@oxy.so/services 4.0.6 → 6.0.0

package/src/ui/oauth/oauthHandshake.ts

@@ -9,7 +9,7 @@
  * identical, which is what lets both lanes converge on one completion path.
  */
 
-import { buildOAuthAuthorizeUrl, generateOAuthState, generatePkcePair } from '@oxy.so/core';
+import { buildOAuthAuthorizeUrl, generateOAuthState, generatePkcePair, type OxyAuthScreen } from '@oxy.so/core';
 import type { OAuthHandshake } from './types';
 
 /** Inputs for {@link prepareAuthorizeRequest}. */
@@ -28,6 +28,8 @@ export interface PrepareAuthorizeRequestParams {
    * not a guarantee — an IdP with no opener still redirects.
    */
   responseMode?: 'web_message';
+  /** The IdP screen a person with no session there lands on. */
+  screen?: OxyAuthScreen;
 }
 
 /** A ready-to-use authorize request plus the secrets that finish it. */
@@ -64,6 +66,7 @@ export async function prepareAuthorizeRequest(
     state,
     codeChallenge: pkce.codeChallenge,
     ...(params.responseMode ? { responseMode: params.responseMode } : {}),
+    ...(params.screen ? { screen: params.screen } : {}),
   });
 
   return {

package/src/ui/oauth/oauthPopup.ts

@@ -11,10 +11,9 @@
  *   is still being handled. Anything awaited first (resolving the application,
  *   generating PKCE) loses it and the popup is silently blocked. So the window
  *   is opened EMPTY up front and navigated once the authorize URL exists —
- *   the same shape as `passkeyHubPopup.ts`.
+ *   a plain function a test can substitute.
  * - **No close event.** A cross-origin popup fires nothing when the user
- *   dismisses it; polling `closed` is the only mechanism (as in core's
- *   `AccountDialogController.watchPopup`).
+ *   dismisses it; polling `closed` is the only mechanism.
  * - **No cross-origin reads.** The popup's URL, title, and document are all
  *   opaque. The authorization result arrives ONLY as a `postMessage`.
  */

package/src/ui/screens/ManageAccountScreen.tsx

@@ -14,7 +14,7 @@ import { useTheme } from '@oxy.so/bloom/theme';
 import { Text } from '@oxy.so/bloom/typography';
 import { SettingsListGroup, SettingsListItem } from '@oxy.so/bloom/settings-list';
 import {
-    IDENTITY_WEB_ORIGIN,
+    AUTH_WEB_ORIGIN,
     getAccountDisplayName,
     getAccountFallbackHandle,
     getNormalizedUserHandle,
@@ -324,10 +324,9 @@ const ManageAccountScreen: React.FC<BaseScreenProps> = ({
             return;
         }
         // Web: deleting an account is signed with its identity key, which only
-        // the identity origin can unseal — the deletion happens there, never on
-        // this page.
+        // auth.oxy.so can unseal — the deletion happens there, never on this page.
         if (isWebBrowser()) {
-            await Linking.openURL(`${IDENTITY_WEB_ORIGIN}/`).catch(() => {
+            await Linking.openURL(`${AUTH_WEB_ORIGIN}/identity`).catch(() => {
                 toast.error(t('accountSwitcher.linkOpenFailed'));
             });
             return;

package/src/ui/screens/trust/TrustLeaderboardScreen.tsx

@@ -115,7 +115,7 @@ const TrustLeaderboardScreen: React.FC<BaseScreenProps> = ({ navigate }) => {
                 </TouchableOpacity>
             );
         },
-        [oxyServices, currentUserId, handleEntryPress, locale],
+        [oxyServices, currentUserId, handleEntryPress, locale, t],
     );
 
     const keyExtractor = useCallback(

package/src/ui/session/authStore.ts

@@ -7,7 +7,6 @@
  * store shape + logic (`createWebAuthStateStore` / `createNativeAuthStateStore` /
  * `createMemoryAuthStateStore`); this module only selects the seam:
  *
- *  - `storage: 'ephemeral'` → `createMemoryAuthStateStore()`, on EVERY platform.
  *  - web  → `createWebAuthStateStore()` (localStorage, in-memory fallback).
  *  - native → `createNativeAuthStateStore(secureKV)` for the SESSION blob over
  *    the shared `createNativeSecureKeyValueStorage()` adapter
@@ -23,7 +22,6 @@
 import {
   createWebAuthStateStore,
   createNativeAuthStateStore,
-  createMemoryAuthStateStore,
   createSharedMirroringAuthStateStore,
   type AuthStateStore,
   type SessionMode,
@@ -46,20 +44,6 @@ export interface PlatformAuthStateStoreOptions {
    * a decision a storage seam gets to make.
    */
   sessionMode?: SessionMode;
-  /**
-   * Whether this origin/app may persist a durable device credential AT ALL.
-   *
-   * `'ephemeral'` stores nothing durable and mirrors nothing: the session lives
-   * in memory for the lifetime of the page and is gone on reload. Its one caller
-   * is `auth.oxy.so` with the browser hub enabled (issue #937 Phase 5, ADR 0003),
-   * where the durable credential for the browser profile is the server-side
-   * DeviceSession behind the `__Host-oxy-device` handle.
-   *
-   * See `OxyProviderProps.deviceCredentialStorage` for why the answer to "let the
-   * hub be authoritative" is to stop persisting the other credential rather than
-   * to consult it second.
-   */
-  storage?: 'persistent' | 'ephemeral';
 }
 
 /**
@@ -68,31 +52,10 @@ export interface PlatformAuthStateStoreOptions {
  * Native persists the SESSION blob (`deviceId` + `deviceSecret` + cached access
  * token) per-app in SecureStore; the SDK re-mints the access token from the
  * device credential on the next cold boot.
- *
- * ## The ephemeral check is FIRST, and the order is load-bearing
- *
- * It short-circuits above the `isReactNative()` branch so an ephemeral caller can
- * never reach the native path — and therefore can never reach the shared-slot
- * mirroring wrapper. Checked after that branch instead, an origin that has
- * declined to persist a credential would publish one into the device-wide slot
- * every sibling app adopts on cold boot: it would keep nothing itself while
- * deciding which session five other apps boot into.
- *
- * That is unreachable today because the only ephemeral caller is a web origin, so
- * `isReactNative()` is false there anyway. Unreachable today is exactly the kind
- * of guarantee that stops holding when someone adds the second caller, so it is
- * structural here rather than incidental, and
- * `__tests__/session/authStoreEphemeral.test.ts` holds the ordering directly.
  */
 export function createPlatformAuthStateStore(
   options: PlatformAuthStateStoreOptions = {},
 ): AuthStateStore {
-  // FIRST, above every platform branch — see the docblock for why the ordering
-  // is the guarantee and not a coincidence.
-  if (options.storage === 'ephemeral') {
-    return createMemoryAuthStateStore();
-  }
-
   if (!isReactNative()) {
     return createWebAuthStateStore();
   }

package/src/ui/types/navigation.ts

@@ -146,32 +146,6 @@ export interface OxyProviderProps {
      * @default false
      */
     backgroundSession?: boolean;
-    /**
-     * Whether this origin/app may persist the durable device credential
-     * (`deviceId` + `deviceSecret`) at all.
-     *
-     * `'persistent'` (the default, and every app's behaviour) stores it — web
-     * localStorage per origin, SecureStore per app on native — so the SDK can
-     * re-mint an access token on the next cold boot.
-     *
-     * `'ephemeral'` stores NOTHING durable: the session lives in memory for the
-     * lifetime of the page and is gone on reload. It exists for ONE caller,
-     * `auth.oxy.so` with the browser hub enabled (issue #937 Phase 5, ADR 0003),
-     * where the durable credential for the browser profile is the server-side
-     * DeviceSession behind the `__Host-oxy-device` handle. Two durable
-     * credentials for one origin is the dual authority that phase exists to
-     * remove — revoking the hub while a localStorage secret still mints would
-     * make a sign-out look like it worked — so the way to let the hub be
-     * authoritative is to stop persisting the other one, not to consult it
-     * second.
-     *
-     * Do NOT reach for this to make an app "more private". A relying-party
-     * origin set to `'ephemeral'` simply signs the user out on every reload,
-     * because nothing else on that origin remembers the device.
-     *
-     * @default 'persistent'
-     */
-    deviceCredentialStorage?: 'persistent' | 'ephemeral';
     /**
      * Wires the app's OWN i18n library to Oxy's resolved language, so the
      * account (or, signed out, the device/guest locale) drives the app's

package/src/ui/utils/accountDeletionHandoff.ts

@@ -1,6 +1,6 @@
 import { surfaces } from '@oxy.so/bloom/surfaces';
 import { toast } from '@oxy.so/bloom/toast';
-import { IDENTITY_WEB_ORIGIN, logger } from '@oxy.so/core';
+import { AUTH_WEB_ORIGIN, logger } from '@oxy.so/core';
 
 /**
  * Commons' own delete-account screen (`app/(tabs)/(settings)/delete-account.tsx`
@@ -100,7 +100,7 @@ export async function runAccountDeletionHandoff(
     return 'handled';
   }
 
-  const site = IDENTITY_WEB_ORIGIN.replace(/^https?:\/\//, '');
+  const site = `${AUTH_WEB_ORIGIN.replace(/^https?:\/\//, '')}/identity`;
   await surfaces.confirm({
     title: text('deleteAccount.handoff.elsewhereTitle', 'Delete your account where your identity is'),
     description: text(

package/lib/commonjs/ui/components/authChooser/SignInEntryView.js

@@ -1,132 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.default = void 0;
-var _reactNative = require("react-native");
-var _button = require("@oxy.so/bloom/button");
-var _typography = require("@oxy.so/bloom/typography");
-var _core = require("@oxy.so/core");
-var _TroubleDisclosure = _interopRequireDefault(require("./TroubleDisclosure.js"));
-var _primitives = require("./primitives.js");
-var _styles = require("./styles.js");
-var _jsxRuntime = require("react/jsx-runtime");
-function _interopRequireDefault(e) { return e && e.__esModule ? e : { default: e }; }
-/**
- * The sign-in ENTRY (`signin` / `add` views) — ONE primary action.
- *
- * Web: "Continue" opens the identity origin (`id.oxy.so`) in a popup, where the
- * person signs in — or creates an account — with a passkey, and the account's
- * self-custody identity is created or unsealed (one identity, two carriers). No
- * philosophy up front: fingerprint, face or device PIN, and they are in. An
- * account that lives on another device is one subordinate link away (Commons
- * QR). Nothing auto-starts: a browser only opens a popup from a user gesture.
- *
- * Native: "Continue with Oxy" — the Commons flow (shared keychain, else the
- * request Oxy routes to the person's Commons identity).
- *
- * Existing accounts still render ABOVE the CTA: "continue as one of these" is a
- * choice of WHO, not of HOW.
- *
- * Signed in (the "Add another account" entry), a row is an account to switch
- * to, and the current one carries its check. Signed out, nothing here is
- * current: the device may still list an identity it holds (Commons' shared
- * one), but THIS app has no session, so each row reads "Continue as @handle"
- * and choosing it signs in (OxyHQ/oxy#1375 items 20 and 21).
- */
-
-const SignInEntryView = ({
-  snapshot,
-  principals,
-  theme,
-  t,
-  handlers,
-  onContinueWithOxy,
-  alternatives
-}) => {
-  const web = alternatives.passkeyAvailable;
-
-  // Web keeps Commons one link away; native keeps its QR/Commons alternatives
-  // behind the disclosure, as before.
-  const troubleActions = web ? [{
-    key: 'get-commons-link',
-    label: t('accountSwitcher.getCommons'),
-    onPress: alternatives.onGetCommons
-  }] : [{
-    key: 'scan-qr-link',
-    label: t('accountSwitcher.scanQr'),
-    onPress: alternatives.onShowQr
-  }, {
-    key: 'get-commons-link',
-    label: t('accountSwitcher.getCommons'),
-    onPress: alternatives.onGetCommons
-  }];
-
-  // Whose route this is only needs naming when the list holds more than one
-  // person, or somebody with more than one account — the same rule the account
-  // menu's group headers follow.
-  const namesTheOperator = (0, _core.showsPrincipalHeaders)(principals);
-  const rows = principals.flatMap(principal => principal.contexts.map(context => ({
-    context,
-    operatedBy: namesTheOperator && context.isDelegated ? t('accountSwitcher.context.operatedBy', {
-      name: principal.displayName
-    }) : null
-  })));
-  return /*#__PURE__*/(0, _jsxRuntime.jsxs)(_reactNative.View, {
-    style: _styles.authChooserStyles.signInBlock,
-    children: [rows.length > 0 ? /*#__PURE__*/(0, _jsxRuntime.jsxs)(_reactNative.View, {
-      style: _styles.authChooserStyles.rows,
-      children: [rows.map(({
-        context,
-        operatedBy
-      }) => /*#__PURE__*/(0, _jsxRuntime.jsx)(_primitives.AccountRow, {
-        context: context,
-        operatedBy: operatedBy,
-        continueAsLabel: snapshot.hasSession ? null : t('signin.chooser.continueAs', {
-          name: context.handle ? `@${context.handle}` : context.displayName
-        }),
-        theme: theme,
-        activating: snapshot.activatingContextId === context.contextId,
-        disabled: snapshot.activatingContextId !== null,
-        onPress: () => handlers.onActivate(context.contextId)
-      }, context.contextId)), /*#__PURE__*/(0, _jsxRuntime.jsx)(_primitives.Dividerish, {
-        theme: theme,
-        label: t('signin.or')
-      })]
-    }) : null, web ? /*#__PURE__*/(0, _jsxRuntime.jsx)(_typography.Text, {
-      style: [_styles.authChooserStyles.mutedText, {
-        color: theme.colors.textSecondary
-      }],
-      children: t('accountSwitcher.passkeyHint')
-    }) : null, /*#__PURE__*/(0, _jsxRuntime.jsx)(_button.Button, {
-      appearance: "solid",
-      tone: "accent"
-      // `lg` (44dp): the surface's ONE primary action is a full-width CTA, and
-      // the default `md` (36dp) is under the touch-target minimum on Android.
-      ,
-      size: "lg",
-      onPress: web ? alternatives.onSignInWithPasskey : onContinueWithOxy,
-      style: _styles.authChooserStyles.primaryButton,
-      testID: "continue-with-oxy",
-      children: web ? t('accountSwitcher.continueWithPasskey') : t('accountSwitcher.continueWithOxy')
-    }), /*#__PURE__*/(0, _jsxRuntime.jsx)(_primitives.SubtleLink, {
-      label: t('signin.createAccountLink'),
-      theme: theme,
-      onPress: alternatives.onCreateAccount,
-      testID: "create-account-link"
-    }), web ? /*#__PURE__*/(0, _jsxRuntime.jsx)(_primitives.SubtleLink, {
-      label: t('accountSwitcher.otherDeviceCommons'),
-      theme: theme,
-      onPress: alternatives.onShowQr,
-      testID: "scan-qr-link"
-    }) : null, /*#__PURE__*/(0, _jsxRuntime.jsx)(_TroubleDisclosure.default, {
-      actions: troubleActions,
-      revealed: false,
-      theme: theme,
-      t: t
-    })]
-  });
-};
-var _default = exports.default = SignInEntryView;
-//# sourceMappingURL=SignInEntryView.js.map

package/lib/commonjs/ui/components/authChooser/SignInEntryView.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["_reactNative","require","_button","_typography","_core","_TroubleDisclosure","_interopRequireDefault","_primitives","_styles","_jsxRuntime","e","__esModule","default","SignInEntryView","snapshot","principals","theme","t","handlers","onContinueWithOxy","alternatives","web","passkeyAvailable","troubleActions","key","label","onPress","onGetCommons","onShowQr","namesTheOperator","showsPrincipalHeaders","rows","flatMap","principal","contexts","map","context","operatedBy","isDelegated","name","displayName","jsxs","View","style","styles","signInBlock","children","length","jsx","AccountRow","continueAsLabel","hasSession","handle","activating","activatingContextId","contextId","disabled","onActivate","Dividerish","Text","mutedText","color","colors","textSecondary","Button","appearance","tone","size","onSignInWithPasskey","primaryButton","testID","SubtleLink","onCreateAccount","actions","revealed","_default","exports"],"sourceRoot":"../../../../../src","sources":["ui/components/authChooser/SignInEntryView.tsx"],"mappings":";;;;;;AAwBA,IAAAA,YAAA,GAAAC,OAAA;AACA,IAAAC,OAAA,GAAAD,OAAA;AACA,IAAAE,WAAA,GAAAF,OAAA;AACA,IAAAG,KAAA,GAAAH,OAAA;AAKA,IAAAI,kBAAA,GAAAC,sBAAA,CAAAL,OAAA;AACA,IAAAM,WAAA,GAAAN,OAAA;AACA,IAAAO,OAAA,GAAAP,OAAA;AAAuD,IAAAQ,WAAA,GAAAR,OAAA;AAAA,SAAAK,uBAAAI,CAAA,WAAAA,CAAA,IAAAA,CAAA,CAAAC,UAAA,GAAAD,CAAA,KAAAE,OAAA,EAAAF,CAAA;AAlCvD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAkCA,MAAMG,eAA+C,GAAGA,CAAC;EACvDC,QAAQ;EACRC,UAAU;EACVC,KAAK;EACLC,CAAC;EACDC,QAAQ;EACRC,iBAAiB;EACjBC;AACF,CAAC,KAAK;EACJ,MAAMC,GAAG,GAAGD,YAAY,CAACE,gBAAgB;;EAEzC;EACA;EACA,MAAMC,cAAwC,GAAGF,GAAG,GAChD,CAAC;IAAEG,GAAG,EAAE,kBAAkB;IAAEC,KAAK,EAAER,CAAC,CAAC,4BAA4B,CAAC;IAAES,OAAO,EAAEN,YAAY,CAACO;EAAa,CAAC,CAAC,GACzG,CACE;IAAEH,GAAG,EAAE,cAAc;IAAEC,KAAK,EAAER,CAAC,CAAC,wBAAwB,CAAC;IAAES,OAAO,EAAEN,YAAY,CAACQ;EAAS,CAAC,EAC3F;IAAEJ,GAAG,EAAE,kBAAkB;IAAEC,KAAK,EAAER,CAAC,CAAC,4BAA4B,CAAC;IAAES,OAAO,EAAEN,YAAY,CAACO;EAAa,CAAC,CACxG;;EAEL;EACA;EACA;EACA,MAAME,gBAAgB,GAAG,IAAAC,2BAAqB,EAACf,UAAU,CAAC;EAC1D,MAAMgB,IAAI,GAAGhB,UAAU,CAACiB,OAAO,CAAEC,SAAS,IACxCA,SAAS,CAACC,QAAQ,CAACC,GAAG,CAAEC,OAAO,KAAM;IACnCA,OAAO;IACPC,UAAU,EACRR,gBAAgB,IAAIO,OAAO,CAACE,WAAW,GACnCrB,CAAC,CAAC,oCAAoC,EAAE;MAAEsB,IAAI,EAAEN,SAAS,CAACO;IAAY,CAAC,CAAC,GACxE;EACR,CAAC,CAAC,CACJ,CAAC;EAED,oBACE,IAAA/B,WAAA,CAAAgC,IAAA,EAACzC,YAAA,CAAA0C,IAAI;IAACC,KAAK,EAAEC,yBAAM,CAACC,WAAY;IAAAC,QAAA,GAC7Bf,IAAI,CAACgB,MAAM,GAAG,CAAC,gBACd,IAAAtC,WAAA,CAAAgC,IAAA,EAACzC,YAAA,CAAA0C,IAAI;MAACC,KAAK,EAAEC,yBAAM,CAACb,IAAK;MAAAe,QAAA,GACtBf,IAAI,CAACI,GAAG,CAAC,CAAC;QAAEC,OAAO;QAAEC;MAAW,CAAC,kBAChC,IAAA5B,WAAA,CAAAuC,GAAA,EAACzC,WAAA,CAAA0C,UAAU;QAETb,OAAO,EAAEA,OAAQ;QACjBC,UAAU,EAAEA,UAAW;QACvBa,eAAe,EACbpC,QAAQ,CAACqC,UAAU,GACf,IAAI,GACJlC,CAAC,CAAC,2BAA2B,EAAE;UAC7BsB,IAAI,EAAEH,OAAO,CAACgB,MAAM,GAAG,IAAIhB,OAAO,CAACgB,MAAM,EAAE,GAAGhB,OAAO,CAACI;QACxD,CAAC,CACN;QACDxB,KAAK,EAAEA,KAAM;QACbqC,UAAU,EAAEvC,QAAQ,CAACwC,mBAAmB,KAAKlB,OAAO,CAACmB,SAAU;QAC/DC,QAAQ,EAAE1C,QAAQ,CAACwC,mBAAmB,KAAK,IAAK;QAChD5B,OAAO,EAAEA,CAAA,KAAMR,QAAQ,CAACuC,UAAU,CAACrB,OAAO,CAACmB,SAAS;MAAE,GAbjDnB,OAAO,CAACmB,SAcd,CACF,CAAC,eACF,IAAA9C,WAAA,CAAAuC,GAAA,EAACzC,WAAA,CAAAmD,UAAU;QAAC1C,KAAK,EAAEA,KAAM;QAACS,KAAK,EAAER,CAAC,CAAC,WAAW;MAAE,CAAE,CAAC;IAAA,CAC/C,CAAC,GACL,IAAI,EAEPI,GAAG,gBACF,IAAAZ,WAAA,CAAAuC,GAAA,EAAC7C,WAAA,CAAAwD,IAAI;MAAChB,KAAK,EAAE,CAACC,yBAAM,CAACgB,SAAS,EAAE;QAAEC,KAAK,EAAE7C,KAAK,CAAC8C,MAAM,CAACC;MAAc,CAAC,CAAE;MAAAjB,QAAA,EACpE7B,CAAC,CAAC,6BAA6B;IAAC,CAC7B,CAAC,GACL,IAAI,eAER,IAAAR,WAAA,CAAAuC,GAAA,EAAC9C,OAAA,CAAA8D,MAAM;MACLC,UAAU,EAAC,OAAO;MAACC,IAAI,EAAC;MACxB;MACA;MAAA;MACAC,IAAI,EAAC,IAAI;MACTzC,OAAO,EAAEL,GAAG,GAAGD,YAAY,CAACgD,mBAAmB,GAAGjD,iBAAkB;MACpEwB,KAAK,EAAEC,yBAAM,CAACyB,aAAc;MAC5BC,MAAM,EAAC,mBAAmB;MAAAxB,QAAA,EAEzBzB,GAAG,GAAGJ,CAAC,CAAC,qCAAqC,CAAC,GAAGA,CAAC,CAAC,iCAAiC;IAAC,CAChF,CAAC,eAIT,IAAAR,WAAA,CAAAuC,GAAA,EAACzC,WAAA,CAAAgE,UAAU;MACT9C,KAAK,EAAER,CAAC,CAAC,0BAA0B,CAAE;MACrCD,KAAK,EAAEA,KAAM;MACbU,OAAO,EAAEN,YAAY,CAACoD,eAAgB;MACtCF,MAAM,EAAC;IAAqB,CAC7B,CAAC,EAEDjD,GAAG,gBACF,IAAAZ,WAAA,CAAAuC,GAAA,EAACzC,WAAA,CAAAgE,UAAU;MACT9C,KAAK,EAAER,CAAC,CAAC,oCAAoC,CAAE;MAC/CD,KAAK,EAAEA,KAAM;MACbU,OAAO,EAAEN,YAAY,CAACQ,QAAS;MAC/B0C,MAAM,EAAC;IAAc,CACtB,CAAC,GACA,IAAI,eAER,IAAA7D,WAAA,CAAAuC,GAAA,EAAC3C,kBAAA,CAAAO,OAAiB;MAAC6D,OAAO,EAAElD,cAAe;MAACmD,QAAQ,EAAE,KAAM;MAAC1D,KAAK,EAAEA,KAAM;MAACC,CAAC,EAAEA;IAAE,CAAE,CAAC;EAAA,CAC/E,CAAC;AAEX,CAAC;AAAC,IAAA0D,QAAA,GAAAC,OAAA,CAAAhE,OAAA,GAEaC,eAAe","ignoreList":[]}

package/lib/commonjs/ui/components/authChooser/SignUpView.js

@@ -1,77 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.default = void 0;
-var _reactNative = require("react-native");
-var _button = require("@oxy.so/bloom/button");
-var _typography = require("@oxy.so/bloom/typography");
-var _primitives = require("./primitives.js");
-var _styles = require("./styles.js");
-var _jsxRuntime = require("react/jsx-runtime");
-/**
- * Account creation (`signup` view).
- *
- * Web: the account AND its self-custody identity are created at the identity
- * origin (`id.oxy.so`), in the same window a passkey sign-in uses — never on
- * this page, whatever its origin (one identity, two carriers). The sign-in
- * entry's "create an account" link opens that window directly; this view is
- * what `openAccountDialog('signup')` lands on, and offers the same one action.
- *
- * Native: Commons owns identity creation. Deep-link straight in when Commons is
- * installed, else lead with the "Get Commons" acquisition CTA.
- */
-
-const SignUpView = ({
-  snapshot,
-  theme,
-  t,
-  passkeyMode,
-  onOpenHub,
-  onCreateIdentityInCommons,
-  onGetCommons,
-  onBackToSignIn
-}) => {
-  if (passkeyMode === 'none') {
-    const commonsInstalled = snapshot.commonsAvailability === 'available';
-    return /*#__PURE__*/(0, _jsxRuntime.jsxs)(_reactNative.View, {
-      style: _styles.authChooserStyles.centeredBlock,
-      children: [/*#__PURE__*/(0, _jsxRuntime.jsx)(_button.Button, {
-        appearance: "solid",
-        tone: "accent",
-        size: "lg",
-        onPress: commonsInstalled ? onCreateIdentityInCommons : onGetCommons,
-        style: _styles.authChooserStyles.primaryButton,
-        children: commonsInstalled ? t('signup.createInCommons') : t('accountSwitcher.getCommons')
-      }), /*#__PURE__*/(0, _jsxRuntime.jsx)(_primitives.SubtleLink, {
-        label: t('signup.backToSignInLink'),
-        theme: theme,
-        onPress: onBackToSignIn
-      })]
-    });
-  }
-  return /*#__PURE__*/(0, _jsxRuntime.jsxs)(_reactNative.View, {
-    style: _styles.authChooserStyles.centeredBlock,
-    children: [/*#__PURE__*/(0, _jsxRuntime.jsx)(_typography.Text, {
-      style: [_styles.authChooserStyles.mutedText, {
-        color: theme.colors.textSecondary
-      }],
-      children: t('accountSwitcher.passkeyHint')
-    }), /*#__PURE__*/(0, _jsxRuntime.jsx)(_button.Button, {
-      appearance: "solid",
-      tone: "accent",
-      size: "lg",
-      onPress: onOpenHub,
-      style: _styles.authChooserStyles.primaryButton,
-      testID: "signup-open-identity",
-      children: t('signup.createAccount')
-    }), /*#__PURE__*/(0, _jsxRuntime.jsx)(_primitives.SubtleLink, {
-      label: t('signup.backToSignInLink'),
-      theme: theme,
-      onPress: onBackToSignIn
-    })]
-  });
-};
-var _default = exports.default = SignUpView;
-//# sourceMappingURL=SignUpView.js.map

package/lib/commonjs/ui/components/authChooser/SignUpView.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["_reactNative","require","_button","_typography","_primitives","_styles","_jsxRuntime","SignUpView","snapshot","theme","t","passkeyMode","onOpenHub","onCreateIdentityInCommons","onGetCommons","onBackToSignIn","commonsInstalled","commonsAvailability","jsxs","View","style","styles","centeredBlock","children","jsx","Button","appearance","tone","size","onPress","primaryButton","SubtleLink","label","Text","mutedText","color","colors","textSecondary","testID","_default","exports","default"],"sourceRoot":"../../../../../src","sources":["ui/components/authChooser/SignUpView.tsx"],"mappings":";;;;;;AAcA,IAAAA,YAAA,GAAAC,OAAA;AACA,IAAAC,OAAA,GAAAD,OAAA;AACA,IAAAE,WAAA,GAAAF,OAAA;AAEA,IAAAG,WAAA,GAAAH,OAAA;AACA,IAAAI,OAAA,GAAAJ,OAAA;AAAuD,IAAAK,WAAA,GAAAL,OAAA;AAnBvD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAyBA,MAAMM,UAAqC,GAAGA,CAAC;EAC7CC,QAAQ;EACRC,KAAK;EACLC,CAAC;EACDC,WAAW;EACXC,SAAS;EACTC,yBAAyB;EACzBC,YAAY;EACZC;AACF,CAAC,KAAK;EACJ,IAAIJ,WAAW,KAAK,MAAM,EAAE;IAC1B,MAAMK,gBAAgB,GAAGR,QAAQ,CAACS,mBAAmB,KAAK,WAAW;IACrE,oBACE,IAAAX,WAAA,CAAAY,IAAA,EAAClB,YAAA,CAAAmB,IAAI;MAACC,KAAK,EAAEC,yBAAM,CAACC,aAAc;MAAAC,QAAA,gBAChC,IAAAjB,WAAA,CAAAkB,GAAA,EAACtB,OAAA,CAAAuB,MAAM;QACLC,UAAU,EAAC,OAAO;QAACC,IAAI,EAAC,QAAQ;QAACC,IAAI,EAAC,IAAI;QAC1CC,OAAO,EAAEb,gBAAgB,GAAGH,yBAAyB,GAAGC,YAAa;QACrEM,KAAK,EAAEC,yBAAM,CAACS,aAAc;QAAAP,QAAA,EAE3BP,gBAAgB,GAAGN,CAAC,CAAC,wBAAwB,CAAC,GAAGA,CAAC,CAAC,4BAA4B;MAAC,CAC3E,CAAC,eACT,IAAAJ,WAAA,CAAAkB,GAAA,EAACpB,WAAA,CAAA2B,UAAU;QAACC,KAAK,EAAEtB,CAAC,CAAC,yBAAyB,CAAE;QAACD,KAAK,EAAEA,KAAM;QAACoB,OAAO,EAAEd;MAAe,CAAE,CAAC;IAAA,CACtF,CAAC;EAEX;EAEA,oBACE,IAAAT,WAAA,CAAAY,IAAA,EAAClB,YAAA,CAAAmB,IAAI;IAACC,KAAK,EAAEC,yBAAM,CAACC,aAAc;IAAAC,QAAA,gBAChC,IAAAjB,WAAA,CAAAkB,GAAA,EAACrB,WAAA,CAAA8B,IAAI;MAACb,KAAK,EAAE,CAACC,yBAAM,CAACa,SAAS,EAAE;QAAEC,KAAK,EAAE1B,KAAK,CAAC2B,MAAM,CAACC;MAAc,CAAC,CAAE;MAAAd,QAAA,EACpEb,CAAC,CAAC,6BAA6B;IAAC,CAC7B,CAAC,eACP,IAAAJ,WAAA,CAAAkB,GAAA,EAACtB,OAAA,CAAAuB,MAAM;MAACC,UAAU,EAAC,OAAO;MAACC,IAAI,EAAC,QAAQ;MAACC,IAAI,EAAC,IAAI;MAACC,OAAO,EAAEjB,SAAU;MAACQ,KAAK,EAAEC,yBAAM,CAACS,aAAc;MAACQ,MAAM,EAAC,sBAAsB;MAAAf,QAAA,EAC9Hb,CAAC,CAAC,sBAAsB;IAAC,CACpB,CAAC,eACT,IAAAJ,WAAA,CAAAkB,GAAA,EAACpB,WAAA,CAAA2B,UAAU;MAACC,KAAK,EAAEtB,CAAC,CAAC,yBAAyB,CAAE;MAACD,KAAK,EAAEA,KAAM;MAACoB,OAAO,EAAEd;IAAe,CAAE,CAAC;EAAA,CACtF,CAAC;AAEX,CAAC;AAAC,IAAAwB,QAAA,GAAAC,OAAA,CAAAC,OAAA,GAEalC,UAAU","ignoreList":[]}

package/lib/commonjs/ui/components/passkeyHubPopup.js

@@ -1,33 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.openPasskeyHubPopup = openPasskeyHubPopup;
-/**
- * Popup opener for the cross-origin passkey hub (b2).
- *
- * On a non-Oxy web origin (e.g. mention.earth) a WebAuthn ceremony can't run
- * locally — the credential's RP ID is bound to `oxy.so`. Instead,
- * `AccountDialogController.startPasskeyHubSignIn` opens a popup at the
- * auth.oxy.so passkey hub, where the SAME ceremony IS a first-party operation.
- *
- * Kept in its own module (mirroring `oauthNavigation.ts`'s
- * `redirectToAuthorize`) so `window.open` sits behind a plain function the
- * controller wiring in `OxyContext` can inject without touching `window`
- * itself, and so a test can substitute a fake opener.
- */
-
-/**
- * Open a new, EMPTY popup window. Must be called SYNCHRONOUSLY from within a
- * user-gesture handler (before any `await`) — opening it after an async call
- * loses the gesture attribution and the browser silently blocks it. Returns
- * `null` when blocked, or when there is no DOM `window` (native/SSR — the
- * hub-popup flow does not apply there).
- */
-function openPasskeyHubPopup() {
-  const win = globalThis.window;
-  if (!win) return null;
-  return win.open('', '_blank', 'width=420,height=640');
-}
-//# sourceMappingURL=passkeyHubPopup.js.map

package/lib/commonjs/ui/components/passkeyHubPopup.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["openPasskeyHubPopup","win","globalThis","window","open"],"sourceRoot":"../../../../src","sources":["ui/components/passkeyHubPopup.ts"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASA,mBAAmBA,CAAA,EAA6B;EAC5D,MAAMC,GAAG,GAAIC,UAAU,CAAyBC,MAAM;EACtD,IAAI,CAACF,GAAG,EAAE,OAAO,IAAI;EACrB,OAAOA,GAAG,CAACG,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,sBAAsB,CAAC;AACzD","ignoreList":[]}

package/lib/commonjs/ui/oauth/legacyRedirectLanes.js

@@ -1,48 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.allowsAutomaticIdpRedirect = allowsAutomaticIdpRedirect;
-/**
- * The legacy, redirect-mode-only lanes that navigate the RP's TOP-LEVEL window
- * to the IdP without a user gesture.
- *
- * `webAuthMode: 'popup'` exists to guarantee exactly one thing: the relying
- * party never leaves its route. Two mechanics in this SDK break that guarantee,
- * because each replaces the whole document on its own initiative:
- *
- * 1. **Cold-boot silent restore** — a full-page `prompt=none` authorize bounce
- *    to `auth.oxy.so` when the device-secret mint finds no local session
- *    (`maybeStartSilentOAuthRestore`, called from `runProviderColdBoot`).
- * 2. **Post-sign-in hub sync** — a full-page hop to `auth.oxy.so/sync` that
- *    plants this device's credential on the IdP hub so OTHER origins can later
- *    run lane 1 (`syncHubAfterSignIn`, called from the `commitSession` funnel).
- *
- * Both belong to the redirect transport and are kept only for the migration
- * window (issue #691, "Cold boot and cross-domain behavior"). In popup mode a
- * domain with no local credential simply resolves SIGNED OUT, and the user's
- * next explicit "Continue with Oxy" opens the popup — from a real user gesture,
- * never automatically.
- *
- * NOT covered here, and correctly enabled in BOTH modes: navigations the user
- * asked for. When the browser blocks the popup, `startWebOAuthSignIn` still
- * falls back to a full-page redirect rather than dead-ending the sign-in, and
- * `tryCompleteOAuthReturn` still consumes a `?code=` that is already on the URL.
- *
- * PHASE 7b: once the pilot flips the default transport to `'popup'`, this
- * predicate and BOTH lanes above are deleted outright. Grepping this symbol
- * finds every site that has to go.
- */
-
-/**
- * Whether a provider running `webAuthMode` may perform an SDK-initiated,
- * non-gesture, full-page navigation to the IdP.
- *
- * `true` only for `'redirect'` — still the default and the compatibility path,
- * whose behaviour must stay byte-for-byte unchanged.
- */
-function allowsAutomaticIdpRedirect(webAuthMode) {
-  return webAuthMode === 'redirect';
-}
-//# sourceMappingURL=legacyRedirectLanes.js.map

package/lib/commonjs/ui/oauth/legacyRedirectLanes.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["allowsAutomaticIdpRedirect","webAuthMode"],"sourceRoot":"../../../../src","sources":["ui/oauth/legacyRedirectLanes.ts"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASA,0BAA0BA,CAACC,WAAwB,EAAW;EAC5E,OAAOA,WAAW,KAAK,UAAU;AACnC","ignoreList":[]}

package/lib/module/ui/components/authChooser/SignInEntryView.js

@@ -1,127 +0,0 @@
-"use strict";
-
-/**
- * The sign-in ENTRY (`signin` / `add` views) — ONE primary action.
- *
- * Web: "Continue" opens the identity origin (`id.oxy.so`) in a popup, where the
- * person signs in — or creates an account — with a passkey, and the account's
- * self-custody identity is created or unsealed (one identity, two carriers). No
- * philosophy up front: fingerprint, face or device PIN, and they are in. An
- * account that lives on another device is one subordinate link away (Commons
- * QR). Nothing auto-starts: a browser only opens a popup from a user gesture.
- *
- * Native: "Continue with Oxy" — the Commons flow (shared keychain, else the
- * request Oxy routes to the person's Commons identity).
- *
- * Existing accounts still render ABOVE the CTA: "continue as one of these" is a
- * choice of WHO, not of HOW.
- *
- * Signed in (the "Add another account" entry), a row is an account to switch
- * to, and the current one carries its check. Signed out, nothing here is
- * current: the device may still list an identity it holds (Commons' shared
- * one), but THIS app has no session, so each row reads "Continue as @handle"
- * and choosing it signs in (OxyHQ/oxy#1375 items 20 and 21).
- */
-
-import { View } from 'react-native';
-import { Button } from '@oxy.so/bloom/button';
-import { Text } from '@oxy.so/bloom/typography';
-import { showsPrincipalHeaders } from '@oxy.so/core';
-import TroubleDisclosure from "./TroubleDisclosure.js";
-import { AccountRow, Dividerish, SubtleLink } from "./primitives.js";
-import { authChooserStyles as styles } from "./styles.js";
-import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-const SignInEntryView = ({
-  snapshot,
-  principals,
-  theme,
-  t,
-  handlers,
-  onContinueWithOxy,
-  alternatives
-}) => {
-  const web = alternatives.passkeyAvailable;
-
-  // Web keeps Commons one link away; native keeps its QR/Commons alternatives
-  // behind the disclosure, as before.
-  const troubleActions = web ? [{
-    key: 'get-commons-link',
-    label: t('accountSwitcher.getCommons'),
-    onPress: alternatives.onGetCommons
-  }] : [{
-    key: 'scan-qr-link',
-    label: t('accountSwitcher.scanQr'),
-    onPress: alternatives.onShowQr
-  }, {
-    key: 'get-commons-link',
-    label: t('accountSwitcher.getCommons'),
-    onPress: alternatives.onGetCommons
-  }];
-
-  // Whose route this is only needs naming when the list holds more than one
-  // person, or somebody with more than one account — the same rule the account
-  // menu's group headers follow.
-  const namesTheOperator = showsPrincipalHeaders(principals);
-  const rows = principals.flatMap(principal => principal.contexts.map(context => ({
-    context,
-    operatedBy: namesTheOperator && context.isDelegated ? t('accountSwitcher.context.operatedBy', {
-      name: principal.displayName
-    }) : null
-  })));
-  return /*#__PURE__*/_jsxs(View, {
-    style: styles.signInBlock,
-    children: [rows.length > 0 ? /*#__PURE__*/_jsxs(View, {
-      style: styles.rows,
-      children: [rows.map(({
-        context,
-        operatedBy
-      }) => /*#__PURE__*/_jsx(AccountRow, {
-        context: context,
-        operatedBy: operatedBy,
-        continueAsLabel: snapshot.hasSession ? null : t('signin.chooser.continueAs', {
-          name: context.handle ? `@${context.handle}` : context.displayName
-        }),
-        theme: theme,
-        activating: snapshot.activatingContextId === context.contextId,
-        disabled: snapshot.activatingContextId !== null,
-        onPress: () => handlers.onActivate(context.contextId)
-      }, context.contextId)), /*#__PURE__*/_jsx(Dividerish, {
-        theme: theme,
-        label: t('signin.or')
-      })]
-    }) : null, web ? /*#__PURE__*/_jsx(Text, {
-      style: [styles.mutedText, {
-        color: theme.colors.textSecondary
-      }],
-      children: t('accountSwitcher.passkeyHint')
-    }) : null, /*#__PURE__*/_jsx(Button, {
-      appearance: "solid",
-      tone: "accent"
-      // `lg` (44dp): the surface's ONE primary action is a full-width CTA, and
-      // the default `md` (36dp) is under the touch-target minimum on Android.
-      ,
-      size: "lg",
-      onPress: web ? alternatives.onSignInWithPasskey : onContinueWithOxy,
-      style: styles.primaryButton,
-      testID: "continue-with-oxy",
-      children: web ? t('accountSwitcher.continueWithPasskey') : t('accountSwitcher.continueWithOxy')
-    }), /*#__PURE__*/_jsx(SubtleLink, {
-      label: t('signin.createAccountLink'),
-      theme: theme,
-      onPress: alternatives.onCreateAccount,
-      testID: "create-account-link"
-    }), web ? /*#__PURE__*/_jsx(SubtleLink, {
-      label: t('accountSwitcher.otherDeviceCommons'),
-      theme: theme,
-      onPress: alternatives.onShowQr,
-      testID: "scan-qr-link"
-    }) : null, /*#__PURE__*/_jsx(TroubleDisclosure, {
-      actions: troubleActions,
-      revealed: false,
-      theme: theme,
-      t: t
-    })]
-  });
-};
-export default SignInEntryView;
-//# sourceMappingURL=SignInEntryView.js.map

package/lib/module/ui/components/authChooser/SignInEntryView.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["View","Button","Text","showsPrincipalHeaders","TroubleDisclosure","AccountRow","Dividerish","SubtleLink","authChooserStyles","styles","jsx","_jsx","jsxs","_jsxs","SignInEntryView","snapshot","principals","theme","t","handlers","onContinueWithOxy","alternatives","web","passkeyAvailable","troubleActions","key","label","onPress","onGetCommons","onShowQr","namesTheOperator","rows","flatMap","principal","contexts","map","context","operatedBy","isDelegated","name","displayName","style","signInBlock","children","length","continueAsLabel","hasSession","handle","activating","activatingContextId","contextId","disabled","onActivate","mutedText","color","colors","textSecondary","appearance","tone","size","onSignInWithPasskey","primaryButton","testID","onCreateAccount","actions","revealed"],"sourceRoot":"../../../../../src","sources":["ui/components/authChooser/SignInEntryView.tsx"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAGA,SAASA,IAAI,QAAQ,cAAc;AACnC,SAASC,MAAM,QAAQ,sBAAsB;AAC7C,SAASC,IAAI,QAAQ,0BAA0B;AAC/C,SACEC,qBAAqB,QAGhB,cAAc;AACrB,OAAOC,iBAAiB,MAAM,wBAAqB;AACnD,SAASC,UAAU,EAAEC,UAAU,EAAEC,UAAU,QAAQ,iBAAc;AACjE,SAASC,iBAAiB,IAAIC,MAAM,QAAQ,aAAU;AAAC,SAAAC,GAAA,IAAAC,IAAA,EAAAC,IAAA,IAAAC,KAAA;AAqBvD,MAAMC,eAA+C,GAAGA,CAAC;EACvDC,QAAQ;EACRC,UAAU;EACVC,KAAK;EACLC,CAAC;EACDC,QAAQ;EACRC,iBAAiB;EACjBC;AACF,CAAC,KAAK;EACJ,MAAMC,GAAG,GAAGD,YAAY,CAACE,gBAAgB;;EAEzC;EACA;EACA,MAAMC,cAAwC,GAAGF,GAAG,GAChD,CAAC;IAAEG,GAAG,EAAE,kBAAkB;IAAEC,KAAK,EAAER,CAAC,CAAC,4BAA4B,CAAC;IAAES,OAAO,EAAEN,YAAY,CAACO;EAAa,CAAC,CAAC,GACzG,CACE;IAAEH,GAAG,EAAE,cAAc;IAAEC,KAAK,EAAER,CAAC,CAAC,wBAAwB,CAAC;IAAES,OAAO,EAAEN,YAAY,CAACQ;EAAS,CAAC,EAC3F;IAAEJ,GAAG,EAAE,kBAAkB;IAAEC,KAAK,EAAER,CAAC,CAAC,4BAA4B,CAAC;IAAES,OAAO,EAAEN,YAAY,CAACO;EAAa,CAAC,CACxG;;EAEL;EACA;EACA;EACA,MAAME,gBAAgB,GAAG3B,qBAAqB,CAACa,UAAU,CAAC;EAC1D,MAAMe,IAAI,GAAGf,UAAU,CAACgB,OAAO,CAAEC,SAAS,IACxCA,SAAS,CAACC,QAAQ,CAACC,GAAG,CAAEC,OAAO,KAAM;IACnCA,OAAO;IACPC,UAAU,EACRP,gBAAgB,IAAIM,OAAO,CAACE,WAAW,GACnCpB,CAAC,CAAC,oCAAoC,EAAE;MAAEqB,IAAI,EAAEN,SAAS,CAACO;IAAY,CAAC,CAAC,GACxE;EACR,CAAC,CAAC,CACJ,CAAC;EAED,oBACE3B,KAAA,CAACb,IAAI;IAACyC,KAAK,EAAEhC,MAAM,CAACiC,WAAY;IAAAC,QAAA,GAC7BZ,IAAI,CAACa,MAAM,GAAG,CAAC,gBACd/B,KAAA,CAACb,IAAI;MAACyC,KAAK,EAAEhC,MAAM,CAACsB,IAAK;MAAAY,QAAA,GACtBZ,IAAI,CAACI,GAAG,CAAC,CAAC;QAAEC,OAAO;QAAEC;MAAW,CAAC,kBAChC1B,IAAA,CAACN,UAAU;QAET+B,OAAO,EAAEA,OAAQ;QACjBC,UAAU,EAAEA,UAAW;QACvBQ,eAAe,EACb9B,QAAQ,CAAC+B,UAAU,GACf,IAAI,GACJ5B,CAAC,CAAC,2BAA2B,EAAE;UAC7BqB,IAAI,EAAEH,OAAO,CAACW,MAAM,GAAG,IAAIX,OAAO,CAACW,MAAM,EAAE,GAAGX,OAAO,CAACI;QACxD,CAAC,CACN;QACDvB,KAAK,EAAEA,KAAM;QACb+B,UAAU,EAAEjC,QAAQ,CAACkC,mBAAmB,KAAKb,OAAO,CAACc,SAAU;QAC/DC,QAAQ,EAAEpC,QAAQ,CAACkC,mBAAmB,KAAK,IAAK;QAChDtB,OAAO,EAAEA,CAAA,KAAMR,QAAQ,CAACiC,UAAU,CAAChB,OAAO,CAACc,SAAS;MAAE,GAbjDd,OAAO,CAACc,SAcd,CACF,CAAC,eACFvC,IAAA,CAACL,UAAU;QAACW,KAAK,EAAEA,KAAM;QAACS,KAAK,EAAER,CAAC,CAAC,WAAW;MAAE,CAAE,CAAC;IAAA,CAC/C,CAAC,GACL,IAAI,EAEPI,GAAG,gBACFX,IAAA,CAACT,IAAI;MAACuC,KAAK,EAAE,CAAChC,MAAM,CAAC4C,SAAS,EAAE;QAAEC,KAAK,EAAErC,KAAK,CAACsC,MAAM,CAACC;MAAc,CAAC,CAAE;MAAAb,QAAA,EACpEzB,CAAC,CAAC,6BAA6B;IAAC,CAC7B,CAAC,GACL,IAAI,eAERP,IAAA,CAACV,MAAM;MACLwD,UAAU,EAAC,OAAO;MAACC,IAAI,EAAC;MACxB;MACA;MAAA;MACAC,IAAI,EAAC,IAAI;MACThC,OAAO,EAAEL,GAAG,GAAGD,YAAY,CAACuC,mBAAmB,GAAGxC,iBAAkB;MACpEqB,KAAK,EAAEhC,MAAM,CAACoD,aAAc;MAC5BC,MAAM,EAAC,mBAAmB;MAAAnB,QAAA,EAEzBrB,GAAG,GAAGJ,CAAC,CAAC,qCAAqC,CAAC,GAAGA,CAAC,CAAC,iCAAiC;IAAC,CAChF,CAAC,eAITP,IAAA,CAACJ,UAAU;MACTmB,KAAK,EAAER,CAAC,CAAC,0BAA0B,CAAE;MACrCD,KAAK,EAAEA,KAAM;MACbU,OAAO,EAAEN,YAAY,CAAC0C,eAAgB;MACtCD,MAAM,EAAC;IAAqB,CAC7B,CAAC,EAEDxC,GAAG,gBACFX,IAAA,CAACJ,UAAU;MACTmB,KAAK,EAAER,CAAC,CAAC,oCAAoC,CAAE;MAC/CD,KAAK,EAAEA,KAAM;MACbU,OAAO,EAAEN,YAAY,CAACQ,QAAS;MAC/BiC,MAAM,EAAC;IAAc,CACtB,CAAC,GACA,IAAI,eAERnD,IAAA,CAACP,iBAAiB;MAAC4D,OAAO,EAAExC,cAAe;MAACyC,QAAQ,EAAE,KAAM;MAAChD,KAAK,EAAEA,KAAM;MAACC,CAAC,EAAEA;IAAE,CAAE,CAAC;EAAA,CAC/E,CAAC;AAEX,CAAC;AAED,eAAeJ,eAAe","ignoreList":[]}