@learnorama/mozaik-sdk 0.1.0-staging.12.1 → 0.1.0-staging.13.1

package/README.md

@@ -35,9 +35,120 @@ The token getter runs for every request, so refreshing a token does not require
 recreating the client. Clients can also supply default headers and a custom fetch
 implementation. Request options accept headers and an AbortSignal.
 
-There is no global token storage, automatic sign-in or automatic replay of failed
-writes. The application owns its PKCE flow and session refresh. Backend-owned
-Keycloak client secrets must never be supplied to this SDK.
+The basic `createClient` transport uses the token getter you provide. For managed
+PKCE and session refresh, use the SSO client below. Neither transport automatically
+replays failed application writes. Backend-owned Keycloak client secrets must
+never be supplied to this SDK.
+
+## Google Workspace and partner SSO
+
+```ts
+// auth.ts — one instance for the browser application
+import { createMozaikAuth } from '@learnorama/mozaik-sdk/auth';
+
+export const auth = createMozaikAuth({
+  baseUrl: 'https://api.stg.mozaik.co',
+  redirectUri: 'https://your-app.example/auth/callback',
+});
+
+// A click handler: prepare returns a URL; navigation stays under your control.
+const { url } = await auth.prepareInternalSso({ returnTo: '/requests' });
+window.location.assign(url);
+
+// On /auth/callback, using the same configuration after the redirect:
+const { account, returnTo } = await auth.completeSso();
+window.location.replace(returnTo);
+```
+
+Register the application's callback URL in Keycloak and allow its origin in the
+backend's `AUTH_ALLOWED_REDIRECT_ORIGINS`. Replace `your-app.example` with your
+frontend origin. Start login on that origin so the callback can read the same
+tab's transaction storage.
+
+| Method | Behavior |
+| --- | --- |
+| `prepareInternalSso({ returnTo? })` | Selects the existing `google` Workspace staff provider. |
+| `prepareProviderSso(alias, { returnTo? })` | Selects a registered, brokered partner; the backend validates the alias. |
+| `prepareSso({ returnTo? })` | Lets the backend resolve the provider from the configured API hostname. |
+| `completeSso(callbackUrl?)` | Validates and consumes the transaction, exchanges the code through the backend, and returns account, principal and return path. Defaults to the current browser URL. |
+| `refresh()` | Refreshes the session; concurrent callers share one exchange. |
+| `logout()` | Clears local authentication immediately and revokes the refresh token. |
+| `dispose()` | Local teardown for the application owner; does not revoke the server session. |
+
+Preparation also accepts `prompt: 'login' | 'none' | 'consent'`. Return paths must
+be local absolute paths such as `/requests`, never an external URL. PKCE uses
+S256; state, callback address, transaction expiry, expected provider and any
+returned issuer are checked. The code exchange stays on our backend so first
+login provisions the local account. Google Workspace membership and permissions
+remain enforced by Keycloak and the backend.
+
+Only short-lived PKCE transactions are saved to per-tab `sessionStorage` (ten
+minutes). Access and refresh tokens stay in memory and are absent from the auth
+snapshot. **Reloading the page starts without a local session**: initiate SSO again;
+an existing Keycloak/Workspace session may complete it without another credential
+prompt. This implementation uses full-page redirects, not popup messaging or
+silent iframe authentication.
+
+The client refreshes before expiry and on demand, coordinating token rotation.
+Transient refresh failures may use an access token only until its expiry; rejected
+or expired sessions clear local authentication. Remote logout errors reject the
+promise while leaving the application signed out. Tokens are attached through
+`auth.client`; its identity changes on login/logout and stays stable across
+refreshes. Old client instances reject requests after a session change.
+
+## React SSO shortcut
+
+`MozaikAuthProvider` supplies both authentication and its own TanStack Query
+provider. Put SDK consumers inside it; an additional QueryClientProvider is not
+needed for that subtree. `/react/auth` still contains the generated HTTP hooks;
+the handwritten SSO integration is `/react/sso`.
+
+```tsx
+import { useEffect } from 'react';
+import { MozaikAuthProvider, useMozaikAuth } from '@learnorama/mozaik-sdk/react/sso';
+import { useReadMe } from '@learnorama/mozaik-sdk/react/auth';
+import { auth } from './auth';
+
+export function Root() {
+  return <MozaikAuthProvider auth={auth}><Account /></MozaikAuthProvider>;
+}
+
+function Account() {
+  const { client, isAuthenticated, isLoading, error, prepareInternalSso, logout } = useMozaikAuth();
+  const me = useReadMe({ request: { client }, query: { enabled: isAuthenticated } });
+  async function signIn() {
+    try {
+      const { url } = await prepareInternalSso({ returnTo: '/requests' });
+      window.location.assign(url);
+    } catch { /* error is exposed by useMozaikAuth */ }
+  }
+  if (isAuthenticated) return <button onClick={() => { void logout().catch(() => {}); }}>Sign out {me.data?.account.email}</button>;
+  return <><button disabled={isLoading} onClick={() => { void signIn(); }}>Sign in with Google Workspace</button>{error && <p role="alert">{error.message}</p>}</>;
+}
+
+// Render this at /auth/callback, also inside MozaikAuthProvider.
+export function SsoCallback() {
+  const { completeSso, error } = useMozaikAuth();
+  useEffect(() => {
+    void completeSso().then(({ returnTo }) => window.location.replace(returnTo)).catch(() => {});
+  }, [completeSso]);
+  return <p>{error ? error.message : 'Completing sign-in…'}</p>;
+}
+```
+
+Concurrent callback completions share one exchange. The callback parameters are
+removed from browser history; repeated default completion calls on that cleaned
+URL are safe during React remounts. Replaying an explicit consumed callback is
+rejected. Login/logout replace the query cache and remount the session subtree,
+preventing previous-account results from appearing. Refresh retains the cache.
+For chat, use the same auth `client` and `enabled: isAuthenticated` with
+`useTutoringChat`; session changes close the previous connection automatically.
+
+Create the auth instance outside component renders, once per browser application
+or per server request. The provider does not call `dispose()` on unmount: this
+would invalidate the shared controller during Strict Mode's cleanup/re-setup.
+The application owner may dispose it on permanent teardown. Browser operations
+require Web Crypto and sessionStorage in a secure context.
 
 ## React
 

package/dist/api/index.js

@@ -1,5 +1,6 @@
 
 import { getListMessagesUrl, getMintChatTicketUrl, getSendMessageUrl, listMessages, mintChatTicket, sendMessage } from "./tutoring-chat.js";
+import { authorization, createSessionFromCode, createSessionFromCredentials, deleteSession, getAuthorizationUrl, getCreateSessionFromCodeUrl, getCreateSessionFromCredentialsUrl, getDeleteSessionUrl, getReadMeUrl, getRefreshSessionUrl, readMe, refreshSession } from "./auth.js";
 import { deleteAccount, getDeleteAccountUrl, getListServicesUrl, getReadAccountUrl, getUpdateAccountUrl, listServices, readAccount, updateAccount } from "./account.js";
 import { amendTheme, createTheme, deleteTheme, getAmendThemeUrl, getCreateThemeUrl, getDeleteThemeUrl, getListThemesUrl, getReadThemeUrl, getReorderThemesUrl, listThemes, readTheme, reorderThemes } from "./admin-catalogue.js";
 import { forceCloseLease, getForceCloseLeaseUrl, getListLiveLeasesUrl, listLiveLeases } from "./admin-consumption.js";
@@ -10,7 +11,6 @@ import { getListGrantsUrl, getReplaceGrantsUrl, listGrants, replaceGrants } from
 import { closeSupportSession, createDemoUser, getCloseSupportSessionUrl, getCreateDemoUserUrl, getOpenSupportSessionUrl, openSupportSession } from "./admin-support.js";
 import { getListTenantsUrl, getReadTenantUrl, getUpdateTenantUrl, listTenants, readTenant, updateTenant } from "./admin-tenants.js";
 import { adminCloseRequest, amendGoal, amendLevel, amendPractitioner, amendRequest, amendSubject, createGoal, createLevel, createSubject, getAdminCloseRequestUrl, getAmendGoalUrl, getAmendLevelUrl, getAmendPractitionerUrl, getAmendRequestUrl, getAmendSubjectUrl, getCreateGoalUrl, getCreateLevelUrl, getCreateSubjectUrl, getListAllRequestsUrl, getListExpiringDocumentsUrl, getListFeedbackUrl, getListPractitionerDocumentsUrl, getListPractitionersUrl, getModerateFeedbackUrl, getReadDraftUrl, getReadRequestUrl, getReviewDraftUrl, listAllRequests, listExpiringDocuments, listFeedback, listPractitionerDocuments, listPractitioners, moderateFeedback, readDraft, readRequest, reviewDraft } from "./admin-tutoring.js";
-import { authorization, createSessionFromCode, createSessionFromCredentials, deleteSession, getAuthorizationUrl, getCreateSessionFromCodeUrl, getCreateSessionFromCredentialsUrl, getDeleteSessionUrl, getReadMeUrl, getRefreshSessionUrl, readMe, refreshSession } from "./auth.js";
 import { getLikeContentUrl, getListEditorsUrl, getReadCatalogThemeUrl, getReadCatalogUrl, getReadContentUrl, getReadEditorUrl, getReadLearningPathUrl, getReadPackUrl, getReadRecommendationsUrl, getUnlikeContentUrl, likeContent, listEditors, readCatalog, readCatalogTheme, readContent, readEditor, readLearningPath, readPack, readRecommendations, unlikeContent } from "./biblio-catalogue.js";
 import { getReadHomeFeedUrl, readHomeFeed } from "./biblio-home.js";
 import { addBiblioFavorite, getAddBiblioFavoriteUrl, getListBiblioCategoriesUrl, getListBiblioFavoritesUrl, getListHistoryUrl, getListPacksUrl, getReadPreferencesUrl, getRemoveBiblioFavoriteUrl, getReplaceCategoryPreferencesUrl, listBiblioCategories, listBiblioFavorites, listHistory, listPacks, readPreferences, removeBiblioFavorite, replaceCategoryPreferences } from "./biblio-library.js";

package/dist/auth.d.ts

@@ -0,0 +1,10 @@
+
+import { a as PreparedSso, i as MozaikAuthOptions, n as CompletedSso, o as SsoOptions, r as MozaikAuth, s as createMozaikAuth, t as AuthSnapshot } from "./chunks/client2.js";
+//#region src/auth/transactions.d.ts
+export declare class AuthError extends Error {
+  readonly code: string;
+  constructor(code: string, message: string);
+}
+//#endregion
+export { type AuthSnapshot, type CompletedSso, type MozaikAuth, type MozaikAuthOptions, type PreparedSso, type SsoOptions, createMozaikAuth };
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.js

@@ -0,0 +1,451 @@
+
+import { n as createClient, t as ApiError } from "./chunks/client.js";
+import { authorization, createSessionFromCode, deleteSession, refreshSession } from "./api/auth.js";
+//#region src/auth/transactions.ts
+var AuthError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+		this.name = "AuthError";
+	}
+};
+const transactionLifetime = 6e5;
+const oauthParameters = [
+	"code",
+	"state",
+	"iss",
+	"session_state",
+	"error",
+	"error_description",
+	"error_uri"
+];
+function callbackAddress(value) {
+	const url = new URL(value);
+	if (!["https:", "http:"].includes(url.protocol) || url.username || url.password || url.search || url.hash) throw new TypeError("redirectUri must be an absolute HTTP(S) callback URL without credentials, query or fragment");
+	return url;
+}
+function localReturnTo(value, origin) {
+	if (!value.startsWith("/") || value.startsWith("//") || /[\\\u0000-\u0020\u007f]/.test(value)) throw new AuthError("invalid_return_to", "returnTo must be a local absolute path");
+	const url = new URL(value, origin);
+	if (url.origin !== origin) throw new AuthError("invalid_return_to", "returnTo must stay on this application");
+	return url.pathname + url.search + url.hash;
+}
+function randomSecret() {
+	return base64url(crypto.getRandomValues(/* @__PURE__ */ new Uint8Array(32)));
+}
+function base64url(bytes) {
+	return btoa(String.fromCharCode(...bytes)).replaceAll("+", "-").replaceAll("/", "_").replace(/=+$/, "");
+}
+async function challenge(verifier) {
+	return base64url(new Uint8Array(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier))));
+}
+function transactionStore(baseUrl, redirect, supplied) {
+	const prefix = `mozaik:sso:${encodeURIComponent(baseUrl)}:${encodeURIComponent(redirect.href)}:`;
+	const storage = () => {
+		if (supplied) return supplied;
+		if (typeof window === "undefined") throw new AuthError("browser_required", "SSO transactions require browser sessionStorage");
+		if (window.location.origin !== redirect.origin) throw new AuthError("invalid_origin", "Start SSO on the callback application origin");
+		return window.sessionStorage;
+	};
+	const keys = (store) => Array.from({ length: store.length }, (_, index) => store.key(index)).filter((key) => key !== null && key.startsWith(prefix));
+	return {
+		save(state, transaction) {
+			const store = storage();
+			for (const key of keys(store)) try {
+				const old = JSON.parse(store.getItem(key));
+				if (!Number.isFinite(old.createdAt) || Date.now() - old.createdAt >= 6e5) store.removeItem(key);
+			} catch {
+				store.removeItem(key);
+			}
+			store.setItem(prefix + state, JSON.stringify(transaction));
+		},
+		consume(state) {
+			if (!/^[A-Za-z0-9_-]{43}$/.test(state)) throw new AuthError("invalid_state", "Invalid SSO state");
+			const store = storage();
+			const saved = store.getItem(prefix + state);
+			if (!saved) throw new AuthError("invalid_state", "SSO transaction is missing or already consumed");
+			store.removeItem(prefix + state);
+			let value;
+			try {
+				value = JSON.parse(saved);
+			} catch {
+				throw new AuthError("invalid_state", "Invalid SSO transaction");
+			}
+			if (!value || !/^[A-Za-z0-9_-]{43}$/.test(value.verifier) || typeof value.issuer !== "string" || typeof value.returnTo !== "string" || !(value.provider === null || typeof value.provider === "string")) throw new AuthError("invalid_state", "Invalid SSO transaction");
+			if (!Number.isFinite(value.createdAt) || value.createdAt > Date.now() || Date.now() - value.createdAt >= 6e5) throw new AuthError("expired_transaction", "SSO transaction expired; start sign-in again");
+			value.returnTo = localReturnTo(value.returnTo, redirect.origin);
+			return value;
+		},
+		clear() {
+			if (!supplied && typeof window === "undefined") return;
+			const store = storage();
+			for (const key of keys(store)) store.removeItem(key);
+		}
+	};
+}
+function parseCallback(value, redirect) {
+	const url = new URL(value);
+	if (url.origin !== redirect.origin || url.pathname !== redirect.pathname || url.username || url.password || url.hash) throw new AuthError("invalid_callback", "SSO callback does not match redirectUri");
+	cleanCallback(url);
+	if (oauthParameters.some((key) => url.searchParams.getAll(key).length > 1)) throw new AuthError("invalid_callback", "SSO callback contains duplicate parameters");
+	return url;
+}
+function cleanCallback(url) {
+	const clean = new URL(url);
+	for (const key of oauthParameters) clean.searchParams.delete(key);
+	if (typeof window !== "undefined" && window.location.href === url.href) window.history.replaceState(window.history.state, "", clean.href);
+	return clean.href;
+}
+//#endregion
+//#region src/auth/client.ts
+const toError = (value) => value instanceof Error ? value : new AuthError("request_failed", "Authentication request failed");
+const changed = () => new AuthError("session_changed", "Authentication session changed");
+/** Browser SSO through Mozaik's account-provisioning backend, with no client secret. */
+function createMozaikAuth(options) {
+	const redirect = callbackAddress(options.redirectUri);
+	const publicClient = createClient({
+		baseUrl: options.baseUrl,
+		fetch: options.fetch
+	});
+	const transactions = transactionStore(publicClient.baseUrl, redirect, options.transactionStorage);
+	const listeners = /* @__PURE__ */ new Set();
+	const pending = /* @__PURE__ */ new Set();
+	const callbacks = /* @__PURE__ */ new Map();
+	let completed;
+	let disposed = false, epoch = 0;
+	let session;
+	let error = null;
+	let abort = new AbortController();
+	let timer;
+	let flight;
+	let client = makeClient();
+	let snapshot = makeSnapshot();
+	function assertUsable() {
+		if (disposed) throw new AuthError("disposed", "Authentication client was disposed");
+	}
+	function assertEpoch(expected) {
+		assertUsable();
+		if (epoch !== expected) throw changed();
+	}
+	function makeSnapshot() {
+		return Object.freeze({
+			status: pending.size ? "authenticating" : flight?.epoch === epoch ? "refreshing" : session ? "authenticated" : "anonymous",
+			isAuthenticated: Boolean(session),
+			isLoading: pending.size > 0 || flight?.epoch === epoch,
+			account: session?.data.account ?? null,
+			principal: session?.data.principal ?? null,
+			error,
+			client
+		});
+	}
+	function publish() {
+		snapshot = makeSnapshot();
+		for (const listener of listeners) listener();
+	}
+	function clearSession() {
+		epoch++;
+		abort.abort();
+		abort = new AbortController();
+		clearTimeout(timer);
+		timer = void 0;
+		session = void 0;
+		pending.clear();
+		flight = void 0;
+		completed = void 0;
+		client = makeClient();
+	}
+	function makeClient() {
+		const boundEpoch = epoch, boundSignal = abort.signal;
+		return createClient({
+			baseUrl: publicClient.baseUrl,
+			getAccessToken: async () => {
+				assertEpoch(boundEpoch);
+				if (session && Date.now() >= session.refreshAt) try {
+					await refresh();
+				} catch (failure) {
+					if (!session || Date.now() >= session.expiresAt) throw failure;
+				}
+				assertEpoch(boundEpoch);
+				return session?.data.access_token;
+			},
+			fetch: async (url, init) => {
+				assertEpoch(boundEpoch);
+				const signal = init?.signal ? AbortSignal.any([init.signal, boundSignal]) : boundSignal;
+				signal.throwIfAborted();
+				const response = await (options.fetch ?? globalThis.fetch)(url, {
+					...init,
+					signal
+				});
+				assertEpoch(boundEpoch);
+				return response;
+			}
+		});
+	}
+	function validateSession(data) {
+		if (!data || typeof data.access_token !== "string" || !data.access_token || !Number.isFinite(data.expires_in) || data.expires_in <= 0 || !data.account || !data.principal || typeof data.principal.subject !== "string" || data.refresh_token != null && (typeof data.refresh_token !== "string" || !data.refresh_token)) throw new AuthError("invalid_response", "Invalid authentication session response");
+	}
+	function schedule(delay) {
+		clearTimeout(timer);
+		timer = setTimeout(() => {
+			refresh().catch(() => {});
+		}, Math.min(2147483647, Math.max(0, delay)));
+		timer.unref?.();
+	}
+	function install(data) {
+		validateSession(data);
+		const now = Date.now(), ttl = data.expires_in * 1e3;
+		session = {
+			data,
+			expiresAt: now + ttl,
+			refreshAt: now + ttl - (data.refresh_token ? Math.min(3e4, ttl / 2) : 0),
+			refreshExpiresAt: data.refresh_expires_in && data.refresh_expires_in > 0 ? now + data.refresh_expires_in * 1e3 : void 0
+		};
+		error = null;
+		schedule(session.refreshAt - now);
+	}
+	async function revoke(token) {
+		if (token) await deleteSession({ refresh_token: token }, {
+			client: publicClient,
+			signal: AbortSignal.timeout(2e4)
+		});
+	}
+	function refresh() {
+		assertUsable();
+		if (flight?.epoch === epoch) return flight.applied;
+		const current = session, expected = epoch;
+		if (!current) return Promise.reject(new AuthError("session_expired", "Sign in before refreshing a session"));
+		if (!current.data.refresh_token || current.refreshExpiresAt && Date.now() >= current.refreshExpiresAt) {
+			const expired = new AuthError("session_expired", "Session expired; sign in again");
+			clearSession();
+			error = expired;
+			publish();
+			return Promise.reject(expired);
+		}
+		const requestAbort = new AbortController();
+		const response = refreshSession({ refresh_token: current.data.refresh_token }, {
+			client: publicClient,
+			signal: AbortSignal.any([requestAbort.signal, AbortSignal.timeout(2e4)])
+		});
+		const running = {
+			epoch: expected,
+			response,
+			applied: Promise.resolve(),
+			abort: requestAbort
+		};
+		flight = running;
+		running.applied = response.then((data) => {
+			assertEpoch(expected);
+			validateSession(data);
+			if (data.principal.subject !== current.data.principal.subject || data.account.id !== current.data.account.id) throw new AuthError("invalid_response", "Refresh changed the authenticated account");
+			install(data);
+		}).catch((failure) => {
+			if (!disposed && expected === epoch) {
+				error = toError(failure);
+				if (failure instanceof ApiError && [401, 403].includes(failure.status) || failure instanceof AuthError || Date.now() >= current.expiresAt) clearSession();
+				else {
+					current.refreshAt = Math.min(current.expiresAt, Date.now() + 5e3);
+					schedule(current.refreshAt - Date.now());
+				}
+			}
+			throw failure;
+		}).finally(() => {
+			if (flight === running) flight = void 0;
+			if (!disposed && expected === epoch) publish();
+			else if (!disposed && !session) publish();
+		});
+		publish();
+		return running.applied;
+	}
+	async function prepare(provider, settings = {}) {
+		assertUsable();
+		if (provider !== void 0 && (!provider.trim() || provider.length > 64)) throw new TypeError("A registered provider alias is required");
+		const returnTo = localReturnTo(settings.returnTo ?? "/", redirect.origin);
+		const expected = epoch, operation = Symbol();
+		pending.add(operation);
+		error = null;
+		publish();
+		try {
+			const state = randomSecret(), verifier = randomSecret(), codeChallenge = await challenge(verifier);
+			assertEpoch(expected);
+			const result = await authorization({
+				redirect_uri: redirect.href,
+				code_challenge: codeChallenge,
+				state,
+				provider,
+				prompt: settings.prompt
+			}, {
+				client: publicClient,
+				signal: AbortSignal.any([abort.signal, AbortSignal.timeout(2e4)])
+			});
+			assertEpoch(expected);
+			const url = new URL(result.authorizationUrl);
+			if (!["https:", "http:"].includes(url.protocol) || url.username || url.password || url.hash || !url.pathname.endsWith("/protocol/openid-connect/auth") || [
+				"state",
+				"code_challenge",
+				"code_challenge_method",
+				"redirect_uri",
+				"response_type"
+			].some((key) => url.searchParams.getAll(key).length !== 1) || url.searchParams.get("state") !== state || url.searchParams.get("code_challenge") !== codeChallenge || url.searchParams.get("code_challenge_method") !== "S256" || url.searchParams.get("redirect_uri") !== redirect.href || url.searchParams.get("response_type") !== "code" || provider === "google" && result.provider !== "google") throw new AuthError("invalid_response", "Invalid SSO authorization response");
+			const createdAt = Date.now();
+			transactions.save(state, {
+				verifier,
+				createdAt,
+				returnTo,
+				provider: result.provider ?? null,
+				issuer: url.origin + url.pathname.slice(0, -29)
+			});
+			return {
+				url: url.href,
+				provider: result.provider ?? null,
+				expiresAt: createdAt + transactionLifetime
+			};
+		} catch (failure) {
+			if (expected === epoch && !disposed) error = toError(failure);
+			throw failure;
+		} finally {
+			pending.delete(operation);
+			if (expected === epoch && !disposed) publish();
+		}
+	}
+	function completeSso(callbackUrl) {
+		try {
+			assertUsable();
+			const url = parseCallback(callbackUrl ?? (typeof window === "undefined" ? "" : window.location.href), redirect);
+			const state = url.searchParams.get("state") ?? "";
+			if (callbackUrl === void 0 && !state) {
+				const pendingCallback = [...callbacks.values()].find((item) => item.cleanUrl === url.href);
+				if (pendingCallback) return pendingCallback.promise;
+				if (completed?.epoch === epoch && completed.url === url.href) return Promise.resolve(completed.result);
+			}
+			const existing = callbacks.get(state);
+			if (existing) {
+				if (existing.url !== url.href) throw new AuthError("invalid_callback", "A different callback is already using this state");
+				return existing.promise;
+			}
+			const cleanUrl = cleanCallback(url);
+			const transaction = transactions.consume(state);
+			if (url.searchParams.has("iss") && url.searchParams.get("iss") !== transaction.issuer) throw new AuthError("invalid_issuer", "Unexpected SSO callback issuer");
+			if (url.searchParams.has("error")) throw new AuthError("provider_error", "Sign-in was refused or cancelled by the identity provider");
+			const code = url.searchParams.get("code");
+			if (!code || code.length > 4096) throw new AuthError("invalid_callback", "SSO callback is missing a valid authorization code");
+			if (session || flight || callbacks.size || pending.size) clearSession();
+			const expected = epoch, operation = Symbol();
+			pending.add(operation);
+			error = null;
+			publish();
+			const completion = (async () => {
+				try {
+					const data = await createSessionFromCode({
+						code,
+						codeVerifier: transaction.verifier,
+						redirectUri: redirect.href,
+						state
+					}, {
+						client: publicClient,
+						signal: AbortSignal.timeout(2e4)
+					});
+					if (disposed || expected !== epoch) {
+						await revoke(data.refresh_token).catch(() => {});
+						throw changed();
+					}
+					validateSession(data);
+					if (transaction.provider && data.principal.provider !== transaction.provider) {
+						await revoke(data.refresh_token).catch(() => {});
+						throw new AuthError("provider_mismatch", "Sign-in completed with a different identity provider");
+					}
+					clearSession();
+					install(data);
+					const result = {
+						account: data.account,
+						principal: data.principal,
+						returnTo: transaction.returnTo
+					};
+					completed = {
+						epoch,
+						url: cleanUrl,
+						result
+					};
+					publish();
+					return result;
+				} catch (failure) {
+					if (!disposed && expected === epoch) {
+						error = toError(failure);
+						publish();
+					}
+					throw failure;
+				} finally {
+					callbacks.delete(state);
+					pending.delete(operation);
+					if (!disposed) publish();
+				}
+			})();
+			callbacks.set(state, {
+				url: url.href,
+				cleanUrl,
+				promise: completion
+			});
+			return completion;
+		} catch (failure) {
+			if (!disposed) {
+				error = toError(failure);
+				publish();
+			}
+			return Promise.reject(failure);
+		}
+	}
+	return {
+		get client() {
+			return client;
+		},
+		getSnapshot: () => snapshot,
+		subscribe(listener) {
+			listeners.add(listener);
+			return () => {
+				listeners.delete(listener);
+			};
+		},
+		prepareInternalSso: (settings) => prepare("google", settings),
+		prepareProviderSso: (alias, settings) => prepare(alias, settings),
+		prepareSso: (settings) => prepare(void 0, settings),
+		completeSso,
+		refresh,
+		async logout() {
+			assertUsable();
+			const old = session, rotating = flight;
+			clearSession();
+			error = null;
+			publish();
+			const expected = epoch;
+			let cleanupError;
+			try {
+				transactions.clear();
+			} catch (failure) {
+				cleanupError = failure;
+			}
+			try {
+				await revoke((await rotating?.response.catch(() => void 0))?.refresh_token ?? old?.data.refresh_token);
+				if (cleanupError) throw cleanupError;
+			} catch (failure) {
+				if (!disposed && expected === epoch) {
+					error = toError(failure);
+					publish();
+				}
+				throw failure;
+			}
+		},
+		dispose() {
+			if (disposed) return;
+			flight?.abort.abort();
+			clearSession();
+			disposed = true;
+			error = null;
+			publish();
+			listeners.clear();
+		}
+	};
+}
+//#endregion
+export { AuthError, createMozaikAuth };
+
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","names":[],"sources":["../src/auth/transactions.ts","../src/auth/client.ts"],"sourcesContent":["// Handwritten. This directory is never an Orval output/cleanup target.\nexport interface Transaction {\n  verifier: string;\n  createdAt: number;\n  returnTo: string;\n  issuer: string;\n  provider: string | null;\n}\n\nexport class AuthError extends Error {\n  constructor(public readonly code: string, message: string) {\n    super(message);\n    this.name = 'AuthError';\n  }\n}\n\nexport const transactionLifetime = 10 * 60_000;\nconst oauthParameters = ['code', 'state', 'iss', 'session_state', 'error', 'error_description', 'error_uri'];\n\nexport function callbackAddress(value: string): URL {\n  const url = new URL(value);\n  if (!['https:', 'http:'].includes(url.protocol) || url.username || url.password || url.search || url.hash) {\n    throw new TypeError('redirectUri must be an absolute HTTP(S) callback URL without credentials, query or fragment');\n  }\n  return url;\n}\n\nexport function localReturnTo(value: string, origin: string): string {\n  // Reject protocol-relative URLs and browser-normalized slash/control tricks.\n  if (!value.startsWith('/') || value.startsWith('//') || /[\\\\\\u0000-\\u0020\\u007f]/.test(value)) {\n    throw new AuthError('invalid_return_to', 'returnTo must be a local absolute path');\n  }\n  const url = new URL(value, origin);\n  if (url.origin !== origin) throw new AuthError('invalid_return_to', 'returnTo must stay on this application');\n  return url.pathname + url.search + url.hash;\n}\n\nexport function randomSecret(): string {\n  return base64url(crypto.getRandomValues(new Uint8Array(32)));\n}\nfunction base64url(bytes: Uint8Array): string {\n  return btoa(String.fromCharCode(...bytes)).replaceAll('+', '-').replaceAll('/', '_').replace(/=+$/, '');\n}\nexport async function challenge(verifier: string): Promise<string> {\n  return base64url(new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier))));\n}\n\nexport function transactionStore(baseUrl: string, redirect: URL, supplied?: Storage) {\n  const prefix = `mozaik:sso:${encodeURIComponent(baseUrl)}:${encodeURIComponent(redirect.href)}:`;\n  const storage = () => {\n    if (supplied) return supplied;\n    if (typeof window === 'undefined') throw new AuthError('browser_required', 'SSO transactions require browser sessionStorage');\n    if (window.location.origin !== redirect.origin) throw new AuthError('invalid_origin', 'Start SSO on the callback application origin');\n    return window.sessionStorage;\n  };\n  const keys = (store: Storage) => Array.from({ length: store.length }, (_, index) => store.key(index))\n    .filter((key): key is string => key !== null && key.startsWith(prefix));\n  return {\n    save(state: string, transaction: Transaction) {\n      const store = storage();\n      for (const key of keys(store)) {\n        try {\n          const old = JSON.parse(store.getItem(key)!);\n          if (!Number.isFinite(old.createdAt) || Date.now() - old.createdAt >= transactionLifetime) store.removeItem(key);\n        } catch { store.removeItem(key); }\n      }\n      store.setItem(prefix + state, JSON.stringify(transaction));\n    },\n    consume(state: string): Transaction {\n      if (!/^[A-Za-z0-9_-]{43}$/.test(state)) throw new AuthError('invalid_state', 'Invalid SSO state');\n      const store = storage();\n      const saved = store.getItem(prefix + state);\n      if (!saved) throw new AuthError('invalid_state', 'SSO transaction is missing or already consumed');\n      store.removeItem(prefix + state);\n      let value: Transaction;\n      try { value = JSON.parse(saved); }\n      catch { throw new AuthError('invalid_state', 'Invalid SSO transaction'); }\n      if (!value || !/^[A-Za-z0-9_-]{43}$/.test(value.verifier) || typeof value.issuer !== 'string' ||\n          typeof value.returnTo !== 'string' || !(value.provider === null || typeof value.provider === 'string')) {\n        throw new AuthError('invalid_state', 'Invalid SSO transaction');\n      }\n      if (!Number.isFinite(value.createdAt) || value.createdAt > Date.now() || Date.now() - value.createdAt >= transactionLifetime) {\n        throw new AuthError('expired_transaction', 'SSO transaction expired; start sign-in again');\n      }\n      value.returnTo = localReturnTo(value.returnTo, redirect.origin);\n      return value;\n    },\n    clear() {\n      // Factory creation/disposal on the server does not access browser globals.\n      if (!supplied && typeof window === 'undefined') return;\n      const store = storage();\n      for (const key of keys(store)) store.removeItem(key);\n    },\n  };\n}\n\nexport function parseCallback(value: string, redirect: URL): URL {\n  const url = new URL(value);\n  if (url.origin !== redirect.origin || url.pathname !== redirect.pathname || url.username || url.password || url.hash) {\n    throw new AuthError('invalid_callback', 'SSO callback does not match redirectUri');\n  }\n  cleanCallback(url);\n  if (oauthParameters.some(key => url.searchParams.getAll(key).length > 1)) {\n    throw new AuthError('invalid_callback', 'SSO callback contains duplicate parameters');\n  }\n  return url;\n}\n\nexport function cleanCallback(url: URL): string {\n  const clean = new URL(url);\n  for (const key of oauthParameters) clean.searchParams.delete(key);\n  if (typeof window !== 'undefined' && window.location.href === url.href) {\n    window.history.replaceState(window.history.state, '', clean.href);\n  }\n  return clean.href;\n}\n","import { ApiError, createClient, type Client, type ClientOptions } from '../client';\nimport { authorization, createSessionFromCode, deleteSession, refreshSession } from '../api/auth/auth';\nimport type { AccountRead, PrincipalRead, SessionRead } from '../models';\nimport { AuthError, callbackAddress, challenge, cleanCallback, localReturnTo, parseCallback, randomSecret, transactionLifetime, transactionStore } from './transactions';\n\nexport interface MozaikAuthOptions {\n  baseUrl: string;\n  redirectUri: string;\n  /** Only PKCE transactions are persisted. Access/refresh tokens stay in memory. */\n  transactionStorage?: Storage;\n  fetch?: ClientOptions['fetch'];\n}\nexport interface SsoOptions {\n  returnTo?: string;\n  prompt?: 'login' | 'none' | 'consent';\n}\nexport interface PreparedSso { url: string; provider: string | null; expiresAt: number }\nexport interface CompletedSso { account: AccountRead; principal: PrincipalRead; returnTo: string }\nexport interface AuthSnapshot {\n  status: 'anonymous' | 'authenticating' | 'authenticated' | 'refreshing';\n  isAuthenticated: boolean;\n  isLoading: boolean;\n  account: AccountRead | null;\n  principal: PrincipalRead | null;\n  error: Error | null;\n  /** Stable across refreshes; replaced on login/logout to isolate account caches. */\n  client: Client;\n}\nexport interface MozaikAuth {\n  readonly client: Client;\n  getSnapshot(): AuthSnapshot;\n  subscribe(listener: () => void): () => void;\n  prepareInternalSso(options?: SsoOptions): Promise<PreparedSso>;\n  prepareProviderSso(alias: string, options?: SsoOptions): Promise<PreparedSso>;\n  prepareSso(options?: SsoOptions): Promise<PreparedSso>;\n  completeSso(callbackUrl?: string): Promise<CompletedSso>;\n  refresh(): Promise<void>;\n  logout(): Promise<void>;\n  /** Local teardown only. Use logout() to revoke the server session. */\n  dispose(): void;\n}\n\ninterface Session { data: SessionRead; expiresAt: number; refreshAt: number; refreshExpiresAt?: number }\nconst toError = (value: unknown) => value instanceof Error ? value : new AuthError('request_failed', 'Authentication request failed');\nconst changed = () => new AuthError('session_changed', 'Authentication session changed');\n\n/** Browser SSO through Mozaik's account-provisioning backend, with no client secret. */\nexport function createMozaikAuth(options: MozaikAuthOptions): MozaikAuth {\n  const redirect = callbackAddress(options.redirectUri);\n  const publicClient = createClient({ baseUrl: options.baseUrl, fetch: options.fetch });\n  const transactions = transactionStore(publicClient.baseUrl, redirect, options.transactionStorage);\n  const listeners = new Set<() => void>();\n  const pending = new Set<symbol>();\n  const callbacks = new Map<string, { url: string; cleanUrl: string; promise: Promise<CompletedSso> }>();\n  let completed: { epoch: number; url: string; result: CompletedSso } | undefined;\n  let disposed = false, epoch = 0;\n  let session: Session | undefined;\n  let error: Error | null = null;\n  let abort = new AbortController();\n  let timer: ReturnType<typeof setTimeout> | undefined;\n  let flight: { epoch: number; response: Promise<SessionRead>; applied: Promise<void>; abort: AbortController } | undefined;\n  let client = makeClient();\n  let snapshot = makeSnapshot();\n\n  function assertUsable() { if (disposed) throw new AuthError('disposed', 'Authentication client was disposed'); }\n  function assertEpoch(expected: number) { assertUsable(); if (epoch !== expected) throw changed(); }\n  function makeSnapshot(): AuthSnapshot {\n    return Object.freeze({\n      status: pending.size ? 'authenticating' : flight?.epoch === epoch ? 'refreshing' : session ? 'authenticated' : 'anonymous',\n      isAuthenticated: Boolean(session), isLoading: pending.size > 0 || flight?.epoch === epoch,\n      account: session?.data.account ?? null, principal: session?.data.principal ?? null, error, client,\n    });\n  }\n  function publish() { snapshot = makeSnapshot(); for (const listener of listeners) listener(); }\n  function clearSession() {\n    epoch++;\n    abort.abort(); abort = new AbortController();\n    clearTimeout(timer); timer = undefined;\n    session = undefined; pending.clear(); flight = undefined; completed = undefined;\n    client = makeClient();\n  }\n  function makeClient(): Client {\n    const boundEpoch = epoch, boundSignal = abort.signal;\n    return createClient({\n      baseUrl: publicClient.baseUrl,\n      getAccessToken: async () => {\n        assertEpoch(boundEpoch);\n        if (session && Date.now() >= session.refreshAt) {\n          try { await refresh(); }\n          catch (failure) {\n            // A transient early-refresh failure can still use a valid token.\n            if (!session || Date.now() >= session.expiresAt) throw failure;\n          }\n        }\n        assertEpoch(boundEpoch);\n        return session?.data.access_token;\n      },\n      fetch: async (url, init) => {\n        assertEpoch(boundEpoch);\n        const signal = init?.signal ? AbortSignal.any([init.signal, boundSignal]) : boundSignal;\n        signal.throwIfAborted();\n        const response = await (options.fetch ?? globalThis.fetch)(url, { ...init, signal });\n        assertEpoch(boundEpoch);\n        return response;\n      },\n    });\n  }\n  function validateSession(data: SessionRead): void {\n    if (!data || typeof data.access_token !== 'string' || !data.access_token ||\n        !Number.isFinite(data.expires_in) || data.expires_in <= 0 ||\n        !data.account || !data.principal || typeof data.principal.subject !== 'string' ||\n        (data.refresh_token != null && (typeof data.refresh_token !== 'string' || !data.refresh_token))) {\n      throw new AuthError('invalid_response', 'Invalid authentication session response');\n    }\n  }\n  function schedule(delay: number) {\n    clearTimeout(timer);\n    timer = setTimeout(() => { void refresh().catch(() => {}); }, Math.min(2_147_483_647, Math.max(0, delay)));\n    // Native/server consumers must be able to terminate without an auth timer keeping Node alive.\n    (timer as unknown as { unref?: () => void }).unref?.();\n  }\n  function install(data: SessionRead) {\n    validateSession(data);\n    const now = Date.now(), ttl = data.expires_in * 1_000;\n    session = {\n      data, expiresAt: now + ttl,\n      refreshAt: now + ttl - (data.refresh_token ? Math.min(30_000, ttl / 2) : 0),\n      refreshExpiresAt: data.refresh_expires_in && data.refresh_expires_in > 0 ? now + data.refresh_expires_in * 1_000 : undefined,\n    };\n    error = null;\n    schedule(session.refreshAt - now);\n  }\n  async function revoke(token?: string | null) {\n    if (token) await deleteSession({ refresh_token: token }, { client: publicClient, signal: AbortSignal.timeout(20_000) });\n  }\n\n  function refresh(): Promise<void> {\n    assertUsable();\n    if (flight?.epoch === epoch) return flight.applied;\n    const current = session, expected = epoch;\n    if (!current) return Promise.reject(new AuthError('session_expired', 'Sign in before refreshing a session'));\n    if (!current.data.refresh_token || (current.refreshExpiresAt && Date.now() >= current.refreshExpiresAt)) {\n      const expired = new AuthError('session_expired', 'Session expired; sign in again');\n      clearSession(); error = expired; publish();\n      return Promise.reject(expired);\n    }\n    const requestAbort = new AbortController();\n    const response = refreshSession({ refresh_token: current.data.refresh_token }, {\n      client: publicClient, signal: AbortSignal.any([requestAbort.signal, AbortSignal.timeout(20_000)]),\n    });\n    const running = { epoch: expected, response, applied: Promise.resolve(), abort: requestAbort };\n    flight = running;\n    running.applied = response.then(data => {\n      assertEpoch(expected);\n      validateSession(data);\n      if (data.principal.subject !== current.data.principal.subject || data.account.id !== current.data.account.id) {\n        throw new AuthError('invalid_response', 'Refresh changed the authenticated account');\n      }\n      install(data);\n    }).catch(failure => {\n      if (!disposed && expected === epoch) {\n        error = toError(failure);\n        if ((failure instanceof ApiError && [401, 403].includes(failure.status)) ||\n            failure instanceof AuthError || Date.now() >= current.expiresAt) {\n          clearSession();\n        } else {\n          current.refreshAt = Math.min(current.expiresAt, Date.now() + 5_000);\n          schedule(current.refreshAt - Date.now());\n        }\n      }\n      throw failure;\n    }).finally(() => {\n      if (flight === running) flight = undefined;\n      if (!disposed && expected === epoch) publish();\n      else if (!disposed && !session) publish();\n    });\n    publish();\n    return running.applied;\n  }\n\n  async function prepare(provider: string | undefined, settings: SsoOptions = {}): Promise<PreparedSso> {\n    assertUsable();\n    if (provider !== undefined && (!provider.trim() || provider.length > 64)) throw new TypeError('A registered provider alias is required');\n    const returnTo = localReturnTo(settings.returnTo ?? '/', redirect.origin);\n    const expected = epoch, operation = Symbol();\n    pending.add(operation); error = null; publish();\n    try {\n      const state = randomSecret(), verifier = randomSecret(), codeChallenge = await challenge(verifier);\n      assertEpoch(expected);\n      const result = await authorization({\n        redirect_uri: redirect.href, code_challenge: codeChallenge, state, provider, prompt: settings.prompt,\n      }, { client: publicClient, signal: AbortSignal.any([abort.signal, AbortSignal.timeout(20_000)]) });\n      assertEpoch(expected);\n      const url = new URL(result.authorizationUrl);\n      const suffix = '/protocol/openid-connect/auth';\n      if (!['https:', 'http:'].includes(url.protocol) || url.username || url.password || url.hash || !url.pathname.endsWith(suffix) ||\n          ['state', 'code_challenge', 'code_challenge_method', 'redirect_uri', 'response_type'].some(key => url.searchParams.getAll(key).length !== 1) ||\n          url.searchParams.get('state') !== state || url.searchParams.get('code_challenge') !== codeChallenge ||\n          url.searchParams.get('code_challenge_method') !== 'S256' || url.searchParams.get('redirect_uri') !== redirect.href ||\n          url.searchParams.get('response_type') !== 'code' || (provider === 'google' && result.provider !== 'google')) {\n        throw new AuthError('invalid_response', 'Invalid SSO authorization response');\n      }\n      const createdAt = Date.now();\n      transactions.save(state, { verifier, createdAt, returnTo, provider: result.provider ?? null, issuer: url.origin + url.pathname.slice(0, -suffix.length) });\n      return { url: url.href, provider: result.provider ?? null, expiresAt: createdAt + transactionLifetime };\n    } catch (failure) {\n      if (expected === epoch && !disposed) error = toError(failure);\n      throw failure;\n    } finally {\n      pending.delete(operation);\n      if (expected === epoch && !disposed) publish();\n    }\n  }\n\n  function completeSso(callbackUrl?: string): Promise<CompletedSso> {\n    try {\n      assertUsable();\n      const url = parseCallback(callbackUrl ?? (typeof window === 'undefined' ? '' : window.location.href), redirect);\n      const state = url.searchParams.get('state') ?? '';\n      // Strict Mode can call the default callback again after the first call\n      // removed its OAuth parameters, but before the exchange has completed.\n      if (callbackUrl === undefined && !state) {\n        const pendingCallback = [...callbacks.values()].find(item => item.cleanUrl === url.href);\n        if (pendingCallback) return pendingCallback.promise;\n        if (completed?.epoch === epoch && completed.url === url.href) return Promise.resolve(completed.result);\n      }\n      const existing = callbacks.get(state);\n      if (existing) {\n        if (existing.url !== url.href) throw new AuthError('invalid_callback', 'A different callback is already using this state');\n        return existing.promise;\n      }\n      const cleanUrl = cleanCallback(url);\n      const transaction = transactions.consume(state);\n      if (url.searchParams.has('iss') && url.searchParams.get('iss') !== transaction.issuer) throw new AuthError('invalid_issuer', 'Unexpected SSO callback issuer');\n      if (url.searchParams.has('error')) throw new AuthError('provider_error', 'Sign-in was refused or cancelled by the identity provider');\n      const code = url.searchParams.get('code');\n      if (!code || code.length > 4096) throw new AuthError('invalid_callback', 'SSO callback is missing a valid authorization code');\n      if (session || flight || callbacks.size || pending.size) clearSession();\n      const expected = epoch, operation = Symbol();\n      pending.add(operation); error = null; publish();\n      const completion = (async () => {\n        try {\n          const data = await createSessionFromCode({ code, codeVerifier: transaction.verifier, redirectUri: redirect.href, state }, {\n            client: publicClient, signal: AbortSignal.timeout(20_000),\n          });\n          if (disposed || expected !== epoch) { await revoke(data.refresh_token).catch(() => {}); throw changed(); }\n          validateSession(data);\n          if (transaction.provider && data.principal.provider !== transaction.provider) {\n            await revoke(data.refresh_token).catch(() => {});\n            throw new AuthError('provider_mismatch', 'Sign-in completed with a different identity provider');\n          }\n          // Anonymous requests made during the callback cannot inherit the new identity.\n          clearSession(); install(data);\n          const result = { account: data.account, principal: data.principal, returnTo: transaction.returnTo };\n          completed = { epoch, url: cleanUrl, result };\n          publish();\n          return result;\n        } catch (failure) {\n          if (!disposed && expected === epoch) { error = toError(failure); publish(); }\n          throw failure;\n        } finally {\n          callbacks.delete(state); pending.delete(operation);\n          if (!disposed) publish();\n        }\n      })();\n      callbacks.set(state, { url: url.href, cleanUrl, promise: completion });\n      return completion;\n    } catch (failure) {\n      if (!disposed) { error = toError(failure); publish(); }\n      return Promise.reject(failure);\n    }\n  }\n\n  return {\n    get client() { return client; }, getSnapshot: () => snapshot,\n    subscribe(listener) { listeners.add(listener); return () => { listeners.delete(listener); }; },\n    prepareInternalSso: settings => prepare('google', settings),\n    prepareProviderSso: (alias, settings) => prepare(alias, settings),\n    prepareSso: settings => prepare(undefined, settings), completeSso, refresh,\n    async logout() {\n      assertUsable();\n      const old = session, rotating = flight;\n      clearSession(); error = null; publish();\n      const expected = epoch;\n      // Local logout is immediate, even if storage or the revocation request fails.\n      let cleanupError: unknown;\n      try { transactions.clear(); } catch (failure) { cleanupError = failure; }\n      try {\n        // A refresh already sent may rotate the token. Revoke its result, not an\n        // obsolete token, without ever restoring it to the local session.\n        const rotated = await rotating?.response.catch(() => undefined);\n        await revoke(rotated?.refresh_token ?? old?.data.refresh_token);\n        if (cleanupError) throw cleanupError;\n      } catch (failure) {\n        if (!disposed && expected === epoch) { error = toError(failure); publish(); }\n        throw failure;\n      }\n    },\n    dispose() {\n      if (disposed) return;\n      flight?.abort.abort();\n      clearSession(); disposed = true; error = null; publish(); listeners.clear();\n    },\n  };\n}\n"],"mappings":";;;;AASA,IAAa,YAAb,cAA+B,MAAM;CACP;CAA5B,YAAY,MAA8B,SAAiB;EACzD,MAAM,OAAO;EADa,KAAA,OAAA;EAE1B,KAAK,OAAO;CACd;AACF;AAEA,MAAa,sBAAsB;AACnC,MAAM,kBAAkB;CAAC;CAAQ;CAAS;CAAO;CAAiB;CAAS;CAAqB;AAAW;AAE3G,SAAgB,gBAAgB,OAAoB;CAClD,MAAM,MAAM,IAAI,IAAI,KAAK;CACzB,IAAI,CAAC,CAAC,UAAU,OAAO,CAAC,CAAC,SAAS,IAAI,QAAQ,KAAK,IAAI,YAAY,IAAI,YAAY,IAAI,UAAU,IAAI,MACnG,MAAM,IAAI,UAAU,6FAA6F;CAEnH,OAAO;AACT;AAEA,SAAgB,cAAc,OAAe,QAAwB;CAEnE,IAAI,CAAC,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,IAAI,KAAK,0BAA0B,KAAK,KAAK,GAC1F,MAAM,IAAI,UAAU,qBAAqB,wCAAwC;CAEnF,MAAM,MAAM,IAAI,IAAI,OAAO,MAAM;CACjC,IAAI,IAAI,WAAW,QAAQ,MAAM,IAAI,UAAU,qBAAqB,wCAAwC;CAC5G,OAAO,IAAI,WAAW,IAAI,SAAS,IAAI;AACzC;AAEA,SAAgB,eAAuB;CACrC,OAAO,UAAU,OAAO,gCAAgB,IAAI,WAAW,EAAE,CAAC,CAAC;AAC7D;AACA,SAAS,UAAU,OAA2B;CAC5C,OAAO,KAAK,OAAO,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,WAAW,KAAK,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE;AACxG;AACA,eAAsB,UAAU,UAAmC;CACjE,OAAO,UAAU,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,CAAC,CAAC,OAAO,QAAQ,CAAC,CAAC,CAAC;AAC5G;AAEA,SAAgB,iBAAiB,SAAiB,UAAe,UAAoB;CACnF,MAAM,SAAS,cAAc,mBAAmB,OAAO,EAAE,GAAG,mBAAmB,SAAS,IAAI,EAAE;CAC9F,MAAM,gBAAgB;EACpB,IAAI,UAAU,OAAO;EACrB,IAAI,OAAO,WAAW,aAAa,MAAM,IAAI,UAAU,oBAAoB,iDAAiD;EAC5H,IAAI,OAAO,SAAS,WAAW,SAAS,QAAQ,MAAM,IAAI,UAAU,kBAAkB,8CAA8C;EACpI,OAAO,OAAO;CAChB;CACA,MAAM,QAAQ,UAAmB,MAAM,KAAK,EAAE,QAAQ,MAAM,OAAO,IAAI,GAAG,UAAU,MAAM,IAAI,KAAK,CAAC,CAAC,CAClG,QAAQ,QAAuB,QAAQ,QAAQ,IAAI,WAAW,MAAM,CAAC;CACxE,OAAO;EACL,KAAK,OAAe,aAA0B;GAC5C,MAAM,QAAQ,QAAQ;GACtB,KAAK,MAAM,OAAO,KAAK,KAAK,GAC1B,IAAI;IACF,MAAM,MAAM,KAAK,MAAM,MAAM,QAAQ,GAAG,CAAE;IAC1C,IAAI,CAAC,OAAO,SAAS,IAAI,SAAS,KAAK,KAAK,IAAI,IAAI,IAAI,aAAA,KAAkC,MAAM,WAAW,GAAG;GAChH,QAAQ;IAAE,MAAM,WAAW,GAAG;GAAG;GAEnC,MAAM,QAAQ,SAAS,OAAO,KAAK,UAAU,WAAW,CAAC;EAC3D;EACA,QAAQ,OAA4B;GAClC,IAAI,CAAC,sBAAsB,KAAK,KAAK,GAAG,MAAM,IAAI,UAAU,iBAAiB,mBAAmB;GAChG,MAAM,QAAQ,QAAQ;GACtB,MAAM,QAAQ,MAAM,QAAQ,SAAS,KAAK;GAC1C,IAAI,CAAC,OAAO,MAAM,IAAI,UAAU,iBAAiB,gDAAgD;GACjG,MAAM,WAAW,SAAS,KAAK;GAC/B,IAAI;GACJ,IAAI;IAAE,QAAQ,KAAK,MAAM,KAAK;GAAG,QAC3B;IAAE,MAAM,IAAI,UAAU,iBAAiB,yBAAyB;GAAG;GACzE,IAAI,CAAC,SAAS,CAAC,sBAAsB,KAAK,MAAM,QAAQ,KAAK,OAAO,MAAM,WAAW,YACjF,OAAO,MAAM,aAAa,YAAY,EAAE,MAAM,aAAa,QAAQ,OAAO,MAAM,aAAa,WAC/F,MAAM,IAAI,UAAU,iBAAiB,yBAAyB;GAEhE,IAAI,CAAC,OAAO,SAAS,MAAM,SAAS,KAAK,MAAM,YAAY,KAAK,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,aAAA,KAC1F,MAAM,IAAI,UAAU,uBAAuB,8CAA8C;GAE3F,MAAM,WAAW,cAAc,MAAM,UAAU,SAAS,MAAM;GAC9D,OAAO;EACT;EACA,QAAQ;GAEN,IAAI,CAAC,YAAY,OAAO,WAAW,aAAa;GAChD,MAAM,QAAQ,QAAQ;GACtB,KAAK,MAAM,OAAO,KAAK,KAAK,GAAG,MAAM,WAAW,GAAG;EACrD;CACF;AACF;AAEA,SAAgB,cAAc,OAAe,UAAoB;CAC/D,MAAM,MAAM,IAAI,IAAI,KAAK;CACzB,IAAI,IAAI,WAAW,SAAS,UAAU,IAAI,aAAa,SAAS,YAAY,IAAI,YAAY,IAAI,YAAY,IAAI,MAC9G,MAAM,IAAI,UAAU,oBAAoB,yCAAyC;CAEnF,cAAc,GAAG;CACjB,IAAI,gBAAgB,MAAK,QAAO,IAAI,aAAa,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,GACrE,MAAM,IAAI,UAAU,oBAAoB,4CAA4C;CAEtF,OAAO;AACT;AAEA,SAAgB,cAAc,KAAkB;CAC9C,MAAM,QAAQ,IAAI,IAAI,GAAG;CACzB,KAAK,MAAM,OAAO,iBAAiB,MAAM,aAAa,OAAO,GAAG;CAChE,IAAI,OAAO,WAAW,eAAe,OAAO,SAAS,SAAS,IAAI,MAChE,OAAO,QAAQ,aAAa,OAAO,QAAQ,OAAO,IAAI,MAAM,IAAI;CAElE,OAAO,MAAM;AACf;;;ACxEA,MAAM,WAAW,UAAmB,iBAAiB,QAAQ,QAAQ,IAAI,UAAU,kBAAkB,+BAA+B;AACpI,MAAM,gBAAgB,IAAI,UAAU,mBAAmB,gCAAgC;;AAGvF,SAAgB,iBAAiB,SAAwC;CACvE,MAAM,WAAW,gBAAgB,QAAQ,WAAW;CACpD,MAAM,eAAe,aAAa;EAAE,SAAS,QAAQ;EAAS,OAAO,QAAQ;CAAM,CAAC;CACpF,MAAM,eAAe,iBAAiB,aAAa,SAAS,UAAU,QAAQ,kBAAkB;CAChG,MAAM,4BAAY,IAAI,IAAgB;CACtC,MAAM,0BAAU,IAAI,IAAY;CAChC,MAAM,4BAAY,IAAI,IAA+E;CACrG,IAAI;CACJ,IAAI,WAAW,OAAO,QAAQ;CAC9B,IAAI;CACJ,IAAI,QAAsB;CAC1B,IAAI,QAAQ,IAAI,gBAAgB;CAChC,IAAI;CACJ,IAAI;CACJ,IAAI,SAAS,WAAW;CACxB,IAAI,WAAW,aAAa;CAE5B,SAAS,eAAe;EAAE,IAAI,UAAU,MAAM,IAAI,UAAU,YAAY,oCAAoC;CAAG;CAC/G,SAAS,YAAY,UAAkB;EAAE,aAAa;EAAG,IAAI,UAAU,UAAU,MAAM,QAAQ;CAAG;CAClG,SAAS,eAA6B;EACpC,OAAO,OAAO,OAAO;GACnB,QAAQ,QAAQ,OAAO,mBAAmB,QAAQ,UAAU,QAAQ,eAAe,UAAU,kBAAkB;GAC/G,iBAAiB,QAAQ,OAAO;GAAG,WAAW,QAAQ,OAAO,KAAK,QAAQ,UAAU;GACpF,SAAS,SAAS,KAAK,WAAW;GAAM,WAAW,SAAS,KAAK,aAAa;GAAM;GAAO;EAC7F,CAAC;CACH;CACA,SAAS,UAAU;EAAE,WAAW,aAAa;EAAG,KAAK,MAAM,YAAY,WAAW,SAAS;CAAG;CAC9F,SAAS,eAAe;EACtB;EACA,MAAM,MAAM;EAAG,QAAQ,IAAI,gBAAgB;EAC3C,aAAa,KAAK;EAAG,QAAQ,KAAA;EAC7B,UAAU,KAAA;EAAW,QAAQ,MAAM;EAAG,SAAS,KAAA;EAAW,YAAY,KAAA;EACtE,SAAS,WAAW;CACtB;CACA,SAAS,aAAqB;EAC5B,MAAM,aAAa,OAAO,cAAc,MAAM;EAC9C,OAAO,aAAa;GAClB,SAAS,aAAa;GACtB,gBAAgB,YAAY;IAC1B,YAAY,UAAU;IACtB,IAAI,WAAW,KAAK,IAAI,KAAK,QAAQ,WACnC,IAAI;KAAE,MAAM,QAAQ;IAAG,SAChB,SAAS;KAEd,IAAI,CAAC,WAAW,KAAK,IAAI,KAAK,QAAQ,WAAW,MAAM;IACzD;IAEF,YAAY,UAAU;IACtB,OAAO,SAAS,KAAK;GACvB;GACA,OAAO,OAAO,KAAK,SAAS;IAC1B,YAAY,UAAU;IACtB,MAAM,SAAS,MAAM,SAAS,YAAY,IAAI,CAAC,KAAK,QAAQ,WAAW,CAAC,IAAI;IAC5E,OAAO,eAAe;IACtB,MAAM,WAAW,OAAO,QAAQ,SAAS,WAAW,MAAA,CAAO,KAAK;KAAE,GAAG;KAAM;IAAO,CAAC;IACnF,YAAY,UAAU;IACtB,OAAO;GACT;EACF,CAAC;CACH;CACA,SAAS,gBAAgB,MAAyB;EAChD,IAAI,CAAC,QAAQ,OAAO,KAAK,iBAAiB,YAAY,CAAC,KAAK,gBACxD,CAAC,OAAO,SAAS,KAAK,UAAU,KAAK,KAAK,cAAc,KACxD,CAAC,KAAK,WAAW,CAAC,KAAK,aAAa,OAAO,KAAK,UAAU,YAAY,YACrE,KAAK,iBAAiB,SAAS,OAAO,KAAK,kBAAkB,YAAY,CAAC,KAAK,gBAClF,MAAM,IAAI,UAAU,oBAAoB,yCAAyC;CAErF;CACA,SAAS,SAAS,OAAe;EAC/B,aAAa,KAAK;EAClB,QAAQ,iBAAiB;GAAE,QAAa,CAAC,CAAC,YAAY,CAAC,CAAC;EAAG,GAAG,KAAK,IAAI,YAAe,KAAK,IAAI,GAAG,KAAK,CAAC,CAAC;EAEzG,MAA6C,QAAQ;CACvD;CACA,SAAS,QAAQ,MAAmB;EAClC,gBAAgB,IAAI;EACpB,MAAM,MAAM,KAAK,IAAI,GAAG,MAAM,KAAK,aAAa;EAChD,UAAU;GACR;GAAM,WAAW,MAAM;GACvB,WAAW,MAAM,OAAO,KAAK,gBAAgB,KAAK,IAAI,KAAQ,MAAM,CAAC,IAAI;GACzE,kBAAkB,KAAK,sBAAsB,KAAK,qBAAqB,IAAI,MAAM,KAAK,qBAAqB,MAAQ,KAAA;EACrH;EACA,QAAQ;EACR,SAAS,QAAQ,YAAY,GAAG;CAClC;CACA,eAAe,OAAO,OAAuB;EAC3C,IAAI,OAAO,MAAM,cAAc,EAAE,eAAe,MAAM,GAAG;GAAE,QAAQ;GAAc,QAAQ,YAAY,QAAQ,GAAM;EAAE,CAAC;CACxH;CAEA,SAAS,UAAyB;EAChC,aAAa;EACb,IAAI,QAAQ,UAAU,OAAO,OAAO,OAAO;EAC3C,MAAM,UAAU,SAAS,WAAW;EACpC,IAAI,CAAC,SAAS,OAAO,QAAQ,OAAO,IAAI,UAAU,mBAAmB,qCAAqC,CAAC;EAC3G,IAAI,CAAC,QAAQ,KAAK,iBAAkB,QAAQ,oBAAoB,KAAK,IAAI,KAAK,QAAQ,kBAAmB;GACvG,MAAM,UAAU,IAAI,UAAU,mBAAmB,gCAAgC;GACjF,aAAa;GAAG,QAAQ;GAAS,QAAQ;GACzC,OAAO,QAAQ,OAAO,OAAO;EAC/B;EACA,MAAM,eAAe,IAAI,gBAAgB;EACzC,MAAM,WAAW,eAAe,EAAE,eAAe,QAAQ,KAAK,cAAc,GAAG;GAC7E,QAAQ;GAAc,QAAQ,YAAY,IAAI,CAAC,aAAa,QAAQ,YAAY,QAAQ,GAAM,CAAC,CAAC;EAClG,CAAC;EACD,MAAM,UAAU;GAAE,OAAO;GAAU;GAAU,SAAS,QAAQ,QAAQ;GAAG,OAAO;EAAa;EAC7F,SAAS;EACT,QAAQ,UAAU,SAAS,MAAK,SAAQ;GACtC,YAAY,QAAQ;GACpB,gBAAgB,IAAI;GACpB,IAAI,KAAK,UAAU,YAAY,QAAQ,KAAK,UAAU,WAAW,KAAK,QAAQ,OAAO,QAAQ,KAAK,QAAQ,IACxG,MAAM,IAAI,UAAU,oBAAoB,2CAA2C;GAErF,QAAQ,IAAI;EACd,CAAC,CAAC,CAAC,OAAM,YAAW;GAClB,IAAI,CAAC,YAAY,aAAa,OAAO;IACnC,QAAQ,QAAQ,OAAO;IACvB,IAAK,mBAAmB,YAAY,CAAC,KAAK,GAAG,CAAC,CAAC,SAAS,QAAQ,MAAM,KAClE,mBAAmB,aAAa,KAAK,IAAI,KAAK,QAAQ,WACxD,aAAa;SACR;KACL,QAAQ,YAAY,KAAK,IAAI,QAAQ,WAAW,KAAK,IAAI,IAAI,GAAK;KAClE,SAAS,QAAQ,YAAY,KAAK,IAAI,CAAC;IACzC;GACF;GACA,MAAM;EACR,CAAC,CAAC,CAAC,cAAc;GACf,IAAI,WAAW,SAAS,SAAS,KAAA;GACjC,IAAI,CAAC,YAAY,aAAa,OAAO,QAAQ;QACxC,IAAI,CAAC,YAAY,CAAC,SAAS,QAAQ;EAC1C,CAAC;EACD,QAAQ;EACR,OAAO,QAAQ;CACjB;CAEA,eAAe,QAAQ,UAA8B,WAAuB,CAAC,GAAyB;EACpG,aAAa;EACb,IAAI,aAAa,KAAA,MAAc,CAAC,SAAS,KAAK,KAAK,SAAS,SAAS,KAAK,MAAM,IAAI,UAAU,yCAAyC;EACvI,MAAM,WAAW,cAAc,SAAS,YAAY,KAAK,SAAS,MAAM;EACxE,MAAM,WAAW,OAAO,YAAY,OAAO;EAC3C,QAAQ,IAAI,SAAS;EAAG,QAAQ;EAAM,QAAQ;EAC9C,IAAI;GACF,MAAM,QAAQ,aAAa,GAAG,WAAW,aAAa,GAAG,gBAAgB,MAAM,UAAU,QAAQ;GACjG,YAAY,QAAQ;GACpB,MAAM,SAAS,MAAM,cAAc;IACjC,cAAc,SAAS;IAAM,gBAAgB;IAAe;IAAO;IAAU,QAAQ,SAAS;GAChG,GAAG;IAAE,QAAQ;IAAc,QAAQ,YAAY,IAAI,CAAC,MAAM,QAAQ,YAAY,QAAQ,GAAM,CAAC,CAAC;GAAE,CAAC;GACjG,YAAY,QAAQ;GACpB,MAAM,MAAM,IAAI,IAAI,OAAO,gBAAgB;GAE3C,IAAI,CAAC,CAAC,UAAU,OAAO,CAAC,CAAC,SAAS,IAAI,QAAQ,KAAK,IAAI,YAAY,IAAI,YAAY,IAAI,QAAQ,CAAC,IAAI,SAAS,SAAS,+BAAM,KACxH;IAAC;IAAS;IAAkB;IAAyB;IAAgB;GAAe,CAAC,CAAC,MAAK,QAAO,IAAI,aAAa,OAAO,GAAG,CAAC,CAAC,WAAW,CAAC,KAC3I,IAAI,aAAa,IAAI,OAAO,MAAM,SAAS,IAAI,aAAa,IAAI,gBAAgB,MAAM,iBACtF,IAAI,aAAa,IAAI,uBAAuB,MAAM,UAAU,IAAI,aAAa,IAAI,cAAc,MAAM,SAAS,QAC9G,IAAI,aAAa,IAAI,eAAe,MAAM,UAAW,aAAa,YAAY,OAAO,aAAa,UACpG,MAAM,IAAI,UAAU,oBAAoB,oCAAoC;GAE9E,MAAM,YAAY,KAAK,IAAI;GAC3B,aAAa,KAAK,OAAO;IAAE;IAAU;IAAW;IAAU,UAAU,OAAO,YAAY;IAAM,QAAQ,IAAI,SAAS,IAAI,SAAS,MAAM,GAAG,GAAc;GAAE,CAAC;GACzJ,OAAO;IAAE,KAAK,IAAI;IAAM,UAAU,OAAO,YAAY;IAAM,WAAW,YAAY;GAAoB;EACxG,SAAS,SAAS;GAChB,IAAI,aAAa,SAAS,CAAC,UAAU,QAAQ,QAAQ,OAAO;GAC5D,MAAM;EACR,UAAU;GACR,QAAQ,OAAO,SAAS;GACxB,IAAI,aAAa,SAAS,CAAC,UAAU,QAAQ;EAC/C;CACF;CAEA,SAAS,YAAY,aAA6C;EAChE,IAAI;GACF,aAAa;GACb,MAAM,MAAM,cAAc,gBAAgB,OAAO,WAAW,cAAc,KAAK,OAAO,SAAS,OAAO,QAAQ;GAC9G,MAAM,QAAQ,IAAI,aAAa,IAAI,OAAO,KAAK;GAG/C,IAAI,gBAAgB,KAAA,KAAa,CAAC,OAAO;IACvC,MAAM,kBAAkB,CAAC,GAAG,UAAU,OAAO,CAAC,CAAC,CAAC,MAAK,SAAQ,KAAK,aAAa,IAAI,IAAI;IACvF,IAAI,iBAAiB,OAAO,gBAAgB;IAC5C,IAAI,WAAW,UAAU,SAAS,UAAU,QAAQ,IAAI,MAAM,OAAO,QAAQ,QAAQ,UAAU,MAAM;GACvG;GACA,MAAM,WAAW,UAAU,IAAI,KAAK;GACpC,IAAI,UAAU;IACZ,IAAI,SAAS,QAAQ,IAAI,MAAM,MAAM,IAAI,UAAU,oBAAoB,kDAAkD;IACzH,OAAO,SAAS;GAClB;GACA,MAAM,WAAW,cAAc,GAAG;GAClC,MAAM,cAAc,aAAa,QAAQ,KAAK;GAC9C,IAAI,IAAI,aAAa,IAAI,KAAK,KAAK,IAAI,aAAa,IAAI,KAAK,MAAM,YAAY,QAAQ,MAAM,IAAI,UAAU,kBAAkB,gCAAgC;GAC7J,IAAI,IAAI,aAAa,IAAI,OAAO,GAAG,MAAM,IAAI,UAAU,kBAAkB,2DAA2D;GACpI,MAAM,OAAO,IAAI,aAAa,IAAI,MAAM;GACxC,IAAI,CAAC,QAAQ,KAAK,SAAS,MAAM,MAAM,IAAI,UAAU,oBAAoB,oDAAoD;GAC7H,IAAI,WAAW,UAAU,UAAU,QAAQ,QAAQ,MAAM,aAAa;GACtE,MAAM,WAAW,OAAO,YAAY,OAAO;GAC3C,QAAQ,IAAI,SAAS;GAAG,QAAQ;GAAM,QAAQ;GAC9C,MAAM,cAAc,YAAY;IAC9B,IAAI;KACF,MAAM,OAAO,MAAM,sBAAsB;MAAE;MAAM,cAAc,YAAY;MAAU,aAAa,SAAS;MAAM;KAAM,GAAG;MACxH,QAAQ;MAAc,QAAQ,YAAY,QAAQ,GAAM;KAC1D,CAAC;KACD,IAAI,YAAY,aAAa,OAAO;MAAE,MAAM,OAAO,KAAK,aAAa,CAAC,CAAC,YAAY,CAAC,CAAC;MAAG,MAAM,QAAQ;KAAG;KACzG,gBAAgB,IAAI;KACpB,IAAI,YAAY,YAAY,KAAK,UAAU,aAAa,YAAY,UAAU;MAC5E,MAAM,OAAO,KAAK,aAAa,CAAC,CAAC,YAAY,CAAC,CAAC;MAC/C,MAAM,IAAI,UAAU,qBAAqB,sDAAsD;KACjG;KAEA,aAAa;KAAG,QAAQ,IAAI;KAC5B,MAAM,SAAS;MAAE,SAAS,KAAK;MAAS,WAAW,KAAK;MAAW,UAAU,YAAY;KAAS;KAClG,YAAY;MAAE;MAAO,KAAK;MAAU;KAAO;KAC3C,QAAQ;KACR,OAAO;IACT,SAAS,SAAS;KAChB,IAAI,CAAC,YAAY,aAAa,OAAO;MAAE,QAAQ,QAAQ,OAAO;MAAG,QAAQ;KAAG;KAC5E,MAAM;IACR,UAAU;KACR,UAAU,OAAO,KAAK;KAAG,QAAQ,OAAO,SAAS;KACjD,IAAI,CAAC,UAAU,QAAQ;IACzB;GACF,EAAA,CAAG;GACH,UAAU,IAAI,OAAO;IAAE,KAAK,IAAI;IAAM;IAAU,SAAS;GAAW,CAAC;GACrE,OAAO;EACT,SAAS,SAAS;GAChB,IAAI,CAAC,UAAU;IAAE,QAAQ,QAAQ,OAAO;IAAG,QAAQ;GAAG;GACtD,OAAO,QAAQ,OAAO,OAAO;EAC/B;CACF;CAEA,OAAO;EACL,IAAI,SAAS;GAAE,OAAO;EAAQ;EAAG,mBAAmB;EACpD,UAAU,UAAU;GAAE,UAAU,IAAI,QAAQ;GAAG,aAAa;IAAE,UAAU,OAAO,QAAQ;GAAG;EAAG;EAC7F,qBAAoB,aAAY,QAAQ,UAAU,QAAQ;EAC1D,qBAAqB,OAAO,aAAa,QAAQ,OAAO,QAAQ;EAChE,aAAY,aAAY,QAAQ,KAAA,GAAW,QAAQ;EAAG;EAAa;EACnE,MAAM,SAAS;GACb,aAAa;GACb,MAAM,MAAM,SAAS,WAAW;GAChC,aAAa;GAAG,QAAQ;GAAM,QAAQ;GACtC,MAAM,WAAW;GAEjB,IAAI;GACJ,IAAI;IAAE,aAAa,MAAM;GAAG,SAAS,SAAS;IAAE,eAAe;GAAS;GACxE,IAAI;IAIF,MAAM,QAAO,MADS,UAAU,SAAS,YAAY,KAAA,CAAS,EAAA,EACxC,iBAAiB,KAAK,KAAK,aAAa;IAC9D,IAAI,cAAc,MAAM;GAC1B,SAAS,SAAS;IAChB,IAAI,CAAC,YAAY,aAAa,OAAO;KAAE,QAAQ,QAAQ,OAAO;KAAG,QAAQ;IAAG;IAC5E,MAAM;GACR;EACF;EACA,UAAU;GACR,IAAI,UAAU;GACd,QAAQ,MAAM,MAAM;GACpB,aAAa;GAAG,WAAW;GAAM,QAAQ;GAAM,QAAQ;GAAG,UAAU,MAAM;EAC5E;CACF;AACF"}

package/dist/chunks/client2.d.ts

@@ -0,0 +1,53 @@
+
+import { si as AccountRead, sn as PrincipalRead } from "./index.js";
+import { i as ClientOptions, r as Client } from "./client.js";
+//#region src/auth/client.d.ts
+interface MozaikAuthOptions {
+  baseUrl: string;
+  redirectUri: string;
+  /** Only PKCE transactions are persisted. Access/refresh tokens stay in memory. */
+  transactionStorage?: Storage;
+  fetch?: ClientOptions['fetch'];
+}
+interface SsoOptions {
+  returnTo?: string;
+  prompt?: 'login' | 'none' | 'consent';
+}
+interface PreparedSso {
+  url: string;
+  provider: string | null;
+  expiresAt: number;
+}
+interface CompletedSso {
+  account: AccountRead;
+  principal: PrincipalRead;
+  returnTo: string;
+}
+interface AuthSnapshot {
+  status: 'anonymous' | 'authenticating' | 'authenticated' | 'refreshing';
+  isAuthenticated: boolean;
+  isLoading: boolean;
+  account: AccountRead | null;
+  principal: PrincipalRead | null;
+  error: Error | null;
+  /** Stable across refreshes; replaced on login/logout to isolate account caches. */
+  client: Client;
+}
+interface MozaikAuth {
+  readonly client: Client;
+  getSnapshot(): AuthSnapshot;
+  subscribe(listener: () => void): () => void;
+  prepareInternalSso(options?: SsoOptions): Promise<PreparedSso>;
+  prepareProviderSso(alias: string, options?: SsoOptions): Promise<PreparedSso>;
+  prepareSso(options?: SsoOptions): Promise<PreparedSso>;
+  completeSso(callbackUrl?: string): Promise<CompletedSso>;
+  refresh(): Promise<void>;
+  logout(): Promise<void>;
+  /** Local teardown only. Use logout() to revoke the server session. */
+  dispose(): void;
+}
+/** Browser SSO through Mozaik's account-provisioning backend, with no client secret. */
+declare function createMozaikAuth(options: MozaikAuthOptions): MozaikAuth;
+//#endregion
+export { PreparedSso as a, MozaikAuthOptions as i, CompletedSso as n, SsoOptions as o, MozaikAuth as r, createMozaikAuth as s, AuthSnapshot as t };
+//# sourceMappingURL=client2.d.ts.map

package/dist/index.d.ts

@@ -2,7 +2,7 @@
 import { c as request, i as ClientOptions, o as RequestOptions, r as Client, s as createClient, t as ApiError } from "./chunks/client.js";
 //#region src/metadata.d.ts
 export declare const apiVersion = "0.1.0";
-export declare const backendRevision = "b73109673f401ca048a1f5dd49156df240186580";
+export declare const backendRevision = "4a542020f6ebb9aa6460023ff6a39cfde89aa82b";
 export declare const schemaSha256 = "991e12e9668ae517fc606191d8374089ebba40e7d21a5394c0d5b6b5d445b22e";
 //#endregion
 export { ApiError, type Client, type ClientOptions, type RequestOptions, createClient, request };

package/dist/index.js

@@ -2,7 +2,7 @@
 import { n as createClient, r as request, t as ApiError } from "./chunks/client.js";
 //#region src/metadata.ts
 const apiVersion = "0.1.0";
-const backendRevision = "b73109673f401ca048a1f5dd49156df240186580";
+const backendRevision = "4a542020f6ebb9aa6460023ff6a39cfde89aa82b";
 const schemaSha256 = "991e12e9668ae517fc606191d8374089ebba40e7d21a5394c0d5b6b5d445b22e";
 //#endregion
 export { ApiError, apiVersion, backendRevision, createClient, request, schemaSha256 };

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","names":[],"sources":["../src/metadata.ts"],"sourcesContent":["// Generated from the deployed OpenAPI snapshot.\nexport const apiVersion = \"0.1.0\";\nexport const backendRevision = \"b73109673f401ca048a1f5dd49156df240186580\";\nexport const schemaSha256 = \"991e12e9668ae517fc606191d8374089ebba40e7d21a5394c0d5b6b5d445b22e\";\n"],"mappings":";;;AACA,MAAa,aAAa;AAC1B,MAAa,kBAAkB;AAC/B,MAAa,eAAe"}
+{"version":3,"file":"index.js","names":[],"sources":["../src/metadata.ts"],"sourcesContent":["// Generated from the deployed OpenAPI snapshot.\nexport const apiVersion = \"0.1.0\";\nexport const backendRevision = \"4a542020f6ebb9aa6460023ff6a39cfde89aa82b\";\nexport const schemaSha256 = \"991e12e9668ae517fc606191d8374089ebba40e7d21a5394c0d5b6b5d445b22e\";\n"],"mappings":";;;AACA,MAAa,aAAa;AAC1B,MAAa,kBAAkB;AAC/B,MAAa,eAAe"}

package/dist/react/sso.d.ts

@@ -0,0 +1,15 @@
+
+import { r as MozaikAuth, t as AuthSnapshot } from "../chunks/client2.js";
+import { ReactNode } from "react";
+//#region src/auth/react.d.ts
+export type MozaikAuthContext = AuthSnapshot & Pick<MozaikAuth, 'prepareInternalSso' | 'prepareProviderSso' | 'prepareSso' | 'completeSso' | 'refresh' | 'logout'>;
+export interface MozaikAuthProviderProps {
+  /** Create once per application (or per SSR request), outside component renders. */
+  auth: MozaikAuth;
+  children?: ReactNode;
+}
+/** Provides auth and a TanStack Query cache isolated to the current session. */
+export declare function MozaikAuthProvider({ auth, children }: MozaikAuthProviderProps): import("react").FunctionComponentElement<import("react").ProviderProps<MozaikAuthContext | null>>;
+export declare function useMozaikAuth(): MozaikAuthContext;
+//#endregion
+//# sourceMappingURL=sso.d.ts.map

package/dist/react/sso.js

@@ -0,0 +1,48 @@
+"use client";
+import { createContext, createElement, useContext, useEffect, useMemo, useSyncExternalStore } from "react";
+import { QueryClient, QueryClientProvider } from "@tanstack/react-query";
+//#region src/auth/react.ts
+const Context = createContext(null);
+let cacheSequence = 0;
+/** Provides auth and a TanStack Query cache isolated to the current session. */
+function MozaikAuthProvider({ auth, children }) {
+	const snapshot = useSyncExternalStore(auth.subscribe, auth.getSnapshot, auth.getSnapshot);
+	const cache = useMemo(() => ({
+		queryClient: new QueryClient(),
+		key: ++cacheSequence,
+		lifetime: 0
+	}), [auth, snapshot.client]);
+	const { queryClient, key } = cache;
+	useEffect(() => {
+		const lifetime = ++cache.lifetime;
+		return () => {
+			queueMicrotask(() => {
+				if (cache.lifetime !== lifetime) return;
+				queryClient.cancelQueries();
+				queryClient.clear();
+			});
+		};
+	}, [cache, queryClient]);
+	const value = useMemo(() => ({
+		...snapshot,
+		prepareInternalSso: auth.prepareInternalSso,
+		prepareProviderSso: auth.prepareProviderSso,
+		prepareSso: auth.prepareSso,
+		completeSso: auth.completeSso,
+		refresh: auth.refresh,
+		logout: auth.logout
+	}), [auth, snapshot]);
+	return createElement(Context.Provider, { value }, createElement(QueryClientProvider, {
+		client: queryClient,
+		key
+	}, children));
+}
+function useMozaikAuth() {
+	const value = useContext(Context);
+	if (!value) throw new Error("useMozaikAuth must be used inside MozaikAuthProvider");
+	return value;
+}
+//#endregion
+export { MozaikAuthProvider, useMozaikAuth };
+
+//# sourceMappingURL=sso.js.map

package/dist/react/sso.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sso.js","names":[],"sources":["../../src/auth/react.ts"],"sourcesContent":["import { createContext, createElement, useContext, useEffect, useMemo, useSyncExternalStore, type ReactNode } from 'react';\nimport { QueryClient, QueryClientProvider } from '@tanstack/react-query';\nimport type { AuthSnapshot, MozaikAuth } from './client';\n\nexport type MozaikAuthContext = AuthSnapshot & Pick<MozaikAuth,\n  'prepareInternalSso' | 'prepareProviderSso' | 'prepareSso' | 'completeSso' | 'refresh' | 'logout'>;\nconst Context = createContext<MozaikAuthContext | null>(null);\nlet cacheSequence = 0;\n\nexport interface MozaikAuthProviderProps {\n  /** Create once per application (or per SSR request), outside component renders. */\n  auth: MozaikAuth;\n  children?: ReactNode;\n}\n\n/** Provides auth and a TanStack Query cache isolated to the current session. */\nexport function MozaikAuthProvider({ auth, children }: MozaikAuthProviderProps) {\n  const snapshot = useSyncExternalStore(auth.subscribe, auth.getSnapshot, auth.getSnapshot);\n  // New account/anonymous state gets a new cache before children render. An\n  // effect clearing a shared cache would permit one render of the old account.\n  const cache = useMemo(() => ({ queryClient: new QueryClient(), key: ++cacheSequence, lifetime: 0 }), [auth, snapshot.client]);\n  const { queryClient, key } = cache;\n  useEffect(() => {\n    const lifetime = ++cache.lifetime;\n    return () => {\n      // Child observers unsubscribe during cleanup and may schedule GC timers.\n      // Clear afterwards; Strict Mode's immediate re-setup keeps its cache.\n      queueMicrotask(() => {\n        if (cache.lifetime !== lifetime) return;\n        void queryClient.cancelQueries(); queryClient.clear();\n      });\n    };\n  }, [cache, queryClient]);\n  const value = useMemo<MozaikAuthContext>(() => ({\n    ...snapshot,\n    prepareInternalSso: auth.prepareInternalSso, prepareProviderSso: auth.prepareProviderSso,\n    prepareSso: auth.prepareSso, completeSso: auth.completeSso, refresh: auth.refresh, logout: auth.logout,\n  }), [auth, snapshot]);\n  // Query observers bind to their initial QueryClient. Remount the session\n  // subtree too, so an existing observer cannot retain the previous cache.\n  return createElement(Context.Provider, { value }, createElement(QueryClientProvider, { client: queryClient, key }, children));\n}\n\nexport function useMozaikAuth(): MozaikAuthContext {\n  const value = useContext(Context);\n  if (!value) throw new Error('useMozaikAuth must be used inside MozaikAuthProvider');\n  return value;\n}\n"],"mappings":";;;;AAMA,MAAM,UAAU,cAAwC,IAAI;AAC5D,IAAI,gBAAgB;;AASpB,SAAgB,mBAAmB,EAAE,MAAM,YAAqC;CAC9E,MAAM,WAAW,qBAAqB,KAAK,WAAW,KAAK,aAAa,KAAK,WAAW;CAGxF,MAAM,QAAQ,eAAe;EAAE,aAAa,IAAI,YAAY;EAAG,KAAK,EAAE;EAAe,UAAU;CAAE,IAAI,CAAC,MAAM,SAAS,MAAM,CAAC;CAC5H,MAAM,EAAE,aAAa,QAAQ;CAC7B,gBAAgB;EACd,MAAM,WAAW,EAAE,MAAM;EACzB,aAAa;GAGX,qBAAqB;IACnB,IAAI,MAAM,aAAa,UAAU;IACjC,YAAiB,cAAc;IAAG,YAAY,MAAM;GACtD,CAAC;EACH;CACF,GAAG,CAAC,OAAO,WAAW,CAAC;CACvB,MAAM,QAAQ,eAAkC;EAC9C,GAAG;EACH,oBAAoB,KAAK;EAAoB,oBAAoB,KAAK;EACtE,YAAY,KAAK;EAAY,aAAa,KAAK;EAAa,SAAS,KAAK;EAAS,QAAQ,KAAK;CAClG,IAAI,CAAC,MAAM,QAAQ,CAAC;CAGpB,OAAO,cAAc,QAAQ,UAAU,EAAE,MAAM,GAAG,cAAc,qBAAqB;EAAE,QAAQ;EAAa;CAAI,GAAG,QAAQ,CAAC;AAC9H;AAEA,SAAgB,gBAAmC;CACjD,MAAM,QAAQ,WAAW,OAAO;CAChC,IAAI,CAAC,OAAO,MAAM,IAAI,MAAM,sDAAsD;CAClF,OAAO;AACT"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@learnorama/mozaik-sdk",
-  "version": "0.1.0-staging.12.1",
+  "version": "0.1.0-staging.13.1",
   "description": "Typed Mozaik API client and optional TanStack Query hooks.",
   "type": "module",
   "license": "UNLICENSED",
@@ -27,6 +27,14 @@
       "types": "./dist/chat.d.ts",
       "import": "./dist/chat.js"
     },
+    "./auth": {
+      "types": "./dist/auth.d.ts",
+      "import": "./dist/auth.js"
+    },
+    "./react/sso": {
+      "types": "./dist/react/sso.d.ts",
+      "import": "./dist/react/sso.js"
+    },
     "./react/chat": {
       "types": "./dist/react/chat.d.ts",
       "import": "./dist/react/chat.js"
@@ -65,14 +73,14 @@
   },
   "mozaik": {
     "apiVersion": "0.1.0",
-    "backendRevision": "b73109673f401ca048a1f5dd49156df240186580",
+    "backendRevision": "4a542020f6ebb9aa6460023ff6a39cfde89aa82b",
     "schemaSha256": "991e12e9668ae517fc606191d8374089ebba40e7d21a5394c0d5b6b5d445b22e",
     "sdkFingerprintVersion": 2,
-    "sdkFingerprint": "4f860f2619105c8491e799e77df3aec27ceadaa4837de5f9ed2cd005e33956e0",
+    "sdkFingerprint": "85c8b55560bc78f9b426ffeb2d5d7d10d7585c2a3e293c27e0d90e9e14705015",
     "sdkContent": {
-      "runtime": "56625842edf623a0de3a6eaf589d4c4156912df5b4557f6601ba2a3249a1a5f2",
-      "types": "9ff0a9d27b8653fd630c7141169b159668c39a7ee6a5f2b8b25ece6b7234e035",
-      "package": "04bdc52a7fa2a72729f344d01ff3d954923245debceae159b8afa25cbb5bb563"
+      "runtime": "d2eb442e13ac3d0102d763c69a0c2cebceaa5bd58da1e2a3df1382f1cf6929ee",
+      "types": "8dfdefdeef650b3491da6a6408d7af210fe9f12d848af5e6d23bdbc094bd1946",
+      "package": "99a714f26e86b40c6eabd5248366c7c0efb397f4a6e7cfb7adbca689382e2f11"
     }
   }
 }