@multiplatform.one/keycloak 6.7.0 → 7.1.0

package/types/oauth/jwt.d.ts

@@ -0,0 +1,31 @@
+/**
+ * File: /src/oauth/jwt.ts
+ * Project: @multiplatform.one/keycloak
+ *
+ * Unverified JWT decoding — the inverse of pkce.ts's base64url encoder, and
+ * hand-rolled for the same reason: GJS has no `atob` and no `Buffer`, and the
+ * OAuth core has to run unchanged on GJS, node and the browser.
+ *
+ * "Unverified" is load-bearing. Nothing in this file looks at the signature.
+ * Decoding a JWT tells you what the bytes claim, not whether the claim is
+ * true; `validateIdToken` in idToken.ts is what turns the former into the
+ * latter, and it is the only thing that should be feeding these results into
+ * a decision.
+ */
+/**
+ * base64url per RFC 4648 §5 — URL-safe alphabet, padding optional.
+ *
+ * Strict on input: an unknown character or a 1-character tail (which no
+ * base64 encoding can produce) is a malformed token, not something to
+ * silently round down.
+ */
+export declare function base64UrlDecode(value: string): Uint8Array;
+export interface DecodedJwt {
+    header: Record<string, unknown>;
+    payload: Record<string, unknown>;
+    /** Present so a caller can see there is one; nothing here verifies it. */
+    signature: string;
+}
+/** Decode a compact-serialization JWS without verifying anything about it. */
+export declare function decodeJwt(token: string): DecodedJwt;
+//# sourceMappingURL=jwt.d.ts.map

package/types/oauth/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/oauth/jwt.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AASH;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CA2BzD;AAeD,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,0EAA0E;IAC1E,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,8EAA8E;AAC9E,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAUnD"}

package/types/oauth/loopbackFlow.d.ts

@@ -0,0 +1,64 @@
+/**
+ * File: /src/oauth/loopbackFlow.ts
+ * Project: @multiplatform.one/keycloak
+ *
+ * Authorization Code + PKCE with a loopback redirect — the flow RFC 8252
+ * ("OAuth 2.0 for Native Apps", §7.3) prescribes for desktop applications.
+ *
+ * The app binds an ephemeral port on 127.0.0.1, hands Keycloak that port as
+ * the redirect URI, and opens the system browser. The user authenticates in a
+ * real browser — with their password manager, their existing SSO cookie and a
+ * verifiable address bar — and Keycloak redirects back to the listener, which
+ * closes as soon as the code arrives.
+ *
+ * Why not the alternatives:
+ *
+ *   - A custom URI scheme (`myapp://callback`) needs an installed .desktop
+ *     file registering `x-scheme-handler/myapp` plus a desktop-database
+ *     refresh. That cannot work from a dev tree run with `gjs -m dist/...`,
+ *     and on a multi-app desktop any other app can register the same scheme.
+ *   - The device authorization grant avoids the redirect entirely, but it has
+ *     to be enabled per-client on the realm, and it downgrades the UX to
+ *     retyping a code for a GUI app that can perfectly well open a browser.
+ *   - An embedded webview would put the app between the user and their
+ *     credentials, which RFC 8252 §8.12 explicitly rules out.
+ *
+ * Everything the flow touches is injected, so the whole orchestration is
+ * exercised in unit tests with no browser, no sockets and no GJS.
+ */
+import { type CallbackQuery } from "./callback";
+import { type PkceCrypto } from "./pkce";
+import { type FetchLike, type TokenSet } from "./tokenExchange";
+/** A bound loopback socket waiting for exactly one redirect. */
+export interface LoopbackListener {
+    /** The `http://127.0.0.1:<port>/…` URI the socket is bound to. */
+    redirectUri: string;
+    waitForCallback(): Promise<CallbackQuery>;
+    close(): void;
+}
+export interface LoopbackTransport {
+    crypto: PkceCrypto;
+    fetch: FetchLike;
+    openBrowser(url: string): void | Promise<void>;
+    /**
+     * Bind a loopback socket for one login.
+     *
+     * `expectedState` is handed over at bind time rather than at wait time so
+     * the listener can tell the real redirect from a stray local request from
+     * the very first packet — there is no window in which it does not yet know
+     * what it is waiting for.
+     */
+    listen(expectedState: string): Promise<LoopbackListener>;
+}
+export interface LoopbackLoginConfig {
+    url: string;
+    realm: string;
+    clientId: string;
+    /** See `RealmLocation.allowInsecureLoopbackHttp` — development only. */
+    allowInsecureLoopbackHttp?: boolean;
+    scopes?: string[];
+    prompt?: "none" | "login" | "consent" | "select_account";
+    loginHint?: string;
+}
+export declare function runLoopbackLogin(transport: LoopbackTransport, config: LoopbackLoginConfig): Promise<TokenSet>;
+//# sourceMappingURL=loopbackFlow.d.ts.map

package/types/oauth/loopbackFlow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loopbackFlow.d.ts","sourceRoot":"","sources":["../../src/oauth/loopbackFlow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAGH,OAAO,EAAE,KAAK,aAAa,EAA8B,MAAM,YAAY,CAAC;AAG5E,OAAO,EAAiD,KAAK,UAAU,EAAE,MAAM,QAAQ,CAAC;AACxF,OAAO,EAA6B,KAAK,SAAS,EAAE,KAAK,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAE3F,gEAAgE;AAChE,MAAM,WAAW,gBAAgB;IAC/B,kEAAkE;IAClE,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1C,KAAK,IAAI,IAAI,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,EAAE,SAAS,CAAC;IACjB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C;;;;;;;OAOG;IACH,MAAM,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CAC1D;AAED,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,wEAAwE;IACxE,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS,GAAG,gBAAgB,CAAC;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,gBAAgB,CACpC,SAAS,EAAE,iBAAiB,EAC5B,MAAM,EAAE,mBAAmB,GAC1B,OAAO,CAAC,QAAQ,CAAC,CAwCnB"}

package/types/oauth/pkce.d.ts

@@ -0,0 +1,49 @@
+/**
+ * File: /src/oauth/pkce.ts
+ * Project: @multiplatform.one/keycloak
+ *
+ * PKCE (RFC 7636) for public clients. A desktop app cannot keep a client
+ * secret, so the code verifier is what proves the app redeeming the
+ * authorization code is the same app that requested it.
+ *
+ * Crypto is injected rather than imported: the browser has WebCrypto, GJS has
+ * GLib.compute_checksum_for_bytes, and neither is reachable from the other.
+ * Keeping the primitive behind an interface is also what makes this file
+ * testable with fixed vectors.
+ */
+export interface PkceCrypto {
+    /** Cryptographically secure random bytes. */
+    randomBytes(length: number): Uint8Array;
+    /** Raw (not hex) SHA-256 digest. */
+    sha256(input: Uint8Array): Uint8Array;
+}
+export interface PkcePair {
+    verifier: string;
+    challenge: string;
+    method: "S256";
+}
+/**
+ * base64url per RFC 4648 §5 — no padding, URL-safe alphabet.
+ *
+ * Hand-rolled rather than btoa/Buffer because this runs on all three of
+ * browsers, node (tests) and GJS, and GJS has neither of those globals.
+ */
+export declare function base64UrlEncode(bytes: Uint8Array): string;
+/**
+ * RFC 7636 §4.1 allows a 43–128 char verifier; 32 random bytes base64url-encode
+ * to 43 chars, the shortest length the spec considers secure.
+ */
+export declare function createPkcePair(crypto: PkceCrypto): PkcePair;
+/** Opaque CSRF token echoed back on the redirect (RFC 6749 §10.12). */
+export declare function createStateToken(crypto: Pick<PkceCrypto, "randomBytes">): string;
+/**
+ * Replay defence for the ID token (OIDC Core §3.1.2.1). Sent on the
+ * authorization request and echoed in the id_token's `nonce` claim, so a
+ * token captured from one login cannot be presented as the result of another.
+ *
+ * Separate from the state token on purpose: state binds the *redirect* to
+ * this process, nonce binds the *token* to this authorization request, and
+ * reusing one value for both would leak the state into the token.
+ */
+export declare function createNonce(crypto: Pick<PkceCrypto, "randomBytes">): string;
+//# sourceMappingURL=pkce.d.ts.map

package/types/oauth/pkce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.d.ts","sourceRoot":"","sources":["../../src/oauth/pkce.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,MAAM,WAAW,UAAU;IACzB,6CAA6C;IAC7C,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC;IACxC,oCAAoC;IACpC,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU,CAAC;CACvC;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAID;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAgBzD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,UAAU,GAAG,QAAQ,CAI3D;AAED,uEAAuE;AACvE,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,MAAM,CAEhF;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,MAAM,CAE3E"}

package/types/oauth/tokenExchange.d.ts

@@ -0,0 +1,89 @@
+/**
+ * File: /src/oauth/tokenExchange.ts
+ * Project: @multiplatform.one/keycloak
+ *
+ * The token endpoint calls, written against a minimal fetch shape so the GJS
+ * libsoup fetch shim satisfies it as readily as the platform fetch.
+ *
+ * This module is also where every ID token this package produces gets
+ * validated. Doing it here rather than in the flow is what makes the
+ * invariant checkable: a `TokenSet` whose `idToken` is set has had that token
+ * validated against the issuer and this client, because there is no other way
+ * to construct one — `toTokenSet` is module-private and `TokenSet` is branded,
+ * so a consumer cannot object-literal its way past the validation either. It
+ * is also the only place OIDC Core §3.1.3.7's "directly from the Token
+ * Endpoint" precondition is provably true — see idToken.ts for what that
+ * precondition buys and what it does not.
+ */
+import type { OidcEndpoints } from "./endpoints";
+import { type IdTokenClaims } from "./idToken";
+export interface FetchLikeResponse {
+    ok: boolean;
+    status: number;
+    json(): Promise<unknown>;
+    text(): Promise<string>;
+}
+export type FetchLike = (url: string, init: {
+    method: string;
+    headers: Record<string, string>;
+    body: string;
+}) => Promise<FetchLikeResponse>;
+declare const tokenSetBrand: unique symbol;
+export interface TokenSet {
+    /**
+     * Phantom brand — in the type, never on the object. It is what makes the
+     * invariant above checkable rather than merely stated: an object literal
+     * cannot satisfy this interface, so the only `TokenSet` that exists is one
+     * `toTokenSet` returned, and `toTokenSet` cannot return without having put
+     * any `idToken` through `validateIdToken` first.
+     */
+    readonly [tokenSetBrand]: true;
+    accessToken: string;
+    /**
+     * Present only when it passed `validateIdToken` — `iss`, `aud`, `azp`,
+     * `exp` and (on the authorization-code grant) `nonce` have all been
+     * checked. Its signature has not been verified; see idToken.ts for why
+     * that is sound here and what would break it.
+     */
+    idToken?: string;
+    /** Claims of the validated `idToken`, so callers need not re-decode it. */
+    idTokenClaims?: IdTokenClaims;
+    refreshToken?: string;
+    /** Access token lifetime in seconds, as reported by the server. */
+    expiresIn?: number;
+    refreshExpiresIn?: number;
+    tokenType?: string;
+    scope?: string;
+}
+export interface ExchangeCodeParams {
+    endpoints: OidcEndpoints;
+    clientId: string;
+    code: string;
+    codeVerifier: string;
+    redirectUri: string;
+    /**
+     * The nonce from the authorization request this code came back on.
+     * Required, not optional: it is the only thing binding the returned ID
+     * token to this login, and an optional parameter is one a caller forgets.
+     */
+    nonce: string;
+    /** Epoch seconds for the `exp`/`iat` checks. Injected by tests. */
+    now?: number;
+}
+export declare function exchangeAuthorizationCode(fetchImpl: FetchLike, { endpoints, clientId, code, codeVerifier, redirectUri, nonce, now }: ExchangeCodeParams): Promise<TokenSet>;
+export interface RefreshParams {
+    endpoints: OidcEndpoints;
+    clientId: string;
+    refreshToken: string;
+    /** Epoch seconds for the `exp`/`iat` checks. Injected by tests. */
+    now?: number;
+}
+export declare function refreshAccessToken(fetchImpl: FetchLike, { endpoints, clientId, refreshToken, now }: RefreshParams): Promise<TokenSet>;
+/**
+ * End the Keycloak SSO session via back-channel logout. Preferred over opening
+ * the end-session URL in a browser on GNOME: there is no app window to return
+ * to, so a browser tab would just be left sitting on a logout page.
+ */
+export declare function endSession(fetchImpl: FetchLike, { endpoints, clientId, refreshToken }: RefreshParams): Promise<void>;
+export {};
+//# sourceMappingURL=tokenExchange.d.ts.map

package/types/oauth/tokenExchange.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenExchange.d.ts","sourceRoot":"","sources":["../../src/oauth/tokenExchange.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAGjD,OAAO,EAAE,KAAK,aAAa,EAAmB,MAAM,WAAW,CAAC;AAEhE,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACzB,IAAI,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;CACzB;AAED,MAAM,MAAM,SAAS,GAAG,CACtB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,KACpE,OAAO,CAAC,iBAAiB,CAAC,CAAC;AAEhC,OAAO,CAAC,MAAM,aAAa,EAAE,OAAO,MAAM,CAAC;AAE3C,MAAM,WAAW,QAAQ;IACvB;;;;;;OAMG;IACH,QAAQ,CAAC,CAAC,aAAa,CAAC,EAAE,IAAI,CAAC;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAkFD,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,aAAa,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,yBAAyB,CAC7C,SAAS,EAAE,SAAS,EACpB,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,kBAAkB,GACvF,OAAO,CAAC,QAAQ,CAAC,CAuBnB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,aAAa,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,mEAAmE;IACnE,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,SAAS,EACpB,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,EAAE,EAAE,aAAa,GACxD,OAAO,CAAC,QAAQ,CAAC,CAWnB;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAC9B,SAAS,EAAE,SAAS,EACpB,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,aAAa,GACnD,OAAO,CAAC,IAAI,CAAC,CAWf"}

package/types/one.d.ts

@@ -23,6 +23,13 @@ export interface AuthHandlerConfig {
     scopes?: string[];
     /** Expo deep-link scheme (e.g. "multiplatform-one") — added to trustedOrigins. */
     expoScheme?: string;
+    /**
+     * Additional origins allowed to hit the auth route (e.g. LAN device
+     * origins). Extends — never replaces — the defaults (baseUrl, keycloak
+     * URL, expo scheme). Also readable from the KEYCLOAK_TRUSTED_ORIGINS env
+     * var as a comma-separated list.
+     */
+    trustedOrigins?: string[];
 }
 export type Auth = ReturnType<typeof createAuth>;
 //# sourceMappingURL=one.d.ts.map

package/types/one.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"one.d.ts","sourceRoot":"","sources":["../src/one.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,wBAAgB,UAAU,CAAC,MAAM,EAAE,iBAAiB,mCA+CnD;AAED,MAAM,WAAW,eAAe;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC"}
+{"version":3,"file":"one.d.ts","sourceRoot":"","sources":["../src/one.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,wBAAgB,UAAU,CAAC,MAAM,EAAE,iBAAiB,mCAmEnD;AAED,MAAM,WAAW,eAAe;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC"}

package/types/provider/AfterAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AfterAuth.d.ts","sourceRoot":"","sources":["../../src/provider/AfterAuth.tsx"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,iBAAiB,EAAa,MAAM,OAAO,CAAC;AAK9E,MAAM,WAAW,cAAe,SAAQ,iBAAiB;IACvD,gBAAgB,CAAC,EAAE,aAAa,CAAC;CAClC;AAED,wBAAgB,SAAS,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,EAAE,cAAc,2CAwD1F"}
+{"version":3,"file":"AfterAuth.d.ts","sourceRoot":"","sources":["../../src/provider/AfterAuth.tsx"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,iBAAiB,EAAa,MAAM,OAAO,CAAC;AAM9E,MAAM,WAAW,cAAe,SAAQ,iBAAiB;IACvD,gBAAgB,CAAC,EAAE,aAAa,CAAC;CAClC;AAED,wBAAgB,SAAS,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,EAAE,cAAc,2CA8D1F"}

package/types/provider/authProvider/index.native.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.native.d.ts","sourceRoot":"","sources":["../../../src/provider/authProvider/index.native.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAYH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAElD,wBAAgB,YAAY,CAAC,EAC3B,QAAQ,EACR,QAAQ,EACR,cAAc,EACd,gBAAgB,GACjB,EAAE,iBAAiB,2CA6FnB"}
+{"version":3,"file":"index.native.d.ts","sourceRoot":"","sources":["../../../src/provider/authProvider/index.native.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAiBH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAElD,wBAAgB,YAAY,CAAC,EAC3B,QAAQ,EACR,QAAQ,EACR,cAAc,EACd,gBAAgB,GACjB,EAAE,iBAAiB,2CAyHnB"}

package/types/state.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,OAAO,SAAmD,CAAC;AAExE,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,SAAU,SAAQ,cAAc;IAC/C,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,eAAe,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,SAAS,EAAE,CAAC,MAAM,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CAC1F;AAOD,wBAAgB,YAAY,IAAI,SAAS,CAUxC"}
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,OAAO,SAAwC,CAAC;AAE7D,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,SAAU,SAAQ,cAAc;IAC/C,UAAU,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;IACtC,eAAe,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,IAAI,CAAC;IAChD,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,SAAS,EAAE,CAAC,MAAM,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;CAC1F;AAOD,wBAAgB,YAAY,IAAI,SAAS,CAUxC"}