@entropy-softworks/ui 2026.7.31

package/lib/services/hibp.js

@@ -0,0 +1,92 @@
+/**
+ * Have-I-Been-Pwned password lookup using `k`-anonymity.
+ *
+ * Sends only the first five hex characters of the SHA-1 hash to the HIBP
+ * API. The full hash and plaintext never leave the device. Designed to be
+ * called from a debounced password-input change handler — see `debounce`
+ * below.
+ */
+import { Platform } from "react-native";
+import * as Crypto from "expo-crypto";
+import { fetchWithTimeout } from "../utils/fetch";
+import { getCachedPolicy } from "./hibp-cache";
+export async function checkPasswordPwned(password) {
+    try {
+        const hash = await Crypto.digestStringAsync(Crypto.CryptoDigestAlgorithm.SHA1, password, {
+            encoding: Crypto.CryptoEncoding.HEX,
+        });
+        const hashUpperCase = hash.toUpperCase();
+        const prefix = hashUpperCase.substring(0, 5);
+        const suffix = hashUpperCase.substring(5);
+        const response = await fetchWithTimeout(`https://api.pwnedpasswords.com/range/${prefix}`, {
+            method: "GET",
+            headers: {
+                // User-Agent is a forbidden header in browsers and cannot be set
+                // via fetch — the browser sends its own. On native, expo handles it.
+                ...(Platform.OS !== "web" ? { "User-Agent": "Entropy Softworks Client" } : {}),
+                "Add-Padding": "true",
+            },
+        }, 10_000);
+        if (!response.ok) {
+            throw new Error(`HIBP API returned status ${response.status}`);
+        }
+        const text = await response.text();
+        const hashes = text.split("\r\n").filter((line) => line.length > 0);
+        for (const hashLine of hashes) {
+            const [hashSuffix, count] = hashLine.split(":");
+            if (hashSuffix === suffix && count) {
+                return { isPwned: true, count: parseInt(count, 10) };
+            }
+        }
+        return { isPwned: false, count: 0 };
+    }
+    catch {
+        return {
+            isPwned: null,
+            count: 0,
+            error: "Unable to verify password security. Please try again later.",
+        };
+    }
+}
+/**
+ * Build a user-friendly message for a HIBP result. The policy comes from
+ * the shared cache populated by the consumer (see `hibp-cache.ts`). If no
+ * policy is cached, falls back to a non-enforcing default.
+ */
+export function getPwnedMessage(result) {
+    if (result.error) {
+        return {
+            title: "Unable to Verify",
+            message: result.error,
+            severity: "info",
+        };
+    }
+    if (result.isPwned === false) {
+        return {
+            title: "Password Is Safe",
+            message: "This password has not been found in any known data breaches.",
+            severity: "info",
+        };
+    }
+    const policy = getCachedPolicy() ?? {
+        enabled: true,
+        enforce: false,
+        block_threshold: 0,
+    };
+    if (policy.enforce && result.count > policy.block_threshold) {
+        return {
+            title: "Password Compromised!",
+            message: `This password has appeared in ${result.count.toLocaleString()} known data breaches. Please choose a different password.`,
+            severity: "error",
+        };
+    }
+    return {
+        title: "Password Found in Breach",
+        message: `This password has appeared ${result.count.toLocaleString()} time${result.count > 1 ? "s" : ""} in data breaches. Consider choosing a different password.`,
+        severity: "warning",
+    };
+}
+// `debounce` moved to `utils/debounce`; re-exported here for back-compat
+// with existing `@entropy-softworks/ui/services/hibp` consumers.
+export { debounce } from "../utils/debounce";
+//# sourceMappingURL=hibp.js.map

package/lib/services/hibp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hibp.js","sourceRoot":"","sources":["../../src/services/hibp.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAmB,MAAM,cAAc,CAAC;AAShE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,QAAgB;IACvD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,MAAM,CAAC,qBAAqB,CAAC,IAAI,EAAE,QAAQ,EAAE;YACvF,QAAQ,EAAE,MAAM,CAAC,cAAc,CAAC,GAAG;SACpC,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAE1C,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CACrC,wCAAwC,MAAM,EAAE,EAChD;YACE,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,iEAAiE;gBACjE,qEAAqE;gBACrE,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,0BAA0B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9E,aAAa,EAAE,MAAM;aACtB;SACF,EACD,MAAM,CACP,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAEpE,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;YAC9B,MAAM,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAChD,IAAI,UAAU,KAAK,MAAM,IAAI,KAAK,EAAE,CAAC;gBACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;YACvD,CAAC;QACH,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,CAAC;YACR,KAAK,EAAE,6DAA6D;SACrE,CAAC;IACJ,CAAC;AACH,CAAC;AAQD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,MAA2B;IACzD,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,OAAO;YACL,KAAK,EAAE,kBAAkB;YACzB,OAAO,EAAE,MAAM,CAAC,KAAK;YACrB,QAAQ,EAAE,MAAM;SACjB,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC7B,OAAO;YACL,KAAK,EAAE,kBAAkB;YACzB,OAAO,EAAE,8DAA8D;YACvE,QAAQ,EAAE,MAAM;SACjB,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAe,eAAe,EAAE,IAAI;QAC9C,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,KAAK;QACd,eAAe,EAAE,CAAC;KACnB,CAAC;IAEF,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,eAAe,EAAE,CAAC;QAC5D,OAAO;YACL,KAAK,EAAE,uBAAuB;YAC9B,OAAO,EAAE,iCAAiC,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,2DAA2D;YAClI,QAAQ,EAAE,OAAO;SAClB,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK,EAAE,0BAA0B;QACjC,OAAO,EAAE,8BAA8B,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,QAAQ,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,4DAA4D;QACnK,QAAQ,EAAE,SAAS;KACpB,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,iEAAiE;AACjE,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC"}

package/lib/services/index.d.ts

@@ -0,0 +1,8 @@
+export { default as AuthService } from "./auth.service";
+export type { User, AuthResponse, LoginRequest, RegisterRequest, ErrorResponse, MfaSetupResponse, ServerConfig, } from "./auth.service";
+export { isPasskeySupported, registerPasskey, authenticateWithPasskey } from "./passkey";
+export { configureApi, getBaseUrl, getDefaultBaseUrl, getStoragePrefix, setBaseUrl, resetBaseUrl, loadServerUrlOverride, getSessionToken, storeSessionToken, clearSessionToken, getAuthMode, getTenant, setTenant, type ApiConfig, } from "./api-config";
+export { checkPasswordPwned, getPwnedMessage, type PwnedPasswordResult, type PwnedMessage, } from "./hibp";
+export { getCachedPolicy as getCachedHibpPolicy, fetchHibpPolicy, getHibpPolicy, type HibpPolicy, } from "./hibp-cache";
+export { buildFaviconUrl, customIconId, customIconRef, isCustomIconRef, resolveIcon, type ResolvedIcon, } from "./favicon";
+//# sourceMappingURL=index.d.ts.map

package/lib/services/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/services/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACxD,YAAY,EACV,IAAI,EACJ,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,aAAa,EACb,gBAAgB,EAChB,YAAY,GACb,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAEzF,OAAO,EACL,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,qBAAqB,EACrB,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,SAAS,EACT,SAAS,EACT,KAAK,SAAS,GACf,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,KAAK,mBAAmB,EACxB,KAAK,YAAY,GAClB,MAAM,QAAQ,CAAC;AAEhB,OAAO,EACL,eAAe,IAAI,mBAAmB,EACtC,eAAe,EACf,aAAa,EACb,KAAK,UAAU,GAChB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,eAAe,EACf,YAAY,EACZ,aAAa,EACb,eAAe,EACf,WAAW,EACX,KAAK,YAAY,GAClB,MAAM,WAAW,CAAC"}

package/lib/services/index.js

@@ -0,0 +1,7 @@
+export { default as AuthService } from "./auth.service";
+export { isPasskeySupported, registerPasskey, authenticateWithPasskey } from "./passkey";
+export { configureApi, getBaseUrl, getDefaultBaseUrl, getStoragePrefix, setBaseUrl, resetBaseUrl, loadServerUrlOverride, getSessionToken, storeSessionToken, clearSessionToken, getAuthMode, getTenant, setTenant, } from "./api-config";
+export { checkPasswordPwned, getPwnedMessage, } from "./hibp";
+export { getCachedPolicy as getCachedHibpPolicy, fetchHibpPolicy, getHibpPolicy, } from "./hibp-cache";
+export { buildFaviconUrl, customIconId, customIconRef, isCustomIconRef, resolveIcon, } from "./favicon";
+//# sourceMappingURL=index.js.map

package/lib/services/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/services/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAWxD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAC;AAEzF,OAAO,EACL,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,qBAAqB,EACrB,eAAe,EACf,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,SAAS,EACT,SAAS,GAEV,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,kBAAkB,EAClB,eAAe,GAGhB,MAAM,QAAQ,CAAC;AAEhB,OAAO,EACL,eAAe,IAAI,mBAAmB,EACtC,eAAe,EACf,aAAa,GAEd,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,eAAe,EACf,YAAY,EACZ,aAAa,EACb,eAAe,EACf,WAAW,GAEZ,MAAM,WAAW,CAAC"}

package/lib/services/passkey.d.ts

@@ -0,0 +1,10 @@
+import type { AuthResponse } from "./auth.service";
+/** Whether this platform can do WebAuthn at all. */
+export declare function isPasskeySupported(): Promise<boolean>;
+/** Register a new passkey for the signed-in user. Triggers the OS biometric. */
+export declare function registerPasskey(label: string): Promise<{
+    label: string;
+}>;
+/** Sign in with a passkey. Returns the authenticated session. */
+export declare function authenticateWithPasskey(email?: string): Promise<AuthResponse>;
+//# sourceMappingURL=passkey.d.ts.map

package/lib/services/passkey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.d.ts","sourceRoot":"","sources":["../../src/services/passkey.ts"],"names":[],"mappings":"AAiBA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAmEnD,oDAAoD;AACpD,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,OAAO,CAAC,CAc3D;AAwFD,gFAAgF;AAChF,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAS/E;AAED,iEAAiE;AACjE,wBAAsB,uBAAuB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAYnF"}

package/lib/services/passkey.js

@@ -0,0 +1,192 @@
+// WebAuthn passkey client (auth-only — no PRF / key-wrapping). Shared across
+// Entropy Softworks Expo apps. Drives the OS authenticator (Face ID / Touch ID
+// / device passkey) and talks to the server's /auth/passkey/* ceremony
+// endpoints.
+//
+// Native (Expo dev build / store build) uses `react-native-passkey`, which
+// consumes/produces the WebAuthn JSON shapes directly (base64url strings). Web
+// uses the DOM `navigator.credentials` API, which needs ArrayBuffers, so the
+// base64url fields are rewritten in and serialized back out.
+//
+// NOTE: passkeys require a native build (not Expo Go) and an associated-domain
+// / asset-link binding the app to the server's WEBAUTHN_RP_ID. `react-native-
+// passkey` is a lazy import so apps/platforms that never call these functions
+// don't need it linked.
+import { Platform } from "react-native";
+import { getBaseUrl, getSessionToken, storeSessionToken } from "./api-config";
+// ── base64url ⇄ ArrayBuffer (web path only) ────────────────────────────────
+function b64urlToBuffer(value) {
+    const pad = "=".repeat((4 - (value.length % 4)) % 4);
+    const base64 = (value + pad).replace(/-/g, "+").replace(/_/g, "/");
+    const bin = atob(base64);
+    const bytes = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++) {
+        bytes[i] = bin.charCodeAt(i);
+    }
+    return bytes.buffer;
+}
+function bufferToB64url(buf) {
+    const bytes = new Uint8Array(buf);
+    let bin = "";
+    for (const b of bytes) {
+        bin += String.fromCharCode(b);
+    }
+    return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+// ── transport ───────────────────────────────────────────────────────────────
+async function post(path, body) {
+    const headers = { "Content-Type": "application/json" };
+    const token = await getSessionToken();
+    if (token) {
+        headers.Authorization = `Bearer ${token}`;
+    }
+    return fetch(`${getBaseUrl()}${path}`, {
+        method: "POST",
+        headers,
+        credentials: "include",
+        body: JSON.stringify(body),
+    });
+}
+async function postJson(path, body) {
+    const res = await post(path, body);
+    if (!res.ok) {
+        let message = `request failed (${res.status})`;
+        try {
+            const data = await res.json();
+            message = data?.error?.message ?? message;
+        }
+        catch {
+            // non-JSON error body; keep the status message
+        }
+        throw new Error(message);
+    }
+    return (await res.json());
+}
+// react-native-passkey is a native module; import lazily so the web bundle and
+// type-checking don't hard-depend on it being linked.
+async function nativePasskey() {
+    const mod = await import("react-native-passkey");
+    return mod.Passkey;
+}
+/** Whether this platform can do WebAuthn at all. */
+export async function isPasskeySupported() {
+    if (Platform.OS === "web") {
+        return (typeof globalThis !== "undefined" &&
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+            !!globalThis.PublicKeyCredential);
+    }
+    try {
+        const Passkey = await nativePasskey();
+        return Boolean(Passkey.isSupported?.());
+    }
+    catch {
+        return false;
+    }
+}
+/** The inner `publicKey` object webauthn-rs wraps its options in. */
+function inner(options) {
+    const pk = options.publicKey;
+    return (pk && typeof pk === "object" ? pk : options);
+}
+async function createCredential(options) {
+    if (Platform.OS === "web") {
+        const pk = { ...inner(options) };
+        pk.challenge = b64urlToBuffer(pk.challenge);
+        const user = pk.user;
+        if (user && typeof user.id === "string") {
+            pk.user = { ...user, id: b64urlToBuffer(user.id) };
+        }
+        if (Array.isArray(pk.excludeCredentials)) {
+            pk.excludeCredentials = pk.excludeCredentials.map((c) => ({
+                ...c,
+                id: typeof c.id === "string" ? b64urlToBuffer(c.id) : c.id,
+            }));
+        }
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const cred = (await navigator.credentials.create({ publicKey: pk }));
+        return serializeWebCredential(cred);
+    }
+    const Passkey = await nativePasskey();
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    return Passkey.create(inner(options));
+}
+async function getCredential(options) {
+    if (Platform.OS === "web") {
+        const pk = { ...inner(options) };
+        pk.challenge = b64urlToBuffer(pk.challenge);
+        if (Array.isArray(pk.allowCredentials)) {
+            pk.allowCredentials = pk.allowCredentials.map((c) => ({
+                ...c,
+                id: typeof c.id === "string" ? b64urlToBuffer(c.id) : c.id,
+            }));
+        }
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        const cred = (await navigator.credentials.get({ publicKey: pk }));
+        return serializeWebCredential(cred);
+    }
+    const Passkey = await nativePasskey();
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    return Passkey.get(inner(options));
+}
+// Convert a DOM PublicKeyCredential into the base64url JSON the server expects.
+// eslint-disable-next-line @typescript-eslint/no-explicit-any
+function serializeWebCredential(cred) {
+    const r = cred.response;
+    const out = {
+        id: cred.id,
+        rawId: bufferToB64url(cred.rawId),
+        type: cred.type,
+        response: {},
+    };
+    const resp = out.response;
+    if (r.attestationObject) {
+        resp.attestationObject = bufferToB64url(r.attestationObject);
+    }
+    if (r.clientDataJSON) {
+        resp.clientDataJSON = bufferToB64url(r.clientDataJSON);
+    }
+    if (r.authenticatorData) {
+        resp.authenticatorData = bufferToB64url(r.authenticatorData);
+    }
+    if (r.signature) {
+        resp.signature = bufferToB64url(r.signature);
+    }
+    if (r.userHandle) {
+        resp.userHandle = bufferToB64url(r.userHandle);
+    }
+    return out;
+}
+function clientExtensionResults(cred) {
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const c = cred;
+    if (typeof c?.getClientExtensionResults === "function") {
+        return c.getClientExtensionResults();
+    }
+    return c?.clientExtensionResults;
+}
+/** Register a new passkey for the signed-in user. Triggers the OS biometric. */
+export async function registerPasskey(label) {
+    const begin = await postJson("/auth/passkey/register/begin", { label });
+    const credential = await createCredential(begin.publickeyOptions);
+    return postJson("/auth/passkey/register/finish", {
+        ceremonyId: begin.ceremonyId,
+        label,
+        credential,
+        clientExtensionResults: clientExtensionResults(credential),
+    });
+}
+/** Sign in with a passkey. Returns the authenticated session. */
+export async function authenticateWithPasskey(email) {
+    const begin = await postJson("/auth/passkey/authenticate/begin", { email });
+    const credential = await getCredential(begin.publickeyOptions);
+    const auth = await postJson("/auth/passkey/authenticate/finish", {
+        ceremonyId: begin.ceremonyId,
+        credential,
+        clientExtensionResults: clientExtensionResults(credential),
+    });
+    if (auth.session_token) {
+        await storeSessionToken(auth.session_token);
+    }
+    return auth;
+}
+//# sourceMappingURL=passkey.js.map

package/lib/services/passkey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.js","sourceRoot":"","sources":["../../src/services/passkey.ts"],"names":[],"mappings":"AAAA,6EAA6E;AAC7E,+EAA+E;AAC/E,uEAAuE;AACvE,aAAa;AACb,EAAE;AACF,2EAA2E;AAC3E,+EAA+E;AAC/E,6EAA6E;AAC7E,6DAA6D;AAC7D,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,8EAA8E;AAC9E,wBAAwB;AAExB,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAG9E,8EAA8E;AAE9E,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACzC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED,SAAS,cAAc,CAAC,GAAgB;IACtC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,+EAA+E;AAE/E,KAAK,UAAU,IAAI,CAAC,IAAY,EAAE,IAAa;IAC7C,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;IAC/E,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,aAAa,GAAG,UAAU,KAAK,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,KAAK,CAAC,GAAG,UAAU,EAAE,GAAG,IAAI,EAAE,EAAE;QACrC,MAAM,EAAE,MAAM;QACd,OAAO;QACP,WAAW,EAAE,SAAS;QACtB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,QAAQ,CAAI,IAAY,EAAE,IAAa;IACpD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACnC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,IAAI,OAAO,GAAG,mBAAmB,GAAG,CAAC,MAAM,GAAG,CAAC;QAC/C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9B,OAAO,GAAG,IAAI,EAAE,KAAK,EAAE,OAAO,IAAI,OAAO,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAM,CAAC;AACjC,CAAC;AAOD,+EAA+E;AAC/E,sDAAsD;AACtD,KAAK,UAAU,aAAa;IAC1B,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;IACjD,OAAO,GAAG,CAAC,OAAO,CAAC;AACrB,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO,CACL,OAAO,UAAU,KAAK,WAAW;YACjC,8DAA8D;YAC9D,CAAC,CAAE,UAAkB,CAAC,mBAAmB,CAC1C,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;QACtC,OAAO,OAAO,CAAE,OAA2C,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,SAAS,KAAK,CAAC,OAAgC;IAC7C,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;IAC7B,OAAO,CAAC,EAAE,IAAI,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAA4B,CAAC;AAClF,CAAC;AAED,KAAK,UAAU,gBAAgB,CAAC,OAAgC;IAC9D,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,EAAE,CAAC,SAAS,GAAG,cAAc,CAAC,EAAE,CAAC,SAAmB,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,EAAE,CAAC,IAA2C,CAAC;QAC5D,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;YACxC,EAAE,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QACrD,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACzC,EAAE,CAAC,kBAAkB,GAAI,EAAE,CAAC,kBAAgD,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvF,GAAG,CAAC;gBACJ,EAAE,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;aAC3D,CAAC,CAAC,CAAC;QACN,CAAC;QACD,8DAA8D;QAC9D,MAAM,IAAI,GAAG,CAAC,MAAM,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,EAAS,EAAE,CAAC,CAAQ,CAAC;QACnF,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;IACtC,8DAA8D;IAC9D,OAAQ,OAAe,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;AACjD,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAAgC;IAC3D,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,EAAE,CAAC,SAAS,GAAG,cAAc,CAAC,EAAE,CAAC,SAAmB,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACvC,EAAE,CAAC,gBAAgB,GAAI,EAAE,CAAC,gBAA8C,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACnF,GAAG,CAAC;gBACJ,EAAE,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;aAC3D,CAAC,CAAC,CAAC;QACN,CAAC;QACD,8DAA8D;QAC9D,MAAM,IAAI,GAAG,CAAC,MAAM,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,EAAS,EAAE,CAAC,CAAQ,CAAC;QAChF,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAC;IACtC,8DAA8D;IAC9D,OAAQ,OAAe,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,gFAAgF;AAChF,8DAA8D;AAC9D,SAAS,sBAAsB,CAAC,IAAS;IACvC,MAAM,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC;IACxB,MAAM,GAAG,GAA4B;QACnC,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC;QACjC,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,QAAQ,EAAE,EAA6B;KACxC,CAAC;IACF,MAAM,IAAI,GAAG,GAAG,CAAC,QAAmC,CAAC;IACrD,IAAI,CAAC,CAAC,iBAAiB,EAAE,CAAC;QACxB,IAAI,CAAC,iBAAiB,GAAG,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,CAAC,iBAAiB,EAAE,CAAC;QACxB,IAAI,CAAC,iBAAiB,GAAG,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAChB,IAAI,CAAC,SAAS,GAAG,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,EAAE,CAAC;QACjB,IAAI,CAAC,UAAU,GAAG,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,sBAAsB,CAAC,IAAa;IAC3C,8DAA8D;IAC9D,MAAM,CAAC,GAAG,IAAW,CAAC;IACtB,IAAI,OAAO,CAAC,EAAE,yBAAyB,KAAK,UAAU,EAAE,CAAC;QACvD,OAAO,CAAC,CAAC,yBAAyB,EAAE,CAAC;IACvC,CAAC;IACD,OAAO,CAAC,EAAE,sBAAsB,CAAC;AACnC,CAAC;AAED,gFAAgF;AAChF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAgB,8BAA8B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACvF,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAClE,OAAO,QAAQ,CAAoB,+BAA+B,EAAE;QAClE,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,KAAK;QACL,UAAU;QACV,sBAAsB,EAAE,sBAAsB,CAAC,UAAU,CAAC;KAC3D,CAAC,CAAC;AACL,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAAc;IAC1D,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAgB,kCAAkC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3F,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAe,mCAAmC,EAAE;QAC7E,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,UAAU;QACV,sBAAsB,EAAE,sBAAsB,CAAC,UAAU,CAAC;KAC3D,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QACvB,MAAM,iBAAiB,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/lib/utils/api-fetch.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Cross-platform authed `fetch` for the entropy-ui auth flows.
+ *
+ * **Web**: HttpOnly session cookie (auto-attached, used in same-origin /
+ * production) + `X-CSRF-Token` on writes. Also attaches a `Bearer` token when
+ * one is stored (sessionStorage) — needed for split-origin dev where the Lax
+ * cookie can't ride cross-origin XHR.
+ * **Native**: Bearer token loaded from SecureStore.
+ */
+export declare function apiFetch(path: string, init?: RequestInit, timeoutMs?: number): Promise<Response>;
+//# sourceMappingURL=api-fetch.d.ts.map

package/lib/utils/api-fetch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-fetch.d.ts","sourceRoot":"","sources":["../../src/utils/api-fetch.ts"],"names":[],"mappings":"AAuBA;;;;;;;;GAQG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,WAAgB,EACtB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,QAAQ,CAAC,CAwBnB"}

package/lib/utils/api-fetch.js

@@ -0,0 +1,52 @@
+import { Platform } from "react-native";
+import { fetchWithTimeout } from "./fetch";
+import { getBaseUrl, getSessionToken } from "../services/api-config";
+const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
+const CSRF_COOKIE_NAME = "csrf_token";
+const CSRF_HEADER_NAME = "X-CSRF-Token";
+function readCookie(name) {
+    if (typeof document === "undefined") {
+        return null;
+    }
+    const prefix = `${name}=`;
+    for (const part of document.cookie.split(";")) {
+        const trimmed = part.trim();
+        if (trimmed.startsWith(prefix)) {
+            return decodeURIComponent(trimmed.slice(prefix.length));
+        }
+    }
+    return null;
+}
+/**
+ * Cross-platform authed `fetch` for the entropy-ui auth flows.
+ *
+ * **Web**: HttpOnly session cookie (auto-attached, used in same-origin /
+ * production) + `X-CSRF-Token` on writes. Also attaches a `Bearer` token when
+ * one is stored (sessionStorage) — needed for split-origin dev where the Lax
+ * cookie can't ride cross-origin XHR.
+ * **Native**: Bearer token loaded from SecureStore.
+ */
+export async function apiFetch(path, init = {}, timeoutMs) {
+    const url = `${getBaseUrl()}${path}`;
+    const method = (init.method ?? "GET").toUpperCase();
+    const headers = new Headers(init.headers);
+    if (Platform.OS === "web") {
+        if (!SAFE_METHODS.has(method)) {
+            const csrf = readCookie(CSRF_COOKIE_NAME);
+            if (csrf) {
+                headers.set(CSRF_HEADER_NAME, csrf);
+            }
+        }
+        const webToken = await getSessionToken();
+        if (webToken && !headers.has("Authorization")) {
+            headers.set("Authorization", `Bearer ${webToken}`);
+        }
+        return fetchWithTimeout(url, { ...init, headers, credentials: "include" }, timeoutMs);
+    }
+    const token = await getSessionToken();
+    if (token) {
+        headers.set("Authorization", `Bearer ${token}`);
+    }
+    return fetchWithTimeout(url, { ...init, headers }, timeoutMs);
+}
+//# sourceMappingURL=api-fetch.js.map

package/lib/utils/api-fetch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-fetch.js","sourceRoot":"","sources":["../../src/utils/api-fetch.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAErE,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AAEzD,MAAM,gBAAgB,GAAG,YAAY,CAAC;AACtC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAExC,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,OAAO,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,IAAY,EACZ,OAAoB,EAAE,EACtB,SAAkB;IAElB,MAAM,GAAG,GAAG,GAAG,UAAU,EAAE,GAAG,IAAI,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAE1C,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,gBAAgB,CAAC,CAAC;YAC1C,IAAI,IAAI,EAAE,CAAC;gBACT,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;YACtC,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,eAAe,EAAE,CAAC;QACzC,IAAI,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;YAC9C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,QAAQ,EAAE,CAAC,CAAC;QACrD,CAAC;QACD,OAAO,gBAAgB,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,SAAS,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,eAAe,EAAE,CAAC;IACtC,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,KAAK,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,gBAAgB,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;AAChE,CAAC"}

package/lib/utils/clipboard.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Centralised copy-to-clipboard with a single, module-scope auto-clear
+ * timer.
+ *
+ * Why module scope: tying the timer to a React component (via `useRef`)
+ * means it gets cancelled when the screen unmounts — which happens
+ * routinely (auto-lock on tab-switch, navigation to another item). The
+ * user's just-completed copy then either gets wiped immediately
+ * (component cleanup runs `setStringAsync("")`) or sits indefinitely.
+ *
+ * Behaviour:
+ *   * `copyToClipboard(value)` writes the value, returns `true` on
+ *     success.
+ *   * On success, schedules a 30-second auto-wipe.
+ *   * Subsequent copies cancel the prior timer and reschedule, so the
+ *     wipe is always 30 seconds from the *last* copy regardless of
+ *     which screen issued it.
+ *
+ * Limitation: we don't read the clipboard back (would require the
+ * clipboard-read permission), so if the user copies from another app
+ * between our copy and the auto-clear firing, we'll still wipe their
+ * value at the 30s mark. Acceptable trade-off for a password manager.
+ */
+/** Write `value` to the clipboard. Returns `true` if the write succeeded. */
+export declare function copyToClipboard(value: string): Promise<boolean>;
+/**
+ * Wipe the clipboard now (e.g. on explicit logout). Cancels the pending
+ * auto-clear so we don't fire a redundant wipe later.
+ */
+export declare function clearClipboardNow(): Promise<void>;
+//# sourceMappingURL=clipboard.d.ts.map

package/lib/utils/clipboard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clipboard.d.ts","sourceRoot":"","sources":["../../src/utils/clipboard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAQH,6EAA6E;AAC7E,wBAAsB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAqBrE;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAUvD"}

package/lib/utils/clipboard.js

@@ -0,0 +1,66 @@
+/**
+ * Centralised copy-to-clipboard with a single, module-scope auto-clear
+ * timer.
+ *
+ * Why module scope: tying the timer to a React component (via `useRef`)
+ * means it gets cancelled when the screen unmounts — which happens
+ * routinely (auto-lock on tab-switch, navigation to another item). The
+ * user's just-completed copy then either gets wiped immediately
+ * (component cleanup runs `setStringAsync("")`) or sits indefinitely.
+ *
+ * Behaviour:
+ *   * `copyToClipboard(value)` writes the value, returns `true` on
+ *     success.
+ *   * On success, schedules a 30-second auto-wipe.
+ *   * Subsequent copies cancel the prior timer and reschedule, so the
+ *     wipe is always 30 seconds from the *last* copy regardless of
+ *     which screen issued it.
+ *
+ * Limitation: we don't read the clipboard back (would require the
+ * clipboard-read permission), so if the user copies from another app
+ * between our copy and the auto-clear firing, we'll still wipe their
+ * value at the 30s mark. Acceptable trade-off for a password manager.
+ */
+import * as Clipboard from "expo-clipboard";
+const AUTO_CLEAR_MS = 30_000;
+let clearTimer = null;
+/** Write `value` to the clipboard. Returns `true` if the write succeeded. */
+export async function copyToClipboard(value) {
+    let ok;
+    try {
+        ok = await Clipboard.setStringAsync(value);
+    }
+    catch {
+        ok = false;
+    }
+    if (!ok) {
+        return false;
+    }
+    if (clearTimer !== null) {
+        clearTimeout(clearTimer);
+    }
+    clearTimer = setTimeout(() => {
+        clearTimer = null;
+        void Clipboard.setStringAsync("").catch(() => {
+            // Best-effort.
+        });
+    }, AUTO_CLEAR_MS);
+    return true;
+}
+/**
+ * Wipe the clipboard now (e.g. on explicit logout). Cancels the pending
+ * auto-clear so we don't fire a redundant wipe later.
+ */
+export async function clearClipboardNow() {
+    if (clearTimer !== null) {
+        clearTimeout(clearTimer);
+        clearTimer = null;
+    }
+    try {
+        await Clipboard.setStringAsync("");
+    }
+    catch {
+        // Best-effort.
+    }
+}
+//# sourceMappingURL=clipboard.js.map

package/lib/utils/clipboard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clipboard.js","sourceRoot":"","sources":["../../src/utils/clipboard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,KAAK,SAAS,MAAM,gBAAgB,CAAC;AAE5C,MAAM,aAAa,GAAG,MAAM,CAAC;AAE7B,IAAI,UAAU,GAAyC,IAAI,CAAC;AAE5D,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAa;IACjD,IAAI,EAAW,CAAC;IAChB,IAAI,CAAC;QACH,EAAE,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,EAAE,GAAG,KAAK,CAAC;IACb,CAAC;IACD,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,YAAY,CAAC,UAAU,CAAC,CAAC;IAC3B,CAAC;IACD,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;QAC3B,UAAU,GAAG,IAAI,CAAC;QAClB,KAAK,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YAC3C,eAAe;QACjB,CAAC,CAAC,CAAC;IACL,CAAC,EAAE,aAAa,CAAC,CAAC;IAClB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB;IACrC,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,YAAY,CAAC,UAAU,CAAC,CAAC;QACzB,UAAU,GAAG,IAAI,CAAC;IACpB,CAAC;IACD,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;AACH,CAAC"}

package/lib/utils/cn.d.ts

@@ -0,0 +1,9 @@
+import { type ClassValue } from "clsx";
+/**
+ * Combines class names using clsx and merges Tailwind CSS classes intelligently.
+ *
+ * @param inputs - Class values to combine
+ * @returns Merged class string
+ */
+export declare function cn(...inputs: ClassValue[]): string;
+//# sourceMappingURL=cn.d.ts.map

package/lib/utils/cn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cn.d.ts","sourceRoot":"","sources":["../../src/utils/cn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAG7C;;;;;GAKG;AACH,wBAAgB,EAAE,CAAC,GAAG,MAAM,EAAE,UAAU,EAAE,UAEzC"}

package/lib/utils/cn.js

@@ -0,0 +1,12 @@
+import { clsx } from "clsx";
+import { twMerge } from "tailwind-merge";
+/**
+ * Combines class names using clsx and merges Tailwind CSS classes intelligently.
+ *
+ * @param inputs - Class values to combine
+ * @returns Merged class string
+ */
+export function cn(...inputs) {
+    return twMerge(clsx(inputs));
+}
+//# sourceMappingURL=cn.js.map

package/lib/utils/cn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cn.js","sourceRoot":"","sources":["../../src/utils/cn.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAmB,MAAM,MAAM,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAEzC;;;;;GAKG;AACH,MAAM,UAAU,EAAE,CAAC,GAAG,MAAoB;IACxC,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;AAC/B,CAAC"}

package/lib/utils/debounce.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Debounce a function. The returned function has a `.cancel()` method
+ * so a pending invocation can be cleared in a `useEffect` cleanup to
+ * avoid a setState-after-unmount on the trailing call.
+ *
+ * Intentionally a tiny, no-dependency implementation — `lodash.debounce`
+ * pulls 200kB of lodash with it; this is 15 lines, type-safe, and tree-
+ * shake-friendly.
+ */
+export declare function debounce<T extends (...args: Parameters<T>) => void>(func: T, wait: number): ((...args: Parameters<T>) => void) & {
+    cancel: () => void;
+};
+//# sourceMappingURL=debounce.d.ts.map

package/lib/utils/debounce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"debounce.d.ts","sourceRoot":"","sources":["../../src/utils/debounce.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,wBAAgB,QAAQ,CAAC,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,EACjE,IAAI,EAAE,CAAC,EACP,IAAI,EAAE,MAAM,GACX,CAAC,CAAC,GAAG,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,GAAG;IAAE,MAAM,EAAE,MAAM,IAAI,CAAA;CAAE,CAoB7D"}

package/lib/utils/debounce.js

@@ -0,0 +1,28 @@
+/**
+ * Debounce a function. The returned function has a `.cancel()` method
+ * so a pending invocation can be cleared in a `useEffect` cleanup to
+ * avoid a setState-after-unmount on the trailing call.
+ *
+ * Intentionally a tiny, no-dependency implementation — `lodash.debounce`
+ * pulls 200kB of lodash with it; this is 15 lines, type-safe, and tree-
+ * shake-friendly.
+ */
+export function debounce(func, wait) {
+    let timeout = null;
+    const debounced = (...args) => {
+        if (timeout) {
+            clearTimeout(timeout);
+        }
+        timeout = setTimeout(() => {
+            func(...args);
+        }, wait);
+    };
+    debounced.cancel = () => {
+        if (timeout) {
+            clearTimeout(timeout);
+            timeout = null;
+        }
+    };
+    return debounced;
+}
+//# sourceMappingURL=debounce.js.map

package/lib/utils/debounce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"debounce.js","sourceRoot":"","sources":["../../src/utils/debounce.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CACtB,IAAO,EACP,IAAY;IAEZ,IAAI,OAAO,GAAyC,IAAI,CAAC;IAEzD,MAAM,SAAS,GAAG,CAAC,GAAG,IAAmB,EAAE,EAAE;QAC3C,IAAI,OAAO,EAAE,CAAC;YACZ,YAAY,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;QACD,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YACxB,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;QAChB,CAAC,EAAE,IAAI,CAAC,CAAC;IACX,CAAC,CAAC;IAEF,SAAS,CAAC,MAAM,GAAG,GAAG,EAAE;QACtB,IAAI,OAAO,EAAE,CAAC;YACZ,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;IAEF,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/lib/utils/error.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Extract a human-readable message from an unknown error value.
+ *
+ * Use this in every `catch (e: unknown)` block instead of accessing
+ * `e?.message` directly — TypeScript's `unknown` type prevents property
+ * access without a type guard.
+ */
+export declare function getErrorMessage(e: unknown, fallback?: string): string;
+//# sourceMappingURL=error.d.ts.map

package/lib/utils/error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.d.ts","sourceRoot":"","sources":["../../src/utils/error.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,SAAiC,GAAG,MAAM,CAE7F"}

package/lib/utils/error.js

@@ -0,0 +1,11 @@
+/**
+ * Extract a human-readable message from an unknown error value.
+ *
+ * Use this in every `catch (e: unknown)` block instead of accessing
+ * `e?.message` directly — TypeScript's `unknown` type prevents property
+ * access without a type guard.
+ */
+export function getErrorMessage(e, fallback = "An unexpected error occurred") {
+    return e instanceof Error ? e.message : fallback;
+}
+//# sourceMappingURL=error.js.map

package/lib/utils/error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"error.js","sourceRoot":"","sources":["../../src/utils/error.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,CAAU,EAAE,QAAQ,GAAG,8BAA8B;IACnF,OAAO,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;AACnD,CAAC"}