organization\n    // step. A hint that was sent evidently did not help, so forget it.\n    if (saved.hintedOrganization) rememberOrganization(saved.clientId, undefined);\n    throw new OrganizationMissing(saved.returnTo);\n  }\n  const minted = await exchange(saved.exchangeEndpoint, idpToken.access_token);\n  rememberOrganization(saved.clientId, organizationAliasOf(idpClaims));\n  return {\n    ...minted,\n    idpClaims,\n    idToken: typeof idpToken.id_token === 'string' ? idpToken.id_token : undefined,\n  };\n}\n\nasync function exchange(\n  exchangeEndpoint: string,\n  subjectToken: string,\n): Promise<Pick<MintedSession, 'accessToken' | 'organizationId'>> {\n  const exResp = await fetch(exchangeEndpoint, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({\n      grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',\n      subject_token: subjectToken,\n      subject_token_type: 'urn:ietf:params:oauth:token-type:access_token',\n    }),\n  });\n  if (!exResp.ok) throw new Error(`/auth/exchange ${exResp.status}: ${await exResp.text()}`);\n  const minted = await exResp.json();\n  return { accessToken: minted.access_token, organizationId: minted.organization_id };\n}\n\n/**\n * Redeem a single-use ticket from `cub auth browser-session` for a minted ConfigHub\n * token (`POST {base}/auth/browser-session`). This is how a browser signs in to an\n * instance with no identity provider, and how a local identity (a break-glass\n * administrator) signs in to one that has a provider. The session has no IdP behind\n * it: when the token expires, the user runs the command again.\n */\nexport async function redeemBrowserTicket(base: string, ticket: string): Promise<MintedSession> {\n  const r = await fetch(trimSlash(base) + '/auth/browser-session', {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({ ticket }),\n  });\n  if (!r.ok) throw new Error(`/auth/browser-session ${r.status}: ${await r.text()}`);\n  const minted = await r.json();\n  return { accessToken: minted.access_token, organizationId: minted.organization_id, idpClaims: {} };\n}\n\n/**\n * End the IdP session (RP-initiated logout) and land on `postLogoutRedirectUri`,\n * which must be registered for the client. Returns only by redirecting. If the\n * issuer publishes no end-session endpoint, navigates to the redirect URI directly.\n */\nexport async function endSession(\n  base: string,\n  clientId: string,\n  idToken: string | undefined,\n  postLogoutRedirectUri: string,\n): Promise<void> {\n  const info = await discover(base);\n  const meta = info.AuthIssuer ? await oidcMetadata(info.AuthIssuer) : undefined;\n  if (!meta?.end_session_endpoint) {\n    window.location.assign(postLogoutRedirectUri);\n    return;\n  }\n  const params: Record<string, string> = {\n    client_id: clientId,\n    post_logout_redirect_uri: postLogoutRedirectUri,\n  };\n  if (idToken) params.id_token_hint = idToken;\n  const url = new URL(meta.end_session_endpoint);\n  url.search = new URLSearchParams(params).toString();\n  window.location.assign(url.toString());\n}\n\n/** Discard the in-progress login memo (used on logout so a later login re-runs). */\nexport function resetPending(): void {\n  pending = null;\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\n// A module-level holder for the current minted token, so non-React consumers can read\n// it. RTK Query's `prepareHeaders` (in @confighub/rtk-query) is not a hook and cannot\n// read React context, so it calls getAccessToken() instead. The provider keeps this in\n// sync with its React state, and registers its 401 handling here for the same reason.\nimport { isExpired } from './core';\n\nlet currentToken: string | undefined;\nlet unauthorizedHandler: (() => void) | undefined;\n// Set while a recovery is under way, so a burst of failing requests starts one.\nlet recovering = false;\n\n/** @internal — called by the provider; not part of the public surface. */\nexport function setAccessToken(token: string | undefined): void {\n  currentToken = token;\n  if (token !== undefined) recovering = false;\n}\n\n/** @internal — the mounted provider's reaction to a rejected token. */\nexport function setUnauthorizedHandler(handler: (() => void) | undefined): void {\n  unauthorizedHandler = handler;\n  recovering = false;\n}\n\n/**\n * The current minted ConfigHub token, or undefined when unauthenticated. Pass this as\n * the `getToken` for `@confighub/rtk-query`'s `configureConfigHub`, or read it anywhere\n * you need the token outside React.\n *\n * A token past its `exp` is never handed out: the server would reject it. Instead the\n * provider's recovery starts (a silent re-authentication, or a logout, per its\n * `onUnauthorized`) and the request goes without a token; the page is about to\n * navigate to the IdP and back to where it was.\n */\nexport function getAccessToken(): string | undefined {\n  if (currentToken !== undefined && isExpired(currentToken)) {\n    handleUnauthorized();\n    return undefined;\n  }\n  return currentToken;\n}\n\n/**\n * Tell the mounted provider the API rejected the token (401). Pass this as the\n * `onUnauthorized` for `@confighub/rtk-query`'s `configureConfigHub` to recover from a\n * token rejected before its expiry, e.g. after a server key rotation; expiry itself is\n * handled by `getAccessToken`. A no-op with no provider mounted, and while a recovery\n * is already under way.\n */\nexport function handleUnauthorized(): void {\n  if (recovering || !unauthorizedHandler) return;\n  recovering = true;\n  unauthorizedHandler();\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\nimport { createConfigHubClient, type ConfigHubClient } from '@confighub/api';\nimport {\n  createContext,\n  useCallback,\n  useEffect,\n  useMemo,\n  useRef,\n  useState,\n  type ReactNode,\n} from 'react';\nimport {\n  NoIdentityProvider,\n  OrganizationMissing,\n  callbackUri,\n  completeLoginFromRedirect,\n  endSession,\n  isExpired,\n  organizationAliasOf,\n  redeemBrowserTicket,\n  resetPending,\n  startLogin,\n  type LoginOptions,\n  type MintedSession,\n} from './core';\nimport { setAccessToken, setUnauthorizedHandler } from './tokenStore';\n\nexport type AuthStatus = 'loading' | 'authenticated' | 'unauthenticated' | 'error';\n\nexport interface ConfigHubUser {\n  organizationId: string;\n  idpClaims: Record<string, unknown>;\n}\n\nexport interface LogoutOptions {\n  /**\n   * Also end the IdP session (RP-initiated logout), so the next login asks for\n   * credentials instead of riding the SSO cookie. Redirects the page; the landing\n   * URI must be registered for the client. Default: false, which only forgets the\n   * token in this tab.\n   */\n  endSession?: boolean;\n  /** Where to land after IdP logout. Defaults to the callback URI. */\n  postLogoutRedirectUri?: string;\n}\n\nexport interface ConfigHubAuthContextValue {\n  status: AuthStatus;\n  user: ConfigHubUser | null;\n  error: Error | null;\n  /** Begin login: redirects the page to the IdP. */\n  login: (options?: LoginOptions) => Promise<void>;\n  /** Forget the session in this tab and, optionally, end the IdP session too. */\n  logout: (options?: LogoutOptions) => Promise<void>;\n  /**\n   * The ConfigHub token stopped working (a 401). Try to get a new one without any\n   * UI: a `prompt=none` round trip through the IdP, for the organization the session\n   * already had. Status goes to `loading` meanwhile, not `unauthenticated`, so an\n   * app that auto-logs-in on `unauthenticated` does not race this with an\n   * interactive login. If the IdP session is gone too, the page comes back\n   * `unauthenticated`. Redirects the page.\n   */\n  reauthenticate: () => Promise<void>;\n  /**\n   * Sign in with a ticket from `cub auth browser-session`, for an instance with no\n   * identity provider or a local identity. Rejects with the server's error if the\n   * ticket is unknown, expired or already used; the session stays as it was.\n   */\n  signInWithTicket: (ticket: string) => Promise<void>;\n  /** Current bearer token, or undefined when unauthenticated. */\n  getToken: () => string | undefined;\n  /** A typed API client pre-wired with the current token. Stable across renders. */\n  client: ConfigHubClient;\n}\n\nexport const ConfigHubAuthContext = createContext<ConfigHubAuthContextValue | null>(null);\n\nexport interface ConfigHubAuthProviderProps {\n  /** Absolute base URL of the ConfigHub instance, e.g. `https://hub.confighub.com`. */\n  baseUrl: string;\n  /** This app's registered OAuth `client_id` (from `cub oauthclient create`). */\n  clientId: string;\n  /**\n   * Same-origin path the IdP redirects back to; `{origin}{callbackPath}` is the\n   * redirect URI to register. Defaults to `/`. Fixed on purpose: the page a user\n   * starts login from travels in the PKCE state, not in the redirect URI.\n   */\n  callbackPath?: string;\n  /**\n   * `'session'` (default) keeps the minted token in `sessionStorage` so a reload or an\n   * in-tab navigation does not round-trip through the IdP. Tab-scoped and gone when the\n   * tab closes. `'none'`: memory only, every page load starts unauthenticated.\n   */\n  persist?: 'none' | 'session';\n  /**\n   * What a 401 from the API means. `'login'` (default): the token is stale, try a\n   * silent re-authentication (`prompt=none`) and fall back to unauthenticated if the\n   * IdP session is gone too. `'logout'`: just drop the session.\n   */\n  onUnauthorized?: 'login' | 'logout';\n  children: ReactNode;\n}\n\nconst SESSION_KEY = 'confighub_session';\n\nfunction readPersisted(): MintedSession | null {\n  try {\n    const raw = sessionStorage.getItem(SESSION_KEY);\n    if (!raw) return null;\n    const session: MintedSession = JSON.parse(raw);\n    if (!session.accessToken || isExpired(session.accessToken)) {\n      sessionStorage.removeItem(SESSION_KEY);\n      return null;\n    }\n    return session;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Runs the browser-direct auth flow and manages the token lifecycle. On mount it\n * completes a redirect if the page is the IdP callback, restores a persisted\n * session if there is one, and otherwise starts unauthenticated until `login()`\n * is called.\n */\nexport function ConfigHubAuthProvider({\n  baseUrl,\n  clientId,\n  callbackPath,\n  persist = 'session',\n  onUnauthorized = 'login',\n  children,\n}: ConfigHubAuthProviderProps): JSX.Element {\n  const [status, setStatus] = useState<AuthStatus>('loading');\n  const [user, setUser] = useState<ConfigHubUser | null>(null);\n  const [error, setError] = useState<Error | null>(null);\n\n  // The session lives in a ref so getToken() reads the latest value synchronously\n  // without re-creating the API client on every render.\n  const sessionRef = useRef<MintedSession | undefined>(undefined);\n  const flow = useMemo(() => ({ callbackPath }), [callbackPath]);\n\n  const persistSession = useCallback(\n    (session: MintedSession | undefined) => {\n      if (persist !== 'session') return;\n      try {\n        if (session) sessionStorage.setItem(SESSION_KEY, JSON.stringify(session));\n        else sessionStorage.removeItem(SESSION_KEY);\n      } catch {\n        // Storage unavailable (private mode, quota): memory-only for this tab.\n      }\n    },\n    [persist],\n  );\n\n  const applySession = useCallback(\n    (session: MintedSession) => {\n      sessionRef.current = session;\n      setAccessToken(session.accessToken); // keep the non-React accessor in sync (rtk-query)\n      persistSession(session);\n      setUser({ organizationId: session.organizationId, idpClaims: session.idpClaims });\n      setError(null);\n      setStatus('authenticated');\n    },\n    [persistSession],\n  );\n\n  const clearSession = useCallback(() => {\n    sessionRef.current = undefined;\n    setAccessToken(undefined);\n    persistSession(undefined);\n    resetPending();\n    setUser(null);\n    setStatus('unauthenticated');\n  }, [persistSession]);\n\n  useEffect(() => {\n    let cancelled = false;\n    completeLoginFromRedirect()\n      .then((session) => {\n        if (cancelled) return;\n        if (session) return applySession(session);\n        const persisted = persist === 'session' ? readPersisted() : null;\n        if (persisted) return applySession(persisted);\n        setStatus('unauthenticated');\n      })\n      .catch((e: unknown) => {\n        if (cancelled) return;\n        if (e instanceof OrganizationMissing) {\n          // Once, with no hint, flagged so a second miss surfaces as an error.\n          void startLogin(\n            baseUrl,\n            clientId,\n            { returnTo: e.returnTo, organization: null },\n            flow,\n            { retriedForOrganization: true },\n          );\n          return;\n        }\n        setError(e instanceof Error ? e : new Error(String(e)));\n        setStatus('error');\n      });\n    return () => {\n      cancelled = true;\n    };\n  }, [applySession, persist, baseUrl, clientId, flow]);\n\n  const login = useCallback(\n    async (options?: LoginOptions) => {\n      setError(null);\n      try {\n        await startLogin(baseUrl, clientId, options, flow);\n      } catch (e: unknown) {\n        setError(e instanceof Error ? e : new Error(String(e)));\n        setStatus('error');\n      }\n    },\n    [baseUrl, clientId, flow],\n  );\n\n  const logout = useCallback(\n    async (options?: LogoutOptions) => {\n      const idToken = sessionRef.current?.idToken;\n      if (!options?.endSession) {\n        clearSession();\n        return;\n      }\n      // Forget the session but stay 'loading': the page is about to navigate to the\n      // IdP's end-session endpoint, and 'unauthenticated' would let an app that\n      // auto-logs-in start a login that races the logout and can win it, landing\n      // the user back in the session they just ended.\n      sessionRef.current = undefined;\n      setAccessToken(undefined);\n      persistSession(undefined);\n      resetPending();\n      setUser(null);\n      setStatus('loading');\n      try {\n        await endSession(\n          baseUrl,\n          clientId,\n          idToken,\n          options.postLogoutRedirectUri ?? callbackUri(flow),\n        );\n      } catch (e: unknown) {\n        // The session in this tab is already gone; say why the IdP's is not.\n        setError(e instanceof Error ? e : new Error(String(e)));\n        setStatus('error');\n      }\n    },\n    [baseUrl, clientId, clearSession, flow, persistSession],\n  );\n\n  const getToken = useCallback(() => sessionRef.current?.accessToken, []);\n\n  const reauthenticate = useCallback(async () => {\n    const organization = organizationAliasOf(sessionRef.current?.idpClaims ?? {});\n    // Forget the token but stay 'loading': the page is about to navigate away,\n    // and 'unauthenticated' would invite an interactive login in the meantime.\n    sessionRef.current = undefined;\n    setAccessToken(undefined);\n    persistSession(undefined);\n    resetPending();\n    setStatus('loading');\n    try {\n      await startLogin(baseUrl, clientId, { prompt: 'none', organization }, flow);\n    } catch (e: unknown) {\n      // No IdP to ask: the session came from a ticket, and the user needs a new one.\n      if (e instanceof NoIdentityProvider) {\n        setStatus('unauthenticated');\n        return;\n      }\n      setError(e instanceof Error ? e : new Error(String(e)));\n      setStatus('error');\n    }\n  }, [baseUrl, clientId, flow, persistSession]);\n\n  const signInWithTicket = useCallback(\n    async (ticket: string) => {\n      applySession(await redeemBrowserTicket(baseUrl, ticket));\n    },\n    [applySession, baseUrl],\n  );\n\n  // A 401 means the minted token no longer works. Silent re-auth keeps the user's\n  // place if the IdP session is still alive; otherwise the page comes back\n  // unauthenticated and the app offers a real login.\n  const handleUnauthorized = useCallback(() => {\n    if (!sessionRef.current) return;\n    if (onUnauthorized === 'login') void reauthenticate();\n    else clearSession();\n  }, [clearSession, reauthenticate, onUnauthorized]);\n\n  // Non-React callers (getAccessToken on an expired token, handleUnauthorized from a\n  // data client's 401) reach this provider's handling through the token store.\n  useEffect(() => {\n    setUnauthorizedHandler(handleUnauthorized);\n    return () => setUnauthorizedHandler(undefined);\n  }, [handleUnauthorized]);\n\n  // One client for the provider's lifetime. getToken reads the session ref.\n  const client = useMemo(\n    () => createConfigHubClient({ baseUrl, getToken, onUnauthorized: handleUnauthorized }),\n    [baseUrl, getToken, handleUnauthorized],\n  );\n\n  const value = useMemo<ConfigHubAuthContextValue>(\n    () => ({\n      status,\n      user,\n      error,\n      login,\n      logout,\n      reauthenticate,\n      signInWithTicket,\n      getToken,\n      client,\n    }),\n    [status, user, error, login, logout, reauthenticate, signInWithTicket, getToken, client],\n  );\n\n  return (\n    <ConfigHubAuthContext.Provider value={value}>{children}</ConfigHubAuthContext.Provider>\n  );\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\nimport type { ConfigHubClient } from '@confighub/api';\nimport { useContext } from 'react';\nimport { ConfigHubAuthContext, type ConfigHubAuthContextValue } from './provider';\n\n/**\n * Access the ConfigHub auth state and actions. Must be called under a\n * `<ConfigHubAuthProvider>`.\n *\n * ```ts\n * const { status, user, login, logout } = useAuth();\n * ```\n */\nexport function useAuth(): ConfigHubAuthContextValue {\n  const ctx = useContext(ConfigHubAuthContext);\n  if (!ctx) {\n    throw new Error('useAuth must be used within a <ConfigHubAuthProvider>');\n  }\n  return ctx;\n}\n\n/**\n * The typed ConfigHub API client, pre-wired with the current token. This is the\n * seam between `@confighub/react-auth` and `@confighub/api`: you never pass a\n * token by hand.\n *\n * ```ts\n * const api = useConfigHub();\n * const { data } = await api.GET('/space/{space_id}/unit', { params: { path: { space_id } } });\n * ```\n */\nexport function useConfigHub(): ConfigHubClient {\n  return useAuth().client;\n}\n"]}

package/dist/index.d.cts

@@ -43,9 +43,12 @@ interface LoginOptions {
      * `'none'` asks the IdP to re-authenticate without any UI, failing with
      * `login_required` if the SSO session is gone -- the way to refresh an expired
      * ConfigHub token when the user is still signed in at the IdP. `'login'` forces the
-     * login form even with a live SSO session.
+     * login form even with a live SSO session. `'create'` opens the IdP's registration
+     * form instead of its login form (OpenID Connect Prompt Create; Keycloak honours it),
+     * so a "sign up" link can be an ordinary PKCE login that lands the new user in the
+     * app signed in.
      */
-    prompt?: 'none' | 'login';
+    prompt?: 'none' | 'login' | 'create';
 }
 interface FlowOptions {
     /**
@@ -65,6 +68,14 @@ declare class OrganizationMissing extends Error {
     readonly returnTo: string;
     constructor(returnTo: string);
 }
+/**
+ * Thrown by `startLogin` when the instance advertises no identity provider. Such an
+ * instance signs a browser in with a ticket from `cub auth browser-session` instead
+ * (see `redeemBrowserTicket`), so there is no login to start.
+ */
+declare class NoIdentityProvider extends Error {
+    constructor();
+}
 /** The organization alias of the last successful login for this client, if any. */
 declare function rememberedOrganization(clientId: string): string | undefined;
 /**
@@ -103,12 +114,6 @@ interface ConfigHubAuthContextValue {
     login: (options?: LoginOptions) => Promise<void>;
     /** Forget the session in this tab and, optionally, end the IdP session too. */
     logout: (options?: LogoutOptions) => Promise<void>;
-    /**
-     * Re-mint the ConfigHub token for another organization the user belongs to. The
-     * IdP session is untouched. Rejects with the server's error if the user is not a
-     * member; the current session stays as it was.
-     */
-    switchOrganization: (organizationId: string) => Promise<void>;
     /**
      * The ConfigHub token stopped working (a 401). Try to get a new one without any
      * UI: a `prompt=none` round trip through the IdP, for the organization the session
@@ -118,6 +123,12 @@ interface ConfigHubAuthContextValue {
      * `unauthenticated`. Redirects the page.
      */
     reauthenticate: () => Promise<void>;
+    /**
+     * Sign in with a ticket from `cub auth browser-session`, for an instance with no
+     * identity provider or a local identity. Rejects with the server's error if the
+     * ticket is unknown, expired or already used; the session stays as it was.
+     */
+    signInWithTicket: (ticket: string) => Promise<void>;
     /** Current bearer token, or undefined when unauthenticated. */
     getToken: () => string | undefined;
     /** A typed API client pre-wired with the current token. Stable across renders. */
@@ -198,4 +209,4 @@ declare function getAccessToken(): string | undefined;
  */
 declare function handleUnauthorized(): void;
 
-export { type AuthStatus, ConfigHubAuthContext, type ConfigHubAuthContextValue, ConfigHubAuthProvider, type ConfigHubAuthProviderProps, type ConfigHubUser, type Discovery, type FlowOptions, type LoginOptions, type LogoutOptions, type MintedSession, OrganizationMissing, callbackUri, decodeJwtClaims, getAccessToken, handleUnauthorized, isExpired, organizationAliasOf, rememberedOrganization, useAuth, useConfigHub };
+export { type AuthStatus, ConfigHubAuthContext, type ConfigHubAuthContextValue, ConfigHubAuthProvider, type ConfigHubAuthProviderProps, type ConfigHubUser, type Discovery, type FlowOptions, type LoginOptions, type LogoutOptions, type MintedSession, NoIdentityProvider, OrganizationMissing, callbackUri, decodeJwtClaims, getAccessToken, handleUnauthorized, isExpired, organizationAliasOf, rememberedOrganization, useAuth, useConfigHub };

package/dist/index.d.ts

@@ -43,9 +43,12 @@ interface LoginOptions {
      * `'none'` asks the IdP to re-authenticate without any UI, failing with
      * `login_required` if the SSO session is gone -- the way to refresh an expired
      * ConfigHub token when the user is still signed in at the IdP. `'login'` forces the
-     * login form even with a live SSO session.
+     * login form even with a live SSO session. `'create'` opens the IdP's registration
+     * form instead of its login form (OpenID Connect Prompt Create; Keycloak honours it),
+     * so a "sign up" link can be an ordinary PKCE login that lands the new user in the
+     * app signed in.
      */
-    prompt?: 'none' | 'login';
+    prompt?: 'none' | 'login' | 'create';
 }
 interface FlowOptions {
     /**
@@ -65,6 +68,14 @@ declare class OrganizationMissing extends Error {
     readonly returnTo: string;
     constructor(returnTo: string);
 }
+/**
+ * Thrown by `startLogin` when the instance advertises no identity provider. Such an
+ * instance signs a browser in with a ticket from `cub auth browser-session` instead
+ * (see `redeemBrowserTicket`), so there is no login to start.
+ */
+declare class NoIdentityProvider extends Error {
+    constructor();
+}
 /** The organization alias of the last successful login for this client, if any. */
 declare function rememberedOrganization(clientId: string): string | undefined;
 /**
@@ -103,12 +114,6 @@ interface ConfigHubAuthContextValue {
     login: (options?: LoginOptions) => Promise<void>;
     /** Forget the session in this tab and, optionally, end the IdP session too. */
     logout: (options?: LogoutOptions) => Promise<void>;
-    /**
-     * Re-mint the ConfigHub token for another organization the user belongs to. The
-     * IdP session is untouched. Rejects with the server's error if the user is not a
-     * member; the current session stays as it was.
-     */
-    switchOrganization: (organizationId: string) => Promise<void>;
     /**
      * The ConfigHub token stopped working (a 401). Try to get a new one without any
      * UI: a `prompt=none` round trip through the IdP, for the organization the session
@@ -118,6 +123,12 @@ interface ConfigHubAuthContextValue {
      * `unauthenticated`. Redirects the page.
      */
     reauthenticate: () => Promise<void>;
+    /**
+     * Sign in with a ticket from `cub auth browser-session`, for an instance with no
+     * identity provider or a local identity. Rejects with the server's error if the
+     * ticket is unknown, expired or already used; the session stays as it was.
+     */
+    signInWithTicket: (ticket: string) => Promise<void>;
     /** Current bearer token, or undefined when unauthenticated. */
     getToken: () => string | undefined;
     /** A typed API client pre-wired with the current token. Stable across renders. */
@@ -198,4 +209,4 @@ declare function getAccessToken(): string | undefined;
  */
 declare function handleUnauthorized(): void;
 
-export { type AuthStatus, ConfigHubAuthContext, type ConfigHubAuthContextValue, ConfigHubAuthProvider, type ConfigHubAuthProviderProps, type ConfigHubUser, type Discovery, type FlowOptions, type LoginOptions, type LogoutOptions, type MintedSession, OrganizationMissing, callbackUri, decodeJwtClaims, getAccessToken, handleUnauthorized, isExpired, organizationAliasOf, rememberedOrganization, useAuth, useConfigHub };
+export { type AuthStatus, ConfigHubAuthContext, type ConfigHubAuthContextValue, ConfigHubAuthProvider, type ConfigHubAuthProviderProps, type ConfigHubUser, type Discovery, type FlowOptions, type LoginOptions, type LogoutOptions, type MintedSession, NoIdentityProvider, OrganizationMissing, callbackUri, decodeJwtClaims, getAccessToken, handleUnauthorized, isExpired, organizationAliasOf, rememberedOrganization, useAuth, useConfigHub };

package/dist/index.js

@@ -12,6 +12,12 @@ var OrganizationMissing = class extends Error {
     this.name = "OrganizationMissing";
   }
 };
+var NoIdentityProvider = class extends Error {
+  constructor() {
+    super("this instance has no identity provider; sign in with `cub auth browser-session`");
+    this.name = "NoIdentityProvider";
+  }
+};
 var PKCE_KEY = "confighub_pkce";
 var LAST_ORG_KEY = "confighub_last_org";
 var lastOrgKey = (clientId) => `${LAST_ORG_KEY}:${clientId}`;
@@ -69,6 +75,7 @@ async function oidcMetadata(issuer) {
 }
 async function startLogin(base, clientId, login = {}, flow = {}, retry = {}) {
   const info = await discover(base);
+  if (!info.AuthIssuer && !info.TokenExchangeEndpoint) throw new NoIdentityProvider();
   if (!info.AuthIssuer || !info.TokenExchangeEndpoint) {
     throw new Error(
       "this instance is not configured for token-exchange auth (server needs CONFIGHUB_IDP_ISSUER)"
@@ -171,18 +178,15 @@ async function exchange(exchangeEndpoint, subjectToken) {
   const minted = await exResp.json();
   return { accessToken: minted.access_token, organizationId: minted.organization_id };
 }
-async function switchOrganization(base, accessToken, organizationId) {
-  const r = await fetch(trimSlash(base) + "/auth/switch-organization", {
+async function redeemBrowserTicket(base, ticket) {
+  const r = await fetch(trimSlash(base) + "/auth/browser-session", {
     method: "POST",
-    headers: {
-      Authorization: `Bearer ${accessToken}`,
-      "Content-Type": "application/x-www-form-urlencoded"
-    },
-    body: new URLSearchParams({ organization_id: organizationId })
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: new URLSearchParams({ ticket })
   });
-  if (!r.ok) throw new Error(`/auth/switch-organization ${r.status}: ${await r.text()}`);
+  if (!r.ok) throw new Error(`/auth/browser-session ${r.status}: ${await r.text()}`);
   const minted = await r.json();
-  return { accessToken: minted.access_token, organizationId: minted.organization_id };
+  return { accessToken: minted.access_token, organizationId: minted.organization_id, idpClaims: {} };
 }
 async function endSession(base, clientId, idToken, postLogoutRedirectUri) {
   const info = await discover(base);
@@ -329,27 +333,29 @@ function ConfigHubAuthProvider({
   const logout = useCallback(
     async (options) => {
       const idToken = sessionRef.current?.idToken;
-      clearSession();
-      if (options?.endSession) {
+      if (!options?.endSession) {
+        clearSession();
+        return;
+      }
+      sessionRef.current = void 0;
+      setAccessToken(void 0);
+      persistSession(void 0);
+      resetPending();
+      setUser(null);
+      setStatus("loading");
+      try {
         await endSession(
           baseUrl,
           clientId,
           idToken,
           options.postLogoutRedirectUri ?? callbackUri(flow)
         );
+      } catch (e) {
+        setError(e instanceof Error ? e : new Error(String(e)));
+        setStatus("error");
       }
     },
-    [baseUrl, clientId, clearSession, flow]
-  );
-  const switchOrganization2 = useCallback(
-    async (organizationId) => {
-      const current = sessionRef.current;
-      if (!current) throw new Error("not authenticated");
-      const minted = await switchOrganization(baseUrl, current.accessToken, organizationId);
-      rememberOrganization(clientId, void 0);
-      applySession({ ...current, ...minted });
-    },
-    [applySession, baseUrl, clientId]
+    [baseUrl, clientId, clearSession, flow, persistSession]
   );
   const getToken = useCallback(() => sessionRef.current?.accessToken, []);
   const reauthenticate = useCallback(async () => {
@@ -362,10 +368,20 @@ function ConfigHubAuthProvider({
     try {
       await startLogin(baseUrl, clientId, { prompt: "none", organization }, flow);
     } catch (e) {
+      if (e instanceof NoIdentityProvider) {
+        setStatus("unauthenticated");
+        return;
+      }
       setError(e instanceof Error ? e : new Error(String(e)));
       setStatus("error");
     }
   }, [baseUrl, clientId, flow, persistSession]);
+  const signInWithTicket = useCallback(
+    async (ticket) => {
+      applySession(await redeemBrowserTicket(baseUrl, ticket));
+    },
+    [applySession, baseUrl]
+  );
   const handleUnauthorized2 = useCallback(() => {
     if (!sessionRef.current) return;
     if (onUnauthorized === "login") void reauthenticate();
@@ -386,12 +402,12 @@ function ConfigHubAuthProvider({
       error,
       login,
       logout,
-      switchOrganization: switchOrganization2,
       reauthenticate,
+      signInWithTicket,
       getToken,
       client
     }),
-    [status, user, error, login, logout, switchOrganization2, reauthenticate, getToken, client]
+    [status, user, error, login, logout, reauthenticate, signInWithTicket, getToken, client]
   );
   return /* @__PURE__ */ jsx(ConfigHubAuthContext.Provider, { value, children });
 }
@@ -406,6 +422,6 @@ function useConfigHub() {
   return useAuth().client;
 }
 
-export { ConfigHubAuthContext, ConfigHubAuthProvider, OrganizationMissing, callbackUri, decodeJwtClaims, getAccessToken, handleUnauthorized, isExpired, organizationAliasOf, rememberedOrganization, useAuth, useConfigHub };
+export { ConfigHubAuthContext, ConfigHubAuthProvider, NoIdentityProvider, OrganizationMissing, callbackUri, decodeJwtClaims, getAccessToken, handleUnauthorized, isExpired, organizationAliasOf, rememberedOrganization, useAuth, useConfigHub };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/core.ts","../src/tokenStore.ts","../src/provider.tsx","../src/hooks.ts"],"names":["switchOrganization","handleUnauthorized"],"mappings":";;;;;;;AAiGO,IAAM,mBAAA,GAAN,cAAkC,KAAA,CAAM;AAAA,EAC7C,YAA4B,QAAA,EAAkB;AAC5C,IAAA,KAAA,CAAM,2DAA2D,CAAA;AADvC,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAE1B,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AAAA,EACd;AACF;AAOA,IAAM,QAAA,GAAW,gBAAA;AACjB,IAAM,YAAA,GAAe,oBAAA;AAIrB,IAAM,aAAa,CAAC,QAAA,KAA6B,CAAA,EAAG,YAAY,IAAI,QAAQ,CAAA,CAAA;AAGrE,SAAS,uBAAuB,QAAA,EAAsC;AAC3E,EAAA,IAAI;AACF,IAAA,OAAO,YAAA,CAAa,OAAA,CAAQ,UAAA,CAAW,QAAQ,CAAC,CAAA,IAAK,KAAA,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAGO,SAAS,oBAAA,CAAqB,UAAkB,KAAA,EAAiC;AACtF,EAAA,IAAI;AACF,IAAA,IAAI,OAAO,YAAA,CAAa,OAAA,CAAQ,UAAA,CAAW,QAAQ,GAAG,KAAK,CAAA;AAAA,SACtD,YAAA,CAAa,UAAA,CAAW,UAAA,CAAW,QAAQ,CAAC,CAAA;AAAA,EACnD,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAMO,SAAS,oBAAoB,SAAA,EAAwD;AAC1F,EAAA,MAAM,MAAM,SAAA,CAAU,YAAA;AACtB,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,UAAU,OAAO,MAAA;AAC5C,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,IAAA,CAAK,GAA8B,CAAA;AAC1D,EAAA,OAAO,OAAA,CAAQ,MAAA,KAAW,CAAA,GAAI,OAAA,CAAQ,CAAC,CAAA,GAAI,MAAA;AAC7C;AAEA,IAAM,YAAY,CAAC,CAAA,KAAsB,CAAA,CAAE,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAGtD,IAAM,cAAc,CAAC,IAAA,KAC1B,OAAO,QAAA,CAAS,MAAA,IAAU,MAAM,YAAA,IAAgB,GAAA;AAElD,IAAM,WAAA,GAAc,MAClB,MAAA,CAAO,QAAA,CAAS,WAAW,MAAA,CAAO,QAAA,CAAS,MAAA,GAAS,MAAA,CAAO,QAAA,CAAS,IAAA;AAEtE,IAAM,MAAA,GAAS,CAAC,GAAA,KACd,IAAA,CAAK,OAAO,YAAA,CAAa,GAAG,IAAI,UAAA,CAAW,GAAG,CAAC,CAAC,CAAA,CAC7C,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,OAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAEtB,IAAM,YAAA,GAAe,CAAC,CAAA,GAAI,EAAA,KACxB,MAAA,CAAO,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,CAAC,CAAC,CAAA,CAAE,MAAM,CAAA;AAEzD,eAAe,OAAO,CAAA,EAA4B;AAChD,EAAA,OAAO,MAAA,CAAO,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AAClF;AAGO,SAAS,gBAAgB,KAAA,EAAwC;AACtE,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC/B,EAAA,IAAI,CAAC,IAAA,EAAM,OAAO,EAAC;AACnB,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAC,CAAC,CAAA;AAAA,EACpE,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAGO,SAAS,SAAA,CAAU,KAAA,EAAe,WAAA,GAAc,EAAA,EAAa;AAClE,EAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,KAAK,CAAA,CAAE,GAAA;AACnC,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,KAAA;AACpC,EAAA,OAAO,GAAA,GAAM,GAAA,IAAQ,IAAA,CAAK,GAAA,KAAQ,WAAA,GAAc,GAAA;AAClD;AAEA,eAAsB,SAAS,IAAA,EAAkC;AAC/D,EAAA,MAAM,IAAI,MAAM,KAAA,CAAM,SAAA,CAAU,IAAI,IAAI,WAAW,CAAA;AACnD,EAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,oBAAA,GAAuB,EAAE,MAAM,CAAA;AAC1D,EAAA,OAAO,EAAE,IAAA,EAAK;AAChB;AAQA,eAAe,aAAa,MAAA,EAAuC;AACjE,EAAA,MAAM,IAAI,MAAM,KAAA,CAAM,SAAA,CAAU,MAAM,IAAI,mCAAmC,CAAA;AAC7E,EAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,yBAAA,GAA4B,EAAE,MAAM,CAAA;AAC/D,EAAA,OAAO,EAAE,IAAA,EAAK;AAChB;AAOA,eAAsB,UAAA,CACpB,IAAA,EACA,QAAA,EACA,KAAA,GAAsB,EAAC,EACvB,IAAA,GAAoB,EAAC,EACrB,KAAA,GAAsB,EAAC,EACR;AACf,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAI,CAAA;AAChC,EAAA,IAAI,CAAC,IAAA,CAAK,UAAA,IAAc,CAAC,KAAK,qBAAA,EAAuB;AACnD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAO,MAAM,YAAA,CAAa,IAAA,CAAK,UAAU,CAAA;AAC/C,EAAA,MAAM,WAAW,YAAA,EAAa;AAC9B,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,QAAQ,CAAA;AACvC,EAAA,MAAM,KAAA,GAAQ,aAAa,EAAE,CAAA;AAC7B,EAAA,MAAM,WAAA,GAAc,YAAY,IAAI,CAAA;AAGpC,EAAA,MAAM,KAAA,GACJ,MAAM,YAAA,KAAiB,IAAA,GACnB,SACC,KAAA,CAAM,YAAA,IAAgB,uBAAuB,QAAQ,CAAA;AAC5D,EAAA,MAAM,QAAA,GAAW,KAAA,GAAQ,CAAA,aAAA,EAAgB,KAAK,CAAA,CAAA,GAAK,cAAA;AACnD,EAAA,MAAM,IAAA,GAAkB;AAAA,IACtB,QAAA;AAAA,IACA,KAAA;AAAA,IACA,QAAA;AAAA,IACA,eAAe,IAAA,CAAK,cAAA;AAAA,IACpB,kBAAkB,IAAA,CAAK,qBAAA;AAAA,IACvB,WAAA;AAAA,IACA,QAAA,EAAU,KAAA,CAAM,QAAA,IAAY,WAAA,EAAY;AAAA,IACxC,MAAA,EAAQ,MAAM,MAAA,KAAW,MAAA;AAAA,IACzB,kBAAA,EAAoB,KAAA;AAAA,IACpB,wBAAwB,KAAA,CAAM;AAAA,GAChC;AACA,EAAA,cAAA,CAAe,OAAA,CAAQ,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AACrD,EAAA,MAAM,MAAA,GAAiC;AAAA,IACrC,aAAA,EAAe,MAAA;AAAA,IACf,SAAA,EAAW,QAAA;AAAA,IACX,YAAA,EAAc,WAAA;AAAA,IACd,KAAA,EAAO,wBAAwB,QAAQ,CAAA,CAAA;AAAA,IACvC,cAAA,EAAgB,SAAA;AAAA,IAChB,qBAAA,EAAuB,MAAA;AAAA,IACvB;AAAA,GACF;AACA,EAAA,IAAI,KAAA,CAAM,MAAA,EAAQ,MAAA,CAAO,MAAA,GAAS,KAAA,CAAM,MAAA;AAExC,EAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,IAAA,CAAK,sBAAsB,CAAA;AACnD,EAAA,OAAA,CAAQ,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAM,EAAE,QAAA,EAAS;AACtD,EAAA,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,OAAA,CAAQ,QAAA,EAAU,CAAA;AAC3C;AAGA,IAAI,OAAA,GAAgD,IAAA;AAU7C,SAAS,yBAAA,GAA2D;AACzE,EAAA,IAAI,CAAC,OAAA,EAAS,OAAA,GAAU,eAAA,EAAgB;AACxC,EAAA,OAAO,OAAA;AACT;AAEA,IAAM,kCAAkB,IAAI,GAAA,CAAI,CAAC,gBAAA,EAAkB,sBAAA,EAAwB,kBAAkB,CAAC,CAAA;AAE9F,eAAe,eAAA,GAAiD;AAC9D,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAA,CAAO,SAAS,MAAM,CAAA;AACzD,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AAC9B,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA;AAChC,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,KAAA,EAAO,OAAO,IAAA;AAE5B,EAAA,MAAM,QAAA,GAAW,cAAA,CAAe,OAAA,CAAQ,QAAQ,CAAA;AAChD,EAAA,cAAA,CAAe,WAAW,QAAQ,CAAA;AAClC,EAAA,MAAM,KAAA,GAA0B,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA,GAAI,IAAA;AAIlE,EAAA,OAAA,CAAQ,aAAa,EAAC,EAAG,IAAI,KAAA,EAAO,QAAA,IAAY,aAAa,CAAA;AAE7D,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,IAAI,OAAO,MAAA,IAAU,eAAA,CAAgB,GAAA,CAAI,KAAK,GAAG,OAAO,IAAA;AACxD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,KAAK,CAAA,CAAA,EAAI,OAAO,GAAA,CAAI,mBAAmB,CAAA,IAAK,EAAE,CAAA,CAAE,CAAA;AAAA,EACzF;AAOA,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,IAAI,MAAA,CAAO,IAAI,OAAO,CAAA,KAAM,MAAM,KAAA,EAAO,MAAM,IAAI,KAAA,CAAM,0BAA0B,CAAA;AAGnF,EAAA,MAAM,SAAA,GAAY,MAAM,KAAA,CAAM,KAAA,CAAM,aAAA,EAAe;AAAA,IACjD,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,oBAAA;AAAA,MACZ,IAAA;AAAA,MACA,cAAc,KAAA,CAAM,WAAA;AAAA,MACpB,WAAW,KAAA,CAAM,QAAA;AAAA,MACjB,eAAe,KAAA,CAAM;AAAA,KACtB;AAAA,GACF,CAAA;AACD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,SAAA,CAAU,MAAM,KAAK,MAAM,SAAA,CAAU,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EACrF;AACA,EAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,IAAA,EAAK;AAGtC,EAAA,MAAM,SAAA,GAAY,eAAA,CAAgB,QAAA,CAAS,YAAY,CAAA;AACvD,EAAA,IAAI,CAAC,mBAAA,CAAoB,SAAS,CAAA,IAAK,CAAC,MAAM,sBAAA,EAAwB;AAIpE,IAAA,IAAI,KAAA,CAAM,kBAAA,EAAoB,oBAAA,CAAqB,KAAA,CAAM,UAAU,MAAS,CAAA;AAC5E,IAAA,MAAM,IAAI,mBAAA,CAAoB,KAAA,CAAM,QAAQ,CAAA;AAAA,EAC9C;AACA,EAAA,MAAM,SAAS,MAAM,QAAA,CAAS,KAAA,CAAM,gBAAA,EAAkB,SAAS,YAAY,CAAA;AAC3E,EAAA,oBAAA,CAAqB,KAAA,CAAM,QAAA,EAAU,mBAAA,CAAoB,SAAS,CAAC,CAAA;AACnE,EAAA,OAAO;AAAA,IACL,GAAG,MAAA;AAAA,IACH,SAAA;AAAA,IACA,SAAS,OAAO,QAAA,CAAS,QAAA,KAAa,QAAA,GAAW,SAAS,QAAA,GAAW;AAAA,GACvE;AACF;AAEA,eAAe,QAAA,CACb,kBACA,YAAA,EACgE;AAChE,EAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,gBAAA,EAAkB;AAAA,IAC3C,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,iDAAA;AAAA,MACZ,aAAA,EAAe,YAAA;AAAA,MACf,kBAAA,EAAoB;AAAA,KACrB;AAAA,GACF,CAAA;AACD,EAAA,IAAI,CAAC,MAAA,CAAO,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,MAAA,CAAO,MAAM,CAAA,EAAA,EAAK,MAAM,MAAA,CAAO,IAAA,EAAM,CAAA,CAAE,CAAA;AACzF,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,EAAK;AACjC,EAAA,OAAO,EAAE,WAAA,EAAa,MAAA,CAAO,YAAA,EAAc,cAAA,EAAgB,OAAO,eAAA,EAAgB;AACpF;AAOA,eAAsB,kBAAA,CACpB,IAAA,EACA,WAAA,EACA,cAAA,EACgE;AAChE,EAAA,MAAM,IAAI,MAAM,KAAA,CAAM,SAAA,CAAU,IAAI,IAAI,2BAAA,EAA6B;AAAA,IACnE,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS;AAAA,MACP,aAAA,EAAe,UAAU,WAAW,CAAA,CAAA;AAAA,MACpC,cAAA,EAAgB;AAAA,KAClB;AAAA,IACA,MAAM,IAAI,eAAA,CAAgB,EAAE,eAAA,EAAiB,gBAAgB;AAAA,GAC9D,CAAA;AACD,EAAA,IAAI,CAAC,CAAA,CAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,0BAAA,EAA6B,CAAA,CAAE,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,CAAA;AACrF,EAAA,MAAM,MAAA,GAAS,MAAM,CAAA,CAAE,IAAA,EAAK;AAC5B,EAAA,OAAO,EAAE,WAAA,EAAa,MAAA,CAAO,YAAA,EAAc,cAAA,EAAgB,OAAO,eAAA,EAAgB;AACpF;AAOA,eAAsB,UAAA,CACpB,IAAA,EACA,QAAA,EACA,OAAA,EACA,qBAAA,EACe;AACf,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAI,CAAA;AAChC,EAAA,MAAM,OAAO,IAAA,CAAK,UAAA,GAAa,MAAM,YAAA,CAAa,IAAA,CAAK,UAAU,CAAA,GAAI,MAAA;AACrE,EAAA,IAAI,CAAC,MAAM,oBAAA,EAAsB;AAC/B,IAAA,MAAA,CAAO,QAAA,CAAS,OAAO,qBAAqB,CAAA;AAC5C,IAAA;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAiC;AAAA,IACrC,SAAA,EAAW,QAAA;AAAA,IACX,wBAAA,EAA0B;AAAA,GAC5B;AACA,EAAA,IAAI,OAAA,SAAgB,aAAA,GAAgB,OAAA;AACpC,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,IAAA,CAAK,oBAAoB,CAAA;AAC7C,EAAA,GAAA,CAAI,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAM,EAAE,QAAA,EAAS;AAClD,EAAA,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,GAAA,CAAI,QAAA,EAAU,CAAA;AACvC;AAGO,SAAS,YAAA,GAAqB;AACnC,EAAA,OAAA,GAAU,IAAA;AACZ;;;ACrZA,IAAI,YAAA;AACJ,IAAI,mBAAA;AAEJ,IAAI,UAAA,GAAa,KAAA;AAGV,SAAS,eAAe,KAAA,EAAiC;AAC9D,EAAA,YAAA,GAAe,KAAA;AACf,EAAA,IAAI,KAAA,KAAU,QAAW,UAAA,GAAa,KAAA;AACxC;AAGO,SAAS,uBAAuB,OAAA,EAAyC;AAC9E,EAAA,mBAAA,GAAsB,OAAA;AACtB,EAAA,UAAA,GAAa,KAAA;AACf;AAYO,SAAS,cAAA,GAAqC;AACnD,EAAA,IAAI,YAAA,KAAiB,MAAA,IAAa,SAAA,CAAU,YAAY,CAAA,EAAG;AACzD,IAAA,kBAAA,EAAmB;AACnB,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,YAAA;AACT;AASO,SAAS,kBAAA,GAA2B;AACzC,EAAA,IAAI,UAAA,IAAc,CAAC,mBAAA,EAAqB;AACxC,EAAA,UAAA,GAAa,IAAA;AACb,EAAA,mBAAA,EAAoB;AACtB;ACsBO,IAAM,oBAAA,GAAuB,cAAgD,IAAI;AA4BxF,IAAM,WAAA,GAAc,mBAAA;AAEpB,SAAS,aAAA,GAAsC;AAC7C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,cAAA,CAAe,OAAA,CAAQ,WAAW,CAAA;AAC9C,IAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,IAAA,MAAM,OAAA,GAAyB,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7C,IAAA,IAAI,CAAC,OAAA,CAAQ,WAAA,IAAe,SAAA,CAAU,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC1D,MAAA,cAAA,CAAe,WAAW,WAAW,CAAA;AACrC,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,OAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAQO,SAAS,qBAAA,CAAsB;AAAA,EACpC,OAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA,GAAU,SAAA;AAAA,EACV,cAAA,GAAiB,OAAA;AAAA,EACjB;AACF,CAAA,EAA4C;AAC1C,EAAA,MAAM,CAAC,MAAA,EAAQ,SAAS,CAAA,GAAI,SAAqB,SAAS,CAAA;AAC1D,EAAA,MAAM,CAAC,IAAA,EAAM,OAAO,CAAA,GAAI,SAA+B,IAAI,CAAA;AAC3D,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAI,SAAuB,IAAI,CAAA;AAIrD,EAAA,MAAM,UAAA,GAAa,OAAkC,MAAS,CAAA;AAC9D,EAAA,MAAM,IAAA,GAAO,QAAQ,OAAO,EAAE,cAAa,CAAA,EAAI,CAAC,YAAY,CAAC,CAAA;AAE7D,EAAA,MAAM,cAAA,GAAiB,WAAA;AAAA,IACrB,CAAC,OAAA,KAAuC;AACtC,MAAA,IAAI,YAAY,SAAA,EAAW;AAC3B,MAAA,IAAI;AACF,QAAA,IAAI,SAAS,cAAA,CAAe,OAAA,CAAQ,aAAa,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAAA,aACnE,cAAA,CAAe,WAAW,WAAW,CAAA;AAAA,MAC5C,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF,CAAA;AAAA,IACA,CAAC,OAAO;AAAA,GACV;AAEA,EAAA,MAAM,YAAA,GAAe,WAAA;AAAA,IACnB,CAAC,OAAA,KAA2B;AAC1B,MAAA,UAAA,CAAW,OAAA,GAAU,OAAA;AACrB,MAAA,cAAA,CAAe,QAAQ,WAAW,CAAA;AAClC,MAAA,cAAA,CAAe,OAAO,CAAA;AACtB,MAAA,OAAA,CAAQ,EAAE,cAAA,EAAgB,OAAA,CAAQ,gBAAgB,SAAA,EAAW,OAAA,CAAQ,WAAW,CAAA;AAChF,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,SAAA,CAAU,eAAe,CAAA;AAAA,IAC3B,CAAA;AAAA,IACA,CAAC,cAAc;AAAA,GACjB;AAEA,EAAA,MAAM,YAAA,GAAe,YAAY,MAAM;AACrC,IAAA,UAAA,CAAW,OAAA,GAAU,MAAA;AACrB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,YAAA,EAAa;AACb,IAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,IAAA,SAAA,CAAU,iBAAiB,CAAA;AAAA,EAC7B,CAAA,EAAG,CAAC,cAAc,CAAC,CAAA;AAEnB,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,SAAA,GAAY,KAAA;AAChB,IAAA,yBAAA,EAA0B,CACvB,IAAA,CAAK,CAAC,OAAA,KAAY;AACjB,MAAA,IAAI,SAAA,EAAW;AACf,MAAA,IAAI,OAAA,EAAS,OAAO,YAAA,CAAa,OAAO,CAAA;AACxC,MAAA,MAAM,SAAA,GAAY,OAAA,KAAY,SAAA,GAAY,aAAA,EAAc,GAAI,IAAA;AAC5D,MAAA,IAAI,SAAA,EAAW,OAAO,YAAA,CAAa,SAAS,CAAA;AAC5C,MAAA,SAAA,CAAU,iBAAiB,CAAA;AAAA,IAC7B,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,CAAA,KAAe;AACrB,MAAA,IAAI,SAAA,EAAW;AACf,MAAA,IAAI,aAAa,mBAAA,EAAqB;AAEpC,QAAA,KAAK,UAAA;AAAA,UACH,OAAA;AAAA,UACA,QAAA;AAAA,UACA,EAAE,QAAA,EAAU,CAAA,CAAE,QAAA,EAAU,cAAc,IAAA,EAAK;AAAA,UAC3C,IAAA;AAAA,UACA,EAAE,wBAAwB,IAAA;AAAK,SACjC;AACA,QAAA;AAAA,MACF;AACA,MAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,MAAA,SAAA,CAAU,OAAO,CAAA;AAAA,IACnB,CAAC,CAAA;AACH,IAAA,OAAO,MAAM;AACX,MAAA,SAAA,GAAY,IAAA;AAAA,IACd,CAAA;AAAA,EACF,GAAG,CAAC,YAAA,EAAc,SAAS,OAAA,EAAS,QAAA,EAAU,IAAI,CAAC,CAAA;AAEnD,EAAA,MAAM,KAAA,GAAQ,WAAA;AAAA,IACZ,OAAO,OAAA,KAA2B;AAChC,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,IAAI;AACF,QAAA,MAAM,UAAA,CAAW,OAAA,EAAS,QAAA,EAAU,OAAA,EAAS,IAAI,CAAA;AAAA,MACnD,SAAS,CAAA,EAAY;AACnB,QAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,QAAA,SAAA,CAAU,OAAO,CAAA;AAAA,MACnB;AAAA,IACF,CAAA;AAAA,IACA,CAAC,OAAA,EAAS,QAAA,EAAU,IAAI;AAAA,GAC1B;AAEA,EAAA,MAAM,MAAA,GAAS,WAAA;AAAA,IACb,OAAO,OAAA,KAA4B;AACjC,MAAA,MAAM,OAAA,GAAU,WAAW,OAAA,EAAS,OAAA;AACpC,MAAA,YAAA,EAAa;AACb,MAAA,IAAI,SAAS,UAAA,EAAY;AACvB,QAAA,MAAM,UAAA;AAAA,UACJ,OAAA;AAAA,UACA,QAAA;AAAA,UACA,OAAA;AAAA,UACA,OAAA,CAAQ,qBAAA,IAAyB,WAAA,CAAY,IAAI;AAAA,SACnD;AAAA,MACF;AAAA,IACF,CAAA;AAAA,IACA,CAAC,OAAA,EAAS,QAAA,EAAU,YAAA,EAAc,IAAI;AAAA,GACxC;AAEA,EAAA,MAAMA,mBAAAA,GAAqB,WAAA;AAAA,IACzB,OAAO,cAAA,KAA2B;AAChC,MAAA,MAAM,UAAU,UAAA,CAAW,OAAA;AAC3B,MAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,mBAAmB,CAAA;AACjD,MAAA,MAAM,SAAS,MAAM,kBAAA,CAAuB,OAAA,EAAS,OAAA,CAAQ,aAAa,cAAc,CAAA;AAGxF,MAAA,oBAAA,CAAqB,UAAU,MAAS,CAAA;AACxC,MAAA,YAAA,CAAa,EAAE,GAAG,OAAA,EAAS,GAAG,QAAQ,CAAA;AAAA,IACxC,CAAA;AAAA,IACA,CAAC,YAAA,EAAc,OAAA,EAAS,QAAQ;AAAA,GAClC;AAEA,EAAA,MAAM,WAAW,WAAA,CAAY,MAAM,WAAW,OAAA,EAAS,WAAA,EAAa,EAAE,CAAA;AAEtE,EAAA,MAAM,cAAA,GAAiB,YAAY,YAAY;AAC7C,IAAA,MAAM,eAAe,mBAAA,CAAoB,UAAA,CAAW,OAAA,EAAS,SAAA,IAAa,EAAE,CAAA;AAG5E,IAAA,UAAA,CAAW,OAAA,GAAU,MAAA;AACrB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,YAAA,EAAa;AACb,IAAA,SAAA,CAAU,SAAS,CAAA;AACnB,IAAA,IAAI;AACF,MAAA,MAAM,UAAA,CAAW,SAAS,QAAA,EAAU,EAAE,QAAQ,MAAA,EAAQ,YAAA,IAAgB,IAAI,CAAA;AAAA,IAC5E,SAAS,CAAA,EAAY;AACnB,MAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,MAAA,SAAA,CAAU,OAAO,CAAA;AAAA,IACnB;AAAA,EACF,GAAG,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,EAAM,cAAc,CAAC,CAAA;AAK5C,EAAA,MAAMC,mBAAAA,GAAqB,YAAY,MAAM;AAC3C,IAAA,IAAI,CAAC,WAAW,OAAA,EAAS;AACzB,IAAA,IAAI,cAAA,KAAmB,OAAA,EAAS,KAAK,cAAA,EAAe;AAAA,SAC/C,YAAA,EAAa;AAAA,EACpB,CAAA,EAAG,CAAC,YAAA,EAAc,cAAA,EAAgB,cAAc,CAAC,CAAA;AAIjD,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,sBAAA,CAAuBA,mBAAkB,CAAA;AACzC,IAAA,OAAO,MAAM,uBAAuB,MAAS,CAAA;AAAA,EAC/C,CAAA,EAAG,CAACA,mBAAkB,CAAC,CAAA;AAGvB,EAAA,MAAM,MAAA,GAAS,OAAA;AAAA,IACb,MAAM,qBAAA,CAAsB,EAAE,SAAS,QAAA,EAAU,cAAA,EAAgBA,qBAAoB,CAAA;AAAA,IACrF,CAAC,OAAA,EAAS,QAAA,EAAUA,mBAAkB;AAAA,GACxC;AAEA,EAAA,MAAM,KAAA,GAAQ,OAAA;AAAA,IACZ,OAAO;AAAA,MACL,MAAA;AAAA,MACA,IAAA;AAAA,MACA,KAAA;AAAA,MACA,KAAA;AAAA,MACA,MAAA;AAAA,MACA,kBAAA,EAAAD,mBAAAA;AAAA,MACA,cAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF,CAAA;AAAA,IACA,CAAC,QAAQ,IAAA,EAAM,KAAA,EAAO,OAAO,MAAA,EAAQA,mBAAAA,EAAoB,cAAA,EAAgB,QAAA,EAAU,MAAM;AAAA,GAC3F;AAEA,EAAA,uBACE,GAAA,CAAC,oBAAA,CAAqB,QAAA,EAArB,EAA8B,OAAe,QAAA,EAAS,CAAA;AAE3D;ACxSO,SAAS,OAAA,GAAqC;AACnD,EAAA,MAAM,GAAA,GAAM,WAAW,oBAAoB,CAAA;AAC3C,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,EACzE;AACA,EAAA,OAAO,GAAA;AACT;AAYO,SAAS,YAAA,GAAgC;AAC9C,EAAA,OAAO,SAAQ,CAAE,MAAA;AACnB","file":"index.js","sourcesContent":["// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n//\n// Framework-neutral browser-auth engine for ConfigHub. Productionized from the\n// reference harness `test/browser-auth/src/confighubAuth.ts` in the ConfigHub\n// monorepo, which is validated end to end against staging and prod.\n//\n// Flow (design: third-party-browser-app-auth.md §6):\n//   GET {base}/api/info                 -> discovery { AuthIssuer, TokenExchangeEndpoint }\n//   OIDC discovery on AuthIssuer        -> authorize/token/end_session endpoints\n//   PKCE authorize + code->token        -> IdP token\n//   POST {TokenExchangeEndpoint} (8693) -> minted ConfigHub token\n//\n// The minted token then rides `Authorization: Bearer` against `/api`. The flow is\n// edition-agnostic: `AuthIssuer` is whatever discovery names (ConfigHub's bundled\n// Keycloak for Cloud, the org's own IdP for Enterprise), so the same code runs\n// against both. Tokens are held by the caller; only the transient PKCE state is\n// parked in sessionStorage across the authorize redirect.\n\nexport interface Discovery {\n  AuthIssuer?: string;\n  TokenExchangeEndpoint?: string;\n  TokenExchangeAudience?: string;\n}\n\nexport interface MintedSession {\n  accessToken: string;\n  organizationId: string;\n  /** Claims of the validated IdP token (owning-org, audience, organization shape). */\n  idpClaims: Record<string, unknown>;\n  /**\n   * The IdP's ID token, kept only so logout can pass it as `id_token_hint` to the\n   * end-session endpoint. Absent for sessions that did not come from an OIDC login.\n   */\n  idToken?: string;\n}\n\nexport interface LoginOptions {\n  /**\n   * Where to land after login, as a same-origin path (`/space/x?tab=units`). Carried\n   * through the authorize round trip in the PKCE state, never in the redirect URI:\n   * OAuth clients register exact redirect URIs, so the URI itself must not vary with\n   * the page the user started from. Defaults to the current path and query.\n   */\n  returnTo?: string;\n  /**\n   * Which organization to sign in to, as the Keycloak organization alias sent in\n   * the `organization:<alias>` scope.\n   *\n   * - a string: that organization, no prompt;\n   * - `undefined` (default): the organization of the last successful login in this\n   *   browser, remembered per client in `localStorage`, so a new tab or a login after\n   *   logout lands in the same organization without a prompt; with nothing\n   *   remembered, Keycloak decides (prompt for a multi-org user, or the org matching\n   *   the email domain on a fresh authentication);\n   * - `null`: no hint on purpose, so Keycloak prompts. This is \"switch organization\".\n   */\n  organization?: string | null;\n  /**\n   * `'none'` asks the IdP to re-authenticate without any UI, failing with\n   * `login_required` if the SSO session is gone -- the way to refresh an expired\n   * ConfigHub token when the user is still signed in at the IdP. `'login'` forces the\n   * login form even with a live SSO session.\n   */\n  prompt?: 'none' | 'login';\n}\n\nexport interface FlowOptions {\n  /**\n   * Same-origin path the IdP redirects back to, and therefore the redirect URI to\n   * register for the client: `{origin}{callbackPath}`. Defaults to `/`.\n   */\n  callbackPath?: string;\n}\n\ninterface PkceState {\n  verifier: string;\n  state: string;\n  clientId: string;\n  tokenEndpoint: string;\n  exchangeEndpoint: string;\n  redirectUri: string;\n  returnTo: string;\n  silent: boolean;\n  /** The organization alias the authorize request hinted, if any. */\n  hintedOrganization?: string;\n  /** This login is already the retry after a token without an organization. */\n  retriedForOrganization?: boolean;\n}\n\n/**\n * Thrown by `completeLoginFromRedirect` when the IdP token names no organization,\n * which the exchange would refuse. Seen on a fresh brokered (Google) login, where\n * Keycloak's organization step does not run; on the next login the SSO session is\n * alive and it does, so the caller logs in again, once, with no hint. Any\n * remembered alias has already been forgotten.\n */\nexport class OrganizationMissing extends Error {\n  constructor(public readonly returnTo: string) {\n    super('the identity provider issued a token with no organization');\n    this.name = 'OrganizationMissing';\n  }\n}\n\nexport interface RetryOptions {\n  /** @internal set by the provider on the one retry after OrganizationMissing. */\n  retriedForOrganization?: boolean;\n}\n\nconst PKCE_KEY = 'confighub_pkce';\nconst LAST_ORG_KEY = 'confighub_last_org';\n\n// The alias is a short public identifier, not a credential, so localStorage is the\n// right place: it must outlive the tab, which is exactly what the token must not.\nconst lastOrgKey = (clientId: string): string => `${LAST_ORG_KEY}:${clientId}`;\n\n/** The organization alias of the last successful login for this client, if any. */\nexport function rememberedOrganization(clientId: string): string | undefined {\n  try {\n    return localStorage.getItem(lastOrgKey(clientId)) ?? undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/** @internal */\nexport function rememberOrganization(clientId: string, alias: string | undefined): void {\n  try {\n    if (alias) localStorage.setItem(lastOrgKey(clientId), alias);\n    else localStorage.removeItem(lastOrgKey(clientId));\n  } catch {\n    // Storage unavailable: the next login gets no hint.\n  }\n}\n\n/**\n * The alias in an IdP token's `organization` claim (`{ \"<alias>\": { id } }`), or\n * undefined when the claim is absent or names more than one organization.\n */\nexport function organizationAliasOf(idpClaims: Record<string, unknown>): string | undefined {\n  const org = idpClaims.organization;\n  if (!org || typeof org !== 'object') return undefined;\n  const aliases = Object.keys(org as Record<string, unknown>);\n  return aliases.length === 1 ? aliases[0] : undefined;\n}\n\nconst trimSlash = (s: string): string => s.replace(/\\/+$/, '');\n\n/** The fixed callback URI: the page origin plus the configured callback path. */\nexport const callbackUri = (opts?: FlowOptions): string =>\n  window.location.origin + (opts?.callbackPath ?? '/');\n\nconst currentPath = (): string =>\n  window.location.pathname + window.location.search + window.location.hash;\n\nconst b64url = (buf: ArrayBuffer): string =>\n  btoa(String.fromCharCode(...new Uint8Array(buf)))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '');\n\nconst randomString = (n = 64): string =>\n  b64url(crypto.getRandomValues(new Uint8Array(n)).buffer);\n\nasync function sha256(s: string): Promise<string> {\n  return b64url(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(s)));\n}\n\n/** Decode a JWT's claims without verifying it. Returns {} for anything malformed. */\nexport function decodeJwtClaims(token: string): Record<string, unknown> {\n  const part = token.split('.')[1];\n  if (!part) return {};\n  try {\n    return JSON.parse(atob(part.replace(/-/g, '+').replace(/_/g, '/')));\n  } catch {\n    return {};\n  }\n}\n\n/** Whether a JWT's `exp` is in the past (with a small skew allowance). */\nexport function isExpired(token: string, skewSeconds = 30): boolean {\n  const exp = decodeJwtClaims(token).exp;\n  if (typeof exp !== 'number') return false;\n  return exp * 1000 <= Date.now() + skewSeconds * 1000;\n}\n\nexport async function discover(base: string): Promise<Discovery> {\n  const r = await fetch(trimSlash(base) + '/api/info');\n  if (!r.ok) throw new Error('/api/info failed: ' + r.status);\n  return r.json();\n}\n\ninterface OidcMetadata {\n  authorization_endpoint: string;\n  token_endpoint: string;\n  end_session_endpoint?: string;\n}\n\nasync function oidcMetadata(issuer: string): Promise<OidcMetadata> {\n  const r = await fetch(trimSlash(issuer) + '/.well-known/openid-configuration');\n  if (!r.ok) throw new Error('OIDC discovery failed: ' + r.status);\n  return r.json();\n}\n\n/**\n * Discover, build a PKCE request, and navigate to the IdP authorize endpoint.\n * Returns only by redirecting the page; `completeLoginFromRedirect()` finishes on\n * the way back.\n */\nexport async function startLogin(\n  base: string,\n  clientId: string,\n  login: LoginOptions = {},\n  flow: FlowOptions = {},\n  retry: RetryOptions = {},\n): Promise<void> {\n  const info = await discover(base);\n  if (!info.AuthIssuer || !info.TokenExchangeEndpoint) {\n    throw new Error(\n      'this instance is not configured for token-exchange auth (server needs CONFIGHUB_IDP_ISSUER)',\n    );\n  }\n  const meta = await oidcMetadata(info.AuthIssuer);\n  const verifier = randomString();\n  const challenge = await sha256(verifier);\n  const state = randomString(16);\n  const redirectUri = callbackUri(flow);\n  // The \"organization\" scope makes Keycloak emit the org claim the exchange resolves;\n  // \"organization:<alias>\" selects one without prompting.\n  const alias =\n    login.organization === null\n      ? undefined\n      : (login.organization ?? rememberedOrganization(clientId));\n  const orgScope = alias ? `organization:${alias}` : 'organization';\n  const pkce: PkceState = {\n    verifier,\n    state,\n    clientId,\n    tokenEndpoint: meta.token_endpoint,\n    exchangeEndpoint: info.TokenExchangeEndpoint,\n    redirectUri,\n    returnTo: login.returnTo ?? currentPath(),\n    silent: login.prompt === 'none',\n    hintedOrganization: alias,\n    retriedForOrganization: retry.retriedForOrganization,\n  };\n  sessionStorage.setItem(PKCE_KEY, JSON.stringify(pkce));\n  const params: Record<string, string> = {\n    response_type: 'code',\n    client_id: clientId,\n    redirect_uri: redirectUri,\n    scope: `openid email profile ${orgScope}`,\n    code_challenge: challenge,\n    code_challenge_method: 'S256',\n    state,\n  };\n  if (login.prompt) params.prompt = login.prompt;\n\n  const authURL = new URL(meta.authorization_endpoint);\n  authURL.search = new URLSearchParams(params).toString();\n  window.location.assign(authURL.toString());\n}\n\n// Memoize so React StrictMode's double-mount can't redeem the one-time code twice.\nlet pending: Promise<MintedSession | null> | null = null;\n\n/**\n * If the page is the IdP redirect (`?code=...`), exchange the code for an IdP token\n * and then exchange that for a minted ConfigHub token, and restore the URL the\n * login started from. Returns null on a normal load, when a `prompt=none` attempt\n * came back with `login_required` (the SSO session is gone; the caller should offer\n * an interactive login), and when the redirect carries a code this tab has no PKCE\n * state for (an IdP email flow landed here; the caller should start a login).\n */\nexport function completeLoginFromRedirect(): Promise<MintedSession | null> {\n  if (!pending) pending = doCompleteLogin();\n  return pending;\n}\n\nconst SILENT_FAILURES = new Set(['login_required', 'interaction_required', 'consent_required']);\n\nasync function doCompleteLogin(): Promise<MintedSession | null> {\n  const params = new URLSearchParams(window.location.search);\n  const code = params.get('code');\n  const error = params.get('error');\n  if (!code && !error) return null;\n\n  const savedRaw = sessionStorage.getItem(PKCE_KEY);\n  sessionStorage.removeItem(PKCE_KEY);\n  const saved: PkceState | null = savedRaw ? JSON.parse(savedRaw) : null;\n\n  // Put the URL back to where the user started before anything else can fail, so\n  // neither the code nor an error string lingers in the address bar or history.\n  history.replaceState({}, '', saved?.returnTo ?? callbackUri());\n\n  if (error) {\n    if (saved?.silent && SILENT_FAILURES.has(error)) return null;\n    throw new Error(`IdP returned error: ${error} ${params.get('error_description') ?? ''}`);\n  }\n  // A code with no PKCE state means this tab did not start the login: the IdP's\n  // email flows (password reset, verify email) finish the authentication in the tab\n  // the mail link opened and redirect it here, while the verifier sits in the tab\n  // that began. The code is unusable without it, so drop it and report a normal\n  // load; the caller starts a login, which the now-live IdP session completes\n  // without a prompt.\n  if (!saved) return null;\n  if (params.get('state') !== saved.state) throw new Error('state mismatch; aborting');\n\n  // Exchange the authorization code for an IdP token (PKCE, public client).\n  const tokenResp = await fetch(saved.tokenEndpoint, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({\n      grant_type: 'authorization_code',\n      code: code!,\n      redirect_uri: saved.redirectUri,\n      client_id: saved.clientId,\n      code_verifier: saved.verifier,\n    }),\n  });\n  if (!tokenResp.ok) {\n    throw new Error(`IdP token endpoint ${tokenResp.status}: ${await tokenResp.text()}`);\n  }\n  const idpToken = await tokenResp.json();\n\n  // RFC 8693 token exchange against ConfigHub -> minted ConfigHub token.\n  const idpClaims = decodeJwtClaims(idpToken.access_token);\n  if (!organizationAliasOf(idpClaims) && !saved.retriedForOrganization) {\n    // The exchange would refuse this token. Rather than surface that, log in\n    // once more: with the SSO session now alive the IdP runs its organization\n    // step. A hint that was sent evidently did not help, so forget it.\n    if (saved.hintedOrganization) rememberOrganization(saved.clientId, undefined);\n    throw new OrganizationMissing(saved.returnTo);\n  }\n  const minted = await exchange(saved.exchangeEndpoint, idpToken.access_token);\n  rememberOrganization(saved.clientId, organizationAliasOf(idpClaims));\n  return {\n    ...minted,\n    idpClaims,\n    idToken: typeof idpToken.id_token === 'string' ? idpToken.id_token : undefined,\n  };\n}\n\nasync function exchange(\n  exchangeEndpoint: string,\n  subjectToken: string,\n): Promise<Pick<MintedSession, 'accessToken' | 'organizationId'>> {\n  const exResp = await fetch(exchangeEndpoint, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({\n      grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',\n      subject_token: subjectToken,\n      subject_token_type: 'urn:ietf:params:oauth:token-type:access_token',\n    }),\n  });\n  if (!exResp.ok) throw new Error(`/auth/exchange ${exResp.status}: ${await exResp.text()}`);\n  const minted = await exResp.json();\n  return { accessToken: minted.access_token, organizationId: minted.organization_id };\n}\n\n/**\n * Trade the current minted token for one scoped to another organization the user\n * belongs to (`POST {base}/auth/switch-organization`, bearer-authenticated). The\n * IdP session is untouched; only the ConfigHub token changes.\n */\nexport async function switchOrganization(\n  base: string,\n  accessToken: string,\n  organizationId: string,\n): Promise<Pick<MintedSession, 'accessToken' | 'organizationId'>> {\n  const r = await fetch(trimSlash(base) + '/auth/switch-organization', {\n    method: 'POST',\n    headers: {\n      Authorization: `Bearer ${accessToken}`,\n      'Content-Type': 'application/x-www-form-urlencoded',\n    },\n    body: new URLSearchParams({ organization_id: organizationId }),\n  });\n  if (!r.ok) throw new Error(`/auth/switch-organization ${r.status}: ${await r.text()}`);\n  const minted = await r.json();\n  return { accessToken: minted.access_token, organizationId: minted.organization_id };\n}\n\n/**\n * End the IdP session (RP-initiated logout) and land on `postLogoutRedirectUri`,\n * which must be registered for the client. Returns only by redirecting. If the\n * issuer publishes no end-session endpoint, navigates to the redirect URI directly.\n */\nexport async function endSession(\n  base: string,\n  clientId: string,\n  idToken: string | undefined,\n  postLogoutRedirectUri: string,\n): Promise<void> {\n  const info = await discover(base);\n  const meta = info.AuthIssuer ? await oidcMetadata(info.AuthIssuer) : undefined;\n  if (!meta?.end_session_endpoint) {\n    window.location.assign(postLogoutRedirectUri);\n    return;\n  }\n  const params: Record<string, string> = {\n    client_id: clientId,\n    post_logout_redirect_uri: postLogoutRedirectUri,\n  };\n  if (idToken) params.id_token_hint = idToken;\n  const url = new URL(meta.end_session_endpoint);\n  url.search = new URLSearchParams(params).toString();\n  window.location.assign(url.toString());\n}\n\n/** Discard the in-progress login memo (used on logout so a later login re-runs). */\nexport function resetPending(): void {\n  pending = null;\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\n// A module-level holder for the current minted token, so non-React consumers can read\n// it. RTK Query's `prepareHeaders` (in @confighub/rtk-query) is not a hook and cannot\n// read React context, so it calls getAccessToken() instead. The provider keeps this in\n// sync with its React state, and registers its 401 handling here for the same reason.\nimport { isExpired } from './core';\n\nlet currentToken: string | undefined;\nlet unauthorizedHandler: (() => void) | undefined;\n// Set while a recovery is under way, so a burst of failing requests starts one.\nlet recovering = false;\n\n/** @internal — called by the provider; not part of the public surface. */\nexport function setAccessToken(token: string | undefined): void {\n  currentToken = token;\n  if (token !== undefined) recovering = false;\n}\n\n/** @internal — the mounted provider's reaction to a rejected token. */\nexport function setUnauthorizedHandler(handler: (() => void) | undefined): void {\n  unauthorizedHandler = handler;\n  recovering = false;\n}\n\n/**\n * The current minted ConfigHub token, or undefined when unauthenticated. Pass this as\n * the `getToken` for `@confighub/rtk-query`'s `configureConfigHub`, or read it anywhere\n * you need the token outside React.\n *\n * A token past its `exp` is never handed out: the server would reject it. Instead the\n * provider's recovery starts (a silent re-authentication, or a logout, per its\n * `onUnauthorized`) and the request goes without a token; the page is about to\n * navigate to the IdP and back to where it was.\n */\nexport function getAccessToken(): string | undefined {\n  if (currentToken !== undefined && isExpired(currentToken)) {\n    handleUnauthorized();\n    return undefined;\n  }\n  return currentToken;\n}\n\n/**\n * Tell the mounted provider the API rejected the token (401). Pass this as the\n * `onUnauthorized` for `@confighub/rtk-query`'s `configureConfigHub` to recover from a\n * token rejected before its expiry, e.g. after a server key rotation; expiry itself is\n * handled by `getAccessToken`. A no-op with no provider mounted, and while a recovery\n * is already under way.\n */\nexport function handleUnauthorized(): void {\n  if (recovering || !unauthorizedHandler) return;\n  recovering = true;\n  unauthorizedHandler();\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\nimport { createConfigHubClient, type ConfigHubClient } from '@confighub/api';\nimport {\n  createContext,\n  useCallback,\n  useEffect,\n  useMemo,\n  useRef,\n  useState,\n  type ReactNode,\n} from 'react';\nimport {\n  OrganizationMissing,\n  callbackUri,\n  completeLoginFromRedirect,\n  endSession,\n  isExpired,\n  organizationAliasOf,\n  rememberOrganization,\n  resetPending,\n  startLogin,\n  switchOrganization as switchOrganizationCore,\n  type LoginOptions,\n  type MintedSession,\n} from './core';\nimport { setAccessToken, setUnauthorizedHandler } from './tokenStore';\n\nexport type AuthStatus = 'loading' | 'authenticated' | 'unauthenticated' | 'error';\n\nexport interface ConfigHubUser {\n  organizationId: string;\n  idpClaims: Record<string, unknown>;\n}\n\nexport interface LogoutOptions {\n  /**\n   * Also end the IdP session (RP-initiated logout), so the next login asks for\n   * credentials instead of riding the SSO cookie. Redirects the page; the landing\n   * URI must be registered for the client. Default: false, which only forgets the\n   * token in this tab.\n   */\n  endSession?: boolean;\n  /** Where to land after IdP logout. Defaults to the callback URI. */\n  postLogoutRedirectUri?: string;\n}\n\nexport interface ConfigHubAuthContextValue {\n  status: AuthStatus;\n  user: ConfigHubUser | null;\n  error: Error | null;\n  /** Begin login: redirects the page to the IdP. */\n  login: (options?: LoginOptions) => Promise<void>;\n  /** Forget the session in this tab and, optionally, end the IdP session too. */\n  logout: (options?: LogoutOptions) => Promise<void>;\n  /**\n   * Re-mint the ConfigHub token for another organization the user belongs to. The\n   * IdP session is untouched. Rejects with the server's error if the user is not a\n   * member; the current session stays as it was.\n   */\n  switchOrganization: (organizationId: string) => Promise<void>;\n  /**\n   * The ConfigHub token stopped working (a 401). Try to get a new one without any\n   * UI: a `prompt=none` round trip through the IdP, for the organization the session\n   * already had. Status goes to `loading` meanwhile, not `unauthenticated`, so an\n   * app that auto-logs-in on `unauthenticated` does not race this with an\n   * interactive login. If the IdP session is gone too, the page comes back\n   * `unauthenticated`. Redirects the page.\n   */\n  reauthenticate: () => Promise<void>;\n  /** Current bearer token, or undefined when unauthenticated. */\n  getToken: () => string | undefined;\n  /** A typed API client pre-wired with the current token. Stable across renders. */\n  client: ConfigHubClient;\n}\n\nexport const ConfigHubAuthContext = createContext<ConfigHubAuthContextValue | null>(null);\n\nexport interface ConfigHubAuthProviderProps {\n  /** Absolute base URL of the ConfigHub instance, e.g. `https://hub.confighub.com`. */\n  baseUrl: string;\n  /** This app's registered OAuth `client_id` (from `cub oauthclient create`). */\n  clientId: string;\n  /**\n   * Same-origin path the IdP redirects back to; `{origin}{callbackPath}` is the\n   * redirect URI to register. Defaults to `/`. Fixed on purpose: the page a user\n   * starts login from travels in the PKCE state, not in the redirect URI.\n   */\n  callbackPath?: string;\n  /**\n   * `'session'` (default) keeps the minted token in `sessionStorage` so a reload or an\n   * in-tab navigation does not round-trip through the IdP. Tab-scoped and gone when the\n   * tab closes. `'none'`: memory only, every page load starts unauthenticated.\n   */\n  persist?: 'none' | 'session';\n  /**\n   * What a 401 from the API means. `'login'` (default): the token is stale, try a\n   * silent re-authentication (`prompt=none`) and fall back to unauthenticated if the\n   * IdP session is gone too. `'logout'`: just drop the session.\n   */\n  onUnauthorized?: 'login' | 'logout';\n  children: ReactNode;\n}\n\nconst SESSION_KEY = 'confighub_session';\n\nfunction readPersisted(): MintedSession | null {\n  try {\n    const raw = sessionStorage.getItem(SESSION_KEY);\n    if (!raw) return null;\n    const session: MintedSession = JSON.parse(raw);\n    if (!session.accessToken || isExpired(session.accessToken)) {\n      sessionStorage.removeItem(SESSION_KEY);\n      return null;\n    }\n    return session;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Runs the browser-direct auth flow and manages the token lifecycle. On mount it\n * completes a redirect if the page is the IdP callback, restores a persisted\n * session if there is one, and otherwise starts unauthenticated until `login()`\n * is called.\n */\nexport function ConfigHubAuthProvider({\n  baseUrl,\n  clientId,\n  callbackPath,\n  persist = 'session',\n  onUnauthorized = 'login',\n  children,\n}: ConfigHubAuthProviderProps): JSX.Element {\n  const [status, setStatus] = useState<AuthStatus>('loading');\n  const [user, setUser] = useState<ConfigHubUser | null>(null);\n  const [error, setError] = useState<Error | null>(null);\n\n  // The session lives in a ref so getToken() reads the latest value synchronously\n  // without re-creating the API client on every render.\n  const sessionRef = useRef<MintedSession | undefined>(undefined);\n  const flow = useMemo(() => ({ callbackPath }), [callbackPath]);\n\n  const persistSession = useCallback(\n    (session: MintedSession | undefined) => {\n      if (persist !== 'session') return;\n      try {\n        if (session) sessionStorage.setItem(SESSION_KEY, JSON.stringify(session));\n        else sessionStorage.removeItem(SESSION_KEY);\n      } catch {\n        // Storage unavailable (private mode, quota): memory-only for this tab.\n      }\n    },\n    [persist],\n  );\n\n  const applySession = useCallback(\n    (session: MintedSession) => {\n      sessionRef.current = session;\n      setAccessToken(session.accessToken); // keep the non-React accessor in sync (rtk-query)\n      persistSession(session);\n      setUser({ organizationId: session.organizationId, idpClaims: session.idpClaims });\n      setError(null);\n      setStatus('authenticated');\n    },\n    [persistSession],\n  );\n\n  const clearSession = useCallback(() => {\n    sessionRef.current = undefined;\n    setAccessToken(undefined);\n    persistSession(undefined);\n    resetPending();\n    setUser(null);\n    setStatus('unauthenticated');\n  }, [persistSession]);\n\n  useEffect(() => {\n    let cancelled = false;\n    completeLoginFromRedirect()\n      .then((session) => {\n        if (cancelled) return;\n        if (session) return applySession(session);\n        const persisted = persist === 'session' ? readPersisted() : null;\n        if (persisted) return applySession(persisted);\n        setStatus('unauthenticated');\n      })\n      .catch((e: unknown) => {\n        if (cancelled) return;\n        if (e instanceof OrganizationMissing) {\n          // Once, with no hint, flagged so a second miss surfaces as an error.\n          void startLogin(\n            baseUrl,\n            clientId,\n            { returnTo: e.returnTo, organization: null },\n            flow,\n            { retriedForOrganization: true },\n          );\n          return;\n        }\n        setError(e instanceof Error ? e : new Error(String(e)));\n        setStatus('error');\n      });\n    return () => {\n      cancelled = true;\n    };\n  }, [applySession, persist, baseUrl, clientId, flow]);\n\n  const login = useCallback(\n    async (options?: LoginOptions) => {\n      setError(null);\n      try {\n        await startLogin(baseUrl, clientId, options, flow);\n      } catch (e: unknown) {\n        setError(e instanceof Error ? e : new Error(String(e)));\n        setStatus('error');\n      }\n    },\n    [baseUrl, clientId, flow],\n  );\n\n  const logout = useCallback(\n    async (options?: LogoutOptions) => {\n      const idToken = sessionRef.current?.idToken;\n      clearSession();\n      if (options?.endSession) {\n        await endSession(\n          baseUrl,\n          clientId,\n          idToken,\n          options.postLogoutRedirectUri ?? callbackUri(flow),\n        );\n      }\n    },\n    [baseUrl, clientId, clearSession, flow],\n  );\n\n  const switchOrganization = useCallback(\n    async (organizationId: string) => {\n      const current = sessionRef.current;\n      if (!current) throw new Error('not authenticated');\n      const minted = await switchOrganizationCore(baseUrl, current.accessToken, organizationId);\n      // The session's IdP claims still name the previous org, so its alias must not\n      // be remembered as the default for the next login.\n      rememberOrganization(clientId, undefined);\n      applySession({ ...current, ...minted });\n    },\n    [applySession, baseUrl, clientId],\n  );\n\n  const getToken = useCallback(() => sessionRef.current?.accessToken, []);\n\n  const reauthenticate = useCallback(async () => {\n    const organization = organizationAliasOf(sessionRef.current?.idpClaims ?? {});\n    // Forget the token but stay 'loading': the page is about to navigate away,\n    // and 'unauthenticated' would invite an interactive login in the meantime.\n    sessionRef.current = undefined;\n    setAccessToken(undefined);\n    persistSession(undefined);\n    resetPending();\n    setStatus('loading');\n    try {\n      await startLogin(baseUrl, clientId, { prompt: 'none', organization }, flow);\n    } catch (e: unknown) {\n      setError(e instanceof Error ? e : new Error(String(e)));\n      setStatus('error');\n    }\n  }, [baseUrl, clientId, flow, persistSession]);\n\n  // A 401 means the minted token no longer works. Silent re-auth keeps the user's\n  // place if the IdP session is still alive; otherwise the page comes back\n  // unauthenticated and the app offers a real login.\n  const handleUnauthorized = useCallback(() => {\n    if (!sessionRef.current) return;\n    if (onUnauthorized === 'login') void reauthenticate();\n    else clearSession();\n  }, [clearSession, reauthenticate, onUnauthorized]);\n\n  // Non-React callers (getAccessToken on an expired token, handleUnauthorized from a\n  // data client's 401) reach this provider's handling through the token store.\n  useEffect(() => {\n    setUnauthorizedHandler(handleUnauthorized);\n    return () => setUnauthorizedHandler(undefined);\n  }, [handleUnauthorized]);\n\n  // One client for the provider's lifetime. getToken reads the session ref.\n  const client = useMemo(\n    () => createConfigHubClient({ baseUrl, getToken, onUnauthorized: handleUnauthorized }),\n    [baseUrl, getToken, handleUnauthorized],\n  );\n\n  const value = useMemo<ConfigHubAuthContextValue>(\n    () => ({\n      status,\n      user,\n      error,\n      login,\n      logout,\n      switchOrganization,\n      reauthenticate,\n      getToken,\n      client,\n    }),\n    [status, user, error, login, logout, switchOrganization, reauthenticate, getToken, client],\n  );\n\n  return (\n    <ConfigHubAuthContext.Provider value={value}>{children}</ConfigHubAuthContext.Provider>\n  );\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\nimport type { ConfigHubClient } from '@confighub/api';\nimport { useContext } from 'react';\nimport { ConfigHubAuthContext, type ConfigHubAuthContextValue } from './provider';\n\n/**\n * Access the ConfigHub auth state and actions. Must be called under a\n * `<ConfigHubAuthProvider>`.\n *\n * ```ts\n * const { status, user, login, logout } = useAuth();\n * ```\n */\nexport function useAuth(): ConfigHubAuthContextValue {\n  const ctx = useContext(ConfigHubAuthContext);\n  if (!ctx) {\n    throw new Error('useAuth must be used within a <ConfigHubAuthProvider>');\n  }\n  return ctx;\n}\n\n/**\n * The typed ConfigHub API client, pre-wired with the current token. This is the\n * seam between `@confighub/react-auth` and `@confighub/api`: you never pass a\n * token by hand.\n *\n * ```ts\n * const api = useConfigHub();\n * const { data } = await api.GET('/space/{space_id}/unit', { params: { path: { space_id } } });\n * ```\n */\nexport function useConfigHub(): ConfigHubClient {\n  return useAuth().client;\n}\n"]}
+{"version":3,"sources":["../src/core.ts","../src/tokenStore.ts","../src/provider.tsx","../src/hooks.ts"],"names":["handleUnauthorized"],"mappings":";;;;;;;AAoGO,IAAM,mBAAA,GAAN,cAAkC,KAAA,CAAM;AAAA,EAC7C,YAA4B,QAAA,EAAkB;AAC5C,IAAA,KAAA,CAAM,2DAA2D,CAAA;AADvC,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAE1B,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AAAA,EACd;AACF;AAOO,IAAM,kBAAA,GAAN,cAAiC,KAAA,CAAM;AAAA,EAC5C,WAAA,GAAc;AACZ,IAAA,KAAA,CAAM,iFAAiF,CAAA;AACvF,IAAA,IAAA,CAAK,IAAA,GAAO,oBAAA;AAAA,EACd;AACF;AAOA,IAAM,QAAA,GAAW,gBAAA;AACjB,IAAM,YAAA,GAAe,oBAAA;AAIrB,IAAM,aAAa,CAAC,QAAA,KAA6B,CAAA,EAAG,YAAY,IAAI,QAAQ,CAAA,CAAA;AAGrE,SAAS,uBAAuB,QAAA,EAAsC;AAC3E,EAAA,IAAI;AACF,IAAA,OAAO,YAAA,CAAa,OAAA,CAAQ,UAAA,CAAW,QAAQ,CAAC,CAAA,IAAK,KAAA,CAAA;AAAA,EACvD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAGO,SAAS,oBAAA,CAAqB,UAAkB,KAAA,EAAiC;AACtF,EAAA,IAAI;AACF,IAAA,IAAI,OAAO,YAAA,CAAa,OAAA,CAAQ,UAAA,CAAW,QAAQ,GAAG,KAAK,CAAA;AAAA,SACtD,YAAA,CAAa,UAAA,CAAW,UAAA,CAAW,QAAQ,CAAC,CAAA;AAAA,EACnD,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAMO,SAAS,oBAAoB,SAAA,EAAwD;AAC1F,EAAA,MAAM,MAAM,SAAA,CAAU,YAAA;AACtB,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,KAAQ,UAAU,OAAO,MAAA;AAC5C,EAAA,MAAM,OAAA,GAAU,MAAA,CAAO,IAAA,CAAK,GAA8B,CAAA;AAC1D,EAAA,OAAO,OAAA,CAAQ,MAAA,KAAW,CAAA,GAAI,OAAA,CAAQ,CAAC,CAAA,GAAI,MAAA;AAC7C;AAEA,IAAM,YAAY,CAAC,CAAA,KAAsB,CAAA,CAAE,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAGtD,IAAM,cAAc,CAAC,IAAA,KAC1B,OAAO,QAAA,CAAS,MAAA,IAAU,MAAM,YAAA,IAAgB,GAAA;AAElD,IAAM,WAAA,GAAc,MAClB,MAAA,CAAO,QAAA,CAAS,WAAW,MAAA,CAAO,QAAA,CAAS,MAAA,GAAS,MAAA,CAAO,QAAA,CAAS,IAAA;AAEtE,IAAM,MAAA,GAAS,CAAC,GAAA,KACd,IAAA,CAAK,OAAO,YAAA,CAAa,GAAG,IAAI,UAAA,CAAW,GAAG,CAAC,CAAC,CAAA,CAC7C,OAAA,CAAQ,KAAA,EAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,OAAO,GAAG,CAAA,CAClB,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAEtB,IAAM,YAAA,GAAe,CAAC,CAAA,GAAI,EAAA,KACxB,MAAA,CAAO,MAAA,CAAO,eAAA,CAAgB,IAAI,UAAA,CAAW,CAAC,CAAC,CAAA,CAAE,MAAM,CAAA;AAEzD,eAAe,OAAO,CAAA,EAA4B;AAChD,EAAA,OAAO,MAAA,CAAO,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AAClF;AAGO,SAAS,gBAAgB,KAAA,EAAwC;AACtE,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,KAAA,CAAM,GAAG,EAAE,CAAC,CAAA;AAC/B,EAAA,IAAI,CAAC,IAAA,EAAM,OAAO,EAAC;AACnB,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,IAAA,CAAK,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAA,CAAE,OAAA,CAAQ,IAAA,EAAM,GAAG,CAAC,CAAC,CAAA;AAAA,EACpE,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACF;AAGO,SAAS,SAAA,CAAU,KAAA,EAAe,WAAA,GAAc,EAAA,EAAa;AAClE,EAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,KAAK,CAAA,CAAE,GAAA;AACnC,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,KAAA;AACpC,EAAA,OAAO,GAAA,GAAM,GAAA,IAAQ,IAAA,CAAK,GAAA,KAAQ,WAAA,GAAc,GAAA;AAClD;AAEA,eAAsB,SAAS,IAAA,EAAkC;AAC/D,EAAA,MAAM,IAAI,MAAM,KAAA,CAAM,SAAA,CAAU,IAAI,IAAI,WAAW,CAAA;AACnD,EAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,oBAAA,GAAuB,EAAE,MAAM,CAAA;AAC1D,EAAA,OAAO,EAAE,IAAA,EAAK;AAChB;AAQA,eAAe,aAAa,MAAA,EAAuC;AACjE,EAAA,MAAM,IAAI,MAAM,KAAA,CAAM,SAAA,CAAU,MAAM,IAAI,mCAAmC,CAAA;AAC7E,EAAA,IAAI,CAAC,EAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,yBAAA,GAA4B,EAAE,MAAM,CAAA;AAC/D,EAAA,OAAO,EAAE,IAAA,EAAK;AAChB;AAOA,eAAsB,UAAA,CACpB,IAAA,EACA,QAAA,EACA,KAAA,GAAsB,EAAC,EACvB,IAAA,GAAoB,EAAC,EACrB,KAAA,GAAsB,EAAC,EACR;AACf,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAI,CAAA;AAChC,EAAA,IAAI,CAAC,KAAK,UAAA,IAAc,CAAC,KAAK,qBAAA,EAAuB,MAAM,IAAI,kBAAA,EAAmB;AAClF,EAAA,IAAI,CAAC,IAAA,CAAK,UAAA,IAAc,CAAC,KAAK,qBAAA,EAAuB;AACnD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,IAAA,GAAO,MAAM,YAAA,CAAa,IAAA,CAAK,UAAU,CAAA;AAC/C,EAAA,MAAM,WAAW,YAAA,EAAa;AAC9B,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,QAAQ,CAAA;AACvC,EAAA,MAAM,KAAA,GAAQ,aAAa,EAAE,CAAA;AAC7B,EAAA,MAAM,WAAA,GAAc,YAAY,IAAI,CAAA;AAGpC,EAAA,MAAM,KAAA,GACJ,MAAM,YAAA,KAAiB,IAAA,GACnB,SACC,KAAA,CAAM,YAAA,IAAgB,uBAAuB,QAAQ,CAAA;AAC5D,EAAA,MAAM,QAAA,GAAW,KAAA,GAAQ,CAAA,aAAA,EAAgB,KAAK,CAAA,CAAA,GAAK,cAAA;AACnD,EAAA,MAAM,IAAA,GAAkB;AAAA,IACtB,QAAA;AAAA,IACA,KAAA;AAAA,IACA,QAAA;AAAA,IACA,eAAe,IAAA,CAAK,cAAA;AAAA,IACpB,kBAAkB,IAAA,CAAK,qBAAA;AAAA,IACvB,WAAA;AAAA,IACA,QAAA,EAAU,KAAA,CAAM,QAAA,IAAY,WAAA,EAAY;AAAA,IACxC,MAAA,EAAQ,MAAM,MAAA,KAAW,MAAA;AAAA,IACzB,kBAAA,EAAoB,KAAA;AAAA,IACpB,wBAAwB,KAAA,CAAM;AAAA,GAChC;AACA,EAAA,cAAA,CAAe,OAAA,CAAQ,QAAA,EAAU,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AACrD,EAAA,MAAM,MAAA,GAAiC;AAAA,IACrC,aAAA,EAAe,MAAA;AAAA,IACf,SAAA,EAAW,QAAA;AAAA,IACX,YAAA,EAAc,WAAA;AAAA,IACd,KAAA,EAAO,wBAAwB,QAAQ,CAAA,CAAA;AAAA,IACvC,cAAA,EAAgB,SAAA;AAAA,IAChB,qBAAA,EAAuB,MAAA;AAAA,IACvB;AAAA,GACF;AACA,EAAA,IAAI,KAAA,CAAM,MAAA,EAAQ,MAAA,CAAO,MAAA,GAAS,KAAA,CAAM,MAAA;AAExC,EAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,IAAA,CAAK,sBAAsB,CAAA;AACnD,EAAA,OAAA,CAAQ,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAM,EAAE,QAAA,EAAS;AACtD,EAAA,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,OAAA,CAAQ,QAAA,EAAU,CAAA;AAC3C;AAGA,IAAI,OAAA,GAAgD,IAAA;AAU7C,SAAS,yBAAA,GAA2D;AACzE,EAAA,IAAI,CAAC,OAAA,EAAS,OAAA,GAAU,eAAA,EAAgB;AACxC,EAAA,OAAO,OAAA;AACT;AAEA,IAAM,kCAAkB,IAAI,GAAA,CAAI,CAAC,gBAAA,EAAkB,sBAAA,EAAwB,kBAAkB,CAAC,CAAA;AAE9F,eAAe,eAAA,GAAiD;AAC9D,EAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAA,CAAO,SAAS,MAAM,CAAA;AACzD,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,GAAA,CAAI,MAAM,CAAA;AAC9B,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,GAAA,CAAI,OAAO,CAAA;AAChC,EAAA,IAAI,CAAC,IAAA,IAAQ,CAAC,KAAA,EAAO,OAAO,IAAA;AAE5B,EAAA,MAAM,QAAA,GAAW,cAAA,CAAe,OAAA,CAAQ,QAAQ,CAAA;AAChD,EAAA,cAAA,CAAe,WAAW,QAAQ,CAAA;AAClC,EAAA,MAAM,KAAA,GAA0B,QAAA,GAAW,IAAA,CAAK,KAAA,CAAM,QAAQ,CAAA,GAAI,IAAA;AAIlE,EAAA,OAAA,CAAQ,aAAa,EAAC,EAAG,IAAI,KAAA,EAAO,QAAA,IAAY,aAAa,CAAA;AAE7D,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,IAAI,OAAO,MAAA,IAAU,eAAA,CAAgB,GAAA,CAAI,KAAK,GAAG,OAAO,IAAA;AACxD,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,KAAK,CAAA,CAAA,EAAI,OAAO,GAAA,CAAI,mBAAmB,CAAA,IAAK,EAAE,CAAA,CAAE,CAAA;AAAA,EACzF;AAOA,EAAA,IAAI,CAAC,OAAO,OAAO,IAAA;AACnB,EAAA,IAAI,MAAA,CAAO,IAAI,OAAO,CAAA,KAAM,MAAM,KAAA,EAAO,MAAM,IAAI,KAAA,CAAM,0BAA0B,CAAA;AAGnF,EAAA,MAAM,SAAA,GAAY,MAAM,KAAA,CAAM,KAAA,CAAM,aAAA,EAAe;AAAA,IACjD,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,oBAAA;AAAA,MACZ,IAAA;AAAA,MACA,cAAc,KAAA,CAAM,WAAA;AAAA,MACpB,WAAW,KAAA,CAAM,QAAA;AAAA,MACjB,eAAe,KAAA,CAAM;AAAA,KACtB;AAAA,GACF,CAAA;AACD,EAAA,IAAI,CAAC,UAAU,EAAA,EAAI;AACjB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,SAAA,CAAU,MAAM,KAAK,MAAM,SAAA,CAAU,IAAA,EAAM,CAAA,CAAE,CAAA;AAAA,EACrF;AACA,EAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,IAAA,EAAK;AAGtC,EAAA,MAAM,SAAA,GAAY,eAAA,CAAgB,QAAA,CAAS,YAAY,CAAA;AACvD,EAAA,IAAI,CAAC,mBAAA,CAAoB,SAAS,CAAA,IAAK,CAAC,MAAM,sBAAA,EAAwB;AAIpE,IAAA,IAAI,KAAA,CAAM,kBAAA,EAAoB,oBAAA,CAAqB,KAAA,CAAM,UAAU,MAAS,CAAA;AAC5E,IAAA,MAAM,IAAI,mBAAA,CAAoB,KAAA,CAAM,QAAQ,CAAA;AAAA,EAC9C;AACA,EAAA,MAAM,SAAS,MAAM,QAAA,CAAS,KAAA,CAAM,gBAAA,EAAkB,SAAS,YAAY,CAAA;AAC3E,EAAA,oBAAA,CAAqB,KAAA,CAAM,QAAA,EAAU,mBAAA,CAAoB,SAAS,CAAC,CAAA;AACnE,EAAA,OAAO;AAAA,IACL,GAAG,MAAA;AAAA,IACH,SAAA;AAAA,IACA,SAAS,OAAO,QAAA,CAAS,QAAA,KAAa,QAAA,GAAW,SAAS,QAAA,GAAW;AAAA,GACvE;AACF;AAEA,eAAe,QAAA,CACb,kBACA,YAAA,EACgE;AAChE,EAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,gBAAA,EAAkB;AAAA,IAC3C,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,MACxB,UAAA,EAAY,iDAAA;AAAA,MACZ,aAAA,EAAe,YAAA;AAAA,MACf,kBAAA,EAAoB;AAAA,KACrB;AAAA,GACF,CAAA;AACD,EAAA,IAAI,CAAC,MAAA,CAAO,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,MAAA,CAAO,MAAM,CAAA,EAAA,EAAK,MAAM,MAAA,CAAO,IAAA,EAAM,CAAA,CAAE,CAAA;AACzF,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,EAAK;AACjC,EAAA,OAAO,EAAE,WAAA,EAAa,MAAA,CAAO,YAAA,EAAc,cAAA,EAAgB,OAAO,eAAA,EAAgB;AACpF;AASA,eAAsB,mBAAA,CAAoB,MAAc,MAAA,EAAwC;AAC9F,EAAA,MAAM,IAAI,MAAM,KAAA,CAAM,SAAA,CAAU,IAAI,IAAI,uBAAA,EAAyB;AAAA,IAC/D,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB,EAAE,QAAQ;AAAA,GACrC,CAAA;AACD,EAAA,IAAI,CAAC,CAAA,CAAE,EAAA,EAAI,MAAM,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,CAAA,CAAE,MAAM,CAAA,EAAA,EAAK,MAAM,CAAA,CAAE,IAAA,EAAM,CAAA,CAAE,CAAA;AACjF,EAAA,MAAM,MAAA,GAAS,MAAM,CAAA,CAAE,IAAA,EAAK;AAC5B,EAAA,OAAO,EAAE,aAAa,MAAA,CAAO,YAAA,EAAc,gBAAgB,MAAA,CAAO,eAAA,EAAiB,SAAA,EAAW,EAAC,EAAE;AACnG;AAOA,eAAsB,UAAA,CACpB,IAAA,EACA,QAAA,EACA,OAAA,EACA,qBAAA,EACe;AACf,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAI,CAAA;AAChC,EAAA,MAAM,OAAO,IAAA,CAAK,UAAA,GAAa,MAAM,YAAA,CAAa,IAAA,CAAK,UAAU,CAAA,GAAI,MAAA;AACrE,EAAA,IAAI,CAAC,MAAM,oBAAA,EAAsB;AAC/B,IAAA,MAAA,CAAO,QAAA,CAAS,OAAO,qBAAqB,CAAA;AAC5C,IAAA;AAAA,EACF;AACA,EAAA,MAAM,MAAA,GAAiC;AAAA,IACrC,SAAA,EAAW,QAAA;AAAA,IACX,wBAAA,EAA0B;AAAA,GAC5B;AACA,EAAA,IAAI,OAAA,SAAgB,aAAA,GAAgB,OAAA;AACpC,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,IAAA,CAAK,oBAAoB,CAAA;AAC7C,EAAA,GAAA,CAAI,MAAA,GAAS,IAAI,eAAA,CAAgB,MAAM,EAAE,QAAA,EAAS;AAClD,EAAA,MAAA,CAAO,QAAA,CAAS,MAAA,CAAO,GAAA,CAAI,QAAA,EAAU,CAAA;AACvC;AAGO,SAAS,YAAA,GAAqB;AACnC,EAAA,OAAA,GAAU,IAAA;AACZ;;;AChaA,IAAI,YAAA;AACJ,IAAI,mBAAA;AAEJ,IAAI,UAAA,GAAa,KAAA;AAGV,SAAS,eAAe,KAAA,EAAiC;AAC9D,EAAA,YAAA,GAAe,KAAA;AACf,EAAA,IAAI,KAAA,KAAU,QAAW,UAAA,GAAa,KAAA;AACxC;AAGO,SAAS,uBAAuB,OAAA,EAAyC;AAC9E,EAAA,mBAAA,GAAsB,OAAA;AACtB,EAAA,UAAA,GAAa,KAAA;AACf;AAYO,SAAS,cAAA,GAAqC;AACnD,EAAA,IAAI,YAAA,KAAiB,MAAA,IAAa,SAAA,CAAU,YAAY,CAAA,EAAG;AACzD,IAAA,kBAAA,EAAmB;AACnB,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,YAAA;AACT;AASO,SAAS,kBAAA,GAA2B;AACzC,EAAA,IAAI,UAAA,IAAc,CAAC,mBAAA,EAAqB;AACxC,EAAA,UAAA,GAAa,IAAA;AACb,EAAA,mBAAA,EAAoB;AACtB;ACsBO,IAAM,oBAAA,GAAuB,cAAgD,IAAI;AA4BxF,IAAM,WAAA,GAAc,mBAAA;AAEpB,SAAS,aAAA,GAAsC;AAC7C,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,cAAA,CAAe,OAAA,CAAQ,WAAW,CAAA;AAC9C,IAAA,IAAI,CAAC,KAAK,OAAO,IAAA;AACjB,IAAA,MAAM,OAAA,GAAyB,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7C,IAAA,IAAI,CAAC,OAAA,CAAQ,WAAA,IAAe,SAAA,CAAU,OAAA,CAAQ,WAAW,CAAA,EAAG;AAC1D,MAAA,cAAA,CAAe,WAAW,WAAW,CAAA;AACrC,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,OAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAQO,SAAS,qBAAA,CAAsB;AAAA,EACpC,OAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,OAAA,GAAU,SAAA;AAAA,EACV,cAAA,GAAiB,OAAA;AAAA,EACjB;AACF,CAAA,EAA4C;AAC1C,EAAA,MAAM,CAAC,MAAA,EAAQ,SAAS,CAAA,GAAI,SAAqB,SAAS,CAAA;AAC1D,EAAA,MAAM,CAAC,IAAA,EAAM,OAAO,CAAA,GAAI,SAA+B,IAAI,CAAA;AAC3D,EAAA,MAAM,CAAC,KAAA,EAAO,QAAQ,CAAA,GAAI,SAAuB,IAAI,CAAA;AAIrD,EAAA,MAAM,UAAA,GAAa,OAAkC,MAAS,CAAA;AAC9D,EAAA,MAAM,IAAA,GAAO,QAAQ,OAAO,EAAE,cAAa,CAAA,EAAI,CAAC,YAAY,CAAC,CAAA;AAE7D,EAAA,MAAM,cAAA,GAAiB,WAAA;AAAA,IACrB,CAAC,OAAA,KAAuC;AACtC,MAAA,IAAI,YAAY,SAAA,EAAW;AAC3B,MAAA,IAAI;AACF,QAAA,IAAI,SAAS,cAAA,CAAe,OAAA,CAAQ,aAAa,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAAA,aACnE,cAAA,CAAe,WAAW,WAAW,CAAA;AAAA,MAC5C,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF,CAAA;AAAA,IACA,CAAC,OAAO;AAAA,GACV;AAEA,EAAA,MAAM,YAAA,GAAe,WAAA;AAAA,IACnB,CAAC,OAAA,KAA2B;AAC1B,MAAA,UAAA,CAAW,OAAA,GAAU,OAAA;AACrB,MAAA,cAAA,CAAe,QAAQ,WAAW,CAAA;AAClC,MAAA,cAAA,CAAe,OAAO,CAAA;AACtB,MAAA,OAAA,CAAQ,EAAE,cAAA,EAAgB,OAAA,CAAQ,gBAAgB,SAAA,EAAW,OAAA,CAAQ,WAAW,CAAA;AAChF,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,SAAA,CAAU,eAAe,CAAA;AAAA,IAC3B,CAAA;AAAA,IACA,CAAC,cAAc;AAAA,GACjB;AAEA,EAAA,MAAM,YAAA,GAAe,YAAY,MAAM;AACrC,IAAA,UAAA,CAAW,OAAA,GAAU,MAAA;AACrB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,YAAA,EAAa;AACb,IAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,IAAA,SAAA,CAAU,iBAAiB,CAAA;AAAA,EAC7B,CAAA,EAAG,CAAC,cAAc,CAAC,CAAA;AAEnB,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,IAAI,SAAA,GAAY,KAAA;AAChB,IAAA,yBAAA,EAA0B,CACvB,IAAA,CAAK,CAAC,OAAA,KAAY;AACjB,MAAA,IAAI,SAAA,EAAW;AACf,MAAA,IAAI,OAAA,EAAS,OAAO,YAAA,CAAa,OAAO,CAAA;AACxC,MAAA,MAAM,SAAA,GAAY,OAAA,KAAY,SAAA,GAAY,aAAA,EAAc,GAAI,IAAA;AAC5D,MAAA,IAAI,SAAA,EAAW,OAAO,YAAA,CAAa,SAAS,CAAA;AAC5C,MAAA,SAAA,CAAU,iBAAiB,CAAA;AAAA,IAC7B,CAAC,CAAA,CACA,KAAA,CAAM,CAAC,CAAA,KAAe;AACrB,MAAA,IAAI,SAAA,EAAW;AACf,MAAA,IAAI,aAAa,mBAAA,EAAqB;AAEpC,QAAA,KAAK,UAAA;AAAA,UACH,OAAA;AAAA,UACA,QAAA;AAAA,UACA,EAAE,QAAA,EAAU,CAAA,CAAE,QAAA,EAAU,cAAc,IAAA,EAAK;AAAA,UAC3C,IAAA;AAAA,UACA,EAAE,wBAAwB,IAAA;AAAK,SACjC;AACA,QAAA;AAAA,MACF;AACA,MAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,MAAA,SAAA,CAAU,OAAO,CAAA;AAAA,IACnB,CAAC,CAAA;AACH,IAAA,OAAO,MAAM;AACX,MAAA,SAAA,GAAY,IAAA;AAAA,IACd,CAAA;AAAA,EACF,GAAG,CAAC,YAAA,EAAc,SAAS,OAAA,EAAS,QAAA,EAAU,IAAI,CAAC,CAAA;AAEnD,EAAA,MAAM,KAAA,GAAQ,WAAA;AAAA,IACZ,OAAO,OAAA,KAA2B;AAChC,MAAA,QAAA,CAAS,IAAI,CAAA;AACb,MAAA,IAAI;AACF,QAAA,MAAM,UAAA,CAAW,OAAA,EAAS,QAAA,EAAU,OAAA,EAAS,IAAI,CAAA;AAAA,MACnD,SAAS,CAAA,EAAY;AACnB,QAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,QAAA,SAAA,CAAU,OAAO,CAAA;AAAA,MACnB;AAAA,IACF,CAAA;AAAA,IACA,CAAC,OAAA,EAAS,QAAA,EAAU,IAAI;AAAA,GAC1B;AAEA,EAAA,MAAM,MAAA,GAAS,WAAA;AAAA,IACb,OAAO,OAAA,KAA4B;AACjC,MAAA,MAAM,OAAA,GAAU,WAAW,OAAA,EAAS,OAAA;AACpC,MAAA,IAAI,CAAC,SAAS,UAAA,EAAY;AACxB,QAAA,YAAA,EAAa;AACb,QAAA;AAAA,MACF;AAKA,MAAA,UAAA,CAAW,OAAA,GAAU,MAAA;AACrB,MAAA,cAAA,CAAe,MAAS,CAAA;AACxB,MAAA,cAAA,CAAe,MAAS,CAAA;AACxB,MAAA,YAAA,EAAa;AACb,MAAA,OAAA,CAAQ,IAAI,CAAA;AACZ,MAAA,SAAA,CAAU,SAAS,CAAA;AACnB,MAAA,IAAI;AACF,QAAA,MAAM,UAAA;AAAA,UACJ,OAAA;AAAA,UACA,QAAA;AAAA,UACA,OAAA;AAAA,UACA,OAAA,CAAQ,qBAAA,IAAyB,WAAA,CAAY,IAAI;AAAA,SACnD;AAAA,MACF,SAAS,CAAA,EAAY;AAEnB,QAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,QAAA,SAAA,CAAU,OAAO,CAAA;AAAA,MACnB;AAAA,IACF,CAAA;AAAA,IACA,CAAC,OAAA,EAAS,QAAA,EAAU,YAAA,EAAc,MAAM,cAAc;AAAA,GACxD;AAEA,EAAA,MAAM,WAAW,WAAA,CAAY,MAAM,WAAW,OAAA,EAAS,WAAA,EAAa,EAAE,CAAA;AAEtE,EAAA,MAAM,cAAA,GAAiB,YAAY,YAAY;AAC7C,IAAA,MAAM,eAAe,mBAAA,CAAoB,UAAA,CAAW,OAAA,EAAS,SAAA,IAAa,EAAE,CAAA;AAG5E,IAAA,UAAA,CAAW,OAAA,GAAU,MAAA;AACrB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,cAAA,CAAe,MAAS,CAAA;AACxB,IAAA,YAAA,EAAa;AACb,IAAA,SAAA,CAAU,SAAS,CAAA;AACnB,IAAA,IAAI;AACF,MAAA,MAAM,UAAA,CAAW,SAAS,QAAA,EAAU,EAAE,QAAQ,MAAA,EAAQ,YAAA,IAAgB,IAAI,CAAA;AAAA,IAC5E,SAAS,CAAA,EAAY;AAEnB,MAAA,IAAI,aAAa,kBAAA,EAAoB;AACnC,QAAA,SAAA,CAAU,iBAAiB,CAAA;AAC3B,QAAA;AAAA,MACF;AACA,MAAA,QAAA,CAAS,CAAA,YAAa,QAAQ,CAAA,GAAI,IAAI,MAAM,MAAA,CAAO,CAAC,CAAC,CAAC,CAAA;AACtD,MAAA,SAAA,CAAU,OAAO,CAAA;AAAA,IACnB;AAAA,EACF,GAAG,CAAC,OAAA,EAAS,QAAA,EAAU,IAAA,EAAM,cAAc,CAAC,CAAA;AAE5C,EAAA,MAAM,gBAAA,GAAmB,WAAA;AAAA,IACvB,OAAO,MAAA,KAAmB;AACxB,MAAA,YAAA,CAAa,MAAM,mBAAA,CAAoB,OAAA,EAAS,MAAM,CAAC,CAAA;AAAA,IACzD,CAAA;AAAA,IACA,CAAC,cAAc,OAAO;AAAA,GACxB;AAKA,EAAA,MAAMA,mBAAAA,GAAqB,YAAY,MAAM;AAC3C,IAAA,IAAI,CAAC,WAAW,OAAA,EAAS;AACzB,IAAA,IAAI,cAAA,KAAmB,OAAA,EAAS,KAAK,cAAA,EAAe;AAAA,SAC/C,YAAA,EAAa;AAAA,EACpB,CAAA,EAAG,CAAC,YAAA,EAAc,cAAA,EAAgB,cAAc,CAAC,CAAA;AAIjD,EAAA,SAAA,CAAU,MAAM;AACd,IAAA,sBAAA,CAAuBA,mBAAkB,CAAA;AACzC,IAAA,OAAO,MAAM,uBAAuB,MAAS,CAAA;AAAA,EAC/C,CAAA,EAAG,CAACA,mBAAkB,CAAC,CAAA;AAGvB,EAAA,MAAM,MAAA,GAAS,OAAA;AAAA,IACb,MAAM,qBAAA,CAAsB,EAAE,SAAS,QAAA,EAAU,cAAA,EAAgBA,qBAAoB,CAAA;AAAA,IACrF,CAAC,OAAA,EAAS,QAAA,EAAUA,mBAAkB;AAAA,GACxC;AAEA,EAAA,MAAM,KAAA,GAAQ,OAAA;AAAA,IACZ,OAAO;AAAA,MACL,MAAA;AAAA,MACA,IAAA;AAAA,MACA,KAAA;AAAA,MACA,KAAA;AAAA,MACA,MAAA;AAAA,MACA,cAAA;AAAA,MACA,gBAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF,CAAA;AAAA,IACA,CAAC,QAAQ,IAAA,EAAM,KAAA,EAAO,OAAO,MAAA,EAAQ,cAAA,EAAgB,gBAAA,EAAkB,QAAA,EAAU,MAAM;AAAA,GACzF;AAEA,EAAA,uBACE,GAAA,CAAC,oBAAA,CAAqB,QAAA,EAArB,EAA8B,OAAe,QAAA,EAAS,CAAA;AAE3D;ACxTO,SAAS,OAAA,GAAqC;AACnD,EAAA,MAAM,GAAA,GAAM,WAAW,oBAAoB,CAAA;AAC3C,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,EACzE;AACA,EAAA,OAAO,GAAA;AACT;AAYO,SAAS,YAAA,GAAgC;AAC9C,EAAA,OAAO,SAAQ,CAAE,MAAA;AACnB","file":"index.js","sourcesContent":["// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n//\n// Framework-neutral browser-auth engine for ConfigHub. Productionized from the\n// reference harness `test/browser-auth/src/confighubAuth.ts` in the ConfigHub\n// monorepo, which is validated end to end against staging and prod.\n//\n// Flow (design: third-party-browser-app-auth.md §6):\n//   GET {base}/api/info                 -> discovery { AuthIssuer, TokenExchangeEndpoint }\n//   OIDC discovery on AuthIssuer        -> authorize/token/end_session endpoints\n//   PKCE authorize + code->token        -> IdP token\n//   POST {TokenExchangeEndpoint} (8693) -> minted ConfigHub token\n//\n// The minted token then rides `Authorization: Bearer` against `/api`. The flow is\n// edition-agnostic: `AuthIssuer` is whatever discovery names (ConfigHub's bundled\n// Keycloak for Cloud, the org's own IdP for Enterprise), so the same code runs\n// against both. Tokens are held by the caller; only the transient PKCE state is\n// parked in sessionStorage across the authorize redirect.\n\nexport interface Discovery {\n  AuthIssuer?: string;\n  TokenExchangeEndpoint?: string;\n  TokenExchangeAudience?: string;\n}\n\nexport interface MintedSession {\n  accessToken: string;\n  organizationId: string;\n  /** Claims of the validated IdP token (owning-org, audience, organization shape). */\n  idpClaims: Record<string, unknown>;\n  /**\n   * The IdP's ID token, kept only so logout can pass it as `id_token_hint` to the\n   * end-session endpoint. Absent for sessions that did not come from an OIDC login.\n   */\n  idToken?: string;\n}\n\nexport interface LoginOptions {\n  /**\n   * Where to land after login, as a same-origin path (`/space/x?tab=units`). Carried\n   * through the authorize round trip in the PKCE state, never in the redirect URI:\n   * OAuth clients register exact redirect URIs, so the URI itself must not vary with\n   * the page the user started from. Defaults to the current path and query.\n   */\n  returnTo?: string;\n  /**\n   * Which organization to sign in to, as the Keycloak organization alias sent in\n   * the `organization:<alias>` scope.\n   *\n   * - a string: that organization, no prompt;\n   * - `undefined` (default): the organization of the last successful login in this\n   *   browser, remembered per client in `localStorage`, so a new tab or a login after\n   *   logout lands in the same organization without a prompt; with nothing\n   *   remembered, Keycloak decides (prompt for a multi-org user, or the org matching\n   *   the email domain on a fresh authentication);\n   * - `null`: no hint on purpose, so Keycloak prompts. This is \"switch organization\".\n   */\n  organization?: string | null;\n  /**\n   * `'none'` asks the IdP to re-authenticate without any UI, failing with\n   * `login_required` if the SSO session is gone -- the way to refresh an expired\n   * ConfigHub token when the user is still signed in at the IdP. `'login'` forces the\n   * login form even with a live SSO session. `'create'` opens the IdP's registration\n   * form instead of its login form (OpenID Connect Prompt Create; Keycloak honours it),\n   * so a \"sign up\" link can be an ordinary PKCE login that lands the new user in the\n   * app signed in.\n   */\n  prompt?: 'none' | 'login' | 'create';\n}\n\nexport interface FlowOptions {\n  /**\n   * Same-origin path the IdP redirects back to, and therefore the redirect URI to\n   * register for the client: `{origin}{callbackPath}`. Defaults to `/`.\n   */\n  callbackPath?: string;\n}\n\ninterface PkceState {\n  verifier: string;\n  state: string;\n  clientId: string;\n  tokenEndpoint: string;\n  exchangeEndpoint: string;\n  redirectUri: string;\n  returnTo: string;\n  silent: boolean;\n  /** The organization alias the authorize request hinted, if any. */\n  hintedOrganization?: string;\n  /** This login is already the retry after a token without an organization. */\n  retriedForOrganization?: boolean;\n}\n\n/**\n * Thrown by `completeLoginFromRedirect` when the IdP token names no organization,\n * which the exchange would refuse. Seen on a fresh brokered (Google) login, where\n * Keycloak's organization step does not run; on the next login the SSO session is\n * alive and it does, so the caller logs in again, once, with no hint. Any\n * remembered alias has already been forgotten.\n */\nexport class OrganizationMissing extends Error {\n  constructor(public readonly returnTo: string) {\n    super('the identity provider issued a token with no organization');\n    this.name = 'OrganizationMissing';\n  }\n}\n\n/**\n * Thrown by `startLogin` when the instance advertises no identity provider. Such an\n * instance signs a browser in with a ticket from `cub auth browser-session` instead\n * (see `redeemBrowserTicket`), so there is no login to start.\n */\nexport class NoIdentityProvider extends Error {\n  constructor() {\n    super('this instance has no identity provider; sign in with `cub auth browser-session`');\n    this.name = 'NoIdentityProvider';\n  }\n}\n\nexport interface RetryOptions {\n  /** @internal set by the provider on the one retry after OrganizationMissing. */\n  retriedForOrganization?: boolean;\n}\n\nconst PKCE_KEY = 'confighub_pkce';\nconst LAST_ORG_KEY = 'confighub_last_org';\n\n// The alias is a short public identifier, not a credential, so localStorage is the\n// right place: it must outlive the tab, which is exactly what the token must not.\nconst lastOrgKey = (clientId: string): string => `${LAST_ORG_KEY}:${clientId}`;\n\n/** The organization alias of the last successful login for this client, if any. */\nexport function rememberedOrganization(clientId: string): string | undefined {\n  try {\n    return localStorage.getItem(lastOrgKey(clientId)) ?? undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/** @internal */\nexport function rememberOrganization(clientId: string, alias: string | undefined): void {\n  try {\n    if (alias) localStorage.setItem(lastOrgKey(clientId), alias);\n    else localStorage.removeItem(lastOrgKey(clientId));\n  } catch {\n    // Storage unavailable: the next login gets no hint.\n  }\n}\n\n/**\n * The alias in an IdP token's `organization` claim (`{ \"<alias>\": { id } }`), or\n * undefined when the claim is absent or names more than one organization.\n */\nexport function organizationAliasOf(idpClaims: Record<string, unknown>): string | undefined {\n  const org = idpClaims.organization;\n  if (!org || typeof org !== 'object') return undefined;\n  const aliases = Object.keys(org as Record<string, unknown>);\n  return aliases.length === 1 ? aliases[0] : undefined;\n}\n\nconst trimSlash = (s: string): string => s.replace(/\\/+$/, '');\n\n/** The fixed callback URI: the page origin plus the configured callback path. */\nexport const callbackUri = (opts?: FlowOptions): string =>\n  window.location.origin + (opts?.callbackPath ?? '/');\n\nconst currentPath = (): string =>\n  window.location.pathname + window.location.search + window.location.hash;\n\nconst b64url = (buf: ArrayBuffer): string =>\n  btoa(String.fromCharCode(...new Uint8Array(buf)))\n    .replace(/\\+/g, '-')\n    .replace(/\\//g, '_')\n    .replace(/=+$/, '');\n\nconst randomString = (n = 64): string =>\n  b64url(crypto.getRandomValues(new Uint8Array(n)).buffer);\n\nasync function sha256(s: string): Promise<string> {\n  return b64url(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(s)));\n}\n\n/** Decode a JWT's claims without verifying it. Returns {} for anything malformed. */\nexport function decodeJwtClaims(token: string): Record<string, unknown> {\n  const part = token.split('.')[1];\n  if (!part) return {};\n  try {\n    return JSON.parse(atob(part.replace(/-/g, '+').replace(/_/g, '/')));\n  } catch {\n    return {};\n  }\n}\n\n/** Whether a JWT's `exp` is in the past (with a small skew allowance). */\nexport function isExpired(token: string, skewSeconds = 30): boolean {\n  const exp = decodeJwtClaims(token).exp;\n  if (typeof exp !== 'number') return false;\n  return exp * 1000 <= Date.now() + skewSeconds * 1000;\n}\n\nexport async function discover(base: string): Promise<Discovery> {\n  const r = await fetch(trimSlash(base) + '/api/info');\n  if (!r.ok) throw new Error('/api/info failed: ' + r.status);\n  return r.json();\n}\n\ninterface OidcMetadata {\n  authorization_endpoint: string;\n  token_endpoint: string;\n  end_session_endpoint?: string;\n}\n\nasync function oidcMetadata(issuer: string): Promise<OidcMetadata> {\n  const r = await fetch(trimSlash(issuer) + '/.well-known/openid-configuration');\n  if (!r.ok) throw new Error('OIDC discovery failed: ' + r.status);\n  return r.json();\n}\n\n/**\n * Discover, build a PKCE request, and navigate to the IdP authorize endpoint.\n * Returns only by redirecting the page; `completeLoginFromRedirect()` finishes on\n * the way back.\n */\nexport async function startLogin(\n  base: string,\n  clientId: string,\n  login: LoginOptions = {},\n  flow: FlowOptions = {},\n  retry: RetryOptions = {},\n): Promise<void> {\n  const info = await discover(base);\n  if (!info.AuthIssuer && !info.TokenExchangeEndpoint) throw new NoIdentityProvider();\n  if (!info.AuthIssuer || !info.TokenExchangeEndpoint) {\n    throw new Error(\n      'this instance is not configured for token-exchange auth (server needs CONFIGHUB_IDP_ISSUER)',\n    );\n  }\n  const meta = await oidcMetadata(info.AuthIssuer);\n  const verifier = randomString();\n  const challenge = await sha256(verifier);\n  const state = randomString(16);\n  const redirectUri = callbackUri(flow);\n  // The \"organization\" scope makes Keycloak emit the org claim the exchange resolves;\n  // \"organization:<alias>\" selects one without prompting.\n  const alias =\n    login.organization === null\n      ? undefined\n      : (login.organization ?? rememberedOrganization(clientId));\n  const orgScope = alias ? `organization:${alias}` : 'organization';\n  const pkce: PkceState = {\n    verifier,\n    state,\n    clientId,\n    tokenEndpoint: meta.token_endpoint,\n    exchangeEndpoint: info.TokenExchangeEndpoint,\n    redirectUri,\n    returnTo: login.returnTo ?? currentPath(),\n    silent: login.prompt === 'none',\n    hintedOrganization: alias,\n    retriedForOrganization: retry.retriedForOrganization,\n  };\n  sessionStorage.setItem(PKCE_KEY, JSON.stringify(pkce));\n  const params: Record<string, string> = {\n    response_type: 'code',\n    client_id: clientId,\n    redirect_uri: redirectUri,\n    scope: `openid email profile ${orgScope}`,\n    code_challenge: challenge,\n    code_challenge_method: 'S256',\n    state,\n  };\n  if (login.prompt) params.prompt = login.prompt;\n\n  const authURL = new URL(meta.authorization_endpoint);\n  authURL.search = new URLSearchParams(params).toString();\n  window.location.assign(authURL.toString());\n}\n\n// Memoize so React StrictMode's double-mount can't redeem the one-time code twice.\nlet pending: Promise<MintedSession | null> | null = null;\n\n/**\n * If the page is the IdP redirect (`?code=...`), exchange the code for an IdP token\n * and then exchange that for a minted ConfigHub token, and restore the URL the\n * login started from. Returns null on a normal load, when a `prompt=none` attempt\n * came back with `login_required` (the SSO session is gone; the caller should offer\n * an interactive login), and when the redirect carries a code this tab has no PKCE\n * state for (an IdP email flow landed here; the caller should start a login).\n */\nexport function completeLoginFromRedirect(): Promise<MintedSession | null> {\n  if (!pending) pending = doCompleteLogin();\n  return pending;\n}\n\nconst SILENT_FAILURES = new Set(['login_required', 'interaction_required', 'consent_required']);\n\nasync function doCompleteLogin(): Promise<MintedSession | null> {\n  const params = new URLSearchParams(window.location.search);\n  const code = params.get('code');\n  const error = params.get('error');\n  if (!code && !error) return null;\n\n  const savedRaw = sessionStorage.getItem(PKCE_KEY);\n  sessionStorage.removeItem(PKCE_KEY);\n  const saved: PkceState | null = savedRaw ? JSON.parse(savedRaw) : null;\n\n  // Put the URL back to where the user started before anything else can fail, so\n  // neither the code nor an error string lingers in the address bar or history.\n  history.replaceState({}, '', saved?.returnTo ?? callbackUri());\n\n  if (error) {\n    if (saved?.silent && SILENT_FAILURES.has(error)) return null;\n    throw new Error(`IdP returned error: ${error} ${params.get('error_description') ?? ''}`);\n  }\n  // A code with no PKCE state means this tab did not start the login: the IdP's\n  // email flows (password reset, verify email) finish the authentication in the tab\n  // the mail link opened and redirect it here, while the verifier sits in the tab\n  // that began. The code is unusable without it, so drop it and report a normal\n  // load; the caller starts a login, which the now-live IdP session completes\n  // without a prompt.\n  if (!saved) return null;\n  if (params.get('state') !== saved.state) throw new Error('state mismatch; aborting');\n\n  // Exchange the authorization code for an IdP token (PKCE, public client).\n  const tokenResp = await fetch(saved.tokenEndpoint, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({\n      grant_type: 'authorization_code',\n      code: code!,\n      redirect_uri: saved.redirectUri,\n      client_id: saved.clientId,\n      code_verifier: saved.verifier,\n    }),\n  });\n  if (!tokenResp.ok) {\n    throw new Error(`IdP token endpoint ${tokenResp.status}: ${await tokenResp.text()}`);\n  }\n  const idpToken = await tokenResp.json();\n\n  // RFC 8693 token exchange against ConfigHub -> minted ConfigHub token.\n  const idpClaims = decodeJwtClaims(idpToken.access_token);\n  if (!organizationAliasOf(idpClaims) && !saved.retriedForOrganization) {\n    // The exchange would refuse this token. Rather than surface that, log in\n    // once more: with the SSO session now alive the IdP runs its organization\n    // step. A hint that was sent evidently did not help, so forget it.\n    if (saved.hintedOrganization) rememberOrganization(saved.clientId, undefined);\n    throw new OrganizationMissing(saved.returnTo);\n  }\n  const minted = await exchange(saved.exchangeEndpoint, idpToken.access_token);\n  rememberOrganization(saved.clientId, organizationAliasOf(idpClaims));\n  return {\n    ...minted,\n    idpClaims,\n    idToken: typeof idpToken.id_token === 'string' ? idpToken.id_token : undefined,\n  };\n}\n\nasync function exchange(\n  exchangeEndpoint: string,\n  subjectToken: string,\n): Promise<Pick<MintedSession, 'accessToken' | 'organizationId'>> {\n  const exResp = await fetch(exchangeEndpoint, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({\n      grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',\n      subject_token: subjectToken,\n      subject_token_type: 'urn:ietf:params:oauth:token-type:access_token',\n    }),\n  });\n  if (!exResp.ok) throw new Error(`/auth/exchange ${exResp.status}: ${await exResp.text()}`);\n  const minted = await exResp.json();\n  return { accessToken: minted.access_token, organizationId: minted.organization_id };\n}\n\n/**\n * Redeem a single-use ticket from `cub auth browser-session` for a minted ConfigHub\n * token (`POST {base}/auth/browser-session`). This is how a browser signs in to an\n * instance with no identity provider, and how a local identity (a break-glass\n * administrator) signs in to one that has a provider. The session has no IdP behind\n * it: when the token expires, the user runs the command again.\n */\nexport async function redeemBrowserTicket(base: string, ticket: string): Promise<MintedSession> {\n  const r = await fetch(trimSlash(base) + '/auth/browser-session', {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({ ticket }),\n  });\n  if (!r.ok) throw new Error(`/auth/browser-session ${r.status}: ${await r.text()}`);\n  const minted = await r.json();\n  return { accessToken: minted.access_token, organizationId: minted.organization_id, idpClaims: {} };\n}\n\n/**\n * End the IdP session (RP-initiated logout) and land on `postLogoutRedirectUri`,\n * which must be registered for the client. Returns only by redirecting. If the\n * issuer publishes no end-session endpoint, navigates to the redirect URI directly.\n */\nexport async function endSession(\n  base: string,\n  clientId: string,\n  idToken: string | undefined,\n  postLogoutRedirectUri: string,\n): Promise<void> {\n  const info = await discover(base);\n  const meta = info.AuthIssuer ? await oidcMetadata(info.AuthIssuer) : undefined;\n  if (!meta?.end_session_endpoint) {\n    window.location.assign(postLogoutRedirectUri);\n    return;\n  }\n  const params: Record<string, string> = {\n    client_id: clientId,\n    post_logout_redirect_uri: postLogoutRedirectUri,\n  };\n  if (idToken) params.id_token_hint = idToken;\n  const url = new URL(meta.end_session_endpoint);\n  url.search = new URLSearchParams(params).toString();\n  window.location.assign(url.toString());\n}\n\n/** Discard the in-progress login memo (used on logout so a later login re-runs). */\nexport function resetPending(): void {\n  pending = null;\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\n// A module-level holder for the current minted token, so non-React consumers can read\n// it. RTK Query's `prepareHeaders` (in @confighub/rtk-query) is not a hook and cannot\n// read React context, so it calls getAccessToken() instead. The provider keeps this in\n// sync with its React state, and registers its 401 handling here for the same reason.\nimport { isExpired } from './core';\n\nlet currentToken: string | undefined;\nlet unauthorizedHandler: (() => void) | undefined;\n// Set while a recovery is under way, so a burst of failing requests starts one.\nlet recovering = false;\n\n/** @internal — called by the provider; not part of the public surface. */\nexport function setAccessToken(token: string | undefined): void {\n  currentToken = token;\n  if (token !== undefined) recovering = false;\n}\n\n/** @internal — the mounted provider's reaction to a rejected token. */\nexport function setUnauthorizedHandler(handler: (() => void) | undefined): void {\n  unauthorizedHandler = handler;\n  recovering = false;\n}\n\n/**\n * The current minted ConfigHub token, or undefined when unauthenticated. Pass this as\n * the `getToken` for `@confighub/rtk-query`'s `configureConfigHub`, or read it anywhere\n * you need the token outside React.\n *\n * A token past its `exp` is never handed out: the server would reject it. Instead the\n * provider's recovery starts (a silent re-authentication, or a logout, per its\n * `onUnauthorized`) and the request goes without a token; the page is about to\n * navigate to the IdP and back to where it was.\n */\nexport function getAccessToken(): string | undefined {\n  if (currentToken !== undefined && isExpired(currentToken)) {\n    handleUnauthorized();\n    return undefined;\n  }\n  return currentToken;\n}\n\n/**\n * Tell the mounted provider the API rejected the token (401). Pass this as the\n * `onUnauthorized` for `@confighub/rtk-query`'s `configureConfigHub` to recover from a\n * token rejected before its expiry, e.g. after a server key rotation; expiry itself is\n * handled by `getAccessToken`. A no-op with no provider mounted, and while a recovery\n * is already under way.\n */\nexport function handleUnauthorized(): void {\n  if (recovering || !unauthorizedHandler) return;\n  recovering = true;\n  unauthorizedHandler();\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\nimport { createConfigHubClient, type ConfigHubClient } from '@confighub/api';\nimport {\n  createContext,\n  useCallback,\n  useEffect,\n  useMemo,\n  useRef,\n  useState,\n  type ReactNode,\n} from 'react';\nimport {\n  NoIdentityProvider,\n  OrganizationMissing,\n  callbackUri,\n  completeLoginFromRedirect,\n  endSession,\n  isExpired,\n  organizationAliasOf,\n  redeemBrowserTicket,\n  resetPending,\n  startLogin,\n  type LoginOptions,\n  type MintedSession,\n} from './core';\nimport { setAccessToken, setUnauthorizedHandler } from './tokenStore';\n\nexport type AuthStatus = 'loading' | 'authenticated' | 'unauthenticated' | 'error';\n\nexport interface ConfigHubUser {\n  organizationId: string;\n  idpClaims: Record<string, unknown>;\n}\n\nexport interface LogoutOptions {\n  /**\n   * Also end the IdP session (RP-initiated logout), so the next login asks for\n   * credentials instead of riding the SSO cookie. Redirects the page; the landing\n   * URI must be registered for the client. Default: false, which only forgets the\n   * token in this tab.\n   */\n  endSession?: boolean;\n  /** Where to land after IdP logout. Defaults to the callback URI. */\n  postLogoutRedirectUri?: string;\n}\n\nexport interface ConfigHubAuthContextValue {\n  status: AuthStatus;\n  user: ConfigHubUser | null;\n  error: Error | null;\n  /** Begin login: redirects the page to the IdP. */\n  login: (options?: LoginOptions) => Promise<void>;\n  /** Forget the session in this tab and, optionally, end the IdP session too. */\n  logout: (options?: LogoutOptions) => Promise<void>;\n  /**\n   * The ConfigHub token stopped working (a 401). Try to get a new one without any\n   * UI: a `prompt=none` round trip through the IdP, for the organization the session\n   * already had. Status goes to `loading` meanwhile, not `unauthenticated`, so an\n   * app that auto-logs-in on `unauthenticated` does not race this with an\n   * interactive login. If the IdP session is gone too, the page comes back\n   * `unauthenticated`. Redirects the page.\n   */\n  reauthenticate: () => Promise<void>;\n  /**\n   * Sign in with a ticket from `cub auth browser-session`, for an instance with no\n   * identity provider or a local identity. Rejects with the server's error if the\n   * ticket is unknown, expired or already used; the session stays as it was.\n   */\n  signInWithTicket: (ticket: string) => Promise<void>;\n  /** Current bearer token, or undefined when unauthenticated. */\n  getToken: () => string | undefined;\n  /** A typed API client pre-wired with the current token. Stable across renders. */\n  client: ConfigHubClient;\n}\n\nexport const ConfigHubAuthContext = createContext<ConfigHubAuthContextValue | null>(null);\n\nexport interface ConfigHubAuthProviderProps {\n  /** Absolute base URL of the ConfigHub instance, e.g. `https://hub.confighub.com`. */\n  baseUrl: string;\n  /** This app's registered OAuth `client_id` (from `cub oauthclient create`). */\n  clientId: string;\n  /**\n   * Same-origin path the IdP redirects back to; `{origin}{callbackPath}` is the\n   * redirect URI to register. Defaults to `/`. Fixed on purpose: the page a user\n   * starts login from travels in the PKCE state, not in the redirect URI.\n   */\n  callbackPath?: string;\n  /**\n   * `'session'` (default) keeps the minted token in `sessionStorage` so a reload or an\n   * in-tab navigation does not round-trip through the IdP. Tab-scoped and gone when the\n   * tab closes. `'none'`: memory only, every page load starts unauthenticated.\n   */\n  persist?: 'none' | 'session';\n  /**\n   * What a 401 from the API means. `'login'` (default): the token is stale, try a\n   * silent re-authentication (`prompt=none`) and fall back to unauthenticated if the\n   * IdP session is gone too. `'logout'`: just drop the session.\n   */\n  onUnauthorized?: 'login' | 'logout';\n  children: ReactNode;\n}\n\nconst SESSION_KEY = 'confighub_session';\n\nfunction readPersisted(): MintedSession | null {\n  try {\n    const raw = sessionStorage.getItem(SESSION_KEY);\n    if (!raw) return null;\n    const session: MintedSession = JSON.parse(raw);\n    if (!session.accessToken || isExpired(session.accessToken)) {\n      sessionStorage.removeItem(SESSION_KEY);\n      return null;\n    }\n    return session;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Runs the browser-direct auth flow and manages the token lifecycle. On mount it\n * completes a redirect if the page is the IdP callback, restores a persisted\n * session if there is one, and otherwise starts unauthenticated until `login()`\n * is called.\n */\nexport function ConfigHubAuthProvider({\n  baseUrl,\n  clientId,\n  callbackPath,\n  persist = 'session',\n  onUnauthorized = 'login',\n  children,\n}: ConfigHubAuthProviderProps): JSX.Element {\n  const [status, setStatus] = useState<AuthStatus>('loading');\n  const [user, setUser] = useState<ConfigHubUser | null>(null);\n  const [error, setError] = useState<Error | null>(null);\n\n  // The session lives in a ref so getToken() reads the latest value synchronously\n  // without re-creating the API client on every render.\n  const sessionRef = useRef<MintedSession | undefined>(undefined);\n  const flow = useMemo(() => ({ callbackPath }), [callbackPath]);\n\n  const persistSession = useCallback(\n    (session: MintedSession | undefined) => {\n      if (persist !== 'session') return;\n      try {\n        if (session) sessionStorage.setItem(SESSION_KEY, JSON.stringify(session));\n        else sessionStorage.removeItem(SESSION_KEY);\n      } catch {\n        // Storage unavailable (private mode, quota): memory-only for this tab.\n      }\n    },\n    [persist],\n  );\n\n  const applySession = useCallback(\n    (session: MintedSession) => {\n      sessionRef.current = session;\n      setAccessToken(session.accessToken); // keep the non-React accessor in sync (rtk-query)\n      persistSession(session);\n      setUser({ organizationId: session.organizationId, idpClaims: session.idpClaims });\n      setError(null);\n      setStatus('authenticated');\n    },\n    [persistSession],\n  );\n\n  const clearSession = useCallback(() => {\n    sessionRef.current = undefined;\n    setAccessToken(undefined);\n    persistSession(undefined);\n    resetPending();\n    setUser(null);\n    setStatus('unauthenticated');\n  }, [persistSession]);\n\n  useEffect(() => {\n    let cancelled = false;\n    completeLoginFromRedirect()\n      .then((session) => {\n        if (cancelled) return;\n        if (session) return applySession(session);\n        const persisted = persist === 'session' ? readPersisted() : null;\n        if (persisted) return applySession(persisted);\n        setStatus('unauthenticated');\n      })\n      .catch((e: unknown) => {\n        if (cancelled) return;\n        if (e instanceof OrganizationMissing) {\n          // Once, with no hint, flagged so a second miss surfaces as an error.\n          void startLogin(\n            baseUrl,\n            clientId,\n            { returnTo: e.returnTo, organization: null },\n            flow,\n            { retriedForOrganization: true },\n          );\n          return;\n        }\n        setError(e instanceof Error ? e : new Error(String(e)));\n        setStatus('error');\n      });\n    return () => {\n      cancelled = true;\n    };\n  }, [applySession, persist, baseUrl, clientId, flow]);\n\n  const login = useCallback(\n    async (options?: LoginOptions) => {\n      setError(null);\n      try {\n        await startLogin(baseUrl, clientId, options, flow);\n      } catch (e: unknown) {\n        setError(e instanceof Error ? e : new Error(String(e)));\n        setStatus('error');\n      }\n    },\n    [baseUrl, clientId, flow],\n  );\n\n  const logout = useCallback(\n    async (options?: LogoutOptions) => {\n      const idToken = sessionRef.current?.idToken;\n      if (!options?.endSession) {\n        clearSession();\n        return;\n      }\n      // Forget the session but stay 'loading': the page is about to navigate to the\n      // IdP's end-session endpoint, and 'unauthenticated' would let an app that\n      // auto-logs-in start a login that races the logout and can win it, landing\n      // the user back in the session they just ended.\n      sessionRef.current = undefined;\n      setAccessToken(undefined);\n      persistSession(undefined);\n      resetPending();\n      setUser(null);\n      setStatus('loading');\n      try {\n        await endSession(\n          baseUrl,\n          clientId,\n          idToken,\n          options.postLogoutRedirectUri ?? callbackUri(flow),\n        );\n      } catch (e: unknown) {\n        // The session in this tab is already gone; say why the IdP's is not.\n        setError(e instanceof Error ? e : new Error(String(e)));\n        setStatus('error');\n      }\n    },\n    [baseUrl, clientId, clearSession, flow, persistSession],\n  );\n\n  const getToken = useCallback(() => sessionRef.current?.accessToken, []);\n\n  const reauthenticate = useCallback(async () => {\n    const organization = organizationAliasOf(sessionRef.current?.idpClaims ?? {});\n    // Forget the token but stay 'loading': the page is about to navigate away,\n    // and 'unauthenticated' would invite an interactive login in the meantime.\n    sessionRef.current = undefined;\n    setAccessToken(undefined);\n    persistSession(undefined);\n    resetPending();\n    setStatus('loading');\n    try {\n      await startLogin(baseUrl, clientId, { prompt: 'none', organization }, flow);\n    } catch (e: unknown) {\n      // No IdP to ask: the session came from a ticket, and the user needs a new one.\n      if (e instanceof NoIdentityProvider) {\n        setStatus('unauthenticated');\n        return;\n      }\n      setError(e instanceof Error ? e : new Error(String(e)));\n      setStatus('error');\n    }\n  }, [baseUrl, clientId, flow, persistSession]);\n\n  const signInWithTicket = useCallback(\n    async (ticket: string) => {\n      applySession(await redeemBrowserTicket(baseUrl, ticket));\n    },\n    [applySession, baseUrl],\n  );\n\n  // A 401 means the minted token no longer works. Silent re-auth keeps the user's\n  // place if the IdP session is still alive; otherwise the page comes back\n  // unauthenticated and the app offers a real login.\n  const handleUnauthorized = useCallback(() => {\n    if (!sessionRef.current) return;\n    if (onUnauthorized === 'login') void reauthenticate();\n    else clearSession();\n  }, [clearSession, reauthenticate, onUnauthorized]);\n\n  // Non-React callers (getAccessToken on an expired token, handleUnauthorized from a\n  // data client's 401) reach this provider's handling through the token store.\n  useEffect(() => {\n    setUnauthorizedHandler(handleUnauthorized);\n    return () => setUnauthorizedHandler(undefined);\n  }, [handleUnauthorized]);\n\n  // One client for the provider's lifetime. getToken reads the session ref.\n  const client = useMemo(\n    () => createConfigHubClient({ baseUrl, getToken, onUnauthorized: handleUnauthorized }),\n    [baseUrl, getToken, handleUnauthorized],\n  );\n\n  const value = useMemo<ConfigHubAuthContextValue>(\n    () => ({\n      status,\n      user,\n      error,\n      login,\n      logout,\n      reauthenticate,\n      signInWithTicket,\n      getToken,\n      client,\n    }),\n    [status, user, error, login, logout, reauthenticate, signInWithTicket, getToken, client],\n  );\n\n  return (\n    <ConfigHubAuthContext.Provider value={value}>{children}</ConfigHubAuthContext.Provider>\n  );\n}\n","// Copyright (C) ConfigHub, Inc.\n// SPDX-License-Identifier: MIT\n\nimport type { ConfigHubClient } from '@confighub/api';\nimport { useContext } from 'react';\nimport { ConfigHubAuthContext, type ConfigHubAuthContextValue } from './provider';\n\n/**\n * Access the ConfigHub auth state and actions. Must be called under a\n * `<ConfigHubAuthProvider>`.\n *\n * ```ts\n * const { status, user, login, logout } = useAuth();\n * ```\n */\nexport function useAuth(): ConfigHubAuthContextValue {\n  const ctx = useContext(ConfigHubAuthContext);\n  if (!ctx) {\n    throw new Error('useAuth must be used within a <ConfigHubAuthProvider>');\n  }\n  return ctx;\n}\n\n/**\n * The typed ConfigHub API client, pre-wired with the current token. This is the\n * seam between `@confighub/react-auth` and `@confighub/api`: you never pass a\n * token by hand.\n *\n * ```ts\n * const api = useConfigHub();\n * const { data } = await api.GET('/space/{space_id}/unit', { params: { path: { space_id } } });\n * ```\n */\nexport function useConfigHub(): ConfigHubClient {\n  return useAuth().client;\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@confighub/react-auth",
-  "version": "0.5.4",
+  "version": "0.6.1",
   "description": "React auth provider and hooks for ConfigHub browser apps (OIDC PKCE + RFC 8693 token exchange)",
   "license": "MIT",
   "repository": {
@@ -39,7 +39,7 @@
     "prepublishOnly": "npm run build"
   },
   "dependencies": {
-    "@confighub/api": "^0.5.4"
+    "@confighub/api": "^0.6.1"
   },
   "peerDependencies": {
     "react": "^18.0.0 || ^19.0.0"