@entropy-softworks/ui 2026.7.31

package/lib/services/auth.service.js

@@ -0,0 +1,376 @@
+import { Platform } from "react-native";
+import { apiFetch } from "../utils/api-fetch";
+import { extractApiError, extractErrorMessage } from "../utils/http-error";
+import { validateEmail as validateEmailUtil, validatePassword as validatePasswordUtil, validateUsername as validateUsernameUtil, } from "../utils/validation";
+import * as ApiConfig from "./api-config";
+import { clearCachedPolicy as clearHibpPolicyCache } from "./hibp-cache";
+// Native persists the user record in SecureStore so the next app launch
+// has it before /auth/me lands. Web keeps it in process memory only —
+// sessionStorage is XSS-readable and the cookie-bound session lets us
+// re-fetch the record from the server on the next mount without a
+// noticeable UX regression. See SECURITY.md.
+const USER_DATA_KEY_SUFFIX = "user_data";
+let inMemoryUser = null;
+function userDataKey() {
+    return `${ApiConfig.getStoragePrefix()}_${USER_DATA_KEY_SUFFIX}`;
+}
+async function persistUser(user) {
+    if (Platform.OS === "web") {
+        inMemoryUser = user;
+        return;
+    }
+    await ApiConfig.kvPut(userDataKey(), JSON.stringify(user));
+}
+async function clearPersistedUser() {
+    if (Platform.OS === "web") {
+        inMemoryUser = null;
+        return;
+    }
+    await ApiConfig.kvPut(userDataKey(), null);
+}
+/**
+ * Normalize a login/register response body into an {@link AuthResponse}.
+ * Single-tenant servers wrap the user as `{ user, session_token }`;
+ * the multi-tenant IdP (access) returns the user record directly and
+ * establishes the session via an HttpOnly cookie (no bearer token).
+ */
+async function parseAuthResponse(response) {
+    const json = await response.json();
+    if (json && typeof json === "object" && "user" in json) {
+        return json;
+    }
+    return { user: json, session_token: "" };
+}
+async function loadPersistedUser() {
+    if (Platform.OS === "web") {
+        return inMemoryUser;
+    }
+    try {
+        const userJson = await ApiConfig.kvGet(userDataKey());
+        if (!userJson) {
+            return null;
+        }
+        return JSON.parse(userJson);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Auth client for Entropy Softworks servers. Apps call `configureApi`
+ * (from `@entropy-softworks/ui/services`) at startup so storage keys and
+ * the base URL are wired up before any of these methods run.
+ */
+class AuthService {
+    static loadServerUrlOverride = ApiConfig.loadServerUrlOverride;
+    static getBaseUrl = ApiConfig.getBaseUrl;
+    static setBaseUrl = ApiConfig.setBaseUrl;
+    static resetBaseUrl = ApiConfig.resetBaseUrl;
+    static getSessionToken = ApiConfig.getSessionToken;
+    /**
+     * Persist the session credential + user record produced by an
+     * alternative auth path (passkey-finish, magic-link, etc.) so the
+     * rest of `useAuth` / `getCurrentUser` sees the same state the
+     * password `login` flow leaves behind.
+     *
+     * Web: session credential is a server-set HttpOnly cookie; only
+     * the user record persists here, and it lives in process memory
+     * (NOT sessionStorage) so an XSS exploit cannot read it.
+     * Native: token goes through SecureStore, user record goes
+     * through SecureStore alongside it.
+     */
+    static async persistAuthSession(data) {
+        // Both writes target independent storage keys; parallelising them
+        // saves one round-trip on the login / register hot path.
+        await Promise.all([ApiConfig.storeSessionToken(data.session_token), persistUser(data.user)]);
+    }
+    static async login(email, password) {
+        // NFC-normalize every password that crosses the wire so the
+        // server-side auth hash agrees with whatever key the client
+        // derived from the same string. Without this a master password
+        // typed on a keyboard / IME that emits combining-character
+        // sequences on one device and precomposed forms on another
+        // produces two different hashes — login looks like wrong
+        // password while everything visually matches. See
+        // `shared/crypto/webcrypto.ts deriveMasterKey` for the
+        // client-side twin.
+        const pw = password.normalize("NFC");
+        // Multi-tenant IdP (access): { tenant, identifier, password } where the
+        // identifier is an email OR username and the tenant is contextual (set
+        // via ApiConfig.setTenant from the OIDC flow). Single-tenant servers use
+        // the { email, password } contract. `email` is the identifier either way.
+        const body = ApiConfig.getAuthMode() === "multi-tenant"
+            ? { tenant: ApiConfig.getTenant(), identifier: email, password: pw }
+            : { email, password: pw };
+        const response = await apiFetch("/auth/login", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(body),
+        });
+        if (!response.ok) {
+            throw await extractApiError(response, "Login failed");
+        }
+        const data = await parseAuthResponse(response);
+        await AuthService.persistAuthSession(data);
+        return data;
+    }
+    static async register(email, username, password, displayName) {
+        const body = { email, password: password.normalize("NFC") };
+        if (username) {
+            body.username = username;
+        }
+        if (displayName !== undefined) {
+            body.display_name = displayName;
+        }
+        const response = await apiFetch("/auth/register", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(body),
+        });
+        if (!response.ok) {
+            throw await extractApiError(response, "Registration failed");
+        }
+        const data = await parseAuthResponse(response);
+        await AuthService.persistAuthSession(data);
+        return data;
+    }
+    static async logout() {
+        try {
+            await apiFetch("/auth/logout", { method: "POST" });
+        }
+        catch (e) {
+            // Logout network call failed — still clear local state below.
+            // Surface the underlying reason in dev so a half-broken logout
+            // (server session still alive after the user thinks they're
+            // gone) doesn't slip past unnoticed. In production we always
+            // clear local state so the UX is "logged out" even if the
+            // server didn't get the request.
+            if (__DEV__) {
+                console.warn("[auth] /auth/logout failed; clearing local state anyway:", e);
+            }
+        }
+        finally {
+            await ApiConfig.clearSessionToken();
+            await clearPersistedUser();
+            clearHibpPolicyCache();
+        }
+    }
+    static async getCurrentUser() {
+        return loadPersistedUser();
+    }
+    static async refreshUserData() {
+        try {
+            if (!(await this.isAuthenticated())) {
+                return null;
+            }
+            const response = await apiFetch("/auth/me", { method: "GET" });
+            if (!response.ok) {
+                if (response.status === 401) {
+                    await this.logout();
+                }
+                return null;
+            }
+            const user = await response.json();
+            await persistUser(user);
+            return user;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Web: HttpOnly cookies aren't readable from JS. We use the
+     * presence of the (non-HttpOnly) `csrf_token` cookie — set by the
+     * server alongside the session cookie at login — as the
+     * "authenticated" probe. Falls back to the in-memory user record if
+     * cookies are unreadable (SSR / non-browser test envs).
+     * Native: a token in SecureStore.
+     */
+    static async isAuthenticated() {
+        if (Platform.OS === "web") {
+            if (typeof document !== "undefined" && document.cookie) {
+                if (/(?:^|;\s*)csrf_token=/.test(document.cookie)) {
+                    return true;
+                }
+            }
+            return (await this.getCurrentUser()) !== null;
+        }
+        const token = await ApiConfig.getSessionToken();
+        return token !== null;
+    }
+    static async hasRole(role) {
+        const user = await this.getCurrentUser();
+        return user?.role === role;
+    }
+    static async deleteAccount(password) {
+        const response = await apiFetch("/auth/delete", {
+            method: "DELETE",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ password: password.normalize("NFC") }),
+        });
+        if (!response.ok) {
+            throw new Error(await extractErrorMessage(response, "Failed to delete account"));
+        }
+        await ApiConfig.clearSessionToken();
+        await clearPersistedUser();
+    }
+    static async changePassword(currentPassword, newPassword, reWrappedKey) {
+        const body = {
+            current_password: currentPassword.normalize("NFC"),
+            new_password: newPassword.normalize("NFC"),
+        };
+        if (reWrappedKey) {
+            body.symmetric_key_enc = reWrappedKey.symmetric_key_enc;
+            body.pbkdf2_salt = reWrappedKey.pbkdf2_salt;
+        }
+        const response = await apiFetch("/auth/password", {
+            method: "PUT",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(body),
+        });
+        if (!response.ok) {
+            throw new Error(await extractErrorMessage(response, "Failed to change password"));
+        }
+    }
+    static async changeEmail(newEmail, password) {
+        const response = await apiFetch("/auth/email", {
+            method: "PUT",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ new_email: newEmail, password: password.normalize("NFC") }),
+        });
+        if (!response.ok) {
+            throw new Error(await extractErrorMessage(response, "Failed to change email"));
+        }
+    }
+    static async updateDisplayName(displayName) {
+        const response = await apiFetch("/auth/display-name", {
+            method: "PUT",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ display_name: displayName }),
+        });
+        if (!response.ok) {
+            throw new Error(await extractErrorMessage(response, "Failed to update display name"));
+        }
+    }
+    static async setupMfa() {
+        const response = await apiFetch("/auth/mfa/setup", { method: "POST" });
+        if (!response.ok) {
+            throw new Error(await extractErrorMessage(response, "Failed to set up MFA"));
+        }
+        return await response.json();
+    }
+    static async verifyMfaSetup(code) {
+        const response = await apiFetch("/auth/mfa/verify-setup", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ code }),
+        });
+        if (!response.ok) {
+            throw new Error(await extractErrorMessage(response, "Invalid verification code"));
+        }
+    }
+    static async verifyMfa(code) {
+        const response = await apiFetch("/auth/mfa/verify", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ code }),
+        });
+        if (!response.ok) {
+            throw new Error(await extractErrorMessage(response, "Invalid MFA code"));
+        }
+    }
+    static async disableMfa(password) {
+        const response = await apiFetch("/auth/mfa", {
+            method: "DELETE",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ password: password.normalize("NFC") }),
+        });
+        if (!response.ok) {
+            throw new Error(await extractErrorMessage(response, "Failed to disable MFA"));
+        }
+    }
+    static async forgotPassword(email) {
+        // Multi-tenant IdP scopes the reset request to a tenant.
+        const body = ApiConfig.getAuthMode() === "multi-tenant"
+            ? { tenant: ApiConfig.getTenant(), email }
+            : { email };
+        const response = await apiFetch("/auth/forgot-password", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(body),
+        });
+        if (!response.ok) {
+            throw new Error(await extractErrorMessage(response, "Failed to send reset email"));
+        }
+    }
+    static async validateResetCode(code) {
+        const response = await apiFetch("/auth/validate-reset-code", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ code }),
+        });
+        if (!response.ok) {
+            throw await extractApiError(response, "Invalid or expired code");
+        }
+    }
+    static async resetPassword(code, newPassword) {
+        const response = await apiFetch("/auth/reset-password", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ code, new_password: newPassword.normalize("NFC") }),
+        });
+        if (!response.ok) {
+            throw await extractApiError(response, "Failed to reset password");
+        }
+    }
+    static async verifyEmail(code) {
+        const response = await apiFetch("/auth/verify-email", {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ code }),
+        });
+        if (!response.ok) {
+            throw new Error(await extractErrorMessage(response, "Email verification failed"));
+        }
+    }
+    static async resendVerification() {
+        const response = await apiFetch("/auth/resend-verification", { method: "POST" });
+        if (!response.ok) {
+            throw new Error(await extractErrorMessage(response, "Failed to resend verification email"));
+        }
+    }
+    static async completeOnboarding() {
+        const response = await apiFetch("/auth/complete-onboarding", { method: "POST" });
+        if (!response.ok) {
+            throw new Error(await extractErrorMessage(response, "Failed to complete onboarding"));
+        }
+    }
+    /**
+     * Public server configuration (feature flags) — read pre-auth to adapt the
+     * UI, e.g. whether MFA enrollment is mandatory during onboarding. Returns
+     * permissive defaults if the endpoint is unavailable so onboarding never
+     * hard-blocks on a missing/older server.
+     */
+    static async getServerConfig() {
+        try {
+            const response = await apiFetch("/config", { method: "GET" });
+            if (!response.ok) {
+                return { require_mfa_enrollment: false, registration_enabled: true };
+            }
+            return (await response.json());
+        }
+        catch {
+            return { require_mfa_enrollment: false, registration_enabled: true };
+        }
+    }
+    // Validator hints kept on the class as re-exports of the canonical
+    // free functions in `utils/validation`. The server enforces the same
+    // rules authoritatively (see entropy-auth's `password::policy`); the
+    // versions here are UI-only previews so the user sees feedback before
+    // the round-trip.
+    static validatePassword = validatePasswordUtil;
+    static validateEmail = validateEmailUtil;
+    static validateUsername = validateUsernameUtil;
+}
+export default AuthService;
+//# sourceMappingURL=auth.service.js.map

package/lib/services/auth.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.service.js","sourceRoot":"","sources":["../../src/services/auth.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC3E,OAAO,EACL,aAAa,IAAI,iBAAiB,EAClC,gBAAgB,IAAI,oBAAoB,EACxC,gBAAgB,IAAI,oBAAoB,GACzC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,SAAS,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,iBAAiB,IAAI,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEzE,wEAAwE;AACxE,sEAAsE;AACtE,sEAAsE;AACtE,kEAAkE;AAClE,6CAA6C;AAC7C,MAAM,oBAAoB,GAAG,WAAW,CAAC;AACzC,IAAI,YAAY,GAAgB,IAAI,CAAC;AAErC,SAAS,WAAW;IAClB,OAAO,GAAG,SAAS,CAAC,gBAAgB,EAAE,IAAI,oBAAoB,EAAE,CAAC;AACnE,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,IAAU;IACnC,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QAC1B,YAAY,GAAG,IAAI,CAAC;QACpB,OAAO;IACT,CAAC;IACD,MAAM,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,kBAAkB;IAC/B,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QAC1B,YAAY,GAAG,IAAI,CAAC;QACpB,OAAO;IACT,CAAC;IACD,MAAM,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB,CAAC,QAAkB;IACjD,MAAM,IAAI,GAAY,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC5C,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACvD,OAAO,IAAoB,CAAC;IAC9B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAY,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;AACnD,CAAC;AAED,KAAK,UAAU,iBAAiB;IAC9B,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAS,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AA+ED;;;;GAIG;AACH,MAAM,WAAW;IACf,MAAM,CAAC,qBAAqB,GAAG,SAAS,CAAC,qBAAqB,CAAC;IAC/D,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC;IACzC,MAAM,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC;IACzC,MAAM,CAAC,YAAY,GAAG,SAAS,CAAC,YAAY,CAAC;IAC7C,MAAM,CAAC,eAAe,GAAG,SAAS,CAAC,eAAe,CAAC;IAEnD;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,KAAK,CAAC,kBAAkB,CAAC,IAAkB;QAChD,kEAAkE;QAClE,yDAAyD;QACzD,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC,iBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,KAAa,EAAE,QAAgB;QAChD,4DAA4D;QAC5D,4DAA4D;QAC5D,+DAA+D;QAC/D,2DAA2D;QAC3D,2DAA2D;QAC3D,yDAAyD;QACzD,kDAAkD;QAClD,uDAAuD;QACvD,oBAAoB;QACpB,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACrC,wEAAwE;QACxE,uEAAuE;QACvE,yEAAyE;QACzE,0EAA0E;QAC1E,MAAM,IAAI,GACR,SAAS,CAAC,WAAW,EAAE,KAAK,cAAc;YACxC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE;YACpE,CAAC,CAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAA0B,CAAC;QACvD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,aAAa,EAAE;YAC7C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,eAAe,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,WAAW,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,QAAQ,CACnB,KAAa,EACb,QAA4B,EAC5B,QAAgB,EAChB,WAAoB;QAEpB,MAAM,IAAI,GAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7E,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC3B,CAAC;QACD,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC9B,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QAClC,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,gBAAgB,EAAE;YAChD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,eAAe,CAAC,QAAQ,EAAE,qBAAqB,CAAC,CAAC;QAC/D,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,WAAW,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,MAAM;QACjB,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,cAAc,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,8DAA8D;YAC9D,+DAA+D;YAC/D,4DAA4D;YAC5D,6DAA6D;YAC7D,0DAA0D;YAC1D,iCAAiC;YACjC,IAAI,OAAO,EAAE,CAAC;gBACZ,OAAO,CAAC,IAAI,CAAC,0DAA0D,EAAE,CAAC,CAAC,CAAC;YAC9E,CAAC;QACH,CAAC;gBAAS,CAAC;YACT,MAAM,SAAS,CAAC,iBAAiB,EAAE,CAAC;YACpC,MAAM,kBAAkB,EAAE,CAAC;YAC3B,oBAAoB,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,cAAc;QACzB,OAAO,iBAAiB,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,eAAe;QAC1B,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC,EAAE,CAAC;gBACpC,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC5B,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC;gBACtB,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAS,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACzC,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,KAAK,CAAC,eAAe;QAC1B,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;YAC1B,IAAI,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACvD,IAAI,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClD,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;YACD,OAAO,CAAC,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC,KAAK,IAAI,CAAC;QAChD,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,eAAe,EAAE,CAAC;QAChD,OAAO,KAAK,KAAK,IAAI,CAAC;IACxB,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,IAAsB;QACzC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QACzC,OAAO,IAAI,EAAE,IAAI,KAAK,IAAI,CAAC;IAC7B,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,QAAgB;QACzC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,cAAc,EAAE;YAC9C,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAM,mBAAmB,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,SAAS,CAAC,iBAAiB,EAAE,CAAC;QACpC,MAAM,kBAAkB,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,cAAc,CACzB,eAAuB,EACvB,WAAmB,EACnB,YAAiE;QAEjE,MAAM,IAAI,GAA4B;YACpC,gBAAgB,EAAE,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC;YAClD,YAAY,EAAE,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC;SAC3C,CAAC;QACF,IAAI,YAAY,EAAE,CAAC;YACjB,IAAI,CAAC,iBAAiB,GAAG,YAAY,CAAC,iBAAiB,CAAC;YACxD,IAAI,CAAC,WAAW,GAAG,YAAY,CAAC,WAAW,CAAC;QAC9C,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,gBAAgB,EAAE;YAChD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAM,mBAAmB,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,QAAgB,EAAE,QAAgB;QACzD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,aAAa,EAAE;YAC7C,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;SACnF,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAM,mBAAmB,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,WAAmB;QAChD,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,oBAAoB,EAAE;YACpD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;SACpD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAM,mBAAmB,CAAC,QAAQ,EAAE,+BAA+B,CAAC,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,QAAQ;QACnB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAM,mBAAmB,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC/B,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,IAAY;QACtC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,wBAAwB,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;SAC/B,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAM,mBAAmB,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAAY;QACjC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,kBAAkB,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;SAC/B,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAM,mBAAmB,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,QAAgB;QACtC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE;YAC3C,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAM,mBAAmB,CAAC,QAAQ,EAAE,uBAAuB,CAAC,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,KAAa;QACvC,yDAAyD;QACzD,MAAM,IAAI,GACR,SAAS,CAAC,WAAW,EAAE,KAAK,cAAc;YACxC,CAAC,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,SAAS,EAAE,EAAE,KAAK,EAAE;YAC1C,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;QAChB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,uBAAuB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC3B,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAM,mBAAmB,CAAC,QAAQ,EAAE,4BAA4B,CAAC,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAY;QACzC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,2BAA2B,EAAE;YAC3D,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;SAC/B,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,eAAe,CAAC,QAAQ,EAAE,yBAAyB,CAAC,CAAC;QACnE,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,IAAY,EAAE,WAAmB;QAC1D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,sBAAsB,EAAE;YACtD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;SAC3E,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,eAAe,CAAC,QAAQ,EAAE,0BAA0B,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,IAAY;QACnC,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,oBAAoB,EAAE;YACpD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC;SAC/B,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAM,mBAAmB,CAAC,QAAQ,EAAE,2BAA2B,CAAC,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,kBAAkB;QAC7B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAM,mBAAmB,CAAC,QAAQ,EAAE,qCAAqC,CAAC,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,CAAC,kBAAkB;QAC7B,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QACjF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,MAAM,mBAAmB,CAAC,QAAQ,EAAE,+BAA+B,CAAC,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,KAAK,CAAC,eAAe;QAC1B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;YAC9D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,OAAO,EAAE,sBAAsB,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;YACvE,CAAC;YACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAiB,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,sBAAsB,EAAE,KAAK,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC;QACvE,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,qEAAqE;IACrE,qEAAqE;IACrE,sEAAsE;IACtE,kBAAkB;IAClB,MAAM,CAAC,gBAAgB,GAAG,oBAAoB,CAAC;IAC/C,MAAM,CAAC,aAAa,GAAG,iBAAiB,CAAC;IACzC,MAAM,CAAC,gBAAgB,GAAG,oBAAoB,CAAC;;AAGjD,eAAe,WAAW,CAAC"}

package/lib/services/favicon.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Favicon-resolution helpers shared between mobile + extension.
+ *
+ * Items in the vault (and analogues in other Entropy apps) store an
+ * `icon_url` reference that may be:
+ *
+ *   * a `custom:<uploadId>` marker for a server-side upload — resolved
+ *     at render time through the auth-aware transport;
+ *   * an arbitrary public URL (logo CDN, etc.) — used verbatim;
+ *   * `null` / empty — the renderer derives a favicon URL from the
+ *     item's site URL via the server's favicon-proxy endpoint.
+ */
+/**
+ * Build the favicon-proxy URL for a site, or return `null` when no
+ * proxy URL can be built. The caller falls back to its default
+ * placeholder when null is returned.
+ */
+export declare function buildFaviconUrl(siteUrl: string | null | undefined, faviconPath?: string): string | null;
+/** Wrap a raw upload id as a `custom:<id>` reference for storage. */
+export declare function customIconRef(uploadId: string): string;
+/** True if the stored icon reference points at a custom upload. */
+export declare function isCustomIconRef(iconRef: string | null | undefined): boolean;
+/** Extract the upload id from a `custom:<id>` reference. */
+export declare function customIconId(iconRef: string | null | undefined): string | null;
+/** Tagged result describing how the renderer should source an item's icon. */
+export type ResolvedIcon = {
+    kind: "upload";
+    uploadId: string;
+} | {
+    kind: "url";
+    uri: string;
+} | {
+    kind: "none";
+};
+/**
+ * Pick the right source for an item's icon. Returning a tagged variant
+ * (rather than always coercing to a URL string) lets the renderer
+ * handle the auth-required upload case differently from public-favicon
+ * URLs without sniffing path patterns at the call site.
+ */
+export declare function resolveIcon(opts: {
+    iconUrl?: string | null;
+    siteUrl?: string | null;
+    faviconPath?: string;
+}): ResolvedIcon;
+//# sourceMappingURL=favicon.d.ts.map

package/lib/services/favicon.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"favicon.d.ts","sourceRoot":"","sources":["../../src/services/favicon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAClC,WAAW,SAAa,GACvB,MAAM,GAAG,IAAI,CA6Bf;AAED,qEAAqE;AACrE,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEtD;AAED,mEAAmE;AACnE,wBAAgB,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE3E;AAED,4DAA4D;AAC5D,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAM9E;AAED,8EAA8E;AAC9E,MAAM,MAAM,YAAY,GACpB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAC5B;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAErB;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE;IAChC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB,GAAG,YAAY,CAUf"}

package/lib/services/favicon.js

@@ -0,0 +1,84 @@
+/**
+ * Favicon-resolution helpers shared between mobile + extension.
+ *
+ * Items in the vault (and analogues in other Entropy apps) store an
+ * `icon_url` reference that may be:
+ *
+ *   * a `custom:<uploadId>` marker for a server-side upload — resolved
+ *     at render time through the auth-aware transport;
+ *   * an arbitrary public URL (logo CDN, etc.) — used verbatim;
+ *   * `null` / empty — the renderer derives a favicon URL from the
+ *     item's site URL via the server's favicon-proxy endpoint.
+ */
+import { getBaseUrl } from "./api-config";
+const CUSTOM_ICON_PREFIX = "custom:";
+/**
+ * Build the favicon-proxy URL for a site, or return `null` when no
+ * proxy URL can be built. The caller falls back to its default
+ * placeholder when null is returned.
+ */
+export function buildFaviconUrl(siteUrl, faviconPath = "/favicon") {
+    if (!siteUrl) {
+        return null;
+    }
+    const trimmed = siteUrl.trim();
+    if (!trimmed) {
+        return null;
+    }
+    let normalized = trimmed;
+    // Reject non-http(s) schemes up front. If we skipped this and just
+    // prepended `https://`, an `ftp:` input would parse as
+    // `https://ftp://…` — `URL` accepts it, the protocol comes out as
+    // `https:`, and a non-web origin leaks into the favicon proxy query.
+    const explicitScheme = /^([a-z][a-z0-9+.-]*):\/\//i.exec(normalized)?.[1];
+    if (explicitScheme && !/^https?$/i.test(explicitScheme)) {
+        return null;
+    }
+    if (!/^https?:\/\//i.test(normalized)) {
+        normalized = `https://${normalized}`;
+    }
+    try {
+        const parsed = new URL(normalized);
+        if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+            return null;
+        }
+        return `${getBaseUrl()}${faviconPath}?url=${encodeURIComponent(parsed.toString())}`;
+    }
+    catch {
+        return null;
+    }
+}
+/** Wrap a raw upload id as a `custom:<id>` reference for storage. */
+export function customIconRef(uploadId) {
+    return `${CUSTOM_ICON_PREFIX}${uploadId}`;
+}
+/** True if the stored icon reference points at a custom upload. */
+export function isCustomIconRef(iconRef) {
+    return !!iconRef && iconRef.startsWith(CUSTOM_ICON_PREFIX);
+}
+/** Extract the upload id from a `custom:<id>` reference. */
+export function customIconId(iconRef) {
+    if (!iconRef || !iconRef.startsWith(CUSTOM_ICON_PREFIX)) {
+        return null;
+    }
+    const id = iconRef.slice(CUSTOM_ICON_PREFIX.length);
+    return id || null;
+}
+/**
+ * Pick the right source for an item's icon. Returning a tagged variant
+ * (rather than always coercing to a URL string) lets the renderer
+ * handle the auth-required upload case differently from public-favicon
+ * URLs without sniffing path patterns at the call site.
+ */
+export function resolveIcon(opts) {
+    if (opts.iconUrl) {
+        const uploadId = customIconId(opts.iconUrl);
+        if (uploadId) {
+            return { kind: "upload", uploadId };
+        }
+        return { kind: "url", uri: opts.iconUrl };
+    }
+    const fav = buildFaviconUrl(opts.siteUrl, opts.faviconPath);
+    return fav ? { kind: "url", uri: fav } : { kind: "none" };
+}
+//# sourceMappingURL=favicon.js.map

package/lib/services/favicon.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"favicon.js","sourceRoot":"","sources":["../../src/services/favicon.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,MAAM,kBAAkB,GAAG,SAAS,CAAC;AAErC;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,OAAkC,EAClC,WAAW,GAAG,UAAU;IAExB,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAC/B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,UAAU,GAAG,OAAO,CAAC;IACzB,mEAAmE;IACnE,uDAAuD;IACvD,kEAAkE;IAClE,qEAAqE;IACrE,MAAM,cAAc,GAAG,4BAA4B,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1E,IAAI,cAAc,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACtC,UAAU,GAAG,WAAW,UAAU,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC;QACnC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,GAAG,UAAU,EAAE,GAAG,WAAW,QAAQ,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;IACtF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,aAAa,CAAC,QAAgB;IAC5C,OAAO,GAAG,kBAAkB,GAAG,QAAQ,EAAE,CAAC;AAC5C,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,eAAe,CAAC,OAAkC;IAChE,OAAO,CAAC,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,CAAC;AAC7D,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,YAAY,CAAC,OAAkC;IAC7D,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC;IACpD,OAAO,EAAE,IAAI,IAAI,CAAC;AACpB,CAAC;AAQD;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAI3B;IACC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC5C,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACtC,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAC5C,CAAC;IACD,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;IAC5D,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC5D,CAAC"}

package/lib/services/hibp-cache.d.ts

@@ -0,0 +1,23 @@
+export interface HibpPolicy {
+    enabled: boolean;
+    enforce: boolean;
+    block_threshold: number;
+}
+export declare function getCachedPolicy(): HibpPolicy | null;
+export declare function setCachedPolicy(policy: HibpPolicy): void;
+export declare function clearCachedPolicy(): void;
+/**
+ * Fetch the HIBP policy from the server (`GET /config`). Result is
+ * memoized in the in-process cache for the lifetime of the app — call
+ * once at startup (typically from `<AuthProvider onBeforeCheckAuth>`).
+ * Server-unreachable falls back to `DEFAULT_POLICY` so the caller is
+ * never blocked.
+ */
+export declare function fetchHibpPolicy(): Promise<HibpPolicy>;
+/**
+ * Synchronous view of the cached policy. Returns the default when
+ * `fetchHibpPolicy` hasn't completed yet; suitable for render-time
+ * gating where blocking is unacceptable.
+ */
+export declare function getHibpPolicy(): HibpPolicy;
+//# sourceMappingURL=hibp-cache.d.ts.map

package/lib/services/hibp-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hibp-cache.d.ts","sourceRoot":"","sources":["../../src/services/hibp-cache.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;CACzB;AAeD,wBAAgB,eAAe,IAAI,UAAU,GAAG,IAAI,CAEnD;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAExD;AAED,wBAAgB,iBAAiB,IAAI,IAAI,CAExC;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,UAAU,CAAC,CAiB3D;AAED;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,UAAU,CAE1C"}

package/lib/services/hibp-cache.js

@@ -0,0 +1,56 @@
+/**
+ * Shared HIBP policy cache — separated to avoid circular imports between
+ * `auth.service` (which clears it) and the consumer's policy fetcher.
+ */
+import { apiFetch } from "../utils/api-fetch";
+/** Conservative default — block re-use of widely-leaked passwords. */
+const DEFAULT_POLICY = {
+    enabled: true,
+    enforce: true,
+    block_threshold: 1000,
+};
+let cachedPolicy = null;
+export function getCachedPolicy() {
+    return cachedPolicy;
+}
+export function setCachedPolicy(policy) {
+    cachedPolicy = policy;
+}
+export function clearCachedPolicy() {
+    cachedPolicy = null;
+}
+/**
+ * Fetch the HIBP policy from the server (`GET /config`). Result is
+ * memoized in the in-process cache for the lifetime of the app — call
+ * once at startup (typically from `<AuthProvider onBeforeCheckAuth>`).
+ * Server-unreachable falls back to `DEFAULT_POLICY` so the caller is
+ * never blocked.
+ */
+export async function fetchHibpPolicy() {
+    const cached = cachedPolicy;
+    if (cached) {
+        return cached;
+    }
+    try {
+        const response = await apiFetch("/config");
+        if (response.ok) {
+            const config = await response.json();
+            cachedPolicy = config.hibp;
+            return config.hibp;
+        }
+    }
+    catch {
+        // Server unreachable — fall through to default.
+    }
+    cachedPolicy = DEFAULT_POLICY;
+    return DEFAULT_POLICY;
+}
+/**
+ * Synchronous view of the cached policy. Returns the default when
+ * `fetchHibpPolicy` hasn't completed yet; suitable for render-time
+ * gating where blocking is unacceptable.
+ */
+export function getHibpPolicy() {
+    return cachedPolicy ?? DEFAULT_POLICY;
+}
+//# sourceMappingURL=hibp-cache.js.map

package/lib/services/hibp-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hibp-cache.js","sourceRoot":"","sources":["../../src/services/hibp-cache.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAY9C,sEAAsE;AACtE,MAAM,cAAc,GAAe;IACjC,OAAO,EAAE,IAAI;IACb,OAAO,EAAE,IAAI;IACb,eAAe,EAAE,IAAI;CACtB,CAAC;AAEF,IAAI,YAAY,GAAsB,IAAI,CAAC;AAE3C,MAAM,UAAU,eAAe;IAC7B,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAkB;IAChD,YAAY,GAAG,MAAM,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,MAAM,GAAG,YAAY,CAAC;IAC5B,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QAC3C,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,MAAM,GAAiB,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnD,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC;YAC3B,OAAO,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;IACD,YAAY,GAAG,cAAc,CAAC;IAC9B,OAAO,cAAc,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,YAAY,IAAI,cAAc,CAAC;AACxC,CAAC"}

package/lib/services/hibp.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Have-I-Been-Pwned password lookup using `k`-anonymity.
+ *
+ * Sends only the first five hex characters of the SHA-1 hash to the HIBP
+ * API. The full hash and plaintext never leave the device. Designed to be
+ * called from a debounced password-input change handler — see `debounce`
+ * below.
+ */
+export interface PwnedPasswordResult {
+    /** `true` = breached, `false` = safe, `null` = check failed (unknown). */
+    isPwned: boolean | null;
+    count: number;
+    error?: string;
+}
+export declare function checkPasswordPwned(password: string): Promise<PwnedPasswordResult>;
+export interface PwnedMessage {
+    title: string;
+    message: string;
+    severity: "error" | "warning" | "info";
+}
+/**
+ * Build a user-friendly message for a HIBP result. The policy comes from
+ * the shared cache populated by the consumer (see `hibp-cache.ts`). If no
+ * policy is cached, falls back to a non-enforcing default.
+ */
+export declare function getPwnedMessage(result: PwnedPasswordResult): PwnedMessage;
+export { debounce } from "../utils/debounce";
+//# sourceMappingURL=hibp.d.ts.map

package/lib/services/hibp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hibp.d.ts","sourceRoot":"","sources":["../../src/services/hibp.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAOH,MAAM,WAAW,mBAAmB;IAClC,0EAA0E;IAC1E,OAAO,EAAE,OAAO,GAAG,IAAI,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA6CvF;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,GAAG,SAAS,GAAG,MAAM,CAAC;CACxC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,mBAAmB,GAAG,YAAY,CAoCzE;AAID,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC"}