@oxyhq/services 14.1.0 → 16.0.0

package/lib/commonjs/ui/hooks/useWebSSO.js

@@ -1,28 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.isWebBrowser = isWebBrowser;
-/**
- * Platform detection helper for the web auth/session-sync surfaces.
- *
- * This module previously hosted a FedCM-based `useWebSSO` hook (Federated
- * Credential Management — Chrome-only). It was removed: FedCM is no longer
- * used anywhere in the client sign-in/cold-boot path (see `CrossDomainAuth`'s
- * doc comment in `@oxyhq/core` for the production sign-in loop that motivated
- * the removal). Cross-domain silent SSO is owned entirely by the
- * `silent-iframe` cold-boot step (per-apex `/auth/silent`) plus the terminal
- * `/sso` bounce in `OxyContext`.
- *
- * `isWebBrowser` is kept here (rather than moved) so every existing consumer
- * import path stays valid.
- */
-
-/**
- * Check if we're running in a web browser environment (not React Native)
- */
-function isWebBrowser() {
-  return typeof window !== 'undefined' && typeof document !== 'undefined' && typeof document.documentElement !== 'undefined';
-}
-//# sourceMappingURL=useWebSSO.js.map

package/lib/commonjs/ui/hooks/useWebSSO.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["isWebBrowser","window","document","documentElement"],"sourceRoot":"../../../../src","sources":["ui/hooks/useWebSSO.ts"],"mappings":";;;;;;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACO,SAASA,YAAYA,CAAA,EAAY;EACtC,OAAO,OAAOC,MAAM,KAAK,WAAW,IAC7B,OAAOC,QAAQ,KAAK,WAAW,IAC/B,OAAOA,QAAQ,CAACC,eAAe,KAAK,WAAW;AACxD","ignoreList":[]}

package/lib/commonjs/ui/session/projectSessionState.js

@@ -1,86 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.accountIdsOf = accountIdsOf;
-exports.activeSessionIdOf = activeSessionIdOf;
-exports.activeUserOf = activeUserOf;
-exports.deviceStateToClientSessions = deviceStateToClientSessions;
-/**
- * Pure projection helpers: `DeviceSessionState` (the device-scoped
- * multi-account session-sync state produced by `@oxyhq/core`'s
- * `SessionClient`) -> the shapes `OxyContext` renders today
- * (`ClientSession[]`, an active session id, an active `User`).
- *
- * No I/O. The caller fetches profiles via
- * `oxyServices.getUsersByIds(accountIdsOf(state))` and builds `usersById`
- * from the result before calling `deviceStateToClientSessions` /
- * `activeUserOf`.
- */
-
-/**
- * Maps every `SessionAccount` in `state.accounts` to a `ClientSession`.
- *
- * `DeviceSessionState` carries no per-account `expiresAt` / `lastActive` —
- * both are set to `state.updatedAt` (converted to an ISO-8601 string; the
- * wire value is an epoch-ms number) as a provisional value. Fase 3-B
- * rewrites `ClientSession` to make `expiresAt`/`lastActive` optional (they
- * are not derivable from `DeviceSessionState`).
- *
- * `usersById` is accepted for signature symmetry with `activeUserOf` even
- * though `ClientSession` only stores `userId` — a session is still
- * projected for an account whose id is absent from `usersById` (no
- * placeholder user is fabricated).
- */
-function deviceStateToClientSessions(state, usersById) {
-  const provisionalTimestamp = new Date(state.updatedAt).toISOString();
-  return state.accounts.map(account => ({
-    sessionId: account.sessionId,
-    deviceId: state.deviceId,
-    // provisional: Fase 3-B rewrites ClientSession to make expiresAt/lastActive
-    // optional (they are not in DeviceSessionState)
-    expiresAt: provisionalTimestamp,
-    lastActive: provisionalTimestamp,
-    userId: account.accountId,
-    isCurrent: account.accountId === state.activeAccountId,
-    authuser: account.authuser
-  }));
-}
-
-/**
- * The active account's `sessionId`, or `null` when there is no state or no
- * active account is set.
- */
-function activeSessionIdOf(state) {
-  if (state === null || state.activeAccountId === null) {
-    return null;
-  }
-  const activeAccountId = state.activeAccountId;
-  const activeAccount = state.accounts.find(account => account.accountId === activeAccountId);
-  return activeAccount?.sessionId ?? null;
-}
-
-/**
- * The active account's `User`, resolved from `usersById`. `null` when there
- * is no state, no active account is set, or the active account id is absent
- * from `usersById`.
- */
-function activeUserOf(state, usersById) {
-  if (state === null || state.activeAccountId === null) {
-    return null;
-  }
-  return usersById.get(state.activeAccountId) ?? null;
-}
-
-/**
- * All account ids in `state`, suitable for an `oxyServices.getUsersByIds(...)`
- * fetch. `[]` for `null` state.
- */
-function accountIdsOf(state) {
-  if (state === null) {
-    return [];
-  }
-  return state.accounts.map(account => account.accountId);
-}
-//# sourceMappingURL=projectSessionState.js.map

package/lib/commonjs/ui/session/projectSessionState.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["deviceStateToClientSessions","state","usersById","provisionalTimestamp","Date","updatedAt","toISOString","accounts","map","account","sessionId","deviceId","expiresAt","lastActive","userId","accountId","isCurrent","activeAccountId","authuser","activeSessionIdOf","activeAccount","find","activeUserOf","get","accountIdsOf"],"sourceRoot":"../../../../src","sources":["ui/session/projectSessionState.ts"],"mappings":";;;;;;;;;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASA,2BAA2BA,CACzCC,KAAyB,EACzBC,SAA4B,EACX;EACjB,MAAMC,oBAAoB,GAAG,IAAIC,IAAI,CAACH,KAAK,CAACI,SAAS,CAAC,CAACC,WAAW,CAAC,CAAC;EACpE,OAAOL,KAAK,CAACM,QAAQ,CAACC,GAAG,CAAEC,OAAO,KAAM;IACtCC,SAAS,EAAED,OAAO,CAACC,SAAS;IAC5BC,QAAQ,EAAEV,KAAK,CAACU,QAAQ;IACxB;IACA;IACAC,SAAS,EAAET,oBAAoB;IAC/BU,UAAU,EAAEV,oBAAoB;IAChCW,MAAM,EAAEL,OAAO,CAACM,SAAS;IACzBC,SAAS,EAAEP,OAAO,CAACM,SAAS,KAAKd,KAAK,CAACgB,eAAe;IACtDC,QAAQ,EAAET,OAAO,CAACS;EACpB,CAAC,CAAC,CAAC;AACL;;AAEA;AACA;AACA;AACA;AACO,SAASC,iBAAiBA,CAAClB,KAAgC,EAAiB;EACjF,IAAIA,KAAK,KAAK,IAAI,IAAIA,KAAK,CAACgB,eAAe,KAAK,IAAI,EAAE;IACpD,OAAO,IAAI;EACb;EACA,MAAMA,eAAe,GAAGhB,KAAK,CAACgB,eAAe;EAC7C,MAAMG,aAAa,GAAGnB,KAAK,CAACM,QAAQ,CAACc,IAAI,CAAEZ,OAAO,IAAKA,OAAO,CAACM,SAAS,KAAKE,eAAe,CAAC;EAC7F,OAAOG,aAAa,EAAEV,SAAS,IAAI,IAAI;AACzC;;AAEA;AACA;AACA;AACA;AACA;AACO,SAASY,YAAYA,CAC1BrB,KAAgC,EAChCC,SAA4B,EACf;EACb,IAAID,KAAK,KAAK,IAAI,IAAIA,KAAK,CAACgB,eAAe,KAAK,IAAI,EAAE;IACpD,OAAO,IAAI;EACb;EACA,OAAOf,SAAS,CAACqB,GAAG,CAACtB,KAAK,CAACgB,eAAe,CAAC,IAAI,IAAI;AACrD;;AAEA;AACA;AACA;AACA;AACO,SAASO,YAAYA,CAACvB,KAAgC,EAAY;EACvE,IAAIA,KAAK,KAAK,IAAI,EAAE;IAClB,OAAO,EAAE;EACX;EACA,OAAOA,KAAK,CAACM,QAAQ,CAACC,GAAG,CAAEC,OAAO,IAAKA,OAAO,CAACM,SAAS,CAAC;AAC3D","ignoreList":[]}

package/lib/commonjs/ui/session/sessionClientHost.js

@@ -1,30 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.createSessionClientHost = createSessionClientHost;
-/**
- * Thin `SessionClientHost` adapter over an `OxyServices` instance.
- *
- * `SessionClient` (in `@oxyhq/core`) is host-agnostic: it only needs a REST +
- * token surface. `OxyServices` already exposes all of that except
- * `getCurrentAccountId`, which has no direct equivalent — the adapter holds a
- * mutable ref set by the caller (`OxyContext`, in Fase 3-B) via
- * `setCurrentAccountId`.
- */
-function createSessionClientHost(oxyServices) {
-  let currentAccountId = null;
-  return {
-    makeRequest: (method, url, data, options) => oxyServices.makeRequest(method, url, data, options),
-    getBaseURL: () => oxyServices.getBaseURL(),
-    getAccessToken: () => oxyServices.getAccessToken(),
-    onTokensChanged: listener => oxyServices.onTokensChanged(listener),
-    setTokens: accessToken => oxyServices.setTokens(accessToken),
-    getCurrentAccountId: () => currentAccountId,
-    setCurrentAccountId: id => {
-      currentAccountId = id;
-    }
-  };
-}
-//# sourceMappingURL=sessionClientHost.js.map

package/lib/commonjs/ui/session/sessionClientHost.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["createSessionClientHost","oxyServices","currentAccountId","makeRequest","method","url","data","options","getBaseURL","getAccessToken","onTokensChanged","listener","setTokens","accessToken","getCurrentAccountId","setCurrentAccountId","id"],"sourceRoot":"../../../../src","sources":["ui/session/sessionClientHost.ts"],"mappings":";;;;;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASA,uBAAuBA,CACrCC,WAAwB,EAC8C;EACtE,IAAIC,gBAA+B,GAAG,IAAI;EAC1C,OAAO;IACLC,WAAW,EAAEA,CAACC,MAAM,EAAEC,GAAG,EAAEC,IAAI,EAAEC,OAAO,KAAKN,WAAW,CAACE,WAAW,CAACC,MAAM,EAAEC,GAAG,EAAEC,IAAI,EAAEC,OAAO,CAAC;IAChGC,UAAU,EAAEA,CAAA,KAAMP,WAAW,CAACO,UAAU,CAAC,CAAC;IAC1CC,cAAc,EAAEA,CAAA,KAAMR,WAAW,CAACQ,cAAc,CAAC,CAAC;IAClDC,eAAe,EAAGC,QAAQ,IAAKV,WAAW,CAACS,eAAe,CAACC,QAAQ,CAAC;IACpEC,SAAS,EAAGC,WAAW,IAAKZ,WAAW,CAACW,SAAS,CAACC,WAAW,CAAC;IAC9DC,mBAAmB,EAAEA,CAAA,KAAMZ,gBAAgB;IAC3Ca,mBAAmB,EAAGC,EAAE,IAAK;MAC3Bd,gBAAgB,GAAGc,EAAE;IACvB;EACF,CAAC;AACH","ignoreList":[]}

package/lib/commonjs/ui/utils/activeAuthuser.js

@@ -1,142 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.clearSignedOut = clearSignedOut;
-exports.clearSsoBounceState = clearSsoBounceState;
-exports.isSilentRestoreSuppressed = isSilentRestoreSuppressed;
-exports.markSignedOut = markSignedOut;
-exports.readActiveAuthuser = readActiveAuthuser;
-var _core = require("@oxyhq/core");
-/**
- * Web-only helpers around the retired `oxy_rt_${authuser}` multi-slot
- * refresh-cookie scheme, PLUS the (unrelated, still load-bearing) deliberate
- * sign-out / SSO-bounce gates.
- *
- * NOTE (session-sync cutover, Task 5): the device account SET is now
- * server-authoritative via `SessionClient` (`@oxyhq/core`) — nothing in
- * `@oxyhq/services` writes the persisted active-`authuser`-slot key anymore
- * (`writeActiveAuthuser`/`clearActiveAuthuser` were deleted; their only
- * callers were the deleted `establishDeviceRefreshSlot` sign-in registration
- * and the deleted `switchToAccount`/`switchSession` slot bookkeeping).
- * {@link readActiveAuthuser} is KEPT purely as an OPTIONAL restore hint:
- * `OxyContext`'s `restoreStoredSession` cold-boot step reads it only to
- * backfill `clientSession.authuser` for the active session when a legacy value
- * happens to be present. It NO LONGER gates whether restore is attempted — the
- * old guard that also required this marker made every web reload with a lapsed
- * local bearer bail before any network validation (P0), and was replaced by a
- * "bail only when there is nothing to restore" guard plus a valid-session
- * election. Since nothing writes the key anymore, the backfill is dormant on
- * fresh installs; it stays for legacy installs and costs nothing.
- *
- * Native (React Native) has no equivalent of these device-local cookies
- * and uses bearer-protected session ids directly, so these helpers no-op
- * outside the browser.
- */
-
-const ACTIVE_AUTHUSER_KEY = 'oxy_active_authuser';
-function hasLocalStorage() {
-  return typeof window !== 'undefined' && typeof window.localStorage !== 'undefined';
-}
-function getSessionStorage() {
-  if (typeof window === 'undefined') return null;
-  try {
-    return window.sessionStorage ?? null;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Read the persisted active `authuser` slot index.
- *
- * Returns `null` on native, on a corrupted value, or when nothing has been
- * persisted yet (first visit). Callers treat `null` as "no preference" and
- * fall back to deterministic selection (lowest authuser).
- */
-function readActiveAuthuser() {
-  if (!hasLocalStorage()) {
-    return null;
-  }
-  try {
-    const raw = window.localStorage.getItem(ACTIVE_AUTHUSER_KEY);
-    if (raw === null) return null;
-    const parsed = Number.parseInt(raw, 10);
-    if (!Number.isFinite(parsed) || parsed < 0) return null;
-    return parsed;
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Mark this origin as DELIBERATELY signed out (durable `localStorage`, via the
- * core {@link ssoSignedOutKey}). Called ONLY on EXPLICIT full sign-out so that
- * the next cold boot does NOT silently re-mint a session from a still-live IdP
- * session (the per-apex `/auth/silent` iframe cold-boot step). Cleared by any
- * deliberate sign-in (see {@link clearSignedOut}). No-ops on native / storage
- * failure (best-effort).
- */
-function markSignedOut() {
-  if (!hasLocalStorage()) return;
-  try {
-    window.localStorage.setItem((0, _core.ssoSignedOutKey)(window.location.origin), '1');
-  } catch {
-    // Best-effort; swallow QuotaExceededError / SecurityError (private mode).
-  }
-}
-
-/**
- * Clear the durable deliberately-signed-out flag. Called on ANY deliberate
- * sign-in (password, account switch, device claim) so a real sign-in
- * fully re-enables automatic silent restore — there is no "stuck signed out"
- * state. No-ops on native / storage failure.
- */
-function clearSignedOut() {
-  if (!hasLocalStorage()) return;
-  try {
-    window.localStorage.removeItem((0, _core.ssoSignedOutKey)(window.location.origin));
-  } catch {
-    // Best-effort.
-  }
-}
-
-/**
- * Whether AUTOMATIC silent restore is suppressed for the current origin because
- * the user deliberately signed out. Reads the durable flag through the core
- * {@link silentRestoreSuppressed} predicate. Returns `false` off-web and on any
- * storage failure (fail safe toward normal restore). Used to gate the
- * `silent-iframe` cold-boot step.
- */
-function isSilentRestoreSuppressed() {
-  // Unlike its try/catch-wrapped siblings this reads `window.location.origin`
-  // directly, so guard it: an RN polyfill can expose `localStorage` without a
-  // `location`, which would throw here. Fail safe toward normal restore.
-  if (!hasLocalStorage() || typeof window.location === 'undefined') return false;
-  return (0, _core.silentRestoreSuppressed)(window.localStorage, window.location.origin);
-}
-
-/**
- * Clear all per-origin SSO bounce sessionStorage keys. Called ONLY on EXPLICIT
- * user sign-out (logout / logoutAll) — never on a cold-boot failure path — so a
- * fresh deliberate sign-in can re-probe the central IdP. Clearing on cold-boot
- * failure would reintroduce the redirect loop.
- *
- * No-ops on native and on any storage failure (best-effort).
- */
-function clearSsoBounceState() {
-  const storage = getSessionStorage();
-  if (!storage) return;
-  try {
-    const origin = window.location.origin;
-    storage.removeItem((0, _core.ssoAttemptedKey)(origin));
-    storage.removeItem((0, _core.ssoNoSessionKey)(origin));
-    storage.removeItem((0, _core.ssoGuardKey)(origin));
-    storage.removeItem((0, _core.ssoStateKey)(origin));
-    storage.removeItem((0, _core.ssoDestKey)(origin));
-  } catch {
-    // Best-effort; swallow SecurityError (e.g. Safari private mode).
-  }
-}
-//# sourceMappingURL=activeAuthuser.js.map

package/lib/commonjs/ui/utils/activeAuthuser.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["_core","require","ACTIVE_AUTHUSER_KEY","hasLocalStorage","window","localStorage","getSessionStorage","sessionStorage","readActiveAuthuser","raw","getItem","parsed","Number","parseInt","isFinite","markSignedOut","setItem","ssoSignedOutKey","location","origin","clearSignedOut","removeItem","isSilentRestoreSuppressed","silentRestoreSuppressed","clearSsoBounceState","storage","ssoAttemptedKey","ssoNoSessionKey","ssoGuardKey","ssoStateKey","ssoDestKey"],"sourceRoot":"../../../../src","sources":["ui/utils/activeAuthuser.ts"],"mappings":";;;;;;;;;;AA0BA,IAAAA,KAAA,GAAAC,OAAA;AA1BA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAYA,MAAMC,mBAAmB,GAAG,qBAAqB;AAEjD,SAASC,eAAeA,CAAA,EAAY;EAClC,OAAO,OAAOC,MAAM,KAAK,WAAW,IAAI,OAAOA,MAAM,CAACC,YAAY,KAAK,WAAW;AACpF;AAEA,SAASC,iBAAiBA,CAAA,EAAmB;EAC3C,IAAI,OAAOF,MAAM,KAAK,WAAW,EAAE,OAAO,IAAI;EAC9C,IAAI;IACF,OAAOA,MAAM,CAACG,cAAc,IAAI,IAAI;EACtC,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,kBAAkBA,CAAA,EAAkB;EAClD,IAAI,CAACL,eAAe,CAAC,CAAC,EAAE;IACtB,OAAO,IAAI;EACb;EACA,IAAI;IACF,MAAMM,GAAG,GAAGL,MAAM,CAACC,YAAY,CAACK,OAAO,CAACR,mBAAmB,CAAC;IAC5D,IAAIO,GAAG,KAAK,IAAI,EAAE,OAAO,IAAI;IAC7B,MAAME,MAAM,GAAGC,MAAM,CAACC,QAAQ,CAACJ,GAAG,EAAE,EAAE,CAAC;IACvC,IAAI,CAACG,MAAM,CAACE,QAAQ,CAACH,MAAM,CAAC,IAAIA,MAAM,GAAG,CAAC,EAAE,OAAO,IAAI;IACvD,OAAOA,MAAM;EACf,CAAC,CAAC,MAAM;IACN,OAAO,IAAI;EACb;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASI,aAAaA,CAAA,EAAS;EACpC,IAAI,CAACZ,eAAe,CAAC,CAAC,EAAE;EACxB,IAAI;IACFC,MAAM,CAACC,YAAY,CAACW,OAAO,CAAC,IAAAC,qBAAe,EAACb,MAAM,CAACc,QAAQ,CAACC,MAAM,CAAC,EAAE,GAAG,CAAC;EAC3E,CAAC,CAAC,MAAM;IACN;EAAA;AAEJ;;AAEA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,cAAcA,CAAA,EAAS;EACrC,IAAI,CAACjB,eAAe,CAAC,CAAC,EAAE;EACxB,IAAI;IACFC,MAAM,CAACC,YAAY,CAACgB,UAAU,CAAC,IAAAJ,qBAAe,EAACb,MAAM,CAACc,QAAQ,CAACC,MAAM,CAAC,CAAC;EACzE,CAAC,CAAC,MAAM;IACN;EAAA;AAEJ;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASG,yBAAyBA,CAAA,EAAY;EACnD;EACA;EACA;EACA,IAAI,CAACnB,eAAe,CAAC,CAAC,IAAI,OAAOC,MAAM,CAACc,QAAQ,KAAK,WAAW,EAAE,OAAO,KAAK;EAC9E,OAAO,IAAAK,6BAAuB,EAACnB,MAAM,CAACC,YAAY,EAAED,MAAM,CAACc,QAAQ,CAACC,MAAM,CAAC;AAC7E;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASK,mBAAmBA,CAAA,EAAS;EAC1C,MAAMC,OAAO,GAAGnB,iBAAiB,CAAC,CAAC;EACnC,IAAI,CAACmB,OAAO,EAAE;EACd,IAAI;IACF,MAAMN,MAAM,GAAGf,MAAM,CAACc,QAAQ,CAACC,MAAM;IACrCM,OAAO,CAACJ,UAAU,CAAC,IAAAK,qBAAe,EAACP,MAAM,CAAC,CAAC;IAC3CM,OAAO,CAACJ,UAAU,CAAC,IAAAM,qBAAe,EAACR,MAAM,CAAC,CAAC;IAC3CM,OAAO,CAACJ,UAAU,CAAC,IAAAO,iBAAW,EAACT,MAAM,CAAC,CAAC;IACvCM,OAAO,CAACJ,UAAU,CAAC,IAAAQ,iBAAW,EAACV,MAAM,CAAC,CAAC;IACvCM,OAAO,CAACJ,UAAU,CAAC,IAAAS,gBAAU,EAACX,MAAM,CAAC,CAAC;EACxC,CAAC,CAAC,MAAM;IACN;EAAA;AAEJ","ignoreList":[]}

package/lib/commonjs/utils/crossApex.js

@@ -1,74 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.CrossApexDirectSignInError = void 0;
-exports.isCrossApexWeb = isCrossApexWeb;
-var _core = require("@oxyhq/core");
-/**
- * Cross-apex web detection for sign-in durability gating.
- *
- * On a web Relying Party whose registrable apex differs from the central Oxy
- * Identity Provider apex (`oxy.so`), the ONLY sign-in completion that survives a
- * page reload is the interactive "Continue with Oxy" IdP flow, because it is the
- * only one that establishes a first-party `fedcm_session` cookie at
- * `auth.<apex>` — the anchor the cross-domain cold-boot restore reads on reload.
- *
- * The other sign-in completions the SDK can drive do NOT plant a `fedcm_session`:
- *   - password / public-key sign-in mints a bearer directly against the Oxy API
- *     (its refresh cookie is host-scoped to `api.oxy.so` and `SameSite=Lax`, so
- *     it is unreachable cross-site from the RP), and
- *   - the Commons-app device-flow handoff (cross-device QR / same-device
- *     deep-link) is approved OUTSIDE the browser, so no IdP browser session is
- *     established.
- * On a cross-apex RP each of these leaves the user signed in for the current
- * page only — a reload logs them out. See OxyHQServices AGENTS.md
- * "Auth / Session Contract".
- *
- * Same-apex `*.oxy.so` apps (e.g. `accounts.oxy.so`) are first-party with
- * `api.oxy.so`: their refresh cookie rides same-site requests so reload restore
- * works without `fedcm_session`, and they are therefore NOT gated.
- *
- * Returns `false` off-browser (React Native has no `window.location`) and for
- * hosts without a registrable apex (localhost / raw IP / single-label dev
- * hosts), so native and local development keep every sign-in method.
- */
-
-/**
- * Whether the given host is a web RP on a registrable apex other than the
- * central Oxy IdP apex (`oxy.so`). See the module doc for why this gates the
- * non-durable sign-in paths.
- *
- * @param hostname - The host to classify. Defaults to the current
- *   `window.location.hostname`; resolves to `undefined` off-browser (React
- *   Native / SSR), which yields `false`. The explicit parameter mirrors
- *   `autoDetectAuthWebUrl(location?)` and keeps the predicate unit-testable
- *   without manipulating the global `window.location`.
- */
-function isCrossApexWeb(hostname = typeof window !== 'undefined' ? window.location?.hostname : undefined) {
-  if (!hostname) {
-    return false;
-  }
-  const apex = (0, _core.registrableApex)(hostname);
-  return apex !== null && apex !== _core.CENTRAL_IDP_APEX;
-}
-
-/**
- * Thrown when an app attempts a direct (non-IdP) sign-in — password or
- * public-key — on a cross-apex web RP, where such a sign-in would not survive a
- * page reload because no `fedcm_session` is established (see {@link isCrossApexWeb}).
- *
- * Apps on a cross-apex apex must sign in through the interactive
- * "Continue with Oxy" IdP flow (`OxySignInButton` / `showSignInModal()`), which
- * plants the durable session.
- */
-class CrossApexDirectSignInError extends Error {
-  name = 'CrossApexDirectSignInError';
-  code = 'CROSS_APEX_DIRECT_SIGN_IN_UNSUPPORTED';
-  constructor() {
-    super('Direct sign-in is unavailable on this domain because the session would ' + 'not survive a page reload. Use "Continue with Oxy" to sign in through ' + 'the Oxy identity provider.');
-  }
-}
-exports.CrossApexDirectSignInError = CrossApexDirectSignInError;
-//# sourceMappingURL=crossApex.js.map

package/lib/commonjs/utils/crossApex.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["_core","require","isCrossApexWeb","hostname","window","location","undefined","apex","registrableApex","CENTRAL_IDP_APEX","CrossApexDirectSignInError","Error","name","code","constructor","exports"],"sourceRoot":"../../../src","sources":["utils/crossApex.ts"],"mappings":";;;;;;;AA6BA,IAAAA,KAAA,GAAAC,OAAA;AA7BA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAIA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASC,cAAcA,CAC5BC,QAA4B,GAAG,OAAOC,MAAM,KAAK,WAAW,GACxDA,MAAM,CAACC,QAAQ,EAAEF,QAAQ,GACzBG,SAAS,EACJ;EACT,IAAI,CAACH,QAAQ,EAAE;IACb,OAAO,KAAK;EACd;EACA,MAAMI,IAAI,GAAG,IAAAC,qBAAe,EAACL,QAAQ,CAAC;EACtC,OAAOI,IAAI,KAAK,IAAI,IAAIA,IAAI,KAAKE,sBAAgB;AACnD;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,MAAMC,0BAA0B,SAASC,KAAK,CAAC;EAClCC,IAAI,GAAG,4BAA4B;EAC5CC,IAAI,GAAG,uCAAuC;EAEvDC,WAAWA,CAAA,EAAG;IACZ,KAAK,CACH,yEAAyE,GACvE,wEAAwE,GACxE,4BACJ,CAAC;EACH;AACF;AAACC,OAAA,CAAAL,0BAAA,GAAAA,0BAAA","ignoreList":[]}

package/lib/module/ui/context/inSessionTokenRefresh.js

@@ -1,238 +0,0 @@
-"use strict";
-
-/**
- * In-session access-token refresh for the React Native / Expo SDK.
- *
- * THE GAP THIS CLOSES: the services `OxyContext` owns the session but never
- * installed an `authRefreshHandler` on the owner `HttpService`, so
- * `HttpService.refreshAccessToken` short-circuited to `null` — there was NO
- * in-session token refresh on the RN path at all. A 15-minute access token
- * expired with the tab/app open and nothing re-minted one; cross-apex RP feeds
- * (mention.earth, …) then 401'd in a loop while `isAuthenticated` stayed `true`
- * (a zombie logged-in state), because the `Domain=oxy.so` refresh cookie can't
- * reach `api.<apex>`. (`AuthManager`, which installs a refresh handler on the
- * web path, is only ever constructed by `WebOxyProvider` in `@oxyhq/auth`.)
- *
- * THE FIX, two cooperating pieces both wired from `OxyContext`:
- *
- *  1. {@link createInSessionRefreshHandler} — an `AuthRefreshHandler` installed
- *     on the owner client. It re-mints a fresh access token WITHOUT a page
- *     reload by composing the SAME silent-restore primitive cold boot uses
- *     ({@link mintSessionViaPerApexIframe}) — not a copy. The linked client
- *     (`createLinkedClient`) inherits the fix for free: its refresh delegates
- *     back to the owner's `refreshAccessToken`.
- *
- *  2. {@link startTokenRefreshScheduler} — a proactive scheduler that refreshes
- *     ~{@link TOKEN_REFRESH_LEAD_MS} before expiry (and on web tab-focus / native
- *     app-foreground), so the common case never even reaches the reactive
- *     401-then-recover flash.
- *
- * Concurrency/cooldown/dedup are owned by `HttpService.refreshAccessToken`
- * (single in-flight `tokenRefreshPromise` + cooldown) — this module does not
- * reimplement them, so the timer / foreground / per-request triggers collapse to
- * one network attempt (no refresh storm).
- *
- * NOTE (session-sync cutover, Task 5): the web arm chain used to fall through
- * to a same-apex `oxy_rt` refresh-cookie arm (`refreshAllSessions` +
- * `selectActiveRefreshAccount`). That arm is DELETED — the device account set
- * is now server-authoritative via `SessionClient` (`@oxyhq/core`), which
- * `OxyContext` bootstraps/reprojects independently of in-session token
- * refresh. `selectActiveRefreshAccount` had no other caller and was deleted
- * with it.
- */
-
-import { logger as loggerUtil } from '@oxyhq/core';
-import { AppState } from 'react-native';
-import { isWebBrowser } from "../hooks/useWebSSO.js";
-import { mintSessionViaPerApexIframe } from "./silentSessionRestore.js";
-
-/**
- * Per-arm fail-fast budget (ms) for the web first-party `/auth/silent` iframe
- * arm. Slightly more generous than the cold-boot iframe budget (2.5s) because an
- * in-session refresh is NOT in the first-paint critical path — a couple hundred
- * ms of extra headroom for the same-origin handshake is worth a higher success
- * rate. `silentSignIn` still fail-fasts on `iframe.onerror`, so a hard failure
- * returns well before this.
- */
-const SILENT_IFRAME_REFRESH_TIMEOUT = 4000;
-
-/**
- * Lead time (ms) before access-token expiry at which the proactive scheduler
- * refreshes. Mirrors `HttpService`'s per-request `TOKEN_REFRESH_LEAD_SECONDS`
- * (60s) so the scheduled refresh and the request-time preflight refresh use the
- * same window — the scheduler simply fires it during idle/background instead of
- * waiting for the next request.
- */
-export const TOKEN_REFRESH_LEAD_MS = 60_000;
-
-/**
- * A single refresh arm: attempts one silent-restore mechanism and resolves to
- * the freshly planted access token, or `null` to fall through to the next arm.
- */
-
-/**
- * Build the in-session `AuthRefreshHandler` for the owner client.
- *
- * Arms run in an explicit order; the first to plant a token wins. Each arm
- * resolves to the planted token (read back via `getAccessToken()` — the
- * underlying SDK call plants it internally) or `null`. A throw in one arm is
- * logged and treated as `null` so the chain continues.
- *
- *   NATIVE (Expo): shared cross-app identity key re-mint
- *     (`signInWithSharedIdentity` → challenge→sign→verify plants the tokens).
- *     The ONLY silent native arm (mirrors cold boot's `shared-key-signin`); the
- *     `/auth/silent` web iframe is NEVER attempted on native. Resolves to `null`
- *     when the device holds no shared identity (e.g. a password-only native
- *     sign-in) so a genuinely dead session reconciles to logged-out rather than
- *     staying a zombie.
- *
- *   WEB: Per-apex `/auth/silent` iframe — {@link mintSessionViaPerApexIframe}
- *     (shared verbatim with cold boot). The durable cross-apex path; also
- *     covers `*.oxy.so` (the per-apex host IS the central host there). There
- *     is no FedCM arm — FedCM was removed from the client sign-in/refresh path
- *     entirely (Chrome-only; see `CrossDomainAuth`'s doc comment in
- *     `@oxyhq/core` for the production sign-in loop that motivated the
- *     removal).
- *
- * NO RECURSION: no arm issues a request through the authed client's
- * `refreshAccessToken` path. The iframe transport is postMessage-based; the
- * follow-up `/session/user` fetch inside `silentSignIn`
- * runs against the just-planted FULL-TTL token (≫ the preflight lead), so it
- * never re-enters the refresh path.
- */
-export function createInSessionRefreshHandler(oxyServices) {
-  const runArm = async (label, reason, arm) => {
-    try {
-      return await arm();
-    } catch (error) {
-      if (__DEV__) {
-        loggerUtil.debug(`In-session refresh arm "${label}" failed (falling through)`, {
-          component: 'inSessionTokenRefresh',
-          method: 'authRefreshHandler',
-          reason
-        }, error);
-      }
-      return null;
-    }
-  };
-  const webArms = [['silent-iframe', async () => (await mintSessionViaPerApexIframe(oxyServices, SILENT_IFRAME_REFRESH_TIMEOUT)) ? oxyServices.getAccessToken() : null]];
-  return async reason => {
-    if (!isWebBrowser()) {
-      return runArm('native-shared-key', reason, async () => (await oxyServices.signInWithSharedIdentity?.()) ? oxyServices.getAccessToken() : null);
-    }
-    for (const [label, arm] of webArms) {
-      const token = await runArm(label, reason, arm);
-      if (token) {
-        return token;
-      }
-    }
-    return null;
-  };
-}
-
-/**
- * Handle returned by {@link startTokenRefreshScheduler}; call `dispose()` to tear
- * down the timer and the foreground listener.
- */
-
-/**
- * Start the proactive in-session refresh scheduler against `oxyServices`.
- *
- * Schedules a single timer to fire {@link TOKEN_REFRESH_LEAD_MS} before the
- * current access token's `exp`, calling `httpService.refreshAccessToken`
- * ('preflight') — which runs the installed handler and is deduped + cooldown-
- * guarded. After every attempt it reschedules from the (possibly rotated) token.
- * It also reschedules whenever the token changes (`onTokensChanged` — so a
- * sign-out that clears the token cancels the timer) and, on web tab-focus /
- * native app-foreground, refreshes immediately if already inside the lead window
- * (a long-hidden tab throttles timers, so the token can be expired on return).
- *
- * The `exp` is derived directly from the JWT via `getAccessTokenExpiry()`. No-ops
- * cleanly when there is no token, an opaque/no-`exp` token, or the host lacks
- * `getAccessTokenExpiry` (older stubs) — the reactive 401 path stays the only
- * refresh trigger in those cases.
- */
-export function startTokenRefreshScheduler(oxyServices) {
-  let disposed = false;
-  let timer = null;
-  const clearTimer = () => {
-    if (timer !== null) {
-      clearTimeout(timer);
-      timer = null;
-    }
-  };
-  const runRefresh = () => {
-    // `refreshAccessToken` is deduped + cooldown-guarded internally, so this is
-    // safe to call from the timer, the foreground listener, and request-time
-    // preflight concurrently — they collapse to one network attempt.
-    const refresh = oxyServices.httpService.refreshAccessToken?.('preflight');
-    if (!refresh) {
-      return;
-    }
-    void refresh.catch(() => null).finally(() => {
-      if (!disposed) {
-        schedule();
-      }
-    });
-  };
-  const schedule = () => {
-    clearTimer();
-    if (disposed || !oxyServices.getAccessToken()) {
-      return;
-    }
-    const expSeconds = oxyServices.getAccessTokenExpiry?.() ?? null;
-    if (expSeconds === null) {
-      return;
-    }
-    const fireInMs = expSeconds * 1000 - Date.now() - TOKEN_REFRESH_LEAD_MS;
-    timer = setTimeout(runRefresh, Math.max(fireInMs, 0));
-  };
-  const onForeground = () => {
-    if (disposed || !oxyServices.getAccessToken()) {
-      return;
-    }
-    const expSeconds = oxyServices.getAccessTokenExpiry?.() ?? null;
-    if (expSeconds === null) {
-      return;
-    }
-    const remainingMs = expSeconds * 1000 - Date.now();
-    if (remainingMs <= TOKEN_REFRESH_LEAD_MS) {
-      runRefresh();
-    } else {
-      schedule();
-    }
-  };
-  const unsubscribeTokens = oxyServices.onTokensChanged(() => {
-    if (!disposed) {
-      schedule();
-    }
-  });
-  let removeForeground = null;
-  if (isWebBrowser() && typeof document !== 'undefined') {
-    const handler = () => {
-      if (document.visibilityState === 'visible') {
-        onForeground();
-      }
-    };
-    document.addEventListener('visibilitychange', handler);
-    removeForeground = () => document.removeEventListener('visibilitychange', handler);
-  } else if (!isWebBrowser() && AppState && typeof AppState.addEventListener === 'function') {
-    const subscription = AppState.addEventListener('change', state => {
-      if (state === 'active') {
-        onForeground();
-      }
-    });
-    removeForeground = () => subscription.remove();
-  }
-  schedule();
-  return {
-    dispose() {
-      disposed = true;
-      clearTimer();
-      unsubscribeTokens();
-      removeForeground?.();
-      removeForeground = null;
-    }
-  };
-}
-//# sourceMappingURL=inSessionTokenRefresh.js.map

package/lib/module/ui/context/inSessionTokenRefresh.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["logger","loggerUtil","AppState","isWebBrowser","mintSessionViaPerApexIframe","SILENT_IFRAME_REFRESH_TIMEOUT","TOKEN_REFRESH_LEAD_MS","createInSessionRefreshHandler","oxyServices","runArm","label","reason","arm","error","__DEV__","debug","component","method","webArms","getAccessToken","signInWithSharedIdentity","token","startTokenRefreshScheduler","disposed","timer","clearTimer","clearTimeout","runRefresh","refresh","httpService","refreshAccessToken","catch","finally","schedule","expSeconds","getAccessTokenExpiry","fireInMs","Date","now","setTimeout","Math","max","onForeground","remainingMs","unsubscribeTokens","onTokensChanged","removeForeground","document","handler","visibilityState","addEventListener","removeEventListener","subscription","state","remove","dispose"],"sourceRoot":"../../../../src","sources":["ui/context/inSessionTokenRefresh.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAMA,SAASA,MAAM,IAAIC,UAAU,QAAQ,aAAa;AAClD,SAASC,QAAQ,QAA6B,cAAc;AAC5D,SAASC,YAAY,QAAQ,uBAAoB;AACjD,SAASC,2BAA2B,QAAQ,2BAAwB;;AAEpE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,6BAA6B,GAAG,IAAI;;AAE1C;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMC,qBAAqB,GAAG,MAAM;;AAE3C;AACA;AACA;AACA;;AAGA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,6BAA6BA,CAACC,WAAwB,EAAsB;EAC1F,MAAMC,MAAM,GAAG,MAAAA,CAAOC,KAAa,EAAEC,MAAyB,EAAEC,GAAe,KAA6B;IAC1G,IAAI;MACF,OAAO,MAAMA,GAAG,CAAC,CAAC;IACpB,CAAC,CAAC,OAAOC,KAAK,EAAE;MACd,IAAIC,OAAO,EAAE;QACXb,UAAU,CAACc,KAAK,CACd,2BAA2BL,KAAK,4BAA4B,EAC5D;UAAEM,SAAS,EAAE,uBAAuB;UAAEC,MAAM,EAAE,oBAAoB;UAAEN;QAAO,CAAC,EAC5EE,KACF,CAAC;MACH;MACA,OAAO,IAAI;IACb;EACF,CAAC;EAED,MAAMK,OAAoC,GAAG,CAC3C,CAAC,eAAe,EAAE,YAChB,CAAC,MAAMd,2BAA2B,CAACI,WAAW,EAAEH,6BAA6B,CAAC,IAC1EG,WAAW,CAACW,cAAc,CAAC,CAAC,GAC5B,IAAI,CACT,CACF;EAED,OAAO,MAAOR,MAAyB,IAA6B;IAClE,IAAI,CAACR,YAAY,CAAC,CAAC,EAAE;MACnB,OAAOM,MAAM,CAAC,mBAAmB,EAAEE,MAAM,EAAE,YACzC,CAAC,MAAMH,WAAW,CAACY,wBAAwB,GAAG,CAAC,IAAIZ,WAAW,CAACW,cAAc,CAAC,CAAC,GAAG,IACpF,CAAC;IACH;IAEA,KAAK,MAAM,CAACT,KAAK,EAAEE,GAAG,CAAC,IAAIM,OAAO,EAAE;MAClC,MAAMG,KAAK,GAAG,MAAMZ,MAAM,CAACC,KAAK,EAAEC,MAAM,EAAEC,GAAG,CAAC;MAC9C,IAAIS,KAAK,EAAE;QACT,OAAOA,KAAK;MACd;IACF;IACA,OAAO,IAAI;EACb,CAAC;AACH;;AAEA;AACA;AACA;AACA;;AAKA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASC,0BAA0BA,CAACd,WAAwB,EAA+B;EAChG,IAAIe,QAAQ,GAAG,KAAK;EACpB,IAAIC,KAA2C,GAAG,IAAI;EAEtD,MAAMC,UAAU,GAAGA,CAAA,KAAY;IAC7B,IAAID,KAAK,KAAK,IAAI,EAAE;MAClBE,YAAY,CAACF,KAAK,CAAC;MACnBA,KAAK,GAAG,IAAI;IACd;EACF,CAAC;EAED,MAAMG,UAAU,GAAGA,CAAA,KAAY;IAC7B;IACA;IACA;IACA,MAAMC,OAAO,GAAGpB,WAAW,CAACqB,WAAW,CAACC,kBAAkB,GAAG,WAAW,CAAC;IACzE,IAAI,CAACF,OAAO,EAAE;MACZ;IACF;IACA,KAAKA,OAAO,CACTG,KAAK,CAAC,MAAM,IAAI,CAAC,CACjBC,OAAO,CAAC,MAAM;MACb,IAAI,CAACT,QAAQ,EAAE;QACbU,QAAQ,CAAC,CAAC;MACZ;IACF,CAAC,CAAC;EACN,CAAC;EAED,MAAMA,QAAQ,GAAGA,CAAA,KAAY;IAC3BR,UAAU,CAAC,CAAC;IACZ,IAAIF,QAAQ,IAAI,CAACf,WAAW,CAACW,cAAc,CAAC,CAAC,EAAE;MAC7C;IACF;IACA,MAAMe,UAAU,GAAG1B,WAAW,CAAC2B,oBAAoB,GAAG,CAAC,IAAI,IAAI;IAC/D,IAAID,UAAU,KAAK,IAAI,EAAE;MACvB;IACF;IACA,MAAME,QAAQ,GAAGF,UAAU,GAAG,IAAI,GAAGG,IAAI,CAACC,GAAG,CAAC,CAAC,GAAGhC,qBAAqB;IACvEkB,KAAK,GAAGe,UAAU,CAACZ,UAAU,EAAEa,IAAI,CAACC,GAAG,CAACL,QAAQ,EAAE,CAAC,CAAC,CAAC;EACvD,CAAC;EAED,MAAMM,YAAY,GAAGA,CAAA,KAAY;IAC/B,IAAInB,QAAQ,IAAI,CAACf,WAAW,CAACW,cAAc,CAAC,CAAC,EAAE;MAC7C;IACF;IACA,MAAMe,UAAU,GAAG1B,WAAW,CAAC2B,oBAAoB,GAAG,CAAC,IAAI,IAAI;IAC/D,IAAID,UAAU,KAAK,IAAI,EAAE;MACvB;IACF;IACA,MAAMS,WAAW,GAAGT,UAAU,GAAG,IAAI,GAAGG,IAAI,CAACC,GAAG,CAAC,CAAC;IAClD,IAAIK,WAAW,IAAIrC,qBAAqB,EAAE;MACxCqB,UAAU,CAAC,CAAC;IACd,CAAC,MAAM;MACLM,QAAQ,CAAC,CAAC;IACZ;EACF,CAAC;EAED,MAAMW,iBAAiB,GAAGpC,WAAW,CAACqC,eAAe,CAAC,MAAM;IAC1D,IAAI,CAACtB,QAAQ,EAAE;MACbU,QAAQ,CAAC,CAAC;IACZ;EACF,CAAC,CAAC;EAEF,IAAIa,gBAAqC,GAAG,IAAI;EAChD,IAAI3C,YAAY,CAAC,CAAC,IAAI,OAAO4C,QAAQ,KAAK,WAAW,EAAE;IACrD,MAAMC,OAAO,GAAGA,CAAA,KAAY;MAC1B,IAAID,QAAQ,CAACE,eAAe,KAAK,SAAS,EAAE;QAC1CP,YAAY,CAAC,CAAC;MAChB;IACF,CAAC;IACDK,QAAQ,CAACG,gBAAgB,CAAC,kBAAkB,EAAEF,OAAO,CAAC;IACtDF,gBAAgB,GAAGA,CAAA,KAAMC,QAAQ,CAACI,mBAAmB,CAAC,kBAAkB,EAAEH,OAAO,CAAC;EACpF,CAAC,MAAM,IAAI,CAAC7C,YAAY,CAAC,CAAC,IAAID,QAAQ,IAAI,OAAOA,QAAQ,CAACgD,gBAAgB,KAAK,UAAU,EAAE;IACzF,MAAME,YAAY,GAAGlD,QAAQ,CAACgD,gBAAgB,CAAC,QAAQ,EAAGG,KAAqB,IAAK;MAClF,IAAIA,KAAK,KAAK,QAAQ,EAAE;QACtBX,YAAY,CAAC,CAAC;MAChB;IACF,CAAC,CAAC;IACFI,gBAAgB,GAAGA,CAAA,KAAMM,YAAY,CAACE,MAAM,CAAC,CAAC;EAChD;EAEArB,QAAQ,CAAC,CAAC;EAEV,OAAO;IACLsB,OAAOA,CAAA,EAAS;MACdhC,QAAQ,GAAG,IAAI;MACfE,UAAU,CAAC,CAAC;MACZmB,iBAAiB,CAAC,CAAC;MACnBE,gBAAgB,GAAG,CAAC;MACpBA,gBAAgB,GAAG,IAAI;IACzB;EACF,CAAC;AACH","ignoreList":[]}