@ic-reactor/react 3.10.0 → 3.12.0

package/README.md

@@ -13,6 +13,17 @@ pnpm add @ic-reactor/react @icp-sdk/core @tanstack/react-query
 pnpm add @icp-sdk/auth
 ```
 
+> **npm needs an override to install this set.** Every published
+> `@icp-sdk/auth` peers `@icp-sdk/core@^5`, while this package needs `^6`, so a
+> strict `npm install` fails with `ERESOLVE`. The metadata is stale rather than
+> the versions being incompatible — auth v8 runs against core v6, and this
+> repository's own suite exercises that combination. pnpm and yarn install it
+> as-is; for npm, add:
+>
+> ```json
+> { "overrides": { "@icp-sdk/auth": { "@icp-sdk/core": "$@icp-sdk/core" } } }
+> ```
+
 `@icp-sdk/auth` is an optional peer. `AuthenticationManager` reaches it through a
 literal `import("@icp-sdk/auth/client")`, so Vite, Rollup and webpack code-split
 it into its own async chunk. That chunk is never fetched unless something

package/dist/auth/authentication-manager.d.ts

@@ -34,6 +34,13 @@ export declare class AuthenticationManager {
     private authStateValue;
     private readonly identityProvider?;
     private readonly internetIdentityId?;
+    /**
+     * Which authorize path the locally deployed Internet Identity serves, once
+     * probed. `undefined` means not probed yet; `null` means it serves no sign-in
+     * UI and login should fail with an explanation rather than open a popup onto
+     * a gateway error page.
+     */
+    private localAuthorizePath?;
     private readonly defaultClientOptions;
     readonly clientManager: ClientManager;
     /** The current authentication state. */
@@ -51,6 +58,14 @@ export declare class AuthenticationManager {
      * what browser popup blockers and the ICRC-29 transport require.
      */
     prepareClient(options?: AuthenticationClientOptions): Promise<AuthClientLike | undefined>;
+    /**
+     * Probe the local Internet Identity canister once, and remember what it
+     * serves.
+     *
+     * Only for the derived local provider: an explicitly configured
+     * `identityProvider` is the caller's business, and mainnet is fixed.
+     */
+    private ensureLocalAuthorizePath;
     /**
      * Returns an AuthClient without awaiting, or `undefined` when the auth
      * module has not been loaded yet.

package/dist/auth/authentication-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authentication-manager.d.ts","sourceRoot":"","sources":["../../src/auth/authentication-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,KAAK,EACV,cAAc,EACd,uBAAuB,EACvB,SAAS,EACT,2BAA2B,EAC3B,2BAA2B,EAC5B,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,aAAa,EAAwB,MAAM,kBAAkB,CAAA;AAUtE,MAAM,WAAW,+BAAgC,SAAQ,2BAA2B;IAClF,aAAa,EAAE,aAAa,CAAA;IAC5B;;;OAGG;IACH,UAAU,CAAC,EAAE,cAAc,CAAA;IAC3B,2DAA2D;IAC3D,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B;AAMD;;;;;;;;;GASG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,UAAU,CAAC,CAAgB;IACnC,OAAO,CAAC,WAAW,CAAC,CAA+B;IACnD,OAAO,CAAC,qBAAqB,CAAQ;IACrC,OAAO,CAAC,iBAAiB,CAAI;IAC7B,OAAO,CAAC,oBAAoB,CAAwC;IACpE,OAAO,CAAC,qBAAqB,CAAC,CAAuB;IACrD,OAAO,CAAC,4BAA4B,CAAC,CAEpC;IACD,OAAO,CAAC,iBAAiB,CAAQ;IACjC,OAAO,CAAC,iBAAiB,CAAC,CAA6B;IACvD,OAAO,CAAC,cAAc,CAKrB;IACD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAc;IAChD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAQ;IAC5C,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6B;IAClE,SAAgB,aAAa,EAAE,aAAa,CAAA;IAE5C,wCAAwC;IACxC,IAAW,SAAS,IAAI,SAAS,CAEhC;gBAEW,EACV,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,GAAG,aAAa,EACjB,EAAE,+BAA+B;IAiClC,mDAAmD;IACnD,IAAW,MAAM,+BAEhB;IAEM,kBAAkB,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI;IAS9D;;;;;;;OAOG;IACU,aAAa,CAAC,OAAO,CAAC,EAAE,2BAA2B;IAUhE;;;;;;;OAOG;IACI,iBAAiB,CACtB,OAAO,CAAC,EAAE,2BAA2B,GACpC,cAAc,GAAG,SAAS;IAItB,YAAY,QAAa,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAqF5D;IAEM,KAAK,GAAU,eAAe,2BAA2B,mBAwD/D;IAEM,MAAM,GAAU,UAAU;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,mBAuBrD;YAEa,gBAAgB;IAc9B,mDAAmD;IACtC,uBAAuB,CAClC,OAAO,CAAC,EAAE,uBAAuB,GAChC,OAAO,CAAC,QAAQ,CAAC;IAyBpB,OAAO,CAAC,oBAAoB;IAiB5B;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAO5B;;;OAGG;IACH,OAAO,CAAC,oBAAoB;YAed,mBAAmB;IAmBjC,mDAAmD;IACtC,YAAY,CAAC,OAAO,CAAC,EAAE,2BAA2B;IAQ/D,mDAAmD;IACtC,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO;IAQxE,mDAAmD;IAC5C,iBAAiB;IAIxB,mDAAmD;IAC5C,sBAAsB,CAAC,KAAK,EAAE,KAAK;IAI1C,OAAO,CAAC,0BAA0B;IAYlC,OAAO,CAAC,WAAW;YASL,yBAAyB;CAkCxC"}
+{"version":3,"file":"authentication-manager.d.ts","sourceRoot":"","sources":["../../src/auth/authentication-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,KAAK,EACV,cAAc,EACd,uBAAuB,EACvB,SAAS,EACT,2BAA2B,EAC3B,2BAA2B,EAC5B,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,aAAa,EAA2B,MAAM,kBAAkB,CAAA;AAgBzE,MAAM,WAAW,+BAAgC,SAAQ,2BAA2B;IAClF,aAAa,EAAE,aAAa,CAAA;IAC5B;;;OAGG;IACH,UAAU,CAAC,EAAE,cAAc,CAAA;IAC3B,2DAA2D;IAC3D,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B;AAMD;;;;;;;;;GASG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,UAAU,CAAC,CAAgB;IACnC,OAAO,CAAC,WAAW,CAAC,CAA+B;IACnD,OAAO,CAAC,qBAAqB,CAAQ;IACrC,OAAO,CAAC,iBAAiB,CAAI;IAC7B,OAAO,CAAC,oBAAoB,CAAwC;IACpE,OAAO,CAAC,qBAAqB,CAAC,CAAuB;IACrD,OAAO,CAAC,4BAA4B,CAAC,CAEpC;IACD,OAAO,CAAC,iBAAiB,CAAQ;IACjC,OAAO,CAAC,iBAAiB,CAAC,CAA6B;IACvD,OAAO,CAAC,cAAc,CAKrB;IACD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAc;IAChD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAQ;IAC5C;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB,CAAC,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6B;IAClE,SAAgB,aAAa,EAAE,aAAa,CAAA;IAE5C,wCAAwC;IACxC,IAAW,SAAS,IAAI,SAAS,CAEhC;gBAEW,EACV,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,GAAG,aAAa,EACjB,EAAE,+BAA+B;IAiClC,mDAAmD;IACnD,IAAW,MAAM,+BAEhB;IAEM,kBAAkB,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI;IAS9D;;;;;;;OAOG;IACU,aAAa,CAAC,OAAO,CAAC,EAAE,2BAA2B;IAehE;;;;;;OAMG;YACW,wBAAwB;IA2BtC;;;;;;;OAOG;IACI,iBAAiB,CACtB,OAAO,CAAC,EAAE,2BAA2B,GACpC,cAAc,GAAG,SAAS;IAItB,YAAY,QAAa,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAqF5D;IAEM,KAAK,GAAU,eAAe,2BAA2B,mBAwD/D;IAEM,MAAM,GAAU,UAAU;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,mBAuBrD;YAEa,gBAAgB;IAc9B,mDAAmD;IACtC,uBAAuB,CAClC,OAAO,CAAC,EAAE,uBAAuB,GAChC,OAAO,CAAC,QAAQ,CAAC;IAyBpB,OAAO,CAAC,oBAAoB;IAiB5B;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAO5B;;;OAGG;IACH,OAAO,CAAC,oBAAoB;YAed,mBAAmB;IAmBjC,mDAAmD;IACtC,YAAY,CAAC,OAAO,CAAC,EAAE,2BAA2B;IAQ/D,mDAAmD;IACtC,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO;IAQxE,mDAAmD;IAC5C,iBAAiB;IAIxB,mDAAmD;IAC5C,sBAAsB,CAAC,KAAK,EAAE,KAAK;IAI1C,OAAO,CAAC,0BAA0B;IA0BlC,OAAO,CAAC,WAAW;YASL,yBAAyB;CAkCxC"}

package/dist/auth/authentication-manager.js

@@ -1,7 +1,8 @@
-import { isDev, isMainnetHost } from "@ic-reactor/core";
+import { isDev, allowsEnvRootKey } from "@ic-reactor/core";
 import { Principal } from "@icp-sdk/core/principal";
 import { safeGetCanisterEnv } from "@icp-sdk/core/agent/canister-env";
-import { IC_INTERNET_IDENTITY_PROVIDER, INTERNET_IDENTITY_PROVIDER_ENV_KEY, localInternetIdentityProvider, } from "./constants.js";
+import { probeLocalInternetIdentity, localInternetIdentityUnavailableError, } from "./local-ii-probe.js";
+import { IC_INTERNET_IDENTITY_PROVIDER, INTERNET_IDENTITY_PROVIDER_ENV_KEY, LOCAL_INTERNET_IDENTITY_CANISTER_ID, localInternetIdentityProvider, } from "./constants.js";
 /**
  * Manages Internet Identity sign-in, session restoration, and authentication
  * state for a {@link ClientManager}.
@@ -95,6 +96,18 @@ export class AuthenticationManager {
             writable: true,
             value: void 0
         });
+        /**
+         * Which authorize path the locally deployed Internet Identity serves, once
+         * probed. `undefined` means not probed yet; `null` means it serves no sign-in
+         * UI and login should fail with an explanation rather than open a popup onto
+         * a gateway error page.
+         */
+        Object.defineProperty(this, "localAuthorizePath", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: void 0
+        });
         Object.defineProperty(this, "defaultClientOptions", {
             enumerable: true,
             configurable: true,
@@ -312,12 +325,42 @@ export class AuthenticationManager {
      * what browser popup blockers and the ICRC-29 transport require.
      */
     async prepareClient(options) {
+        // Before resolving options, because resolving them is what picks the
+        // provider URL. This is the last async point before `login()` has to stay
+        // inside the user gesture, so the answer has to be cached by now.
+        await this.ensureLocalAuthorizePath();
         const clientOptions = this.resolveClientOptions(options);
         if (this.authClient && !this.shouldRecreateClient(clientOptions)) {
             return this.authClient;
         }
         return this.initializeClient(clientOptions);
     }
+    /**
+     * Probe the local Internet Identity canister once, and remember what it
+     * serves.
+     *
+     * Only for the derived local provider: an explicitly configured
+     * `identityProvider` is the caller's business, and mainnet is fixed.
+     */
+    async ensureLocalAuthorizePath() {
+        if (this.localAuthorizePath !== undefined)
+            return;
+        if (this.identityProvider)
+            return;
+        if (!this.clientManager.isLocal)
+            return;
+        const canisterId = this.internetIdentityId ?? LOCAL_INTERNET_IDENTITY_CANISTER_ID;
+        const { path, inconclusive } = await probeLocalInternetIdentity(this.clientManager.agent, canisterId);
+        // An inconclusive probe must not change behaviour: the canister may be
+        // fine and merely unreachable from here, and a diagnostic that blocks a
+        // working login is worse than the failure it explains.
+        this.localAuthorizePath = inconclusive ? "/authorize" : path;
+        if (path === "/#authorize" && !inconclusive) {
+            console.warn(`[ic-reactor] Internet Identity canister ${canisterId} serves its sign-in UI at ` +
+                `"/" rather than "/authorize" — using the legacy #authorize flow. This is a ` +
+                `pre-2026 build; newer ones through release-2026-03-16 serve /authorize directly.`);
+        }
+    }
     /**
      * Returns an AuthClient without awaiting, or `undefined` when the auth
      * module has not been loaded yet.
@@ -439,9 +482,18 @@ export class AuthenticationManager {
         if (this.identityProvider) {
             return this.identityProvider;
         }
-        return this.clientManager.isLocal
-            ? localInternetIdentityProvider(Number(this.clientManager.agentHost?.port) || 4943, this.internetIdentityId)
-            : IC_INTERNET_IDENTITY_PROVIDER;
+        if (!this.clientManager.isLocal) {
+            return IC_INTERNET_IDENTITY_PROVIDER;
+        }
+        const canisterId = this.internetIdentityId ?? LOCAL_INTERNET_IDENTITY_CANISTER_ID;
+        // `null` is the probe's positive finding that this build serves no sign-in
+        // UI. Throwing here surfaces an actionable message where the caller can see
+        // it, instead of opening a popup onto the gateway's verification-error page
+        // and leaving the app waiting until the user closes it.
+        if (this.localAuthorizePath === null) {
+            throw localInternetIdentityUnavailableError(canisterId);
+        }
+        return localInternetIdentityProvider(Number(this.clientManager.agentHost?.port) || 4943, this.internetIdentityId, this.localAuthorizePath);
     }
     updateState(newState) {
         if (isDev())
@@ -588,15 +640,20 @@ function acceptEnvIdentityProvider(value, clientManager) {
     if (pageOrigin && url.origin === pageOrigin) {
         return url.toString();
     }
-    // `isMainnetHost` matches only the real boundary domains and defaults to true
-    // for an unknown host, so custom testnets keep working while anything that
-    // looks like mainnet fails closed. `clientManager.isLocal` would be wrong
-    // here: it treats every unrecognized hostname as "ic".
-    if (isMainnetHost(clientManager.agentHost?.toString())) {
+    // Positive allowlist, not `!isMainnetHost(...)`.
+    //
+    // The old comment here claimed this defaulted to true for an unknown host so
+    // that "anything that looks like mainnet fails closed". It did not:
+    // isMainnetHost defaults to true only for `undefined`, and returns false for
+    // every unrecognised host — so a dapp on a custom domain accepted an identity
+    // provider chosen by a cookie, and the ic_env cookie is writable by any
+    // sibling subdomain. Redirecting the Internet Identity flow is as severe as
+    // substituting the root key, so both now use the same test.
+    if (!allowsEnvRootKey(clientManager.agentHost?.toString())) {
         console.warn(`[ic-reactor] Ignoring the Internet Identity provider from the ic_env cookie ` +
-            `("${url.origin}") because this reactor targets mainnet, where the provider ` +
-            `is taken from configuration rather than the environment. Pass ` +
-            `\`identityProvider\` to AuthenticationManager to use a custom provider on mainnet.`);
+            `("${url.origin}") because this reactor does not target a local replica, where ` +
+            `the provider is taken from configuration rather than the environment. Pass ` +
+            `\`identityProvider\` to AuthenticationManager to use a custom provider.`);
         return undefined;
     }
     return url.toString();

package/dist/auth/authentication-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"authentication-manager.js","sourceRoot":"","sources":["../../src/auth/authentication-manager.ts"],"names":[],"mappings":"AAQA,OAAO,EAAiB,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAEtE,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AACrE,OAAO,EACL,6BAA6B,EAC7B,kCAAkC,EAClC,6BAA6B,GAC9B,MAAM,gBAAgB,CAAA;AAiBvB;;;;;;;;;GASG;AACH,MAAM,OAAO,qBAAqB;IAuBhC,wCAAwC;IACxC,IAAW,SAAS;QAClB,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAED,YAAY,EACV,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,GAAG,aAAa,EACgB;QAjC1B;;;;;WAA2B;QAC3B;;;;;WAA2C;QAC3C;;;;mBAAwB,KAAK;WAAA;QAC7B;;;;mBAAoB,CAAC;WAAA;QACrB;;;;mBAA0D,EAAE;WAAA;QAC5D;;;;;WAA6C;QAC7C;;;;;WAEP;QACO;;;;mBAAoB,KAAK;WAAA;QACzB;;;;;WAA+C;QAC/C;;;;mBAA4B;gBAClC,QAAQ,EAAE,IAAI;gBACd,gBAAgB,EAAE,KAAK;gBACvB,eAAe,EAAE,KAAK;gBACtB,KAAK,EAAE,SAAS;aACjB;WAAA;QACgB;;;;;WAA+B;QAC/B;;;;;WAA2B;QAC3B;;;;;WAAiD;QAClD;;;;;WAA4B;QA4FrC;;;;mBAAe,KAAK,IAAmC,EAAE;gBAC9D,IAAI,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,CAAC;oBACnC,qEAAqE;oBACrE,uEAAuE;oBACvE,qEAAqE;oBACrE,uEAAuE;oBACvE,mEAAmE;oBACnE,kCAAkC;oBAClC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;wBACrB,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAA;oBAC7C,CAAC;oBACD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,OAAO,CACtC,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAClC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;oBACnB,IAAI,UAAU,EAAE,CAAC;wBACf,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAA;oBAC7C,CAAC;oBACD,qEAAqE;oBACrE,oDAAoD;oBACpD,IAAI,CAAC,WAAW,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAA;gBAC9C,CAAC;gBACD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;oBACrB,OAAO,IAAI,CAAC,WAAW,CAAA;gBACzB,CAAC;gBACD,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBAC3B,OAAO,SAAS,CAAA;gBAClB,CAAC;gBAED,IAAI,CAAC,WAAW,GAAG,CAAC,KAAK,IAAI,EAAE;oBAC7B,IAAI,KAAK,EAAE,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;wBAC7C,OAAO,CAAC,IAAI,CACV,mCAAmC,EACnC,mCAAmC,EACnC,gBAAgB,EAChB;4BACE,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,OAAO;4BACnC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB;yBACnE,CACF,CAAA;oBACH,CAAC;oBACD,IAAI,CAAC,WAAW,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAA;oBAC5C,wEAAwE;oBACxE,mEAAmE;oBACnE,sEAAsE;oBACtE,gEAAgE;oBAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAA;oBACvC,IAAI,CAAC;wBACH,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;4BACrB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAC5C,IAAI,CAAC,oBAAoB,EAAE,CAC5B,CAAA;4BACD,IAAI,CAAC,UAAU,EAAE,CAAC;gCAChB,IAAI,CAAC,WAAW,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAA;gCAC7C,OAAO,SAAS,CAAA;4BAClB,CAAC;wBACH,CAAC;wBACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAW,CAAC,WAAW,EAAE,CAAA;wBACrD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,UAAW,CAAC,eAAe,EAAE,CAAA;wBAEhE,IAAI,QAAQ,KAAK,IAAI,CAAC,iBAAiB,EAAE,CAAC;4BACxC,4DAA4D;4BAC5D,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAA;wBAC7C,CAAC;wBACD,wEAAwE;wBACxE,mEAAmE;wBACnE,2BAA2B;wBAC3B,IAAI,eAAe,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;4BAC9D,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;wBAC1C,CAAC;wBACD,IAAI,CAAC,WAAW,CAAC;4BACf,QAAQ;4BACR,eAAe;4BACf,gBAAgB,EAAE,KAAK;yBACxB,CAAC,CAAA;wBACF,OAAO,QAAQ,CAAA;oBACjB,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,KAAc,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAA;wBACpE,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAA;wBAC9C,MAAM,KAAK,CAAA;oBACb,CAAC;4BAAS,CAAC;wBACT,IAAI,CAAC,WAAW,GAAG,SAAS,CAAA;oBAC9B,CAAC;gBACH,CAAC,CAAC,EAAE,CAAA;gBAEJ,OAAO,IAAI,CAAC,WAAW,CAAA;YACzB,CAAC;WAAA;QAEM;;;;mBAAQ,KAAK,EAAE,YAA0C,EAAE,EAAE;gBAClE,IAAI,iBAAiB,GAAG,KAAK,CAAA;gBAE7B,IAAI,CAAC;oBACH,MAAM,iBAAiB,GAAG,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAA;oBAEjE,uEAAuE;oBACvE,sEAAsE;oBACtE,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,EAAE,CAAC;wBAClD,MAAM,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAAA;oBAChD,CAAC;oBAED,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;wBACrB,MAAM,IAAI,CAAC,YAAY,EAAE,CAAA;oBAC3B,CAAC;oBAED,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;wBACrB,MAAM,IAAI,KAAK,CACb,2TAA2T,CAC5T,CAAA;oBACH,CAAC;oBAED,IAAI,CAAC,WAAW,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;oBAC9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CACjD,gBAAgB,CAAC,YAAY,CAAC,CAC/B,CAAA;oBAED,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;wBACjD,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,CAAA;oBAC5C,CAAC;oBAED,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;oBACxC,IAAI,CAAC,WAAW,CAAC;wBACf,QAAQ;wBACR,eAAe,EAAE,IAAI;wBACrB,gBAAgB,EAAE,KAAK;qBACxB,CAAC,CAAA;oBACF,iBAAiB,GAAG,IAAI,CAAA;oBAExB,IAAI,CAAC;wBACH,MAAM,YAAY,EAAE,SAAS,EAAE,EAAE,CAAA;oBACnC,CAAC;oBAAC,OAAO,aAAa,EAAE,CAAC;wBACvB,IAAI,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,aAAsB,EAAE,CAAC,CAAA;wBACnD,MAAM,YAAY,EAAE,OAAO,EAAE,CAAE,aAAuB,CAAC,OAAO,CAAC,CAAA;wBAC/D,MAAM,aAAa,CAAA;oBACrB,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBACvB,MAAM,YAAY,EAAE,OAAO,EAAE,CAAE,KAAe,CAAC,OAAO,CAAC,CAAA;wBACvD,IAAI,CAAC,WAAW,CAAC;4BACf,KAAK,EAAE,KAAc;4BACrB,gBAAgB,EAAE,KAAK;yBACxB,CAAC,CAAA;oBACJ,CAAC;oBACD,MAAM,KAAK,CAAA;gBACb,CAAC;YACH,CAAC;WAAA;QAEM;;;;mBAAS,KAAK,EAAE,OAA+B,EAAE,EAAE;gBACxD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;oBACrB,MAAM,IAAI,KAAK,CACb,4TAA4T,CAC7T,CAAA;gBACH,CAAC;gBACD,IAAI,CAAC,WAAW,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;gBAC9D,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;oBACtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAA;oBACpD,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;oBACxC,IAAI,CAAC,WAAW,CAAC;wBACf,QAAQ;wBACR,eAAe,EAAE,KAAK;wBACtB,gBAAgB,EAAE,KAAK;qBACxB,CAAC,CAAA;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,yEAAyE;oBACzE,0EAA0E;oBAC1E,gCAAgC;oBAChC,IAAI,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,KAAc,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAA;oBACpE,MAAM,KAAK,CAAA;gBACb,CAAC;YACH,CAAC;WAAA;QAtPC,IAAI,CAAC,aAAa,GAAG,aAAa,CAAA;QAClC,MAAM,WAAW,GACf,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,4BAA4B,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;QAC5E,IAAI,CAAC,gBAAgB;YACnB,gBAAgB;gBAChB,yBAAyB,CACvB,WAAW,EAAE,CAAC,kCAAkC,CAAC;oBAC/C,WAAW,EAAE,CAAC,mCAAmC,CAAC,EACpD,aAAa,CACd,CAAA;QACH,IAAI,CAAC,kBAAkB;YACrB,kBAAkB;gBAClB,mBAAmB,CACjB,WAAW,EAAE,CAAC,mBAAmB,CAAC;oBAChC,WAAW,EAAE,CAAC,sCAAsC,CAAC;oBACrD,WAAW,EAAE,CAAC,+BAA+B,CAAC,CACjD,CAAA;QACH,IAAI,CAAC,oBAAoB,GAAG,aAAa,CAAA;QAEzC,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAA;YACjC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;YAC5B,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC/D,IAAI,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,KAAc,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAA;YACtE,CAAC,CAAC,CAAA;QACJ,CAAC;aAAM,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YACzC,IAAI,CAAC,yBAAyB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC1C,iEAAiE;YACnE,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,IAAW,MAAM;QACf,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;IAEM,kBAAkB,CAAC,QAAoC;QAC5D,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACxC,OAAO,GAAG,EAAE;YACV,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAC1D,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,KAAK,QAAQ,CACxC,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,aAAa,CAAC,OAAqC;QAC9D,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAA;QAExD,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,EAAE,CAAC;YACjE,OAAO,IAAI,CAAC,UAAU,CAAA;QACxB,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAA;IAC7C,CAAC;IAED;;;;;;;OAOG;IACI,iBAAiB,CACtB,OAAqC;QAErC,OAAO,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAA;IACtE,CAAC;IA4KO,KAAK,CAAC,gBAAgB,CAC5B,OAAqC;QAErC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAA;QAEzD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAA;QACzC,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAA;QAChC,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;IAED,mDAAmD;IAC5C,KAAK,CAAC,uBAAuB,CAClC,OAAiC;QAEjC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,2TAA2T,CAC5T,CAAA;QACH,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CACpC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAC9B,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;YACnB,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,OAAO,CAC3C,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAClC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAA;YAEpB,IAAI,QAAQ,IAAI,eAAe,EAAE,CAAC;gBAChC,OAAO,QAAQ,CAAA;YACjB,CAAC;YAED,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAEO,oBAAoB,CAC1B,OAAqC;QAErC,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3D,OAAO,IAAI,CAAC,UAAU,CAAA;QACxB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,qBAAqB,CAAA;QAC7C,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC9C,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAA;QACzC,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAA;QAChC,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;IAED;;;;;;OAMG;IACK,oBAAoB,CAAC,OAAqC;QAChE,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,CAAC,uBAAuB,CAAC,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAA;IAClE,CAAC;IAED;;;OAGG;IACK,oBAAoB,CAC1B,OAAqC;QAErC,MAAM,MAAM,GAAG,oBAAoB,CAAC;YAClC,GAAG,IAAI,CAAC,oBAAoB;YAC5B,GAAG,OAAO;SACX,CAAC,CAAA;QAEF,OAAO;YACL,GAAG,MAAM;YACT,gBAAgB,EACd,MAAM,EAAE,gBAAgB,IAAI,IAAI,CAAC,0BAA0B,EAAE;SAChE,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,QAAQ,GAAG,IAAI,CAAC,iBAAiB;QACjE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,OAAM;QACR,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAA;QACpD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAAA;QAC/D,IAAI,QAAQ,KAAK,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxC,OAAM;QACR,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;QACxC,IAAI,CAAC,WAAW,CAAC;YACf,QAAQ;YACR,eAAe;YACf,gBAAgB,EAAE,KAAK;YACvB,KAAK,EAAE,SAAS;SACjB,CAAC,CAAA;IACJ,CAAC;IAED,mDAAmD;IAC5C,KAAK,CAAC,YAAY,CAAC,OAAqC;QAC7D,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAA;QACxD,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAA;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;IAED,mDAAmD;IAC5C,KAAK,CAAC,cAAc,CAAC,QAAkB,EAAE,eAAwB;QACtE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,CAAA;QAC5C,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;QACxC,IAAI,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED,mDAAmD;IAC5C,iBAAiB;QACtB,IAAI,CAAC,WAAW,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,mDAAmD;IAC5C,sBAAsB,CAAC,KAAY;QACxC,IAAI,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAA;IACtD,CAAC;IAEO,0BAA0B;QAChC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,gBAAgB,CAAA;QAC9B,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO;YAC/B,CAAC,CAAC,6BAA6B,CAC3B,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,IAAI,EAClD,IAAI,CAAC,kBAAkB,CACxB;YACH,CAAC,CAAC,6BAA6B,CAAA;IACnC,CAAC;IAEO,WAAW,CAAC,QAA4B;QAC9C,IAAI,KAAK,EAAE;YAAE,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,QAAQ,CAAC,CAAA;QACzE,IAAI,CAAC,iBAAiB,IAAI,CAAC,CAAA;QAC3B,IAAI,CAAC,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,EAAE,CAAA;QAC7D,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CAC/C,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAChC,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,yBAAyB;QACrC,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,qBAAqB,CAAA;QACnC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,4BAA4B,EAAE,CAAC;YACvC,IAAI,CAAC,4BAA4B,GAAG,sBAAsB,EAAE;iBACzD,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE;gBACnB,MAAM,UAAU,GACd,UACD,CAAC,UAAU,CAAA;gBAEZ,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;gBACnE,CAAC;gBAED,IAAI,CAAC,qBAAqB,GAAG,UAAU,CAAA;gBACvC,OAAO,UAAU,CAAA;YACnB,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACf,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAA;gBAC7B,IAAI,CAAC,4BAA4B,GAAG,SAAS,CAAA;gBAC7C,IACE,KAAK,YAAY,KAAK;oBACtB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EACnD,CAAC;oBACD,MAAM,KAAK,CAAA;gBACb,CAAC;gBACD,OAAO,SAAS,CAAA;YAClB,CAAC,CAAC,CAAA;QACN,CAAC;QAED,OAAO,IAAI,CAAC,4BAA4B,CAAA;IAC1C,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,sBAAsB;IAC7B,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAA;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0EAA0E;QAC1E,iEAAiE;QACjE,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC9B,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,OAAqC;IAErC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,OAAO;QACL,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;QAClD,cAAc,EAAE,2BAA2B,CAAC,OAAO,CAAC,cAAc,CAAC;QACnE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAA;AACH,CAAC;AAED,SAAS,2BAA2B,CAClC,cAA8D;IAE9D,OAAO,cAAc,KAAK,QAAQ;QAChC,cAAc,KAAK,OAAO;QAC1B,cAAc,KAAK,WAAW;QAC9B,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAC9B,OAAqC,EACrC,IAAkC;IAElC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,CACL,MAAM,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACrC,OAAO,CAAC,oBAAoB,KAAK,IAAI,CAAC,oBAAoB;QAC1D,OAAO,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc;QAC9C,MAAM,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACrC,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;QAChC,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;QAChC,OAAO,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;QACxC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;QAClC,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CACrC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,yBAAyB,CAChC,KAAyB,EACzB,aAA4B;IAE5B,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAE5B,MAAM,UAAU,GACd,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IAErE,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAI,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC5C,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;IACvB,CAAC;IAED,8EAA8E;IAC9E,2EAA2E;IAC3E,0EAA0E;IAC1E,uDAAuD;IACvD,IAAI,aAAa,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QACvD,OAAO,CAAC,IAAI,CACV,8EAA8E;YAC5E,KAAK,GAAG,CAAC,MAAM,8DAA8D;YAC7E,gEAAgE;YAChE,oFAAoF,CACvF,CAAA;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;AACvB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,KAAyB;IACpD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B;IACnC,MAAM,WAAW,GAAG,kBAAkB,EAA0B,CAAA;IAChE,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,WAAgD,CAAA;IACzD,CAAC;IAED,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;QACpC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM;SAC3B,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;IACpD,MAAM,YAAY,GAAG,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAA;IAClE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAC5B,kBAAkB,CAAC,YAAY,CAAC;SAC7B,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACzC,OAAO,cAAc,KAAK,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YACb,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAA;IACvE,CAAC,CAAC,CACL,CAAA;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AAClD,CAAC;AAED,SAAS,gBAAgB,CACvB,OAAqC;IAErC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,OAAO;QACL,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAA;AACH,CAAC"}
+{"version":3,"file":"authentication-manager.js","sourceRoot":"","sources":["../../src/auth/authentication-manager.ts"],"names":[],"mappings":"AAQA,OAAO,EAAiB,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAA;AAEzE,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAA;AACrE,OAAO,EACL,0BAA0B,EAC1B,qCAAqC,GAEtC,MAAM,qBAAqB,CAAA;AAC5B,OAAO,EACL,6BAA6B,EAC7B,kCAAkC,EAClC,mCAAmC,EACnC,6BAA6B,GAC9B,MAAM,gBAAgB,CAAA;AAiBvB;;;;;;;;;GASG;AACH,MAAM,OAAO,qBAAqB;IA8BhC,wCAAwC;IACxC,IAAW,SAAS;QAClB,OAAO,IAAI,CAAC,cAAc,CAAA;IAC5B,CAAC;IAED,YAAY,EACV,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,GAAG,aAAa,EACgB;QAxC1B;;;;;WAA2B;QAC3B;;;;;WAA2C;QAC3C;;;;mBAAwB,KAAK;WAAA;QAC7B;;;;mBAAoB,CAAC;WAAA;QACrB;;;;mBAA0D,EAAE;WAAA;QAC5D;;;;;WAA6C;QAC7C;;;;;WAEP;QACO;;;;mBAAoB,KAAK;WAAA;QACzB;;;;;WAA+C;QAC/C;;;;mBAA4B;gBAClC,QAAQ,EAAE,IAAI;gBACd,gBAAgB,EAAE,KAAK;gBACvB,eAAe,EAAE,KAAK;gBACtB,KAAK,EAAE,SAAS;aACjB;WAAA;QACgB;;;;;WAA+B;QAC/B;;;;;WAA2B;QAC5C;;;;;WAKG;QACK;;;;;WAAyC;QAChC;;;;;WAAiD;QAClD;;;;;WAA4B;QAmIrC;;;;mBAAe,KAAK,IAAmC,EAAE;gBAC9D,IAAI,IAAI,CAAC,SAAS,CAAC,eAAe,EAAE,CAAC;oBACnC,qEAAqE;oBACrE,uEAAuE;oBACvE,qEAAqE;oBACrE,uEAAuE;oBACvE,mEAAmE;oBACnE,kCAAkC;oBAClC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;wBACrB,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAA;oBAC7C,CAAC;oBACD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,OAAO,CACtC,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAClC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;oBACnB,IAAI,UAAU,EAAE,CAAC;wBACf,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAA;oBAC7C,CAAC;oBACD,qEAAqE;oBACrE,oDAAoD;oBACpD,IAAI,CAAC,WAAW,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAA;gBAC9C,CAAC;gBACD,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;oBACrB,OAAO,IAAI,CAAC,WAAW,CAAA;gBACzB,CAAC;gBACD,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;oBAC3B,OAAO,SAAS,CAAA;gBAClB,CAAC;gBAED,IAAI,CAAC,WAAW,GAAG,CAAC,KAAK,IAAI,EAAE;oBAC7B,IAAI,KAAK,EAAE,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;wBAC7C,OAAO,CAAC,IAAI,CACV,mCAAmC,EACnC,mCAAmC,EACnC,gBAAgB,EAChB;4BACE,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,OAAO;4BACnC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,gBAAgB;yBACnE,CACF,CAAA;oBACH,CAAC;oBACD,IAAI,CAAC,WAAW,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAA;oBAC5C,wEAAwE;oBACxE,mEAAmE;oBACnE,sEAAsE;oBACtE,gEAAgE;oBAChE,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAA;oBACvC,IAAI,CAAC;wBACH,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;4BACrB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAC5C,IAAI,CAAC,oBAAoB,EAAE,CAC5B,CAAA;4BACD,IAAI,CAAC,UAAU,EAAE,CAAC;gCAChB,IAAI,CAAC,WAAW,CAAC,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAA;gCAC7C,OAAO,SAAS,CAAA;4BAClB,CAAC;wBACH,CAAC;wBACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAW,CAAC,WAAW,EAAE,CAAA;wBACrD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,UAAW,CAAC,eAAe,EAAE,CAAA;wBAEhE,IAAI,QAAQ,KAAK,IAAI,CAAC,iBAAiB,EAAE,CAAC;4BACxC,4DAA4D;4BAC5D,OAAO,IAAI,CAAC,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAA;wBAC7C,CAAC;wBACD,wEAAwE;wBACxE,mEAAmE;wBACnE,2BAA2B;wBAC3B,IAAI,eAAe,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;4BAC9D,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;wBAC1C,CAAC;wBACD,IAAI,CAAC,WAAW,CAAC;4BACf,QAAQ;4BACR,eAAe;4BACf,gBAAgB,EAAE,KAAK;yBACxB,CAAC,CAAA;wBACF,OAAO,QAAQ,CAAA;oBACjB,CAAC;oBAAC,OAAO,KAAK,EAAE,CAAC;wBACf,IAAI,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,KAAc,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAA;wBACpE,OAAO,CAAC,KAAK,CAAC,wBAAwB,EAAE,KAAK,CAAC,CAAA;wBAC9C,MAAM,KAAK,CAAA;oBACb,CAAC;4BAAS,CAAC;wBACT,IAAI,CAAC,WAAW,GAAG,SAAS,CAAA;oBAC9B,CAAC;gBACH,CAAC,CAAC,EAAE,CAAA;gBAEJ,OAAO,IAAI,CAAC,WAAW,CAAA;YACzB,CAAC;WAAA;QAEM;;;;mBAAQ,KAAK,EAAE,YAA0C,EAAE,EAAE;gBAClE,IAAI,iBAAiB,GAAG,KAAK,CAAA;gBAE7B,IAAI,CAAC;oBACH,MAAM,iBAAiB,GAAG,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,CAAA;oBAEjE,uEAAuE;oBACvE,sEAAsE;oBACtE,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,EAAE,CAAC;wBAClD,MAAM,IAAI,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,CAAA;oBAChD,CAAC;oBAED,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;wBACrB,MAAM,IAAI,CAAC,YAAY,EAAE,CAAA;oBAC3B,CAAC;oBAED,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;wBACrB,MAAM,IAAI,KAAK,CACb,2TAA2T,CAC5T,CAAA;oBACH,CAAC;oBAED,IAAI,CAAC,WAAW,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;oBAC9D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,uBAAuB,CACjD,gBAAgB,CAAC,YAAY,CAAC,CAC/B,CAAA;oBAED,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;wBACjD,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,CAAA;oBAC5C,CAAC;oBAED,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;oBACxC,IAAI,CAAC,WAAW,CAAC;wBACf,QAAQ;wBACR,eAAe,EAAE,IAAI;wBACrB,gBAAgB,EAAE,KAAK;qBACxB,CAAC,CAAA;oBACF,iBAAiB,GAAG,IAAI,CAAA;oBAExB,IAAI,CAAC;wBACH,MAAM,YAAY,EAAE,SAAS,EAAE,EAAE,CAAA;oBACnC,CAAC;oBAAC,OAAO,aAAa,EAAE,CAAC;wBACvB,IAAI,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,aAAsB,EAAE,CAAC,CAAA;wBACnD,MAAM,YAAY,EAAE,OAAO,EAAE,CAAE,aAAuB,CAAC,OAAO,CAAC,CAAA;wBAC/D,MAAM,aAAa,CAAA;oBACrB,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBACvB,MAAM,YAAY,EAAE,OAAO,EAAE,CAAE,KAAe,CAAC,OAAO,CAAC,CAAA;wBACvD,IAAI,CAAC,WAAW,CAAC;4BACf,KAAK,EAAE,KAAc;4BACrB,gBAAgB,EAAE,KAAK;yBACxB,CAAC,CAAA;oBACJ,CAAC;oBACD,MAAM,KAAK,CAAA;gBACb,CAAC;YACH,CAAC;WAAA;QAEM;;;;mBAAS,KAAK,EAAE,OAA+B,EAAE,EAAE;gBACxD,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;oBACrB,MAAM,IAAI,KAAK,CACb,4TAA4T,CAC7T,CAAA;gBACH,CAAC;gBACD,IAAI,CAAC,WAAW,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;gBAC9D,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;oBACtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAA;oBACpD,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;oBACxC,IAAI,CAAC,WAAW,CAAC;wBACf,QAAQ;wBACR,eAAe,EAAE,KAAK;wBACtB,gBAAgB,EAAE,KAAK;qBACxB,CAAC,CAAA;gBACJ,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,yEAAyE;oBACzE,0EAA0E;oBAC1E,gCAAgC;oBAChC,IAAI,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,KAAc,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAA;oBACpE,MAAM,KAAK,CAAA;gBACb,CAAC;YACH,CAAC;WAAA;QA7RC,IAAI,CAAC,aAAa,GAAG,aAAa,CAAA;QAClC,MAAM,WAAW,GACf,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,4BAA4B,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;QAC5E,IAAI,CAAC,gBAAgB;YACnB,gBAAgB;gBAChB,yBAAyB,CACvB,WAAW,EAAE,CAAC,kCAAkC,CAAC;oBAC/C,WAAW,EAAE,CAAC,mCAAmC,CAAC,EACpD,aAAa,CACd,CAAA;QACH,IAAI,CAAC,kBAAkB;YACrB,kBAAkB;gBAClB,mBAAmB,CACjB,WAAW,EAAE,CAAC,mBAAmB,CAAC;oBAChC,WAAW,EAAE,CAAC,sCAAsC,CAAC;oBACrD,WAAW,EAAE,CAAC,+BAA+B,CAAC,CACjD,CAAA;QACH,IAAI,CAAC,oBAAoB,GAAG,aAAa,CAAA;QAEzC,IAAI,UAAU,EAAE,CAAC;YACf,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAA;YACjC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAA;YAC5B,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBAC/D,IAAI,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,KAAc,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAA;YACtE,CAAC,CAAC,CAAA;QACJ,CAAC;aAAM,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YACzC,IAAI,CAAC,yBAAyB,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE;gBAC1C,iEAAiE;YACnE,CAAC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,IAAW,MAAM;QACf,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;IAEM,kBAAkB,CAAC,QAAoC;QAC5D,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACxC,OAAO,GAAG,EAAE;YACV,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAC1D,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,KAAK,QAAQ,CACxC,CAAA;QACH,CAAC,CAAA;IACH,CAAC;IAED;;;;;;;OAOG;IACI,KAAK,CAAC,aAAa,CAAC,OAAqC;QAC9D,qEAAqE;QACrE,0EAA0E;QAC1E,kEAAkE;QAClE,MAAM,IAAI,CAAC,wBAAwB,EAAE,CAAA;QAErC,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAA;QAExD,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,EAAE,CAAC;YACjE,OAAO,IAAI,CAAC,UAAU,CAAA;QACxB,CAAC;QAED,OAAO,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAA;IAC7C,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,wBAAwB;QACpC,IAAI,IAAI,CAAC,kBAAkB,KAAK,SAAS;YAAE,OAAM;QACjD,IAAI,IAAI,CAAC,gBAAgB;YAAE,OAAM;QACjC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO;YAAE,OAAM;QAEvC,MAAM,UAAU,GACd,IAAI,CAAC,kBAAkB,IAAI,mCAAmC,CAAA;QAEhE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,MAAM,0BAA0B,CAC7D,IAAI,CAAC,aAAa,CAAC,KAAK,EACxB,UAAU,CACX,CAAA;QAED,uEAAuE;QACvE,wEAAwE;QACxE,uDAAuD;QACvD,IAAI,CAAC,kBAAkB,GAAG,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAA;QAE5D,IAAI,IAAI,KAAK,aAAa,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5C,OAAO,CAAC,IAAI,CACV,2CAA2C,UAAU,4BAA4B;gBAC/E,6EAA6E;gBAC7E,kFAAkF,CACrF,CAAA;QACH,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACI,iBAAiB,CACtB,OAAqC;QAErC,OAAO,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAA;IACtE,CAAC;IA4KO,KAAK,CAAC,gBAAgB,CAC5B,OAAqC;QAErC,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,yBAAyB,EAAE,CAAA;QAEzD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAA;QACzC,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAA;QAChC,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;IAED,mDAAmD;IAC5C,KAAK,CAAC,uBAAuB,CAClC,OAAiC;QAEjC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CACb,2TAA2T,CAC5T,CAAA;QACH,CAAC;QAED,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAA;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CACpC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAC9B,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;YACnB,MAAM,eAAe,GAAG,MAAM,OAAO,CAAC,OAAO,CAC3C,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAClC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAA;YAEpB,IAAI,QAAQ,IAAI,eAAe,EAAE,CAAC;gBAChC,OAAO,QAAQ,CAAA;YACjB,CAAC;YAED,MAAM,KAAK,CAAA;QACb,CAAC;IACH,CAAC;IAEO,oBAAoB,CAC1B,OAAqC;QAErC,IAAI,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3D,OAAO,IAAI,CAAC,UAAU,CAAA;QACxB,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,qBAAqB,CAAA;QAC7C,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC9C,OAAO,SAAS,CAAA;QAClB,CAAC;QAED,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAA;QACzC,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAA;QAChC,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;IAED;;;;;;OAMG;IACK,oBAAoB,CAAC,OAAqC;QAChE,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,OAAO,KAAK,CAAA;QACd,CAAC;QACD,OAAO,CAAC,uBAAuB,CAAC,IAAI,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAA;IAClE,CAAC;IAED;;;OAGG;IACK,oBAAoB,CAC1B,OAAqC;QAErC,MAAM,MAAM,GAAG,oBAAoB,CAAC;YAClC,GAAG,IAAI,CAAC,oBAAoB;YAC5B,GAAG,OAAO;SACX,CAAC,CAAA;QAEF,OAAO;YACL,GAAG,MAAM;YACT,gBAAgB,EACd,MAAM,EAAE,gBAAgB,IAAI,IAAI,CAAC,0BAA0B,EAAE;SAChE,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,mBAAmB,CAAC,QAAQ,GAAG,IAAI,CAAC,iBAAiB;QACjE,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACrB,OAAM;QACR,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAA;QACpD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAAA;QAC/D,IAAI,QAAQ,KAAK,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACxC,OAAM;QACR,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;QACxC,IAAI,CAAC,WAAW,CAAC;YACf,QAAQ;YACR,eAAe;YACf,gBAAgB,EAAE,KAAK;YACvB,KAAK,EAAE,SAAS;SACjB,CAAC,CAAA;IACJ,CAAC;IAED,mDAAmD;IAC5C,KAAK,CAAC,YAAY,CAAC,OAAqC;QAC7D,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAA;QACxD,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,aAAa,CAAC,EAAE,CAAC;YAC9C,MAAM,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,CAAA;QAC5C,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAA;IACxB,CAAC;IAED,mDAAmD;IAC5C,KAAK,CAAC,cAAc,CAAC,QAAkB,EAAE,eAAwB;QACtE,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,UAAU,CAAC,aAAa,EAAE,CAAC;YACjD,MAAM,IAAI,CAAC,aAAa,CAAC,eAAe,EAAE,CAAA;QAC5C,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAA;QACxC,IAAI,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAA;IAC1E,CAAC;IAED,mDAAmD;IAC5C,iBAAiB;QACtB,IAAI,CAAC,WAAW,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;IAChE,CAAC;IAED,mDAAmD;IAC5C,sBAAsB,CAAC,KAAY;QACxC,IAAI,CAAC,WAAW,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,CAAC,CAAA;IACtD,CAAC;IAEO,0BAA0B;QAChC,IAAI,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,gBAAgB,CAAA;QAC9B,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,CAAC;YAChC,OAAO,6BAA6B,CAAA;QACtC,CAAC;QAED,MAAM,UAAU,GACd,IAAI,CAAC,kBAAkB,IAAI,mCAAmC,CAAA;QAEhE,2EAA2E;QAC3E,4EAA4E;QAC5E,4EAA4E;QAC5E,wDAAwD;QACxD,IAAI,IAAI,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;YACrC,MAAM,qCAAqC,CAAC,UAAU,CAAC,CAAA;QACzD,CAAC;QAED,OAAO,6BAA6B,CAClC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,IAAI,EAClD,IAAI,CAAC,kBAAkB,EACvB,IAAI,CAAC,kBAAkB,CACxB,CAAA;IACH,CAAC;IAEO,WAAW,CAAC,QAA4B;QAC9C,IAAI,KAAK,EAAE;YAAE,OAAO,CAAC,KAAK,CAAC,mCAAmC,EAAE,QAAQ,CAAC,CAAA;QACzE,IAAI,CAAC,iBAAiB,IAAI,CAAC,CAAA;QAC3B,IAAI,CAAC,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,EAAE,GAAG,QAAQ,EAAE,CAAA;QAC7D,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,EAAE,CAC/C,UAAU,CAAC,IAAI,CAAC,cAAc,CAAC,CAChC,CAAA;IACH,CAAC;IAEO,KAAK,CAAC,yBAAyB;QACrC,IAAI,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAC/B,OAAO,IAAI,CAAC,qBAAqB,CAAA;QACnC,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,4BAA4B,EAAE,CAAC;YACvC,IAAI,CAAC,4BAA4B,GAAG,sBAAsB,EAAE;iBACzD,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE;gBACnB,MAAM,UAAU,GACd,UACD,CAAC,UAAU,CAAA;gBAEZ,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;gBACnE,CAAC;gBAED,IAAI,CAAC,qBAAqB,GAAG,UAAU,CAAA;gBACvC,OAAO,UAAU,CAAA;YACnB,CAAC,CAAC;iBACD,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACf,IAAI,CAAC,iBAAiB,GAAG,IAAI,CAAA;gBAC7B,IAAI,CAAC,4BAA4B,GAAG,SAAS,CAAA;gBAC7C,IACE,KAAK,YAAY,KAAK;oBACtB,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,2BAA2B,CAAC,EACnD,CAAC;oBACD,MAAM,KAAK,CAAA;gBACb,CAAC;gBACD,OAAO,SAAS,CAAA;YAClB,CAAC,CAAC,CAAA;QACN,CAAC;QAED,OAAO,IAAI,CAAC,4BAA4B,CAAA;IAC1C,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,sBAAsB;IAC7B,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,sBAAsB,CAAC,CAAA;IACvC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,0EAA0E;QAC1E,iEAAiE;QACjE,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC9B,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,OAAqC;IAErC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,OAAO;QACL,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;QAClD,cAAc,EAAE,2BAA2B,CAAC,OAAO,CAAC,cAAc,CAAC;QACnE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAA;AACH,CAAC;AAED,SAAS,2BAA2B,CAClC,cAA8D;IAE9D,OAAO,cAAc,KAAK,QAAQ;QAChC,cAAc,KAAK,OAAO;QAC1B,cAAc,KAAK,WAAW;QAC9B,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,SAAS,CAAA;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,uBAAuB,CAC9B,OAAqC,EACrC,IAAkC;IAElC,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAA;IACb,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,OAAO,KAAK,CAAA;IACd,CAAC;IAED,OAAO,CACL,MAAM,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACpC,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACrC,OAAO,CAAC,oBAAoB,KAAK,IAAI,CAAC,oBAAoB;QAC1D,OAAO,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc;QAC9C,MAAM,CAAC,OAAO,CAAC,gBAAgB,IAAI,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACrC,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;QAChC,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;QAChC,OAAO,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW;QACxC,OAAO,CAAC,QAAQ,KAAK,IAAI,CAAC,QAAQ;QAClC,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,CACrC,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,yBAAyB,CAChC,KAAyB,EACzB,aAA4B;IAE5B,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAE5B,MAAM,UAAU,GACd,OAAO,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IAErE,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAA;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,IAAI,UAAU,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC5C,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;IACvB,CAAC;IAED,iDAAiD;IACjD,EAAE;IACF,6EAA6E;IAC7E,oEAAoE;IACpE,6EAA6E;IAC7E,8EAA8E;IAC9E,wEAAwE;IACxE,4EAA4E;IAC5E,4DAA4D;IAC5D,IAAI,CAAC,gBAAgB,CAAC,aAAa,CAAC,SAAS,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;QAC3D,OAAO,CAAC,IAAI,CACV,8EAA8E;YAC5E,KAAK,GAAG,CAAC,MAAM,iEAAiE;YAChF,6EAA6E;YAC7E,yEAAyE,CAC5E,CAAA;QACD,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;AACvB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,mBAAmB,CAAC,KAAyB;IACpD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAA;IAC5B,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAA;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B;IACnC,MAAM,WAAW,GAAG,kBAAkB,EAA0B,CAAA;IAChE,IAAI,WAAW,EAAE,CAAC;QAChB,OAAO,WAAgD,CAAA;IACzD,CAAC;IAED,IAAI,OAAO,QAAQ,KAAK,WAAW,EAAE,CAAC;QACpC,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM;SAC3B,KAAK,CAAC,GAAG,CAAC;SACV,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;IACpD,MAAM,YAAY,GAAG,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAA;IAClE,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAC5B,kBAAkB,CAAC,YAAY,CAAC;SAC7B,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACzC,OAAO,cAAc,KAAK,CAAC,CAAC;YAC1B,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YACb,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,cAAc,GAAG,CAAC,CAAC,CAAC,CAAA;IACvE,CAAC,CAAC,CACL,CAAA;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AAClD,CAAC;AAED,SAAS,gBAAgB,CACvB,OAAqC;IAErC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,OAAO;QACL,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAA;AACH,CAAC"}

package/dist/auth/constants.d.ts

@@ -9,8 +9,14 @@ export declare const INTERNET_IDENTITY_PROVIDER_ENV_KEY = "INTERNET_IDENTITY_PRO
 export declare const LOCAL_INTERNET_IDENTITY_CANISTER_ID = "rdmx6-jaaaa-aaaaa-aaadq-cai";
 /**
  * Builds the local Internet Identity provider URL for the given replica port.
+ *
+ * `authorizePath` selects the shape the installed build understands: modern
+ * builds serve `/authorize` as a real asset, while pre-2026 ones serve the SPA
+ * at `/` and drive the flow from a `#authorize` fragment. `AuthenticationManager`
+ * probes the canister and passes the right one; the default keeps the previous
+ * behaviour for direct callers.
  */
-export declare const localInternetIdentityProvider: (port: number, canisterId?: string) => string;
+export declare const localInternetIdentityProvider: (port: number, canisterId?: string, authorizePath?: "/authorize" | "/#authorize") => string;
 /**
  * Legacy default URL for local Internet Identity, using port `4943`.
  */

package/dist/auth/constants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/auth/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,6BAA6B,4BAA4B,CAAA;AAEtE;;GAEG;AACH,eAAO,MAAM,kCAAkC,+BAA+B,CAAA;AAE9E;;GAEG;AACH,eAAO,MAAM,mCAAmC,gCAAgC,CAAA;AAEhF;;GAEG;AACH,eAAO,MAAM,6BAA6B,GACxC,MAAM,MAAM,EACZ,aAAY,MAA4C,WACH,CAAA;AAEvD;;GAEG;AACH,eAAO,MAAM,gCAAgC,QACR,CAAA"}
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/auth/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,6BAA6B,4BAA4B,CAAA;AAEtE;;GAEG;AACH,eAAO,MAAM,kCAAkC,+BAA+B,CAAA;AAE9E;;GAEG;AACH,eAAO,MAAM,mCAAmC,gCAAgC,CAAA;AAEhF;;;;;;;;GAQG;AACH,eAAO,MAAM,6BAA6B,GACxC,MAAM,MAAM,EACZ,aAAY,MAA4C,EACxD,gBAAe,YAAY,GAAG,aAA4B,WACC,CAAA;AAE7D;;GAEG;AACH,eAAO,MAAM,gCAAgC,QACR,CAAA"}

package/dist/auth/constants.js

@@ -9,8 +9,14 @@ export const INTERNET_IDENTITY_PROVIDER_ENV_KEY = "INTERNET_IDENTITY_PROVIDER";
 export const LOCAL_INTERNET_IDENTITY_CANISTER_ID = "rdmx6-jaaaa-aaaaa-aaadq-cai";
 /**
  * Builds the local Internet Identity provider URL for the given replica port.
+ *
+ * `authorizePath` selects the shape the installed build understands: modern
+ * builds serve `/authorize` as a real asset, while pre-2026 ones serve the SPA
+ * at `/` and drive the flow from a `#authorize` fragment. `AuthenticationManager`
+ * probes the canister and passes the right one; the default keeps the previous
+ * behaviour for direct callers.
  */
-export const localInternetIdentityProvider = (port, canisterId = LOCAL_INTERNET_IDENTITY_CANISTER_ID) => `http://${canisterId}.localhost:${port}/authorize`;
+export const localInternetIdentityProvider = (port, canisterId = LOCAL_INTERNET_IDENTITY_CANISTER_ID, authorizePath = "/authorize") => `http://${canisterId}.localhost:${port}${authorizePath}`;
 /**
  * Legacy default URL for local Internet Identity, using port `4943`.
  */

package/dist/auth/constants.js.map

@@ -1 +1 @@
-{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/auth/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,6BAA6B,GAAG,yBAAyB,CAAA;AAEtE;;GAEG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,4BAA4B,CAAA;AAE9E;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,6BAA6B,CAAA;AAEhF;;GAEG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC3C,IAAY,EACZ,aAAqB,mCAAmC,EACxD,EAAE,CAAC,UAAU,UAAU,cAAc,IAAI,YAAY,CAAA;AAEvD;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAC3C,6BAA6B,CAAC,IAAI,CAAC,CAAA"}
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/auth/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,6BAA6B,GAAG,yBAAyB,CAAA;AAEtE;;GAEG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,4BAA4B,CAAA;AAE9E;;GAEG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,6BAA6B,CAAA;AAEhF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAC3C,IAAY,EACZ,aAAqB,mCAAmC,EACxD,gBAA8C,YAAY,EAC1D,EAAE,CAAC,UAAU,UAAU,cAAc,IAAI,GAAG,aAAa,EAAE,CAAA;AAE7D;;GAEG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAC3C,6BAA6B,CAAC,IAAI,CAAC,CAAA"}

package/dist/auth/identity-attributes-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-attributes-manager.d.ts","sourceRoot":"","sources":["../../src/auth/identity-attributes-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAGV,uBAAuB,EACvB,mCAAmC,EACnC,yCAAyC,EAC1C,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AAOnE;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,yBAAyB;aACR,cAAc,EAAE,qBAAqB;gBAArC,cAAc,EAAE,qBAAqB;IAE1D,OAAO,GAAU,mEAOrB,mCAAmC,KAAG,OAAO,CAAC,uBAAuB,CAAC,CAyDxE;IAEM,aAAa,GAAI,mCAIrB,yCAAyC,KAAG,OAAO,CAAC,uBAAuB,CAAC,CAO9E;CACF"}
+{"version":3,"file":"identity-attributes-manager.d.ts","sourceRoot":"","sources":["../../src/auth/identity-attributes-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEV,uBAAuB,EACvB,mCAAmC,EACnC,yCAAyC,EAC1C,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAA;AAOnE;;;;;;;;;;;;;;;;GAgBG;AACH,qBAAa,yBAAyB;aACR,cAAc,EAAE,qBAAqB;gBAArC,cAAc,EAAE,qBAAqB;IAE1D,OAAO,GAAU,mEAOrB,mCAAmC,KAAG,OAAO,CAAC,uBAAuB,CAAC,CAyDxE;IAEM,aAAa,GAAI,mCAIrB,yCAAyC,KAAG,OAAO,CAAC,uBAAuB,CAAC,CAO9E;CACF"}

package/dist/auth/identity-attributes-manager.js

@@ -36,7 +36,7 @@ export class IdentityAttributesManager {
                 const preparedClient = this.authentication.getPreparedClient(clientOptions);
                 const authClient = preparedClient ?? (await this.authentication.ensureClient(clientOptions));
                 if (!authClient) {
-                    throw new Error("Authentication module is missing or failed to initialize. To request identity attributes, please install @icp-sdk/auth v7 or later, or provide a compatible authClient.");
+                    throw new Error("Authentication module is missing or failed to initialize. To request identity attributes, please install @icp-sdk/auth v8, or provide a compatible authClient.");
                 }
                 this.authentication.setAuthenticating();
                 try {
@@ -50,7 +50,7 @@ export class IdentityAttributesManager {
                         : Promise.resolve(authClient.getIdentity());
                     const requestPromise = authClient.requestAttributes({
                         keys,
-                        nonce: toAuthClientNonce(authClient, nonce),
+                        nonce: toAuthClientNonce(nonce),
                     });
                     const [signedAttributes, identity] = await Promise.all([
                         requestPromise,
@@ -90,19 +90,18 @@ export class IdentityAttributesManager {
     }
 }
 /**
- * Bridges the two `@icp-sdk/auth` nonce contracts.
+ * Adapts our nonce input to the `@icp-sdk/auth` nonce contract.
  *
- * v8 takes `() => Promise<Uint8Array>` (it journals the value so a redirect
- * flow replays the same bytes); v7 takes `Uint8Array | Promise<Uint8Array>`.
- * Both open the transport channel synchronously for the deferred forms, so we
- * always hand over the deferred shape the installed client understands.
- * `memoize` only exists from v8 onwards, which makes it a reliable marker.
+ * v8 takes `() => Promise<Uint8Array>` — a thunk, so it can journal the value
+ * and replay the same bytes through a redirect flow. The thunk form also opens
+ * the transport channel synchronously, which is what preserves the user
+ * gesture.
+ *
+ * Until 3.12.0 this probed `typeof authClient.memoize === "function"` to detect
+ * v8 and fell back to a bare promise for v7. The peer range is now `^8.0.0`, so
+ * the probe would only ever take one branch.
  */
-function toAuthClientNonce(authClient, nonce) {
-    const supportsNonceThunk = typeof authClient.memoize === "function";
-    if (supportsNonceThunk) {
-        return () => Promise.resolve(typeof nonce === "function" ? nonce() : nonce);
-    }
-    return Promise.resolve(typeof nonce === "function" ? nonce() : nonce);
+function toAuthClientNonce(nonce) {
+    return () => Promise.resolve(typeof nonce === "function" ? nonce() : nonce);
 }
 //# sourceMappingURL=identity-attributes-manager.js.map

package/dist/auth/identity-attributes-manager.js.map

@@ -1 +1 @@
-{"version":3,"file":"identity-attributes-manager.js","sourceRoot":"","sources":["../../src/auth/identity-attributes-manager.ts"],"names":[],"mappings":"AASA,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,iCAAiC,GAClC,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,yBAAyB;IACpC,YAA4B,cAAqC;QAArD;;;;mBAAgB,cAAc;WAAuB;QAE1D;;;;mBAAU,KAAK,EAAE,EACtB,IAAI,EACJ,KAAK,EACL,MAAM,GAAG,IAAI,EACb,aAAa,EACb,OAAO,EACP,GAAG,aAAa,EACoB,EAAoC,EAAE;gBAC1E,4EAA4E;gBAC5E,0EAA0E;gBAC1E,0EAA0E;gBAC1E,qDAAqD;gBACrD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAA;gBAC3E,MAAM,UAAU,GACd,cAAc,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAA;gBAE3E,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,IAAI,KAAK,CACb,yKAAyK,CAC1K,CAAA;gBACH,CAAC;gBAED,IAAI,CAAC,cAAc,CAAC,iBAAiB,EAAE,CAAA;gBAEvC,IAAI,CAAC;oBACH,wEAAwE;oBACxE,8DAA8D;oBAC9D,MAAM,eAAe,GAAG,MAAM;wBAC5B,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,uBAAuB,CAAC;4BAC1C,aAAa;4BACb,OAAO;yBACR,CAAC;wBACJ,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAA;oBAC7C,MAAM,cAAc,GAAG,UAAU,CAAC,iBAAiB,CAAC;wBAClD,IAAI;wBACJ,KAAK,EAAE,iBAAiB,CAAC,UAAU,EAAE,KAAK,CAAC;qBAC5C,CAAC,CAAA;oBAEF,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;wBACrD,cAAc;wBACd,eAAe;qBAChB,CAAC,CAAA;oBAEF,MAAM,aAAa,GAAG,QAAQ,IAAI,CAAC,MAAM,UAAU,CAAC,WAAW,EAAE,CAAC,CAAA;oBAClE,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,eAAe,EAAE,CAAA;oBAC1D,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,aAAa,EAAE,eAAe,CAAC,CAAA;oBAExE,MAAM,0BAA0B,GAC9B,iCAAiC,CAAC,gBAAgB,CAAC,CAAA;oBAErD,OAAO;wBACL,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE;wBAChD,aAAa,EAAE,IAAI;wBACnB,gBAAgB,EAAE,0BAA0B;wBAC5C,iBAAiB,EAAE,6BAA6B,CAC9C,0BAA0B,CAAC,IAAI,EAC/B,IAAI,CACL;wBACD,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;qBACtC,CAAA;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,KAAc,CAAC,CAAA;oBAC1D,MAAM,KAAK,CAAA;gBACb,CAAC;YACH,CAAC;WAAA;QAEM;;;;mBAAgB,CAAC,EACtB,IAAI,EACJ,cAAc,EACd,GAAG,IAAI,EACmC,EAAoC,EAAE;gBAChF,uEAAuE;gBACvE,OAAO,IAAI,CAAC,OAAO,CAAC;oBAClB,GAAG,IAAI;oBACP,cAAc;oBACd,IAAI,EAAE,qBAAqB,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;iBACtD,CAAC,CAAA;YACJ,CAAC;WAAA;IA/EmE,CAAC;CAgFtE;AAED;;;;;;;;GAQG;AACH,SAAS,iBAAiB,CACxB,UAA0B,EAC1B,KAA6B;IAE7B,MAAM,kBAAkB,GAAG,OAAO,UAAU,CAAC,OAAO,KAAK,UAAU,CAAA;IAEnE,IAAI,kBAAkB,EAAE,CAAC;QACvB,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;IAC7E,CAAC;IAED,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;AACvE,CAAC"}
+{"version":3,"file":"identity-attributes-manager.js","sourceRoot":"","sources":["../../src/auth/identity-attributes-manager.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,6BAA6B,EAC7B,qBAAqB,EACrB,iCAAiC,GAClC,MAAM,0BAA0B,CAAA;AAEjC;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,OAAO,yBAAyB;IACpC,YAA4B,cAAqC;QAArD;;;;mBAAgB,cAAc;WAAuB;QAE1D;;;;mBAAU,KAAK,EAAE,EACtB,IAAI,EACJ,KAAK,EACL,MAAM,GAAG,IAAI,EACb,aAAa,EACb,OAAO,EACP,GAAG,aAAa,EACoB,EAAoC,EAAE;gBAC1E,4EAA4E;gBAC5E,0EAA0E;gBAC1E,0EAA0E;gBAC1E,qDAAqD;gBACrD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAA;gBAC3E,MAAM,UAAU,GACd,cAAc,IAAI,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC,CAAA;gBAE3E,IAAI,CAAC,UAAU,EAAE,CAAC;oBAChB,MAAM,IAAI,KAAK,CACb,gKAAgK,CACjK,CAAA;gBACH,CAAC;gBAED,IAAI,CAAC,cAAc,CAAC,iBAAiB,EAAE,CAAA;gBAEvC,IAAI,CAAC;oBACH,wEAAwE;oBACxE,8DAA8D;oBAC9D,MAAM,eAAe,GAAG,MAAM;wBAC5B,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,uBAAuB,CAAC;4BAC1C,aAAa;4BACb,OAAO;yBACR,CAAC;wBACJ,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAA;oBAC7C,MAAM,cAAc,GAAG,UAAU,CAAC,iBAAiB,CAAC;wBAClD,IAAI;wBACJ,KAAK,EAAE,iBAAiB,CAAC,KAAK,CAAC;qBAChC,CAAC,CAAA;oBAEF,MAAM,CAAC,gBAAgB,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;wBACrD,cAAc;wBACd,eAAe;qBAChB,CAAC,CAAA;oBAEF,MAAM,aAAa,GAAG,QAAQ,IAAI,CAAC,MAAM,UAAU,CAAC,WAAW,EAAE,CAAC,CAAA;oBAClE,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,eAAe,EAAE,CAAA;oBAC1D,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,CAAC,aAAa,EAAE,eAAe,CAAC,CAAA;oBAExE,MAAM,0BAA0B,GAC9B,iCAAiC,CAAC,gBAAgB,CAAC,CAAA;oBAErD,OAAO;wBACL,SAAS,EAAE,aAAa,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE;wBAChD,aAAa,EAAE,IAAI;wBACnB,gBAAgB,EAAE,0BAA0B;wBAC5C,iBAAiB,EAAE,6BAA6B,CAC9C,0BAA0B,CAAC,IAAI,EAC/B,IAAI,CACL;wBACD,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;qBACtC,CAAA;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,KAAc,CAAC,CAAA;oBAC1D,MAAM,KAAK,CAAA;gBACb,CAAC;YACH,CAAC;WAAA;QAEM;;;;mBAAgB,CAAC,EACtB,IAAI,EACJ,cAAc,EACd,GAAG,IAAI,EACmC,EAAoC,EAAE;gBAChF,uEAAuE;gBACvE,OAAO,IAAI,CAAC,OAAO,CAAC;oBAClB,GAAG,IAAI;oBACP,cAAc;oBACd,IAAI,EAAE,qBAAqB,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;iBACtD,CAAC,CAAA;YACJ,CAAC;WAAA;IA/EmE,CAAC;CAgFtE;AAED;;;;;;;;;;;GAWG;AACH,SAAS,iBAAiB,CACxB,KAA6B;IAE7B,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC"}

package/dist/auth/local-ii-probe.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Ask a locally deployed Internet Identity canister what it actually serves.
+ *
+ * `localInternetIdentityProvider` builds `http://<id>.localhost:<port>/authorize`,
+ * the id.ai-era path. Whether that works depends on which Internet Identity
+ * build is installed, and the window is narrow:
+ *
+ * - up to `release-2025-03-07`, the SPA lived at `/` and used a `#authorize`
+ *   fragment; `/authorize` is not an asset
+ * - `release-2026-01-05` through `release-2026-03-16` serve `/authorize`
+ * - from `release-2026-03-23` the frontend left the canister entirely (the id.ai
+ *   split), so `/authorize` 404s even on `.raw`
+ *
+ * Outside that window the login popup renders the gateway's
+ * "Response Verification Error" page and the app simply waits until the user
+ * closes it. Nothing points at the cause.
+ *
+ * Asking the canister over the agent avoids the gateway, so the answer is about
+ * the canister's assets rather than about how the gateway felt about them.
+ */
+import { type HttpAgent } from "@icp-sdk/core/agent";
+/** Where a given Internet Identity build expects the sign-in flow to start. */
+export type AuthorizePath = "/authorize" | "/#authorize";
+export interface LocalIiProbe {
+    /** The path that works, or `null` when the canister serves no sign-in UI. */
+    path: AuthorizePath | null;
+    /**
+     * The probe could not reach a conclusion — the canister was unreachable, or
+     * it does not expose `http_request` at all. Callers keep their existing
+     * behaviour rather than blocking a login that might well work.
+     */
+    inconclusive: boolean;
+}
+/**
+ * Determine which authorize path a locally deployed Internet Identity serves.
+ *
+ * Never throws. A probe that cannot answer returns `inconclusive`, because a
+ * diagnostic that blocks a working setup is worse than the failure it explains.
+ */
+export declare function probeLocalInternetIdentity(agent: HttpAgent, canisterId: string): Promise<LocalIiProbe>;
+/**
+ * The error a login gets when the installed build serves no sign-in UI, in
+ * place of a 503 page inside a popup the app cannot see.
+ */
+export declare function localInternetIdentityUnavailableError(canisterId: string): Error;
+//# sourceMappingURL=local-ii-probe.d.ts.map

package/dist/auth/local-ii-probe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-ii-probe.d.ts","sourceRoot":"","sources":["../../src/auth/local-ii-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAS,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAqC3D,+EAA+E;AAC/E,MAAM,MAAM,aAAa,GAAG,YAAY,GAAG,aAAa,CAAA;AAExD,MAAM,WAAW,YAAY;IAC3B,6EAA6E;IAC7E,IAAI,EAAE,aAAa,GAAG,IAAI,CAAA;IAC1B;;;;OAIG;IACH,YAAY,EAAE,OAAO,CAAA;CACtB;AAmBD;;;;;GAKG;AACH,wBAAsB,0BAA0B,CAC9C,KAAK,EAAE,SAAS,EAChB,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,YAAY,CAAC,CA+BvB;AAED;;;GAGG;AACH,wBAAgB,qCAAqC,CACnD,UAAU,EAAE,MAAM,GACjB,KAAK,CASP"}

package/dist/auth/local-ii-probe.js

@@ -0,0 +1,102 @@
+/**
+ * Ask a locally deployed Internet Identity canister what it actually serves.
+ *
+ * `localInternetIdentityProvider` builds `http://<id>.localhost:<port>/authorize`,
+ * the id.ai-era path. Whether that works depends on which Internet Identity
+ * build is installed, and the window is narrow:
+ *
+ * - up to `release-2025-03-07`, the SPA lived at `/` and used a `#authorize`
+ *   fragment; `/authorize` is not an asset
+ * - `release-2026-01-05` through `release-2026-03-16` serve `/authorize`
+ * - from `release-2026-03-23` the frontend left the canister entirely (the id.ai
+ *   split), so `/authorize` 404s even on `.raw`
+ *
+ * Outside that window the login popup renders the gateway's
+ * "Response Verification Error" page and the app simply waits until the user
+ * closes it. Nothing points at the cause.
+ *
+ * Asking the canister over the agent avoids the gateway, so the answer is about
+ * the canister's assets rather than about how the gateway felt about them.
+ */
+import { Actor } from "@icp-sdk/core/agent";
+/** The `http_request` query every asset-serving canister exposes. */
+const httpInterface = ({ IDL }) => {
+    const HeaderField = IDL.Tuple(IDL.Text, IDL.Text);
+    return IDL.Service({
+        http_request: IDL.Func([
+            IDL.Record({
+                method: IDL.Text,
+                url: IDL.Text,
+                headers: IDL.Vec(HeaderField),
+                body: IDL.Vec(IDL.Nat8),
+            }),
+        ], [
+            IDL.Record({
+                status_code: IDL.Nat16,
+                headers: IDL.Vec(HeaderField),
+                body: IDL.Vec(IDL.Nat8),
+            }),
+        ], ["query"]),
+    });
+};
+async function statusOf(actor, url) {
+    try {
+        const response = await actor.http_request({
+            method: "GET",
+            url,
+            headers: [],
+            body: new Uint8Array(),
+        });
+        return response.status_code;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Determine which authorize path a locally deployed Internet Identity serves.
+ *
+ * Never throws. A probe that cannot answer returns `inconclusive`, because a
+ * diagnostic that blocks a working setup is worse than the failure it explains.
+ */
+export async function probeLocalInternetIdentity(agent, canisterId) {
+    let actor;
+    try {
+        actor = Actor.createActor(httpInterface, {
+            agent,
+            canisterId,
+        });
+    }
+    catch {
+        return { path: "/authorize", inconclusive: true };
+    }
+    const authorize = await statusOf(actor, "/authorize");
+    // The canister does not answer http_request at all — not an asset canister,
+    // not deployed, or the replica is down. Not our call to make.
+    if (authorize === undefined) {
+        return { path: "/authorize", inconclusive: true };
+    }
+    if (authorize >= 200 && authorize < 300) {
+        return { path: "/authorize", inconclusive: false };
+    }
+    // Pre-2026 builds serve the SPA at the root and drive the flow from a
+    // `#authorize` fragment, which is a path the gateway never sees.
+    const root = await statusOf(actor, "/");
+    if (root !== undefined && root >= 200 && root < 300) {
+        return { path: "/#authorize", inconclusive: false };
+    }
+    return { path: null, inconclusive: false };
+}
+/**
+ * The error a login gets when the installed build serves no sign-in UI, in
+ * place of a 503 page inside a popup the app cannot see.
+ */
+export function localInternetIdentityUnavailableError(canisterId) {
+    return new Error(`[ic-reactor] The Internet Identity canister ${canisterId} does not serve a sign-in UI: ` +
+        `neither /authorize nor / returned a page. Internet Identity builds from ` +
+        `release-2026-03-23 onward moved their frontend out of the canister (the id.ai split) ` +
+        `and cannot be used locally. Install internet_identity_dev.wasm from release-2026-03-16, ` +
+        `the newest build that still self-serves /authorize, or point \`identityProvider\` at a ` +
+        `provider you host yourself.`);
+}
+//# sourceMappingURL=local-ii-probe.js.map

package/dist/auth/local-ii-probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-ii-probe.js","sourceRoot":"","sources":["../../src/auth/local-ii-probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAE,KAAK,EAAkB,MAAM,qBAAqB,CAAA;AAG3D,qEAAqE;AACrE,MAAM,aAAa,GAAyB,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;IACtD,MAAM,WAAW,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAA;IACjD,OAAO,GAAG,CAAC,OAAO,CAAC;QACjB,YAAY,EAAE,GAAG,CAAC,IAAI,CACpB;YACE,GAAG,CAAC,MAAM,CAAC;gBACT,MAAM,EAAE,GAAG,CAAC,IAAI;gBAChB,GAAG,EAAE,GAAG,CAAC,IAAI;gBACb,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC;gBAC7B,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;aACxB,CAAC;SACH,EACD;YACE,GAAG,CAAC,MAAM,CAAC;gBACT,WAAW,EAAE,GAAG,CAAC,KAAK;gBACtB,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC;gBAC7B,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;aACxB,CAAC;SACH,EACD,CAAC,OAAO,CAAC,CACV;KACF,CAAC,CAAA;AACJ,CAAC,CAAA;AAyBD,KAAK,UAAU,QAAQ,CACrB,KAAuB,EACvB,GAAW;IAEX,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC;YACxC,MAAM,EAAE,KAAK;YACb,GAAG;YACH,OAAO,EAAE,EAAE;YACX,IAAI,EAAE,IAAI,UAAU,EAAE;SACvB,CAAC,CAAA;QACF,OAAO,QAAQ,CAAC,WAAW,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAA;IAClB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,KAAgB,EAChB,UAAkB;IAElB,IAAI,KAAuB,CAAA;IAC3B,IAAI,CAAC;QACH,KAAK,GAAG,KAAK,CAAC,WAAW,CAAmB,aAAa,EAAE;YACzD,KAAK;YACL,UAAU;SACX,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,CAAA;IACnD,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;IAErD,4EAA4E;IAC5E,8DAA8D;IAC9D,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,CAAA;IACnD,CAAC;IAED,IAAI,SAAS,IAAI,GAAG,IAAI,SAAS,GAAG,GAAG,EAAE,CAAC;QACxC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,KAAK,EAAE,CAAA;IACpD,CAAC;IAED,sEAAsE;IACtE,iEAAiE;IACjE,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IACvC,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,IAAI,GAAG,IAAI,IAAI,GAAG,GAAG,EAAE,CAAC;QACpD,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,YAAY,EAAE,KAAK,EAAE,CAAA;IACrD,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAA;AAC5C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qCAAqC,CACnD,UAAkB;IAElB,OAAO,IAAI,KAAK,CACd,+CAA+C,UAAU,gCAAgC;QACvF,0EAA0E;QAC1E,uFAAuF;QACvF,0FAA0F;QAC1F,yFAAyF;QACzF,6BAA6B,CAChC,CAAA;AACH,CAAC"}

package/dist/auth/types.d.ts

@@ -167,10 +167,8 @@ export interface AuthClientLike {
     }): Promise<void>;
     requestAttributes(params: {
         keys: string[];
-        nonce: Uint8Array | Promise<Uint8Array> | (() => Promise<Uint8Array>);
+        nonce: () => Promise<Uint8Array>;
     }): Promise<SignedIdentityAttributes>;
-    /** Present from `@icp-sdk/auth` v8; used to detect the nonce contract. */
-    memoize?<T>(produce: () => T | Promise<T>): Promise<T>;
 }
 export interface AuthState {
     identity: Identity | null;

package/dist/auth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAExD,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,UAAU,CAAA;IAChB,SAAS,EAAE,UAAU,CAAA;CACtB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,sBAAsB,GAChC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;AAE7E,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,KAAK,EAAE,sBAAsB,CAAA;CAC9B;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,gBAAgB,EAAE,wBAAwB,CAAA;IAC1C,iBAAiB,EAAE,uBAAuB,CAAA;IAC1C,WAAW,EAAE,MAAM,CAAA;CACpB;AAED;;;GAGG;AACH,KAAK,oCAAoC,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,CAAA;AAE5E;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,+BAA+B,GACzC,oCAAoC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;AAEtD,mDAAmD;AACnD,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,SAAS,CAAA;AAEnD,kEAAkE;AAClE,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,aAAa,GAAG,IAAI,CAAC,CAAA;IACxD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9D,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACnC;AAED,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,OAAO,CAAA;IACtB,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,sDAAsD;IACtD,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,0CAA0C;IAC1C,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,sDAAsD;IACtD,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB;;;OAGG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAA;CACrC;AAED,MAAM,WAAW,2BAA2B;IAC1C,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,MAAM,GAAG,GAAG,CAAA;IAC/B,qEAAqE;IACrE,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,+BAA+B,CAAA;IAChD;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,GAAG,CAAA;IAC/B,qDAAqD;IACrD,OAAO,CAAC,EAAE,qBAAqB,CAAA;IAC/B;;;OAGG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAA;IAC3B;;;OAGG;IACH,WAAW,CAAC,EAAE,qBAAqB,CAAA;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,YAAY,GAAG,eAAe,CAAA;IACzC;;;;OAIG;IACH,SAAS,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAA;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,OAAO,CAAC,EAAE,SAAS,EAAE,CAAA;CACtB;AAED,MAAM,WAAW,2BACf,SAAQ,uBAAuB,EAAE,2BAA2B;IAC5D,SAAS,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACtC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACnD;AAED,MAAM,WAAW,mCAAoC,SAAQ,2BAA2B;IACtF,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,KAAK,EAAE,sBAAsB,CAAA;IAC7B;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,OAAO,CAAC,EAAE,SAAS,EAAE,CAAA;CACtB;AAED,MAAM,WAAW,yCAA0C,SAAQ,IAAI,CACrE,mCAAmC,EACnC,gBAAgB,CACjB;IACC;;;;;;;;OAQG;IACH,cAAc,EAAE,+BAA+B,CAAA;CAChD;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,WAAW,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAA;IAC3C,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;IAC7C,MAAM,CAAC,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC5D,OAAO,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvD,iBAAiB,CAAC,MAAM,EAAE;QACxB,IAAI,EAAE,MAAM,EAAE,CAAA;QAId,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;KACtE,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAA;IACrC,0EAA0E;IAC1E,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;CACvD;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,gBAAgB,EAAE,OAAO,CAAA;IACzB,eAAe,EAAE,OAAO,CAAA;IACxB,KAAK,EAAE,KAAK,GAAG,SAAS,CAAA;CACzB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AACjE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAA;AAExD,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,UAAU,CAAA;IAChB,SAAS,EAAE,UAAU,CAAA;CACtB;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,sBAAsB,GAChC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAA;AAE7E,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,KAAK,EAAE,sBAAsB,CAAA;CAC9B;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAAA;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE,MAAM,EAAE,CAAA;IACvB,gBAAgB,EAAE,wBAAwB,CAAA;IAC1C,iBAAiB,EAAE,uBAAuB,CAAA;IAC1C,WAAW,EAAE,MAAM,CAAA;CACpB;AAED;;;GAGG;AACH,KAAK,oCAAoC,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,CAAA;AAE5E;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,+BAA+B,GACzC,oCAAoC,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAA;AAEtD,mDAAmD;AACnD,MAAM,MAAM,iBAAiB,GAAG,OAAO,GAAG,SAAS,CAAA;AAEnD,kEAAkE;AAClE,MAAM,WAAW,qBAAqB;IACpC,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,aAAa,GAAG,IAAI,CAAC,CAAA;IACxD,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9D,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACnC;AAED,yEAAyE;AACzE,MAAM,WAAW,qBAAqB;IACpC,+DAA+D;IAC/D,MAAM,CAAC,EAAE,MAAM,OAAO,CAAA;IACtB,wDAAwD;IACxD,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,sDAAsD;IACtD,aAAa,CAAC,EAAE,OAAO,CAAA;IACvB,0CAA0C;IAC1C,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,sDAAsD;IACtD,WAAW,CAAC,EAAE,OAAO,CAAA;IACrB;;;OAGG;IACH,0BAA0B,CAAC,EAAE,OAAO,CAAA;CACrC;AAED,MAAM,WAAW,2BAA2B;IAC1C,gEAAgE;IAChE,gBAAgB,CAAC,EAAE,MAAM,GAAG,GAAG,CAAA;IAC/B,qEAAqE;IACrE,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;;;;OAOG;IACH,cAAc,CAAC,EAAE,+BAA+B,CAAA;IAChD;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,GAAG,CAAA;IAC/B,qDAAqD;IACrD,OAAO,CAAC,EAAE,qBAAqB,CAAA;IAC/B;;;OAGG;IACH,OAAO,CAAC,EAAE,iBAAiB,CAAA;IAC3B;;;OAGG;IACH,WAAW,CAAC,EAAE,qBAAqB,CAAA;IACnC,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,YAAY,GAAG,eAAe,CAAA;IACzC;;;;OAIG;IACH,SAAS,CAAC,EAAE,QAAQ,GAAG,UAAU,CAAA;CAClC;AAED,MAAM,WAAW,uBAAuB;IACtC,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,OAAO,CAAC,EAAE,SAAS,EAAE,CAAA;CACtB;AAED,MAAM,WAAW,2BACf,SAAQ,uBAAuB,EAAE,2BAA2B;IAC5D,SAAS,CAAC,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACtC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACnD;AAED,MAAM,WAAW,mCAAoC,SAAQ,2BAA2B;IACtF,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,KAAK,EAAE,sBAAsB,CAAA;IAC7B;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,OAAO,CAAC,EAAE,SAAS,EAAE,CAAA;CACtB;AAED,MAAM,WAAW,yCAA0C,SAAQ,IAAI,CACrE,mCAAmC,EACnC,gBAAgB,CACjB;IACC;;;;;;;;OAQG;IACH,cAAc,EAAE,+BAA+B,CAAA;CAChD;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,WAAW,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,QAAQ,CAAA;IAC3C,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;IAC7C,MAAM,CAAC,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC5D,OAAO,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvD,iBAAiB,CAAC,MAAM,EAAE;QACxB,IAAI,EAAE,MAAM,EAAE,CAAA;QAId,KAAK,EAAE,MAAM,OAAO,CAAC,UAAU,CAAC,CAAA;KACjC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAA;CACtC;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,QAAQ,GAAG,IAAI,CAAA;IACzB,gBAAgB,EAAE,OAAO,CAAA;IACzB,eAAe,EAAE,OAAO,CAAA;IACxB,KAAK,EAAE,KAAK,GAAG,SAAS,CAAA;CACzB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ic-reactor/react",
-  "version": "3.10.0",
+  "version": "3.12.0",
   "description": "IC Reactor React library for building Internet Computer apps",
   "main": "dist/index.js",
   "module": "dist/index.js",
@@ -53,30 +53,30 @@
   "author": "Behrad Deylami",
   "license": "MIT",
   "dependencies": {
-    "@ic-reactor/core": "^3.10.0"
+    "@ic-reactor/core": "^3.12.0"
   },
   "peerDependencies": {
-    "@icp-sdk/auth": "^7.1.0 || ^8.0.0",
-    "@icp-sdk/core": "^6.0.0",
+    "@icp-sdk/auth": "^8.0.0",
+    "@icp-sdk/core": "^6.1.0",
     "@tanstack/react-query": "^5.0.0",
     "react": ">=18.0.0",
     "react-dom": ">=18.0.0"
   },
   "devDependencies": {
-    "@icp-sdk/auth": "^8.0.0",
-    "@icp-sdk/core": "^6.0.0",
-    "@size-limit/preset-small-lib": "^12.1.0",
+    "@icp-sdk/auth": "^8.0.3",
+    "@icp-sdk/core": "^6.1.0",
+    "@size-limit/preset-small-lib": "^13.0.3",
     "@tanstack/react-query": "^5.101.4",
     "@testing-library/dom": "^10.4.1",
-    "@testing-library/jest-dom": "^6.9.1",
+    "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/react": "^16.3.2",
-    "@types/react": "^19.2.17",
-    "@types/react-dom": "^19.2.3",
+    "@types/react": "^19.2.18",
+    "@types/react-dom": "^19.2.4",
     "fake-indexeddb": "^6.2.5",
-    "jsdom": "^29.1.1",
+    "jsdom": "^30.0.1",
     "react": "^19.2.8",
     "react-dom": "^19.2.8",
-    "size-limit": "^12.1.0",
+    "size-limit": "^13.0.3",
     "vitest": "^4.1.10"
   },
   "size-limit": [

package/src/auth/authentication-manager.ts

@@ -6,13 +6,19 @@ import type {
   AuthenticationClientOptions,
   AuthenticationSignInOptions,
 } from "./types.js"
-import { ClientManager, isDev, isMainnetHost } from "@ic-reactor/core"
+import { ClientManager, isDev, allowsEnvRootKey } from "@ic-reactor/core"
 
 import { Principal } from "@icp-sdk/core/principal"
 import { safeGetCanisterEnv } from "@icp-sdk/core/agent/canister-env"
+import {
+  probeLocalInternetIdentity,
+  localInternetIdentityUnavailableError,
+  type AuthorizePath,
+} from "./local-ii-probe.js"
 import {
   IC_INTERNET_IDENTITY_PROVIDER,
   INTERNET_IDENTITY_PROVIDER_ENV_KEY,
+  LOCAL_INTERNET_IDENTITY_CANISTER_ID,
   localInternetIdentityProvider,
 } from "./constants.js"
 
@@ -61,6 +67,13 @@ export class AuthenticationManager {
   }
   private readonly identityProvider?: string | URL
   private readonly internetIdentityId?: string
+  /**
+   * Which authorize path the locally deployed Internet Identity serves, once
+   * probed. `undefined` means not probed yet; `null` means it serves no sign-in
+   * UI and login should fail with an explanation rather than open a popup onto
+   * a gateway error page.
+   */
+  private localAuthorizePath?: AuthorizePath | null
   private readonly defaultClientOptions: AuthenticationClientOptions
   public readonly clientManager: ClientManager
 
@@ -131,6 +144,11 @@ export class AuthenticationManager {
    * what browser popup blockers and the ICRC-29 transport require.
    */
   public async prepareClient(options?: AuthenticationClientOptions) {
+    // Before resolving options, because resolving them is what picks the
+    // provider URL. This is the last async point before `login()` has to stay
+    // inside the user gesture, so the answer has to be cached by now.
+    await this.ensureLocalAuthorizePath()
+
     const clientOptions = this.resolveClientOptions(options)
 
     if (this.authClient && !this.shouldRecreateClient(clientOptions)) {
@@ -140,6 +158,40 @@ export class AuthenticationManager {
     return this.initializeClient(clientOptions)
   }
 
+  /**
+   * Probe the local Internet Identity canister once, and remember what it
+   * serves.
+   *
+   * Only for the derived local provider: an explicitly configured
+   * `identityProvider` is the caller's business, and mainnet is fixed.
+   */
+  private async ensureLocalAuthorizePath(): Promise<void> {
+    if (this.localAuthorizePath !== undefined) return
+    if (this.identityProvider) return
+    if (!this.clientManager.isLocal) return
+
+    const canisterId =
+      this.internetIdentityId ?? LOCAL_INTERNET_IDENTITY_CANISTER_ID
+
+    const { path, inconclusive } = await probeLocalInternetIdentity(
+      this.clientManager.agent,
+      canisterId
+    )
+
+    // An inconclusive probe must not change behaviour: the canister may be
+    // fine and merely unreachable from here, and a diagnostic that blocks a
+    // working login is worse than the failure it explains.
+    this.localAuthorizePath = inconclusive ? "/authorize" : path
+
+    if (path === "/#authorize" && !inconclusive) {
+      console.warn(
+        `[ic-reactor] Internet Identity canister ${canisterId} serves its sign-in UI at ` +
+          `"/" rather than "/authorize" — using the legacy #authorize flow. This is a ` +
+          `pre-2026 build; newer ones through release-2026-03-16 serve /authorize directly.`
+      )
+    }
+  }
+
   /**
    * Returns an AuthClient without awaiting, or `undefined` when the auth
    * module has not been loaded yet.
@@ -467,12 +519,26 @@ export class AuthenticationManager {
     if (this.identityProvider) {
       return this.identityProvider
     }
-    return this.clientManager.isLocal
-      ? localInternetIdentityProvider(
-          Number(this.clientManager.agentHost?.port) || 4943,
-          this.internetIdentityId
-        )
-      : IC_INTERNET_IDENTITY_PROVIDER
+    if (!this.clientManager.isLocal) {
+      return IC_INTERNET_IDENTITY_PROVIDER
+    }
+
+    const canisterId =
+      this.internetIdentityId ?? LOCAL_INTERNET_IDENTITY_CANISTER_ID
+
+    // `null` is the probe's positive finding that this build serves no sign-in
+    // UI. Throwing here surfaces an actionable message where the caller can see
+    // it, instead of opening a popup onto the gateway's verification-error page
+    // and leaving the app waiting until the user closes it.
+    if (this.localAuthorizePath === null) {
+      throw localInternetIdentityUnavailableError(canisterId)
+    }
+
+    return localInternetIdentityProvider(
+      Number(this.clientManager.agentHost?.port) || 4943,
+      this.internetIdentityId,
+      this.localAuthorizePath
+    )
   }
 
   private updateState(newState: Partial<AuthState>) {
@@ -651,16 +717,21 @@ function acceptEnvIdentityProvider(
     return url.toString()
   }
 
-  // `isMainnetHost` matches only the real boundary domains and defaults to true
-  // for an unknown host, so custom testnets keep working while anything that
-  // looks like mainnet fails closed. `clientManager.isLocal` would be wrong
-  // here: it treats every unrecognized hostname as "ic".
-  if (isMainnetHost(clientManager.agentHost?.toString())) {
+  // Positive allowlist, not `!isMainnetHost(...)`.
+  //
+  // The old comment here claimed this defaulted to true for an unknown host so
+  // that "anything that looks like mainnet fails closed". It did not:
+  // isMainnetHost defaults to true only for `undefined`, and returns false for
+  // every unrecognised host — so a dapp on a custom domain accepted an identity
+  // provider chosen by a cookie, and the ic_env cookie is writable by any
+  // sibling subdomain. Redirecting the Internet Identity flow is as severe as
+  // substituting the root key, so both now use the same test.
+  if (!allowsEnvRootKey(clientManager.agentHost?.toString())) {
     console.warn(
       `[ic-reactor] Ignoring the Internet Identity provider from the ic_env cookie ` +
-        `("${url.origin}") because this reactor targets mainnet, where the provider ` +
-        `is taken from configuration rather than the environment. Pass ` +
-        `\`identityProvider\` to AuthenticationManager to use a custom provider on mainnet.`
+        `("${url.origin}") because this reactor does not target a local replica, where ` +
+        `the provider is taken from configuration rather than the environment. Pass ` +
+        `\`identityProvider\` to AuthenticationManager to use a custom provider.`
     )
     return undefined
   }

package/src/auth/constants.ts

@@ -12,11 +12,18 @@ export const LOCAL_INTERNET_IDENTITY_CANISTER_ID = "rdmx6-jaaaa-aaaaa-aaadq-cai"
 
 /**
  * Builds the local Internet Identity provider URL for the given replica port.
+ *
+ * `authorizePath` selects the shape the installed build understands: modern
+ * builds serve `/authorize` as a real asset, while pre-2026 ones serve the SPA
+ * at `/` and drive the flow from a `#authorize` fragment. `AuthenticationManager`
+ * probes the canister and passes the right one; the default keeps the previous
+ * behaviour for direct callers.
  */
 export const localInternetIdentityProvider = (
   port: number,
-  canisterId: string = LOCAL_INTERNET_IDENTITY_CANISTER_ID
-) => `http://${canisterId}.localhost:${port}/authorize`
+  canisterId: string = LOCAL_INTERNET_IDENTITY_CANISTER_ID,
+  authorizePath: "/authorize" | "/#authorize" = "/authorize"
+) => `http://${canisterId}.localhost:${port}${authorizePath}`
 
 /**
  * Legacy default URL for local Internet Identity, using port `4943`.

package/src/auth/identity-attributes-manager.ts

@@ -1,5 +1,4 @@
 import type {
-  AuthClientLike,
   IdentityAttributeNonce,
   IdentityAttributeResult,
   RequestIdentityAttributesParameters,
@@ -51,7 +50,7 @@ export class IdentityAttributesManager {
 
     if (!authClient) {
       throw new Error(
-        "Authentication module is missing or failed to initialize. To request identity attributes, please install @icp-sdk/auth v7 or later, or provide a compatible authClient."
+        "Authentication module is missing or failed to initialize. To request identity attributes, please install @icp-sdk/auth v8, or provide a compatible authClient."
       )
     }
 
@@ -68,7 +67,7 @@ export class IdentityAttributesManager {
         : Promise.resolve(authClient.getIdentity())
       const requestPromise = authClient.requestAttributes({
         keys,
-        nonce: toAuthClientNonce(authClient, nonce),
+        nonce: toAuthClientNonce(nonce),
       })
 
       const [signedAttributes, identity] = await Promise.all([
@@ -114,23 +113,19 @@ export class IdentityAttributesManager {
 }
 
 /**
- * Bridges the two `@icp-sdk/auth` nonce contracts.
+ * Adapts our nonce input to the `@icp-sdk/auth` nonce contract.
  *
- * v8 takes `() => Promise<Uint8Array>` (it journals the value so a redirect
- * flow replays the same bytes); v7 takes `Uint8Array | Promise<Uint8Array>`.
- * Both open the transport channel synchronously for the deferred forms, so we
- * always hand over the deferred shape the installed client understands.
- * `memoize` only exists from v8 onwards, which makes it a reliable marker.
+ * v8 takes `() => Promise<Uint8Array>` — a thunk, so it can journal the value
+ * and replay the same bytes through a redirect flow. The thunk form also opens
+ * the transport channel synchronously, which is what preserves the user
+ * gesture.
+ *
+ * Until 3.12.0 this probed `typeof authClient.memoize === "function"` to detect
+ * v8 and fell back to a bare promise for v7. The peer range is now `^8.0.0`, so
+ * the probe would only ever take one branch.
  */
 function toAuthClientNonce(
-  authClient: AuthClientLike,
   nonce: IdentityAttributeNonce
-): Uint8Array | Promise<Uint8Array> | (() => Promise<Uint8Array>) {
-  const supportsNonceThunk = typeof authClient.memoize === "function"
-
-  if (supportsNonceThunk) {
-    return () => Promise.resolve(typeof nonce === "function" ? nonce() : nonce)
-  }
-
-  return Promise.resolve(typeof nonce === "function" ? nonce() : nonce)
+): () => Promise<Uint8Array> {
+  return () => Promise.resolve(typeof nonce === "function" ? nonce() : nonce)
 }

package/src/auth/local-ii-probe.ts

@@ -0,0 +1,147 @@
+/**
+ * Ask a locally deployed Internet Identity canister what it actually serves.
+ *
+ * `localInternetIdentityProvider` builds `http://<id>.localhost:<port>/authorize`,
+ * the id.ai-era path. Whether that works depends on which Internet Identity
+ * build is installed, and the window is narrow:
+ *
+ * - up to `release-2025-03-07`, the SPA lived at `/` and used a `#authorize`
+ *   fragment; `/authorize` is not an asset
+ * - `release-2026-01-05` through `release-2026-03-16` serve `/authorize`
+ * - from `release-2026-03-23` the frontend left the canister entirely (the id.ai
+ *   split), so `/authorize` 404s even on `.raw`
+ *
+ * Outside that window the login popup renders the gateway's
+ * "Response Verification Error" page and the app simply waits until the user
+ * closes it. Nothing points at the cause.
+ *
+ * Asking the canister over the agent avoids the gateway, so the answer is about
+ * the canister's assets rather than about how the gateway felt about them.
+ */
+
+import { Actor, type HttpAgent } from "@icp-sdk/core/agent"
+import { IDL } from "@icp-sdk/core/candid"
+
+/** The `http_request` query every asset-serving canister exposes. */
+const httpInterface: IDL.InterfaceFactory = ({ IDL }) => {
+  const HeaderField = IDL.Tuple(IDL.Text, IDL.Text)
+  return IDL.Service({
+    http_request: IDL.Func(
+      [
+        IDL.Record({
+          method: IDL.Text,
+          url: IDL.Text,
+          headers: IDL.Vec(HeaderField),
+          body: IDL.Vec(IDL.Nat8),
+        }),
+      ],
+      [
+        IDL.Record({
+          status_code: IDL.Nat16,
+          headers: IDL.Vec(HeaderField),
+          body: IDL.Vec(IDL.Nat8),
+        }),
+      ],
+      ["query"]
+    ),
+  })
+}
+
+interface HttpCapableActor {
+  http_request: (request: {
+    method: string
+    url: string
+    headers: [string, string][]
+    body: Uint8Array
+  }) => Promise<{ status_code: number }>
+}
+
+/** Where a given Internet Identity build expects the sign-in flow to start. */
+export type AuthorizePath = "/authorize" | "/#authorize"
+
+export interface LocalIiProbe {
+  /** The path that works, or `null` when the canister serves no sign-in UI. */
+  path: AuthorizePath | null
+  /**
+   * The probe could not reach a conclusion — the canister was unreachable, or
+   * it does not expose `http_request` at all. Callers keep their existing
+   * behaviour rather than blocking a login that might well work.
+   */
+  inconclusive: boolean
+}
+
+async function statusOf(
+  actor: HttpCapableActor,
+  url: string
+): Promise<number | undefined> {
+  try {
+    const response = await actor.http_request({
+      method: "GET",
+      url,
+      headers: [],
+      body: new Uint8Array(),
+    })
+    return response.status_code
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * Determine which authorize path a locally deployed Internet Identity serves.
+ *
+ * Never throws. A probe that cannot answer returns `inconclusive`, because a
+ * diagnostic that blocks a working setup is worse than the failure it explains.
+ */
+export async function probeLocalInternetIdentity(
+  agent: HttpAgent,
+  canisterId: string
+): Promise<LocalIiProbe> {
+  let actor: HttpCapableActor
+  try {
+    actor = Actor.createActor<HttpCapableActor>(httpInterface, {
+      agent,
+      canisterId,
+    })
+  } catch {
+    return { path: "/authorize", inconclusive: true }
+  }
+
+  const authorize = await statusOf(actor, "/authorize")
+
+  // The canister does not answer http_request at all — not an asset canister,
+  // not deployed, or the replica is down. Not our call to make.
+  if (authorize === undefined) {
+    return { path: "/authorize", inconclusive: true }
+  }
+
+  if (authorize >= 200 && authorize < 300) {
+    return { path: "/authorize", inconclusive: false }
+  }
+
+  // Pre-2026 builds serve the SPA at the root and drive the flow from a
+  // `#authorize` fragment, which is a path the gateway never sees.
+  const root = await statusOf(actor, "/")
+  if (root !== undefined && root >= 200 && root < 300) {
+    return { path: "/#authorize", inconclusive: false }
+  }
+
+  return { path: null, inconclusive: false }
+}
+
+/**
+ * The error a login gets when the installed build serves no sign-in UI, in
+ * place of a 503 page inside a popup the app cannot see.
+ */
+export function localInternetIdentityUnavailableError(
+  canisterId: string
+): Error {
+  return new Error(
+    `[ic-reactor] The Internet Identity canister ${canisterId} does not serve a sign-in UI: ` +
+      `neither /authorize nor / returned a page. Internet Identity builds from ` +
+      `release-2026-03-23 onward moved their frontend out of the canister (the id.ai split) ` +
+      `and cannot be used locally. Install internet_identity_dev.wasm from release-2026-03-16, ` +
+      `the newest build that still self-serves /authorize, or point \`identityProvider\` at a ` +
+      `provider you host yourself.`
+  )
+}

package/src/auth/types.ts

@@ -190,10 +190,8 @@ export interface AuthClientLike {
     // Widened across `@icp-sdk/auth` v7 (value or promise) and v8 (thunk).
     // Method-shorthand parameters are bivariant, so both real signatures are
     // assignable to this one.
-    nonce: Uint8Array | Promise<Uint8Array> | (() => Promise<Uint8Array>)
+    nonce: () => Promise<Uint8Array>
   }): Promise<SignedIdentityAttributes>
-  /** Present from `@icp-sdk/auth` v8; used to detect the nonce contract. */
-  memoize?<T>(produce: () => T | Promise<T>): Promise<T>
 }
 
 export interface AuthState {