@pelican-identity/auth-core 1.2.6 → 1.2.8

package/README.md

@@ -1,570 +1,174 @@
-# Pelican Auth SDK
+This documentation provides a comprehensive guide for using the Pelican Identity Vanilla SDK. It covers three integration paths: using the pre-built UI via CDN, using the UI wrapper via NPM, and building a custom UI using the Core Engine.
 
-A modern, event-driven JavaScript/TypeScript SDK for integrating Pelican Vault authentication into your web applications.
+---
 
-## Features
+# Pelican Identity Vanilla SDK
 
-- 🎯 **Event-Driven Architecture** - Subscribe to authentication lifecycle events
-- 🔄 **Continuous Mode** - Automatic session restart for repeated authentication
-- 📱 **Multi-Platform** - Supports both QR code (desktop) and deep linking (mobile)
-- 🔐 **Secure** - End-to-end encrypted authentication using TweetNaCl
-- 🔌 **WebSocket Transport** - Real-time communication with Pelican Vault
-- 🎨 **Framework Agnostic** - Works with React, Vue, Svelte, or vanilla JS
-- 📦 **Type-Safe** - Full TypeScript support with comprehensive type definitions
+The Vanilla SDK provides a framework-agnostic way to integrate Pelican authentication. It includes a high-level UI wrapper that mirrors the React experience and a low-level Core Engine for custom implementations.
 
 ## Installation
 
-```bash
-npm @pelican-identity/sdk
-# or
-yarn add @pelican-identity/sdk
-# or
-pnpm add @pelican-identity/sdk
-```
-
-## Quick Start
-
-### Basic Usage
-
-```typescript
-import { PelicanAuth } from "@pelican-identity/sdk";
-
-// Initialize the SDK
-const auth = new PelicanAuth({
-  publicKey: "your-public-key",
-  projectId: "your-project-id",
-  authType: "login", // 'login' | 'signup' | 'id-verification'
-});
-
-// Listen for authentication success
-auth.on("success", (identity) => {
-  console.log("User authenticated:", identity);
-  // Handle successful authentication
-});
-
-// Listen for errors
-auth.on("error", (error) => {
-  console.error("Authentication failed:", error);
-});
-
-// Listen for QR code (desktop) or deep link (mobile)
-auth.on("qr", (qrDataUrl) => {
-  // Display QR code image
-  document.getElementById("qr").src = qrDataUrl;
-});
-
-auth.on("deeplink", (url) => {
-  // Redirect to Pelican Vault app
-  window.location.href = url;
-});
-
-// Start authentication
-auth.start();
-```
-
-## API Reference
-
-### Constructor
-
-```typescript
-new PelicanAuth(config: PelicanAuthConfig)
-```
-
-#### Configuration Options
+### 1. Via CDN (Easiest)
 
-| Option           | Type                                       | Required | Default | Description                          |
-| ---------------- | ------------------------------------------ | -------- | ------- | ------------------------------------ |
-| `publicKey`      | `string`                                   | ✅ Yes   | -       | Your Pelican Vault public key        |
-| `projectId`      | `string`                                   | ✅ Yes   | -       | Your project identifier              |
-| `authType`       | `'login' \| 'signup' \| 'id-verification'` | ✅ Yes   | -       | Type of authentication flow          |
-| `continuousMode` | `boolean`                                  | ❌ No    | `false` | Auto-restart after successful auth   |
-| `forceQRCode`    | `boolean`                                  | ❌ No    | `false` | Force QR code even on mobile devices |
+Ideal for projects without a build step. Includes the UI and logic in a single file.
 
-### Methods
+```html
+<link
+  rel="stylesheet"
+  href="https://cdn.jsdelivr.net/npm/@pelican-identity/vanilla@1.0.2/dist/pelican.css"
+/>
 
-#### `start(): Promise<void>`
+<script src="https://cdn.jsdelivr.net/npm/@pelican-identity/vanilla@1.0.2/dist/index.min.js"></script>
 
-Initiates the authentication flow.
-
-```typescript
-await auth.start();
-```
-
-#### `stop(): void`
-
-Stops the authentication flow and cleans up resources.
-
-```typescript
-auth.stop();
-```
+<div id="pelican-auth-root"></div>
 
-#### `on<K>(event: K, callback: Listener<K>): () => void`
-
-Subscribe to authentication events. Returns an unsubscribe function.
-
-```typescript
-const unsubscribe = auth.on("success", (identity) => {
-  console.log(identity);
-});
-
-// Later: unsubscribe
-unsubscribe();
-```
-
-#### `destroy(): void`
-
-Completely destroys the SDK instance, removing all listeners and cleanup.
-
-```typescript
-auth.destroy();
+<script>
+  const auth = Pelican.createPelicanAuth("pelican-auth-root", {
+    publicKey: "your-business-public-key",
+    projectId: "your-project-id",
+    authType: "login",
+    onSuccess: (data) => console.log("Success:", data),
+    onError: (err) => console.error("Error:", err),
+  });
+</script>
 ```
 
-### Events
+### 2. Via NPM/PNPM
 
-The SDK emits the following events:
+Ideal for modern web apps (Vue, Svelte, or Vanilla TS) using a bundler like Vite or Webpack.
 
-#### `state`
-
-Emitted when the authentication state changes.
+```bash
+npm install @pelican-identity/vanilla
 
-```typescript
-auth.on("state", (state) => {
-  console.log("Current state:", state);
-});
 ```
 
-**States:**
-
-- `idle` - Initial state
-- `initializing` - Fetching relay server
-- `awaiting-pair` - Waiting for mobile device to scan
-- `paired` - Device connected
-- `authenticated` - User authenticated
-- `confirmed` - Authentication confirmed
-- `terminated` - Session ended
-- `error` - Error occurred
-
-#### `success`
-
-Emitted when authentication succeeds.
-
 ```typescript
-auth.on("success", (identity: IdentityResult) => {
-  console.log("User ID:", identity.user_id);
-  console.log("Email:", identity.user_data.email.value);
-  console.log("Phone:", identity.user_data.phone.number);
-  console.log("First Name:", identity.user_data.first_name);
+import { createPelicanAuth } from "@pelican-identity/vanilla";
+import "@pelican-identity/vanilla/dist/pelican.css";
 
-  console.log("ID Verification:", identity.id_verification);
+const cleanup = createPelicanAuth("container-id", {
+  publicKey: "...",
+  projectId: "...",
+  authType: "login",
+  onSuccess: (identity) => {
+    console.log(identity.user_id);
+  },
 });
-```
-
-**IdentityResult:**
-
-```typescript
-interface IdentityResult {
-  user_id: string;
-  user_data: IUserData;
-  id_verification: IKycData;
-  id_downloadurls?: { front_of_card?: string; back_of_card?: string };
-}
-```
-
-#### `error`
-
-Emitted when an error occurs.
 
-```typescript
-auth.on("error", (error: Error) => {
-  console.error("Error:", error.message);
-});
+// To stop and cleanup the instance
+// cleanup();
 ```
 
-#### `qr`
+---
 
-Emitted on desktop with QR code data URL.
+## UI Wrapper API Reference (`createPelicanAuth`)
 
-```typescript
-auth.on("qr", (dataUrl: string) => {
-  // Display in an <img> tag
-  document.getElementById("qr").src = dataUrl;
-});
-```
+The `createPelicanAuth` function initializes the Pelican UI inside a target DOM element.
 
-#### `deeplink`
+| Option           | Type       | Required | Description                                   |
+| ---------------- | ---------- | -------- | --------------------------------------------- |
+| `publicKey`      | `string`   | ✅       | Business public key from Pelican dashboard    |
+| `projectId`      | `string`   | ✅       | Project ID from Pelican dashboard             |
+| `authType`       | `AuthType` | ✅       | `"signup"`, `"login"`, or `"id-verification"` |
+| `onSuccess`      | `Function` | ✅       | Callback with `IdentityResult`                |
+| `onError`        | `Function` | ❌       | Callback for errors                           |
+| `onClose`        | `Function` | ❌       | Callback when the user closes the modal       |
+| `continuousMode` | `boolean`  | ❌       | Auto-restart auth after completion            |
+| `forceQRCode`    | `boolean`  | ❌       | Always show QR even on mobile                 |
+| `buttonText`     | `string`   | ❌       | Custom text for the Pelican button            |
 
-Emitted on mobile with deep link URL.
+---
 
-```typescript
-auth.on("deeplink", (url: string) => {
-  // Open Pelican Vault app
-  window.location.href = url;
-  // Or use as href in a button
-  document.getElementById("login-btn").href = url;
-});
-```
+## Low-Level Core Usage (Custom UI)
 
-## Usage Examples
+If you want to build your own UI from scratch, use the `@pelican-identity/auth-core` package directly. This provides the event-driven state machine without any HTML/CSS.
 
-### React Hook
+### Basic Implementation
 
 ```typescript
-import { useEffect, useState } from "react";
-import { PelicanAuth } from "@pelican-identity/sdk";
-
-function usePelicanAuth(config) {
-  const [state, setState] = useState("idle");
-  const [qrCode, setQrCode] = useState(null);
-  const [deepLink, setDeepLink] = useState(null);
-  const [error, setError] = useState(null);
-
-  useEffect(() => {
-    const auth = new PelicanAuth(config);
-
-    auth.on("state", setState);
-    auth.on("qr", setQrCode);
-    auth.on("deeplink", setDeepLink);
-    auth.on("error", setError);
+import { PelicanAuthentication } from "@pelican-identity/auth-core";
 
-    auth.on("success", (identity) => {
-      console.log("Authenticated:", identity);
-      config.onSuccess?.(identity);
-    });
-
-    return () => auth.destroy();
-  }, []);
-
-  return { state, qrCode, deepLink, error };
-}
-
-// Usage
-function LoginButton() {
-  const { state, qrCode, deepLink } = usePelicanAuth({
-    publicKey: "your-key",
-    projectId: "your-project",
-    authType: "login",
-    onSuccess: (identity) => {
-      // Handle login
-    },
-  });
-
-  if (qrCode) {
-    return <img src={qrCode} alt="Scan to login" />;
-  }
-
-  if (deepLink) {
-    return <a href={deepLink}>Open Pelican App</a>;
-  }
-
-  return <button onClick={() => auth.start()}>Login</button>;
-}
-```
-
-### Vue Composition API
-
-```vue
-<script setup>
-import { ref, onMounted, onUnmounted } from "vue";
-import { PelicanAuth } from "@pelican-identity/pelican-sdk";
-
-const props = defineProps(["publicKey", "projectId", "authType"]);
-const emit = defineEmits(["success", "error"]);
-
-const state = ref("idle");
-const qrCode = ref(null);
-const deepLink = ref(null);
-
-let auth;
-
-onMounted(() => {
-  auth = new PelicanAuth({
-    publicKey: props.publicKey,
-    projectId: props.projectId,
-    authType: props.authType,
-  });
-
-  auth.on("state", (s) => (state.value = s));
-  auth.on("qr", (qr) => (qrCode.value = qr));
-  auth.on("deeplink", (link) => (deepLink.value = link));
-  auth.on("success", (identity) => emit("success", identity));
-  auth.on("error", (err) => emit("error", err));
-
-  auth.start();
-});
-
-onUnmounted(() => {
-  auth?.destroy();
-});
-</script>
-
-<template>
-  <div>
-    <img v-if="qrCode" :src="qrCode" alt="QR Code" />
-    <a v-else-if="deepLink" :href="deepLink">Open App</a>
-    <p v-else>{{ state }}</p>
-  </div>
-</template>
-```
-
-### Vanilla JavaScript
-
-```javascript
-import { PelicanAuth } from "@pelican-identity/sdk";
-
-// Create container
-const container = document.getElementById("auth-container");
-
-// Initialize
-const auth = new PelicanAuth({
+const pelican = new PelicanAuthentication({
   publicKey: "your-key",
-  projectId: "your-project",
+  projectId: "your-id",
   authType: "login",
 });
 
-// Handle QR code
-auth.on("qr", (dataUrl) => {
-  container.innerHTML = `
-    <img src="${dataUrl}" alt="Scan to login" />
-    <p>Scan with Pelican Vault app</p>
-  `;
+// 1. Listen for the QR code
+pelican.on("qr", (qrDataUrl) => {
+  document.getElementById("my-qr").src = qrDataUrl;
 });
 
-// Handle deep link
-auth.on("deeplink", (url) => {
-  container.innerHTML = `
-    <a href="${url}" class="btn">Open Pelican App</a>
-  `;
+// 2. Listen for Mobile Deep Links
+pelican.on("deeplink", (url) => {
+  document.getElementById("mobile-link").href = url;
 });
 
-// Handle success
-auth.on("success", (identity) => {
-  console.log("Logged in as:", identity.user_id);
-  // Redirect or update UI
-  window.location.href = "/dashboard";
+// 3. Track State Changes
+pelican.on("state", (state) => {
+  console.log("Current state:", state); // 'initializing', 'paired', etc.
 });
 
-// Handle errors
-auth.on("error", (error) => {
-  container.innerHTML = `
-    <p class="error">${error.message}</p>
-    <button onclick="auth.start()">Retry</button>
-  `;
+// 4. Handle Completion
+pelican.on("success", (identity) => {
+  alert(`Welcome ${identity.user_id}`);
 });
 
-// Start authentication
-auth.start();
-
-// Cleanup on page unload
-window.addEventListener("beforeunload", () => {
-  auth.destroy();
-});
+// Start the engine
+pelican.start();
 ```
 
-## Advanced Features
+---
 
-### Continuous Mode
+## Authentication Flow logic
 
-Automatically restart authentication sessions after completion. Useful for kiosks or multi-user scenarios.
+The SDK manages the transition between Desktop and Mobile automatically:
 
-```typescript
-const auth = new PelicanAuth({
-  publicKey: "your-key",
-  projectId: "your-project",
-  authType: "login",
-  continuousMode: true, // Enable continuous mode
-});
+1. **Desktop:** Emits a `qr` event containing a Base64 Data URL.
+2. **Mobile:** Emits a `deeplink` event. Browsers should provide a "Open App" button using this URL.
+3. **Paired:** Once the user scans/clicks, the state moves to `paired`.
+4. **Success:** After biometric/PIN approval in the Pelican app, the `success` event fires with user data.
 
-auth.on("success", (identity) => {
-  // Process user
-  console.log("User authenticated:", identity);
-  // Session will automatically restart after ~300ms
-});
+---
 
-auth.start();
-```
-
-### Force QR Code on Mobile
+## Identity Result Structure
 
-By default, mobile devices use deep links. Force QR code display instead:
+Regardless of which integration path you choose, the successful authentication returns this object:
 
 ```typescript
-const auth = new PelicanAuth({
-  publicKey: "your-key",
-  projectId: "your-project",
-  authType: "login",
-  forceQRCode: true, // Show QR even on mobile
-});
-```
-
-### Session Recovery
-
-The SDK automatically handles session recovery when users return from the Pelican Vault app:
-
-```typescript
-// Session is automatically cached when deep link is opened
-auth.on("deeplink", (url) => {
-  // User clicks and goes to Pelican app
-  window.location.href = url;
-});
-
-// When user returns (visibility change), session is recovered automatically
-// Success event will fire if authentication completed
-auth.on("success", (identity) => {
-  console.log("Recovered session:", identity);
-});
-```
-
-### State Machine Tracking
-
-Track the complete authentication lifecycle:
-
-```typescript
-auth.on("state", (state) => {
-  switch (state) {
-    case "idle":
-      console.log("Ready to start");
-      break;
-    case "initializing":
-      console.log("Connecting to server...");
-      break;
-    case "awaiting-pair":
-      console.log("Waiting for device...");
-      break;
-    case "paired":
-      console.log("Device connected!");
-      break;
-    case "authenticated":
-      console.log("User authenticated!");
-      break;
-    case "confirmed":
-      console.log("Session confirmed");
-      break;
-    case "error":
-      console.log("Error occurred");
-      break;
-  }
-});
-```
-
-## Error Handling
-
-The SDK provides detailed error information:
-
-```typescript
-auth.on("error", (error) => {
-  console.error("Error type:", error.message);
-
-  // Common errors:
-  // - "Failed to fetch relay URL" - Server connection issue
-  // - "WebSocket connection failed" - Network issue
-  // - "Invalid authentication payload" - Data corruption
-  // - "Failed to decrypt authentication data" - Crypto error
-  // - "Authenticating device terminated the connection" - User cancelled
-  // - "Session recovery failed" - Invalid cached session
-});
+interface IdentityResult {
+  user_id: string; // Unique business-scoped identifier
+  user_data?: {
+    first_name?: string;
+    email?: { value: string; verified: boolean };
+    phone?: { number: string; verified: boolean };
+  };
+  id_verification?: {
+    status: "Approved" | "Declined";
+    document_type: string;
+  };
+}
 ```
 
-## Security Considerations
-
-1. **Public Key and Project ID**: It is recommended to use environment variables or fetch from a secure server for production.
-2. **HTTPS Required**: Always use HTTPS in production
-3. **Session Expiry**: Sessions expire after 5 minutes by default
-4. **End-to-End Encryption**: All data is encrypted using TweetNaCl (NaCl crypto)
-5. **No Password Storage**: Authentication happens entirely through the Pelican Vault app
-
-## Browser Support
-
-- Chrome/Edge 90+
-- Firefox 88+
-- Safari 14+
-- Opera 76+
-
-**Required APIs:**
-
-- WebSocket
-- Crypto API (`crypto.randomUUID()`)
-- sessionStorage
-- Visibility API
+---
 
 ## Troubleshooting
 
-### QR Code Not Displaying
-
-```typescript
-auth.on("qr", (dataUrl) => {
-  if (!dataUrl) {
-    console.error("QR code generation failed");
-  }
-});
-```
+### `crypto.randomUUID is not a function`
 
-### WebSocket Connection Issues
-
-```typescript
-// Check network connectivity
-auth.on("error", (error) => {
-  if (error.message.includes("WebSocket")) {
-    console.log("Check network connection");
-    // Retry logic
-    setTimeout(() => auth.start(), 5000);
-  }
-});
-```
-
-### Session Recovery Not Working
-
-Ensure visibility change detection is working:
-
-```typescript
-document.addEventListener("visibilitychange", () => {
-  console.log("Visibility changed:", document.visibilityState);
-});
-```
-
-## TypeScript Support
-
-Full TypeScript definitions included:
-
-```typescript
-import type {
-  IEmail,
-  IKycData,
-  IPhone,
-  IUserData,
-  IdentityResult,
-  IdCardTypes,
-} from "@pelican-identity/sdk";
-import {
-  AuthType,
-  ISocketMessage,
-  PelicanAuthConfig,
-  PelicanAuthEventMap,
-  PelicanAuthState,
-} from "@pelican-identity/sdk";
-
-const config: PelicanAuthConfig = {
-  publicKey: "your-key",
-  projectId: "your-project",
-  authType: "login",
-};
-
-const auth = new PelicanAuth(config);
-
-auth.on("success", (identity: IdentityResult) => {
-  const userId: string = identity.user_id;
-});
-```
+**Cause:** Browsers only allow the Crypto API in **Secure Contexts** (HTTPS or localhost).
+**Fix:** Ensure you are serving your site over HTTPS or using `http://localhost`.
 
-## License
+### QR Code not showing
 
-MIT
+**Cause:** The engine might be in `initializing` state or the domain isn't whitelisted.
+**Fix:** Check your Pelican Dashboard and ensure your current domain (including port if applicable) is added to the project whitelist.
 
-## Support
+### Styles not applying
 
-- Documentation: https://docs.pelicanidentity.com
-- Issues: https://github.com/pelican-identity/sdk/issues
-- Email: support@pelicanidentity.com
+**Cause:** The CSS file is missing.
+**Fix:** If using NPM, ensure you import `@pelican-identity/vanilla/dist/pelican.css`. If using the CDN `.min.js` version with `injectStyle: true`, this should be automatic.
 
-## Changelog
+---
 
-See [CHANGELOG.md](CHANGELOG.md) for release history.
+**Would you like me to help you create a "Getting Started" guide specifically for the Pelican Dashboard setup to complement this SDK documentation?**

package/dist/index.d.mts

@@ -182,6 +182,6 @@ declare const getAuthSession: () => AuthSession | null;
 declare const clearAuthSession: () => void;
 declare const clearAllAuthData: () => void;
 
-declare const BASEURL = "http://192.168.1.2:8080";
+declare const BASEURL = "https://identityapi.pelicanidentity.com";
 
 export { type AuthSession, type AuthType, BASEURL, CryptoService, type IEmail, type IKycData, type IPhone, type ISocketMessage, type IUserData, type IdCardTypes, type IdentityResult, type PelicanAuthConfig, type PelicanAuthEventMap, type PelicanAuthState, PelicanAuthentication, type PelicanWebAuthProps, StateMachine, Transport, clearAllAuthData, clearAuthSession, getAuthSession, storeAuthSession };

package/dist/index.d.ts

@@ -182,6 +182,6 @@ declare const getAuthSession: () => AuthSession | null;
 declare const clearAuthSession: () => void;
 declare const clearAllAuthData: () => void;
 
-declare const BASEURL = "http://192.168.1.2:8080";
+declare const BASEURL = "https://identityapi.pelicanidentity.com";
 
 export { type AuthSession, type AuthType, BASEURL, CryptoService, type IEmail, type IKycData, type IPhone, type ISocketMessage, type IUserData, type IdCardTypes, type IdentityResult, type PelicanAuthConfig, type PelicanAuthEventMap, type PelicanAuthState, PelicanAuthentication, type PelicanWebAuthProps, StateMachine, Transport, clearAllAuthData, clearAuthSession, getAuthSession, storeAuthSession };

package/dist/index.js

@@ -241,7 +241,7 @@ var Transport = class {
 };
 
 // src/constants.ts
-var BASEURL = "http://192.168.1.2:8080";
+var BASEURL = "https://identityapi.pelicanidentity.com";
 
 // src/engine/engine.ts
 var PelicanAuthentication = class {
@@ -280,6 +280,7 @@ var PelicanAuthentication = class {
   async start() {
     if (this.stateMachine.current !== "idle") return;
     this.resetSession();
+    clearAuthSession();
     this.stateMachine.transition("initializing");
     try {
       const relay = await this.fetchRelayUrl();
@@ -317,7 +318,8 @@ var PelicanAuthentication = class {
       `${BASEURL}/relay?public_key=${publicKey}&auth_type=${authType}&project_id=${projectId}`
     );
     if (!res.ok) {
-      throw new Error("Failed to fetch relay URL");
+      const error = await res.text();
+      throw new Error(error);
     }
     const json = await res.json();
     return json.relay_url;
@@ -351,7 +353,7 @@ var PelicanAuthentication = class {
       const qr = await QRCode__default.default.toDataURL(JSON.stringify(payload), {
         type: "image/png",
         scale: 3,
-        color: { light: "#FFFFF5", dark: "#121212" }
+        color: { light: "#ffffff", dark: "#424242ff" }
       });
       this.emit("qr", qr);
     }
@@ -457,7 +459,6 @@ var PelicanAuthentication = class {
   }
   /** Cleans up the current session state */
   terminate(success) {
-    if (!this.transport) return;
     if (!success) {
       this.transport?.send({
         type: "client-terminated",
@@ -477,6 +478,7 @@ var PelicanAuthentication = class {
   }
   restartIfContinuous() {
     this.stateMachine.transition("idle");
+    this.transport?.close();
     if (!this.config.continuousMode) return;
     setTimeout(() => {
       this.start();

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/utilities/crypto.ts","../src/utilities/storage.ts","../src/utilities/stateMachine.ts","../src/utilities/transport.ts","../src/constants.ts","../src/engine/engine.ts"],"names":["nacl","encodeBase64","decodeBase64","QRCode"],"mappings":";;;;;;;;;;;;AAQO,IAAM,gBAAN,MAAoB;AAAA,EACzB,oBAAA,GAA+B;AAC7B,IAAA,MAAM,GAAA,GAAMA,qBAAA,CAAK,WAAA,CAAY,EAAE,CAAA;AAC/B,IAAA,OAAOC,2BAAa,GAAG,CAAA;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,gBAAA,CAAiB;AAAA,IACf,SAAA;AAAA,IACA;AAAA,GACF,EAGqB;AACnB,IAAA,MAAM,GAAA,GAAMC,2BAAa,SAAS,CAAA;AAClC,IAAA,MAAM,KAAA,GAAQF,qBAAA,CAAK,WAAA,CAAY,EAAE,CAAA;AAEjC,IAAA,MAAM,YAAA,GAAe,IAAI,WAAA,EAAY,CAAE,OAAO,SAAS,CAAA;AAEvD,IAAA,MAAM,UAAA,GAAaA,qBAAA,CAAK,SAAA,CAAU,YAAA,EAAc,OAAO,GAAG,CAAA;AAE1D,IAAA,OAAO;AAAA,MACL,MAAA,EAAQC,2BAAa,UAAU,CAAA;AAAA,MAC/B,KAAA,EAAOA,2BAAa,KAAK;AAAA,KAC3B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,gBAAA,CAAiB;AAAA,IACf,SAAA;AAAA,IACA;AAAA,GACF,EAGkB;AAChB,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAMC,2BAAa,SAAS,CAAA;AAClC,MAAA,MAAM,eAAA,GAAkBA,0BAAA,CAAa,SAAA,CAAU,MAAM,CAAA;AACrD,MAAA,MAAM,UAAA,GAAaA,0BAAA,CAAa,SAAA,CAAU,KAAK,CAAA;AAE/C,MAAA,MAAM,YAAYF,qBAAA,CAAK,SAAA,CAAU,IAAA,CAAK,eAAA,EAAiB,YAAY,GAAG,CAAA;AAEtE,MAAA,IAAI,CAAC,SAAA,EAAW;AACd,QAAA,MAAM,IAAI,MAAM,mDAAmD,CAAA;AAAA,MACrE;AAEA,MAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY,CAAE,OAAO,SAAS,CAAA;AAClD,MAAA,OAAO,OAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,OAAA,CAAQ,KAAA,CAAM,qBAAqB,KAAK,CAAA;AACxC,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AACF;AAEA,IAAO,cAAA,GAAQ,aAAA;;;AC/Df,IAAM,cAAN,MAAkB;AAAA,EAAlB,WAAA,GAAA;AACE,IAAA,IAAA,CAAiB,MAAA,GAAS,eAAA;AAC1B,IAAA,IAAA,CAAiB,UAAA,GAAa,IAAI,EAAA,GAAK,GAAA;AACvC;AAAA,IAAA,IAAA,CAAQ,WAAA,uBACF,GAAA,EAAI;AAAA,EAAA;AAAA;AAAA;AAAA;AAAA,EAKV,GAAA,CAAI,GAAA,EAAa,KAAA,EAAY,OAAA,GAA0B,EAAC,EAAS;AAC/D,IAAA,MAAM,EAAE,KAAA,GAAQ,IAAA,CAAK,UAAA,EAAY,iBAAA,GAAoB,MAAK,GAAI,OAAA;AAE9D,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA;AAC/B,IAAA,MAAM,IAAA,GAAO,EAAE,KAAA,EAAO,SAAA,EAAU;AAGhC,IAAA,IAAI,iBAAA,EAAmB;AACrB,MAAA,IAAI;AACF,QAAA,cAAA,CAAe,OAAA,CAAQ,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AAAA,MACrE,SAAS,KAAA,EAAO;AACd,QAAA,OAAA,CAAQ,IAAA,CAAK,6CAA6C,KAAK,CAAA;AAC/D,QAAA,IAAA,CAAK,SAAA,CAAU,KAAK,IAAI,CAAA;AAAA,MAC1B;AAAA,IACF,CAAA,MAAO;AACL,MAAA,IAAA,CAAK,SAAA,CAAU,KAAK,IAAI,CAAA;AAAA,IAC1B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,GAAA,EAAyB;AAE3B,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,eAAe,OAAA,CAAQ,CAAA,EAAG,KAAK,MAAM,CAAA,EAAG,GAAG,CAAA,CAAE,CAAA;AAC5D,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA;AAG9B,QAAA,IAAI,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,SAAA,EAAW;AAC/B,UAAA,IAAA,CAAK,OAAO,GAAG,CAAA;AACf,UAAA,OAAO,IAAA;AAAA,QACT;AAEA,QAAA,OAAO,IAAA,CAAK,KAAA;AAAA,MACd;AAAA,IACF,SAAS,KAAA,EAAO;AAAA,IAEhB;AAGA,IAAA,OAAO,IAAA,CAAK,UAAU,GAAG,CAAA;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,GAAA,EAAmB;AACxB,IAAA,IAAI;AACF,MAAA,cAAA,CAAe,WAAW,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,EAAG,GAAG,CAAA,CAAE,CAAA;AAAA,IAClD,SAAS,KAAA,EAAO;AAAA,IAEhB;AACA,IAAA,IAAA,CAAK,WAAA,CAAY,OAAO,GAAG,CAAA;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA,EAKA,KAAA,GAAc;AAEZ,IAAA,IAAI;AACF,MAAA,MAAA,CAAO,IAAA,CAAK,cAAc,CAAA,CAAE,OAAA,CAAQ,CAAC,GAAA,KAAQ;AAC3C,QAAA,IAAI,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,MAAM,CAAA,EAAG;AAC/B,UAAA,cAAA,CAAe,WAAW,GAAG,CAAA;AAAA,QAC/B;AAAA,MACF,CAAC,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AAAA,IAEhB;AAGA,IAAA,IAAA,CAAK,YAAY,KAAA,EAAM;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA,EAMQ,SAAA,CACN,KACA,IAAA,EACM;AACN,IAAA,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,GAAA,EAAK,IAAI,CAAA;AAG9B,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,SAAA,GAAY,IAAA,CAAK,GAAA,EAAI;AACtC,IAAA,UAAA,CAAW,MAAM;AACf,MAAA,IAAA,CAAK,WAAA,CAAY,OAAO,GAAG,CAAA;AAAA,IAC7B,GAAG,GAAG,CAAA;AAAA,EACR;AAAA,EAEQ,UAAU,GAAA,EAAyB;AACzC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,GAAG,CAAA;AACrC,IAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAElB,IAAA,IAAI,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,SAAA,EAAW;AAC/B,MAAA,IAAA,CAAK,WAAA,CAAY,OAAO,GAAG,CAAA;AAC3B,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EACd;AACF,CAAA;AAGA,IAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAWzB,IAAM,gBAAA,GAAmB,CAC9B,SAAA,EACA,UAAA,EACA,KAAA,KACS;AACT,EAAA,OAAA,CAAQ,GAAA,CAAI,WAAW,EAAE,SAAA,EAAW,YAAW,EAAG,EAAE,OAAO,CAAA;AAC7D;AAEO,IAAM,iBAAiB,MAA0B;AACtD,EAAA,OAAO,OAAA,CAAQ,IAAI,SAAS,CAAA;AAC9B;AAEO,IAAM,mBAAmB,MAAY;AAC1C,EAAA,OAAA,CAAQ,OAAO,SAAS,CAAA;AAC1B;AAEO,IAAM,mBAAmB,MAAY;AAC1C,EAAA,OAAA,CAAQ,KAAA,EAAM;AAChB;;;AC1JO,IAAM,eAAN,MAAmB;AAAA,EAAnB,WAAA,GAAA;AACL,IAAA,IAAA,CAAQ,KAAA,GAA0B,MAAA;AAClC,IAAA,IAAA,CAAQ,SAAA,uBAAgB,GAAA,EAAmC;AAAA,EAAA;AAAA,EAE3D,IAAI,OAAA,GAAU;AACZ,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EACd;AAAA,EAEA,WAAW,IAAA,EAAwB;AACjC,IAAA,IAAA,CAAK,KAAA,GAAQ,IAAA;AACb,IAAA,IAAA,CAAK,UAAU,OAAA,CAAQ,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAC,CAAA;AAAA,EACvC;AAAA,EAEA,UAAU,EAAA,EAAmC;AAC3C,IAAA,IAAA,CAAK,SAAA,CAAU,IAAI,EAAE,CAAA;AACrB,IAAA,OAAO,MAAM,IAAA,CAAK,SAAA,CAAU,MAAA,CAAO,EAAE,CAAA;AAAA,EACvC;AACF;;;ACVO,IAAM,YAAN,MAAgB;AAAA,EAQrB,YAAY,QAAA,EAA6B;AALzC,IAAA,IAAA,CAAQ,iBAAA,GAAoB,CAAA;AAC5B,IAAA,IAAA,CAAQ,oBAAA,GAAuB,CAAA;AAC/B,IAAA,IAAA,CAAQ,kBAAA,GAAqB,KAAA;AAI3B,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAAA,EAClB;AAAA,EAEA,QAAQ,GAAA,EAAa;AACnB,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AACX,IAAA,IAAA,CAAK,kBAAA,GAAqB,KAAA;AAC1B,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,SAAA,CAAU,GAAG,CAAA;AAE/B,IAAA,IAAA,CAAK,MAAA,CAAO,SAAS,MAAM;AACzB,MAAA,IAAA,CAAK,iBAAA,GAAoB,CAAA;AACzB,MAAA,IAAA,CAAK,SAAS,MAAA,IAAS;AAAA,IACzB,CAAA;AACA,IAAA,IAAA,CAAK,MAAA,CAAO,SAAA,GAAY,CAAC,CAAA,KAAoB;AAC3C,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAA,CAAE,IAAI,CAAA;AAC9B,QAAA,IAAA,CAAK,QAAA,CAAS,YAAY,IAAI,CAAA;AAAA,MAChC,SAAS,GAAA,EAAK;AACZ,QAAA,OAAA,CAAQ,KAAA,CAAM,2BAA2B,GAAG,CAAA;AAAA,MAC9C;AAAA,IACF,CAAA;AACA,IAAA,IAAA,CAAK,MAAA,CAAO,OAAA,GAAU,CAAC,CAAA,KAAa;AAClC,MAAA,IAAA,CAAK,QAAA,CAAS,UAAU,CAAC,CAAA;AAAA,IAC3B,CAAA;AACA,IAAA,IAAA,CAAK,MAAA,CAAO,OAAA,GAAU,CAAC,CAAA,KAAkB;AACvC,MAAA,IAAA,CAAK,QAAA,CAAS,UAAU,CAAC,CAAA;AAGzB,MAAA,IAAI,CAAC,KAAK,kBAAA,EAAoB;AAC5B,QAAA,IAAA,CAAK,gBAAA,EAAiB;AAAA,MACxB;AAAA,IACF,CAAA;AAAA,EACF;AAAA,EAEQ,gBAAA,GAAmB;AACzB,IAAA,IAAI,IAAA,CAAK,iBAAA,IAAqB,IAAA,CAAK,oBAAA,EAAsB;AACvD,MAAA,OAAA,CAAQ,MAAM,uCAAkC,CAAA;AAChD,MAAA;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,iBAAA,EAAA;AAEL,IAAA,MAAM,QAAQ,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,iBAAiB,CAAA,GAAI,GAAA;AACpD,IAAA,UAAA,CAAW,MAAM;AACf,MAAA,IAAI,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,OAAA,CAAQ,KAAK,GAAG,CAAA;AAAA,IACrC,GAAG,KAAK,CAAA;AAAA,EACV;AAAA,EACA,KAAK,OAAA,EAAyB;AAC5B,IAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,UAAA,KAAe,SAAA,CAAU,IAAA,EAAM;AAC9C,MAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAAA,IAC1C;AAAA,EACF;AAAA,EAEA,KAAA,GAAQ;AACN,IAAA,IAAA,CAAK,kBAAA,GAAqB,IAAA;AAC1B,IAAA,IAAA,CAAK,QAAQ,KAAA,EAAM;AAAA,EACrB;AACF;;;AC1EO,IAAM,OAAA,GAAU;;;ACyBhB,IAAM,wBAAN,MAA4B;AAAA,EAgBjC,YAAY,MAAA,EAA2B;AAfvC,IAAA,IAAA,CAAiB,MAAA,GAAS,IAAI,cAAA,EAAc;AAC5C,IAAA,IAAA,CAAiB,YAAA,GAAe,IAAI,YAAA,EAAa;AAGjD,IAAA,IAAA,CAAQ,SAAA,GAAY,EAAA;AACpB,IAAA,IAAA,CAAQ,UAAA,GAA4B,IAAA;AAIpC,IAAA,IAAA,CAAQ,YAEJ,EAAC;AAKH,IAAA,IAAI,CAAC,MAAA,CAAO,SAAA,EAAW,MAAM,IAAI,MAAM,mBAAmB,CAAA;AAC1D,IAAA,IAAI,CAAC,MAAA,CAAO,SAAA,EAAW,MAAM,IAAI,MAAM,mBAAmB,CAAA;AAC1D,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,EAAU,MAAM,IAAI,MAAM,kBAAkB,CAAA;AAExD,IAAA,IAAA,CAAK,MAAA,GAAS;AAAA,MACZ,cAAA,EAAgB,KAAA;AAAA,MAChB,WAAA,EAAa,KAAA;AAAA,MACb,GAAG;AAAA,KACL;AAGA,IAAA,IAAA,CAAK,YAAA,CAAa,UAAU,CAAC,CAAA,KAAM,KAAK,IAAA,CAAK,OAAA,EAAS,CAAC,CAAC,CAAA;AACxD,IAAA,IAAA,CAAK,wBAAA,EAAyB;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,EAAA,CACE,OACA,EAAA,EACA;AAlEJ,IAAA,IAAA,EAAA;AAmEI,IAAA,CAAA,EAAA,GAAA,IAAA,CAAK,SAAA,EAAL,KAAA,CAAA,KAAA,EAAA,CAAA,KAAA,CAAA,mBAA0B,IAAI,GAAA,EAAI,CAAA;AAClC,IAAA,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,CAAG,GAAA,CAAI,EAAE,CAAA;AAC7B,IAAA,OAAO,MAAM,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,CAAG,OAAO,EAAE,CAAA;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,KAAA,GAAQ;AACZ,IAAA,IAAI,IAAA,CAAK,YAAA,CAAa,OAAA,KAAY,MAAA,EAAQ;AAE1C,IAAA,IAAA,CAAK,YAAA,EAAa;AAClB,IAAA,IAAA,CAAK,YAAA,CAAa,WAAW,cAAc,CAAA;AAE3C,IAAA,IAAI;AACF,MAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,aAAA,EAAc;AAGvC,MAAA,IAAA,CAAK,UAAA,GAAa,IAAA,CAAK,MAAA,CAAO,oBAAA,EAAqB;AACnD,MAAA,IAAA,CAAK,SAAA,GAAY,MAAA,CAAO,UAAA,EAAW,GAAI,OAAO,UAAA,EAAW;AAEzD,MAAA,IAAA,CAAK,SAAA,GAAY,IAAI,SAAA,CAAU;AAAA,QAC7B,QAAQ,MAAM;AAEZ,UAAA,IAAA,CAAK,UAAW,IAAA,CAAK;AAAA,YACnB,IAAA,EAAM,UAAA;AAAA,YACN,WAAW,IAAA,CAAK,SAAA;AAAA,YAChB,GAAG,IAAA,CAAK;AAAA,WACT,CAAA;AACD,UAAA,IAAA,CAAK,YAAA,CAAa,WAAW,eAAe,CAAA;AAAA,QAC9C,CAAA;AAAA,QACA,SAAA,EAAW,CAAC,GAAA,KAAwB,IAAA,CAAK,cAAc,GAAG,CAAA;AAAA,QAC1D,SAAS,MAAM,IAAA,CAAK,KAAK,IAAI,KAAA,CAAM,6BAA6B,CAAC;AAAA,OAClE,CAAA;AAED,MAAA,IAAA,CAAK,SAAA,CAAU,QAAQ,KAAK,CAAA;AAC5B,MAAA,MAAM,KAAK,cAAA,EAAe;AAAA,IAC5B,SAAS,GAAA,EAAK;AACZ,MAAA,IAAA,CAAK,KAAK,GAAA,YAAe,KAAA,GAAQ,MAAM,IAAI,KAAA,CAAM,cAAc,CAAC,CAAA;AAAA,IAClE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,IAAA,GAAO;AACL,IAAA,IAAA,CAAK,UAAU,KAAK,CAAA;AAAA,EACtB;AAAA;AAAA;AAAA,EAKA,MAAc,aAAA,GAAiC;AAC7C,IAAA,MAAM,EAAE,SAAA,EAAW,SAAA,EAAW,QAAA,KAAa,IAAA,CAAK,MAAA;AAChD,IAAA,MAAM,MAAM,MAAM,KAAA;AAAA,MAChB,GAAG,OAAO,CAAA,kBAAA,EAAqB,SAAS,CAAA,WAAA,EAAc,QAAQ,eAAe,SAAS,CAAA;AAAA,KACxF;AAEA,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAAA,IAC7C;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,OAAO,IAAA,CAAK,SAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,cAAA,GAAiB;AAC7B,IAAA,MAAM,OAAA,GAAU;AAAA,MACd,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,SAAA,EAAW,KAAK,MAAA,CAAO,SAAA;AAAA,MACvB,QAAA,EAAU,KAAK,MAAA,CAAO,QAAA;AAAA,MACtB,SAAA,EAAW,KAAK,MAAA,CAAO,SAAA;AAAA,MACvB,GAAA,EAAK,OAAO,QAAA,CAAS;AAAA,KACvB;AAEA,IAAA,MAAM,WAAA,GACJ,KAAK,MAAA,CAAO,WAAA,IACZ,CAAC,sBAAA,CAAuB,IAAA,CAAK,UAAU,SAAS,CAAA;AAElD,IAAA,IAAI,CAAC,WAAA,IAAe,IAAA,CAAK,UAAA,EAAY;AAEnC,MAAA,gBAAA,CAAiB,IAAA,CAAK,SAAA,EAAW,IAAA,CAAK,UAAA,EAAY,IAAI,GAAM,CAAA;AAC5D,MAAA,IAAA,CAAK,IAAA;AAAA,QACH,UAAA;AAAA,QACA,CAAA,wCAAA,EAA2C,kBAAA;AAAA,UACzC,IAAA,CAAK;AAAA,SACN,CAAA,YAAA,EAAe,kBAAA;AAAA,UACd,IAAA,CAAK;AAAA,SACN,CAAA,WAAA,EAAc,kBAAA,CAAmB,IAAA,CAAK,MAAA,CAAO,SAAS,CAAC,CAAA,UAAA,EACtD,IAAA,CAAK,MAAA,CAAO,QACd,CAAA,WAAA,EAAc,kBAAA;AAAA,UACZ,KAAK,MAAA,CAAO;AAAA,SACb,CAAA,KAAA,EAAQ,kBAAA,CAAmB,MAAA,CAAO,QAAA,CAAS,IAAI,CAAC,CAAA;AAAA,OACnD;AAAA,IACF,CAAA,MAAO;AACL,MAAA,MAAM,KAAK,MAAMG,uBAAA,CAAO,UAAU,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA,EAAG;AAAA,QACzD,IAAA,EAAM,WAAA;AAAA,QACN,KAAA,EAAO,CAAA;AAAA,QACP,KAAA,EAAO,EAAE,KAAA,EAAO,SAAA,EAAW,MAAM,SAAA;AAAU,OAC5C,CAAA;AACD,MAAA,IAAA,CAAK,IAAA,CAAK,MAAM,EAAE,CAAA;AAAA,IACpB;AAAA,EACF;AAAA;AAAA,EAGQ,cAAc,GAAA,EAAqB;AACzC,IAAA,QAAQ,IAAI,IAAA;AAAM,MAChB,KAAK,QAAA;AACH,QAAA,IAAA,CAAK,YAAA,CAAa,WAAW,QAAQ,CAAA;AACrC,QAAA,IAAA,CAAK,UAAW,IAAA,CAAK;AAAA,UACnB,IAAA,EAAM,cAAA;AAAA,UACN,WAAW,IAAA,CAAK,SAAA;AAAA,UAChB,GAAG,IAAA,CAAK,MAAA;AAAA,UACR,GAAA,EAAK,OAAO,QAAA,CAAS;AAAA,SACtB,CAAA;AACD,QAAA;AAAA,MAEF,KAAK,oBAAA;AAEH,QAAA,IAAA,CAAK,kBAAkB,GAAG,CAAA;AAC1B,QAAA;AAAA,MAEF,KAAK,kBAAA;AACH,QAAA,IAAA,CAAK,IAAA,CAAK,IAAI,KAAA,CAAM,iDAAiD,CAAC,CAAA;AACtE,QAAA,IAAA,CAAK,mBAAA,EAAoB;AACzB,QAAA;AAAA,MAEF,KAAK,WAAA;AAEH,QAAA,IAAA,CAAK,UAAU,IAAI,CAAA;AACnB,QAAA,IAAA,CAAK,mBAAA,EAAoB;AACzB,QAAA;AAAA;AACJ,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,kBAAkB,GAAA,EAAqB;AAC7C,IAAA,IAAI,CAAC,KAAK,UAAA,IAAc,CAAC,IAAI,MAAA,IAAU,CAAC,IAAI,KAAA,EAAO;AACjD,MAAA,IAAA,CAAK,IAAA,CAAK,IAAI,KAAA,CAAM,gCAAgC,CAAC,CAAA;AACrD,MAAA,IAAA,CAAK,mBAAA,EAAoB;AACzB,MAAA;AAAA,IACF;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAY,IAAA,CAAK,MAAA,CAAO,gBAAA,CAAiB;AAAA,QAC7C,WAAW,EAAE,MAAA,EAAQ,IAAI,MAAA,EAAQ,KAAA,EAAO,IAAI,KAAA,EAAM;AAAA,QAClD,WAAW,IAAA,CAAK;AAAA,OACjB,CAAA;AAED,MAAA,IAAI,CAAC,SAAA,EAAW;AACd,QAAA,IAAA,CAAK,IAAA,CAAK,IAAI,KAAA,CAAM,6BAA6B,CAAC,CAAA;AAClD,QAAA,IAAA,CAAK,mBAAA,EAAoB;AACzB,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,MAAA,GAAyB,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA;AAEnD,MAAA,IAAA,CAAK,IAAA,CAAK,WAAW,MAAM,CAAA;AAC3B,MAAA,IAAA,CAAK,YAAA,CAAa,WAAW,eAAe,CAAA;AAG5C,MAAA,IAAA,CAAK,WAAW,IAAA,CAAK;AAAA,QACnB,IAAA,EAAM,SAAA;AAAA,QACN,WAAW,IAAA,CAAK;AAAA,OACjB,CAAA;AAAA,IACH,CAAA,CAAA,MAAQ;AACN,MAAA,IAAA,CAAK,IAAA,CAAK,IAAI,KAAA,CAAM,uCAAuC,CAAC,CAAA;AAC5D,MAAA,IAAA,CAAK,mBAAA,EAAoB;AAAA,IAC3B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,eAAe,MAAA,EAAqB;AAChD,IAAA,IAAI;AACF,MAAA,MAAM,MAAM,MAAM,KAAA;AAAA,QAChB,CAAA,EAAG,OAAO,CAAA,oBAAA,EAAuB,MAAA,CAAO,SAAS,CAAA;AAAA,OACnD;AAEA,MAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,MAAM,IAAI,MAAM,iBAAiB,CAAA;AAE9C,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,MAAA,MAAM,SAAA,GAAY,IAAA,CAAK,MAAA,CAAO,gBAAA,CAAiB;AAAA,QAC7C,WAAW,EAAE,MAAA,EAAQ,KAAK,MAAA,EAAQ,KAAA,EAAO,KAAK,KAAA,EAAM;AAAA,QACpD,WAAW,MAAA,CAAO;AAAA,OACnB,CAAA;AAED,MAAA,IAAI,CAAC,SAAA,EAAW;AACd,QAAA,IAAA,CAAK,IAAA,CAAK,IAAI,KAAA,CAAM,sBAAsB,CAAC,CAAA;AAC3C,QAAA,IAAA,CAAK,mBAAA,EAAoB;AACzB,QAAA;AAAA,MACF;AACA,MAAA,MAAM,MAAA,GAAyB,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA;AACnD,MAAA,IAAA,CAAK,IAAA,CAAK,WAAW,MAAM,CAAA;AAC3B,MAAA,gBAAA,EAAiB;AAAA,IACnB,CAAA,CAAA,MAAQ;AACN,MAAA,IAAA,CAAK,IAAA,CAAK,IAAI,KAAA,CAAM,yBAAyB,CAAC,CAAA;AAC9C,MAAA,IAAA,CAAK,mBAAA,EAAoB;AAAA,IAC3B;AAAA,EACF;AAAA,EAEQ,wBAAA,GAA2B;AACjC,IAAA,IAAA,CAAK,oBAAoB,YAAY;AACnC,MAAA,IAAI,QAAA,CAAS,oBAAoB,SAAA,EAAW;AAE5C,MAAA,MAAM,SAAS,cAAA,EAAe;AAC9B,MAAA,IAAI,CAAC,MAAA,EAAQ;AACb,MAAA,MAAM,IAAA,CAAK,eAAe,MAAM,CAAA;AAAA,IAClC,CAAA;AAEA,IAAA,QAAA,CAAS,gBAAA,CAAiB,kBAAA,EAAoB,IAAA,CAAK,iBAAiB,CAAA;AAAA,EACtE;AAAA,EAEQ,wBAAA,GAA2B;AACjC,IAAA,IAAI,KAAK,iBAAA,EAAmB;AAC1B,MAAA,QAAA,CAAS,mBAAA,CAAoB,kBAAA,EAAoB,IAAA,CAAK,iBAAiB,CAAA;AACvE,MAAA,IAAA,CAAK,iBAAA,GAAoB,MAAA;AAAA,IAC3B;AAAA,EACF;AAAA;AAAA,EAGQ,UAAU,OAAA,EAAkB;AAClC,IAAA,IAAI,CAAC,KAAK,SAAA,EAAW;AACrB,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,IAAA,CAAK,WAAW,IAAA,CAAK;AAAA,QACnB,IAAA,EAAM,mBAAA;AAAA,QACN,WAAW,IAAA,CAAK,SAAA;AAAA,QAChB,SAAA,EAAW,KAAK,MAAA,CAAO,SAAA;AAAA,QACvB,SAAA,EAAW,KAAK,MAAA,CAAO,SAAA;AAAA,QACvB,QAAA,EAAU,KAAK,MAAA,CAAO;AAAA,OACvB,CAAA;AAAA,IACH;AAEA,IAAA,IAAA,CAAK,WAAW,KAAA,EAAM;AACtB,IAAA,gBAAA,EAAiB;AACjB,IAAA,IAAA,CAAK,YAAA,EAAa;AAElB,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,CAAO,cAAA,EAAgB;AAC/B,MAAA,IAAA,CAAK,wBAAA,EAAyB;AAAA,IAChC;AACA,IAAA,IAAA,CAAK,YAAA,CAAa,UAAA,CAAW,OAAA,GAAU,WAAA,GAAc,MAAM,CAAA;AAAA,EAC7D;AAAA,EAEQ,mBAAA,GAAsB;AAC5B,IAAA,IAAA,CAAK,YAAA,CAAa,WAAW,MAAM,CAAA;AACnC,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,CAAO,cAAA,EAAgB;AACjC,IAAA,UAAA,CAAW,MAAM;AACf,MAAA,IAAA,CAAK,KAAA,EAAM;AAAA,IACb,GAAG,GAAG,CAAA;AAAA,EACR;AAAA,EAEQ,YAAA,GAAe;AACrB,IAAA,IAAA,CAAK,SAAA,GAAY,EAAA;AACjB,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAAA,EACpB;AAAA;AAAA,EAGA,OAAA,GAAU;AACR,IAAA,IAAA,CAAK,wBAAA,EAAyB;AAC9B,IAAA,IAAA,CAAK,WAAW,KAAA,EAAM;AACtB,IAAA,IAAA,CAAK,YAAY,EAAC;AAAA,EACpB;AAAA,EAEQ,IAAA,CACN,OACA,OAAA,EACA;AACA,IAAA,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,EAAG,OAAA,CAAQ,CAAC,EAAA,KAAO,EAAA,CAAG,OAAO,CAAC,CAAA;AAAA,EACpD;AAAA,EAEQ,KAAK,GAAA,EAAY;AACvB,IAAA,IAAA,CAAK,IAAA,CAAK,SAAS,GAAG,CAAA;AACtB,IAAA,IAAA,CAAK,YAAA,CAAa,WAAW,OAAO,CAAA;AAAA,EACtC;AACF","file":"index.js","sourcesContent":["import nacl from \"tweetnacl\";\nimport { decodeBase64, encodeBase64 } from \"tweetnacl-util\";\n\ninterface EncryptedMessage {\n  cipher: string; // Base64 encoded\n  nonce: string; // Base64 encoded\n}\n\nexport class CryptoService {\n  generateSymmetricKey(): string {\n    const key = nacl.randomBytes(32);\n    return encodeBase64(key);\n  }\n\n  /**\n   * Encrypt with symmetric key (secret-key encryption)\n   * Use this when both parties share the same secret key\n   * @param plaintext - Message to encrypt\n   * @param keyString - Symmetric key (base64)\n   * @returns Encrypted message with nonce\n   */\n  encryptSymmetric({\n    plaintext,\n    keyString,\n  }: {\n    plaintext: string;\n    keyString: string;\n  }): EncryptedMessage {\n    const key = decodeBase64(keyString);\n    const nonce = nacl.randomBytes(24);\n\n    const messageBytes = new TextEncoder().encode(plaintext);\n\n    const ciphertext = nacl.secretbox(messageBytes, nonce, key);\n\n    return {\n      cipher: encodeBase64(ciphertext),\n      nonce: encodeBase64(nonce),\n    };\n  }\n\n  /**\n   * Decrypt with symmetric key\n   * @param encrypted - Encrypted message with nonce\n   * @param keyString - Symmetric key (base64)\n   * @returns Decrypted plaintext\n   */\n  decryptSymmetric({\n    encrypted,\n    keyString,\n  }: {\n    encrypted: EncryptedMessage;\n    keyString: string;\n  }): string | null {\n    try {\n      const key = decodeBase64(keyString);\n      const ciphertextBytes = decodeBase64(encrypted.cipher);\n      const nonceBytes = decodeBase64(encrypted.nonce);\n\n      const decrypted = nacl.secretbox.open(ciphertextBytes, nonceBytes, key);\n\n      if (!decrypted) {\n        throw new Error(\"Decryption failed - invalid key or corrupted data\");\n      }\n\n      const decoded = new TextDecoder().decode(decrypted);\n      return decoded;\n    } catch (error) {\n      console.error(\"Decryption failed\", error);\n      return null;\n    }\n  }\n}\n\nexport default CryptoService;\nexport type { EncryptedMessage };\n","// hybridStorage.ts\n/**\n * Hybrid storage: Try sessionStorage first, fallback to memory\n * Best of both worlds - survives page refresh but auto-cleans\n */\n\ninterface StorageOptions {\n  ttlMs?: number;\n  useSessionStorage?: boolean;\n}\n\nclass AuthStorage {\n  private readonly prefix = \"pelican_auth_\";\n  private readonly defaultTTL = 5 * 60 * 1000; // 5 minutes\n  private memoryCache: Map<string, { value: any; expiresAt: number }> =\n    new Map();\n\n  /**\n   * Store auth session with automatic cleanup\n   */\n  set(key: string, value: any, options: StorageOptions = {}): void {\n    const { ttlMs = this.defaultTTL, useSessionStorage = true } = options;\n\n    const expiresAt = Date.now() + ttlMs;\n    const data = { value, expiresAt };\n\n    // Try sessionStorage first\n    if (useSessionStorage) {\n      try {\n        sessionStorage.setItem(`${this.prefix}${key}`, JSON.stringify(data));\n      } catch (error) {\n        console.warn(\"SessionStorage unavailable, using memory:\", error);\n        this.setMemory(key, data);\n      }\n    } else {\n      this.setMemory(key, data);\n    }\n  }\n\n  /**\n   * Get stored value if not expired\n   */\n  get(key: string): any | null {\n    // Try sessionStorage first\n    try {\n      const stored = sessionStorage.getItem(`${this.prefix}${key}`);\n      if (stored) {\n        const data = JSON.parse(stored);\n\n        // Check expiration\n        if (Date.now() > data.expiresAt) {\n          this.remove(key);\n          return null;\n        }\n\n        return data.value;\n      }\n    } catch (error) {\n      // Fallback to memory\n    }\n\n    // Try memory cache\n    return this.getMemory(key);\n  }\n\n  /**\n   * Remove specific key\n   */\n  remove(key: string): void {\n    try {\n      sessionStorage.removeItem(`${this.prefix}${key}`);\n    } catch (error) {\n      // Ignore\n    }\n    this.memoryCache.delete(key);\n  }\n\n  /**\n   * Clear all auth data\n   */\n  clear(): void {\n    // Clear sessionStorage\n    try {\n      Object.keys(sessionStorage).forEach((key) => {\n        if (key.startsWith(this.prefix)) {\n          sessionStorage.removeItem(key);\n        }\n      });\n    } catch (error) {\n      // Ignore\n    }\n\n    // Clear memory\n    this.memoryCache.clear();\n  }\n\n  // ========================================\n  // Memory cache helpers\n  // ========================================\n\n  private setMemory(\n    key: string,\n    data: { value: any; expiresAt: number }\n  ): void {\n    this.memoryCache.set(key, data);\n\n    // Schedule cleanup\n    const ttl = data.expiresAt - Date.now();\n    setTimeout(() => {\n      this.memoryCache.delete(key);\n    }, ttl);\n  }\n\n  private getMemory(key: string): any | null {\n    const data = this.memoryCache.get(key);\n    if (!data) return null;\n\n    if (Date.now() > data.expiresAt) {\n      this.memoryCache.delete(key);\n      return null;\n    }\n\n    return data.value;\n  }\n}\n\n// Singleton instance\nconst storage = new AuthStorage();\n\n// ========================================\n// Convenience functions for auth flow\n// ========================================\n\nexport interface AuthSession {\n  sessionId: string;\n  sessionKey: string;\n}\n\nexport const storeAuthSession = (\n  sessionId: string,\n  sessionKey: string,\n  ttlMs?: number\n): void => {\n  storage.set(\"session\", { sessionId, sessionKey }, { ttlMs });\n};\n\nexport const getAuthSession = (): AuthSession | null => {\n  return storage.get(\"session\");\n};\n\nexport const clearAuthSession = (): void => {\n  storage.remove(\"session\");\n};\n\nexport const clearAllAuthData = (): void => {\n  storage.clear();\n};\n\nexport default storage;\n","import type { PelicanAuthState } from \"../types/types\";\n\nexport class StateMachine {\n  private state: PelicanAuthState = \"idle\";\n  private listeners = new Set<(s: PelicanAuthState) => void>();\n\n  get current() {\n    return this.state;\n  }\n\n  transition(next: PelicanAuthState) {\n    this.state = next;\n    this.listeners.forEach((l) => l(next));\n  }\n\n  subscribe(fn: (s: PelicanAuthState) => void) {\n    this.listeners.add(fn);\n    return () => this.listeners.delete(fn);\n  }\n}\n","import { ISocketMessage } from \"../types/types\";\n\ntype TransportHandlers = {\n  onOpen?: () => void;\n  onMessage?: (msg: ISocketMessage) => void;\n  onError?: (err: Event) => void;\n  onClose?: (ev: CloseEvent) => void;\n};\n\nexport class Transport {\n  private socket?: WebSocket;\n  private handlers: TransportHandlers;\n  private reconnectAttempts = 0;\n  private maxReconnectAttempts = 5;\n  private isExplicitlyClosed = false;\n  private url?: string;\n\n  constructor(handlers: TransportHandlers) {\n    this.handlers = handlers;\n  }\n\n  connect(url: string) {\n    this.url = url;\n    this.isExplicitlyClosed = false;\n    this.socket = new WebSocket(url);\n\n    this.socket.onopen = () => {\n      this.reconnectAttempts = 0;\n      this.handlers.onOpen?.();\n    };\n    this.socket.onmessage = (e: MessageEvent) => {\n      try {\n        const data = JSON.parse(e.data);\n        this.handlers.onMessage?.(data);\n      } catch (err) {\n        console.error(\"Failed to parse message\", err);\n      }\n    };\n    this.socket.onerror = (e: Event) => {\n      this.handlers.onError?.(e);\n    };\n    this.socket.onclose = (e: CloseEvent) => {\n      this.handlers.onClose?.(e);\n\n      // Only reconnect if the user didn't call .close() manually\n      if (!this.isExplicitlyClosed) {\n        this.attemptReconnect();\n      }\n    };\n  }\n\n  private attemptReconnect() {\n    if (this.reconnectAttempts >= this.maxReconnectAttempts) {\n      console.error(\"❌ Max reconnect attempts reached\");\n      return;\n    }\n\n    this.reconnectAttempts++;\n\n    const delay = Math.pow(2, this.reconnectAttempts) * 500;\n    setTimeout(() => {\n      if (this.url) this.connect(this.url);\n    }, delay);\n  }\n  send(payload: ISocketMessage) {\n    if (this.socket?.readyState === WebSocket.OPEN) {\n      this.socket.send(JSON.stringify(payload));\n    }\n  }\n\n  close() {\n    this.isExplicitlyClosed = true;\n    this.socket?.close();\n  }\n}\n","export const BASEURL = \"http://192.168.1.2:8080\";\n","import CryptoService from \"../utilities/crypto\";\nimport QRCode from \"qrcode\";\nimport {\n  PelicanAuthConfig,\n  PelicanAuthEventMap,\n  ISocketMessage,\n  IdentityResult,\n} from \"../types/types\";\nimport {\n  storeAuthSession,\n  getAuthSession,\n  clearAuthSession,\n  AuthSession,\n} from \"../utilities/storage\";\nimport { StateMachine } from \"../utilities/stateMachine\";\nimport { Transport } from \"../utilities/transport\";\n\nimport { BASEURL } from \"../constants\";\n\ntype Listener<T> = (payload: T) => void;\n\n/**\n * PelicanAuth SDK\n * Handles cross-device authentication via WebSockets and E2EE (End-to-End Encryption).\n */\nexport class PelicanAuthentication {\n  private readonly crypto = new CryptoService();\n  private readonly stateMachine = new StateMachine();\n\n  private transport?: Transport;\n  private sessionId = \"\";\n  private sessionKey: string | null = null;\n\n  private visibilityHandler?: () => void;\n\n  private listeners: {\n    [K in keyof PelicanAuthEventMap]?: Set<Listener<any>>;\n  } = {};\n\n  private readonly config: Required<PelicanAuthConfig>;\n\n  constructor(config: PelicanAuthConfig) {\n    if (!config.publicKey) throw new Error(\"Missing publicKey\");\n    if (!config.projectId) throw new Error(\"Missing projectId\");\n    if (!config.authType) throw new Error(\"Missing authType\");\n\n    this.config = {\n      continuousMode: false,\n      forceQRCode: false,\n      ...config,\n    };\n\n    // Sync internal state machine changes with the 'state' event\n    this.stateMachine.subscribe((s) => this.emit(\"state\", s));\n    this.attachVisibilityRecovery();\n  }\n\n  /* -------------------- public API -------------------- */\n\n  /**\n   * Subscribe to SDK events (qr, deeplink, success, error, state)\n   * @returns Unsubscribe function\n   */\n  on<K extends keyof PelicanAuthEventMap>(\n    event: K,\n    cb: Listener<PelicanAuthEventMap[K]>\n  ) {\n    this.listeners[event] ??= new Set();\n    this.listeners[event]!.add(cb);\n    return () => this.listeners[event]!.delete(cb);\n  }\n\n  /**\n   * Initializes the authentication flow.\n   * Fetches a relay, establishes a WebSocket, and generates the E2EE session key.\n   */\n  async start() {\n    if (this.stateMachine.current !== \"idle\") return;\n\n    this.resetSession();\n    this.stateMachine.transition(\"initializing\");\n\n    try {\n      const relay = await this.fetchRelayUrl();\n\n      // Generate a fresh symmetric key for this specific session\n      this.sessionKey = this.crypto.generateSymmetricKey();\n      this.sessionId = crypto.randomUUID() + crypto.randomUUID();\n\n      this.transport = new Transport({\n        onOpen: () => {\n          // Register this browser session with the relay\n          this.transport!.send({\n            type: \"register\",\n            sessionID: this.sessionId,\n            ...this.config,\n          });\n          this.stateMachine.transition(\"awaiting-pair\");\n        },\n        onMessage: (msg: ISocketMessage) => this.handleMessage(msg),\n        onError: () => this.fail(new Error(\"WebSocket connection failed\")),\n      });\n\n      this.transport.connect(relay);\n      await this.emitEntryPoint();\n    } catch (err) {\n      this.fail(err instanceof Error ? err : new Error(\"Start failed\"));\n    }\n  }\n\n  /**\n   * Manually stops the authentication process and closes connections.\n   */\n  stop() {\n    this.terminate(false);\n  }\n\n  /* -------------------- internals -------------------- */\n\n  /** Fetches the WebSocket Relay URL from the backend */\n  private async fetchRelayUrl(): Promise<string> {\n    const { publicKey, projectId, authType } = this.config;\n    const res = await fetch(\n      `${BASEURL}/relay?public_key=${publicKey}&auth_type=${authType}&project_id=${projectId}`\n    );\n\n    if (!res.ok) {\n      throw new Error(\"Failed to fetch relay URL\");\n    }\n\n    const json = await res.json();\n    return json.relay_url;\n  }\n\n  /**\n   * Decides whether to show a QR code (Desktop) or a Deep Link (Mobile).\n   */\n  private async emitEntryPoint() {\n    const payload = {\n      sessionID: this.sessionId,\n      sessionKey: this.sessionKey,\n      publicKey: this.config.publicKey,\n      authType: this.config.authType,\n      projectId: this.config.projectId,\n      url: window.location.href,\n    };\n\n    const shouldUseQR =\n      this.config.forceQRCode ||\n      !/Android|iPhone|iPad/i.test(navigator.userAgent);\n\n    if (!shouldUseQR && this.sessionKey) {\n      // For mobile: Store session locally so we can recover when the user returns from the app\n      storeAuthSession(this.sessionId, this.sessionKey, 5 * 60_000);\n      this.emit(\n        \"deeplink\",\n        `pelicanvault://auth/deep-link?sessionID=${encodeURIComponent(\n          this.sessionId\n        )}&sessionKey=${encodeURIComponent(\n          this.sessionKey\n        )}&publicKey=${encodeURIComponent(this.config.publicKey)}&authType=${\n          this.config.authType\n        }&projectId=${encodeURIComponent(\n          this.config.projectId\n        )}&url=${encodeURIComponent(window.location.href)}`\n      );\n    } else {\n      const qr = await QRCode.toDataURL(JSON.stringify(payload), {\n        type: \"image/png\",\n        scale: 3,\n        color: { light: \"#FFFFF5\", dark: \"#121212\" },\n      });\n      this.emit(\"qr\", qr);\n    }\n  }\n\n  /** Main WebSocket message router */\n  private handleMessage(msg: ISocketMessage) {\n    switch (msg.type) {\n      case \"paired\":\n        this.stateMachine.transition(\"paired\");\n        this.transport!.send({\n          type: \"authenticate\",\n          sessionID: this.sessionId,\n          ...this.config,\n          url: window.location.href,\n        });\n        return;\n\n      case \"phone-auth-success\":\n        // Mobile device successfully authenticated and sent encrypted credentials\n        this.handleAuthSuccess(msg);\n        return;\n\n      case \"phone-terminated\":\n        this.fail(new Error(\"Authenticating device terminated the connection\"));\n        this.restartIfContinuous();\n        return;\n\n      case \"confirmed\":\n        // Handshake complete\n        this.terminate(true);\n        this.restartIfContinuous();\n        return;\n    }\n  }\n\n  /**\n   * Decrypts the identity payload received from the phone using the session key.\n   */\n  private handleAuthSuccess(msg: ISocketMessage) {\n    if (!this.sessionKey || !msg.cipher || !msg.nonce) {\n      this.fail(new Error(\"Invalid authentication payload\"));\n      this.restartIfContinuous();\n      return;\n    }\n\n    try {\n      const decrypted = this.crypto.decryptSymmetric({\n        encrypted: { cipher: msg.cipher, nonce: msg.nonce },\n        keyString: this.sessionKey,\n      });\n\n      if (!decrypted) {\n        this.fail(new Error(\"Invalid authentication data\"));\n        this.restartIfContinuous();\n        return;\n      }\n\n      const result: IdentityResult = JSON.parse(decrypted);\n\n      this.emit(\"success\", result);\n      this.stateMachine.transition(\"authenticated\");\n\n      // Signal to the relay/phone that we have received and decrypted the data\n      this.transport?.send({\n        type: \"confirm\",\n        sessionID: this.sessionId,\n      });\n    } catch {\n      this.fail(new Error(\"Failed to decrypt authentication data\"));\n      this.restartIfContinuous();\n    }\n  }\n\n  /**\n   * Logic to handle users returning to the browser tab after using the mobile app.\n   * Checks the server for a completed session that might have finished while in background.\n   */\n\n  private async getCachedEntry(cached: AuthSession) {\n    try {\n      const res = await fetch(\n        `${BASEURL}/session?session_id=${cached.sessionId}`\n      );\n\n      if (!res.ok) throw new Error(\"Invalid session\");\n\n      const data = await res.json();\n      const decrypted = this.crypto.decryptSymmetric({\n        encrypted: { cipher: data.cipher, nonce: data.nonce },\n        keyString: cached.sessionKey,\n      });\n\n      if (!decrypted) {\n        this.fail(new Error(\"Invalid session data\"));\n        this.restartIfContinuous();\n        return;\n      }\n      const result: IdentityResult = JSON.parse(decrypted);\n      this.emit(\"success\", result);\n      clearAuthSession();\n    } catch {\n      this.fail(new Error(\"Session recovery failed\"));\n      this.restartIfContinuous();\n    }\n  }\n\n  private attachVisibilityRecovery() {\n    this.visibilityHandler = async () => {\n      if (document.visibilityState !== \"visible\") return;\n\n      const cached = getAuthSession();\n      if (!cached) return;\n      await this.getCachedEntry(cached);\n    };\n\n    document.addEventListener(\"visibilitychange\", this.visibilityHandler);\n  }\n\n  private detachVisibilityRecovery() {\n    if (this.visibilityHandler) {\n      document.removeEventListener(\"visibilitychange\", this.visibilityHandler);\n      this.visibilityHandler = undefined;\n    }\n  }\n\n  /** Cleans up the current session state */\n  private terminate(success: boolean) {\n    if (!this.transport) return;\n    if (!success) {\n      this.transport?.send({\n        type: \"client-terminated\",\n        sessionID: this.sessionId,\n        projectId: this.config.projectId,\n        publicKey: this.config.publicKey,\n        authType: this.config.authType,\n      });\n    }\n\n    this.transport?.close();\n    clearAuthSession();\n    this.resetSession();\n\n    if (!this.config.continuousMode) {\n      this.detachVisibilityRecovery();\n    }\n    this.stateMachine.transition(success ? \"confirmed\" : \"idle\");\n  }\n\n  private restartIfContinuous() {\n    this.stateMachine.transition(\"idle\");\n    if (!this.config.continuousMode) return;\n    setTimeout(() => {\n      this.start();\n    }, 150);\n  }\n\n  private resetSession() {\n    this.sessionId = \"\";\n    this.sessionKey = null;\n  }\n\n  /** Completely destroys the instance and removes all listeners */\n  destroy() {\n    this.detachVisibilityRecovery();\n    this.transport?.close();\n    this.listeners = {};\n  }\n\n  private emit<K extends keyof PelicanAuthEventMap>(\n    event: K,\n    payload: PelicanAuthEventMap[K]\n  ) {\n    this.listeners[event]?.forEach((cb) => cb(payload));\n  }\n\n  private fail(err: Error) {\n    this.emit(\"error\", err);\n    this.stateMachine.transition(\"error\");\n  }\n}\n"]}
+{"version":3,"sources":["../src/utilities/crypto.ts","../src/utilities/storage.ts","../src/utilities/stateMachine.ts","../src/utilities/transport.ts","../src/constants.ts","../src/engine/engine.ts"],"names":["nacl","encodeBase64","decodeBase64","QRCode"],"mappings":";;;;;;;;;;;;AAQO,IAAM,gBAAN,MAAoB;AAAA,EACzB,oBAAA,GAA+B;AAC7B,IAAA,MAAM,GAAA,GAAMA,qBAAA,CAAK,WAAA,CAAY,EAAE,CAAA;AAC/B,IAAA,OAAOC,2BAAa,GAAG,CAAA;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,gBAAA,CAAiB;AAAA,IACf,SAAA;AAAA,IACA;AAAA,GACF,EAGqB;AACnB,IAAA,MAAM,GAAA,GAAMC,2BAAa,SAAS,CAAA;AAClC,IAAA,MAAM,KAAA,GAAQF,qBAAA,CAAK,WAAA,CAAY,EAAE,CAAA;AAEjC,IAAA,MAAM,YAAA,GAAe,IAAI,WAAA,EAAY,CAAE,OAAO,SAAS,CAAA;AAEvD,IAAA,MAAM,UAAA,GAAaA,qBAAA,CAAK,SAAA,CAAU,YAAA,EAAc,OAAO,GAAG,CAAA;AAE1D,IAAA,OAAO;AAAA,MACL,MAAA,EAAQC,2BAAa,UAAU,CAAA;AAAA,MAC/B,KAAA,EAAOA,2BAAa,KAAK;AAAA,KAC3B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,gBAAA,CAAiB;AAAA,IACf,SAAA;AAAA,IACA;AAAA,GACF,EAGkB;AAChB,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAMC,2BAAa,SAAS,CAAA;AAClC,MAAA,MAAM,eAAA,GAAkBA,0BAAA,CAAa,SAAA,CAAU,MAAM,CAAA;AACrD,MAAA,MAAM,UAAA,GAAaA,0BAAA,CAAa,SAAA,CAAU,KAAK,CAAA;AAE/C,MAAA,MAAM,YAAYF,qBAAA,CAAK,SAAA,CAAU,IAAA,CAAK,eAAA,EAAiB,YAAY,GAAG,CAAA;AAEtE,MAAA,IAAI,CAAC,SAAA,EAAW;AACd,QAAA,MAAM,IAAI,MAAM,mDAAmD,CAAA;AAAA,MACrE;AAEA,MAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY,CAAE,OAAO,SAAS,CAAA;AAClD,MAAA,OAAO,OAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,OAAA,CAAQ,KAAA,CAAM,qBAAqB,KAAK,CAAA;AACxC,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AACF;AAEA,IAAO,cAAA,GAAQ,aAAA;;;AC/Df,IAAM,cAAN,MAAkB;AAAA,EAAlB,WAAA,GAAA;AACE,IAAA,IAAA,CAAiB,MAAA,GAAS,eAAA;AAC1B,IAAA,IAAA,CAAiB,UAAA,GAAa,IAAI,EAAA,GAAK,GAAA;AACvC;AAAA,IAAA,IAAA,CAAQ,WAAA,uBACF,GAAA,EAAI;AAAA,EAAA;AAAA;AAAA;AAAA;AAAA,EAKV,GAAA,CAAI,GAAA,EAAa,KAAA,EAAY,OAAA,GAA0B,EAAC,EAAS;AAC/D,IAAA,MAAM,EAAE,KAAA,GAAQ,IAAA,CAAK,UAAA,EAAY,iBAAA,GAAoB,MAAK,GAAI,OAAA;AAE9D,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA;AAC/B,IAAA,MAAM,IAAA,GAAO,EAAE,KAAA,EAAO,SAAA,EAAU;AAGhC,IAAA,IAAI,iBAAA,EAAmB;AACrB,MAAA,IAAI;AACF,QAAA,cAAA,CAAe,OAAA,CAAQ,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AAAA,MACrE,SAAS,KAAA,EAAO;AACd,QAAA,OAAA,CAAQ,IAAA,CAAK,6CAA6C,KAAK,CAAA;AAC/D,QAAA,IAAA,CAAK,SAAA,CAAU,KAAK,IAAI,CAAA;AAAA,MAC1B;AAAA,IACF,CAAA,MAAO;AACL,MAAA,IAAA,CAAK,SAAA,CAAU,KAAK,IAAI,CAAA;AAAA,IAC1B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,GAAA,EAAyB;AAE3B,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,eAAe,OAAA,CAAQ,CAAA,EAAG,KAAK,MAAM,CAAA,EAAG,GAAG,CAAA,CAAE,CAAA;AAC5D,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA;AAG9B,QAAA,IAAI,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,SAAA,EAAW;AAC/B,UAAA,IAAA,CAAK,OAAO,GAAG,CAAA;AACf,UAAA,OAAO,IAAA;AAAA,QACT;AAEA,QAAA,OAAO,IAAA,CAAK,KAAA;AAAA,MACd;AAAA,IACF,SAAS,KAAA,EAAO;AAAA,IAEhB;AAGA,IAAA,OAAO,IAAA,CAAK,UAAU,GAAG,CAAA;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,GAAA,EAAmB;AACxB,IAAA,IAAI;AACF,MAAA,cAAA,CAAe,WAAW,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,EAAG,GAAG,CAAA,CAAE,CAAA;AAAA,IAClD,SAAS,KAAA,EAAO;AAAA,IAEhB;AACA,IAAA,IAAA,CAAK,WAAA,CAAY,OAAO,GAAG,CAAA;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA,EAKA,KAAA,GAAc;AAEZ,IAAA,IAAI;AACF,MAAA,MAAA,CAAO,IAAA,CAAK,cAAc,CAAA,CAAE,OAAA,CAAQ,CAAC,GAAA,KAAQ;AAC3C,QAAA,IAAI,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,MAAM,CAAA,EAAG;AAC/B,UAAA,cAAA,CAAe,WAAW,GAAG,CAAA;AAAA,QAC/B;AAAA,MACF,CAAC,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AAAA,IAEhB;AAGA,IAAA,IAAA,CAAK,YAAY,KAAA,EAAM;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA,EAMQ,SAAA,CACN,KACA,IAAA,EACM;AACN,IAAA,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,GAAA,EAAK,IAAI,CAAA;AAG9B,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,SAAA,GAAY,IAAA,CAAK,GAAA,EAAI;AACtC,IAAA,UAAA,CAAW,MAAM;AACf,MAAA,IAAA,CAAK,WAAA,CAAY,OAAO,GAAG,CAAA;AAAA,IAC7B,GAAG,GAAG,CAAA;AAAA,EACR;AAAA,EAEQ,UAAU,GAAA,EAAyB;AACzC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,GAAG,CAAA;AACrC,IAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAElB,IAAA,IAAI,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,SAAA,EAAW;AAC/B,MAAA,IAAA,CAAK,WAAA,CAAY,OAAO,GAAG,CAAA;AAC3B,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EACd;AACF,CAAA;AAGA,IAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAWzB,IAAM,gBAAA,GAAmB,CAC9B,SAAA,EACA,UAAA,EACA,KAAA,KACS;AACT,EAAA,OAAA,CAAQ,GAAA,CAAI,WAAW,EAAE,SAAA,EAAW,YAAW,EAAG,EAAE,OAAO,CAAA;AAC7D;AAEO,IAAM,iBAAiB,MAA0B;AACtD,EAAA,OAAO,OAAA,CAAQ,IAAI,SAAS,CAAA;AAC9B;AAEO,IAAM,mBAAmB,MAAY;AAC1C,EAAA,OAAA,CAAQ,OAAO,SAAS,CAAA;AAC1B;AAEO,IAAM,mBAAmB,MAAY;AAC1C,EAAA,OAAA,CAAQ,KAAA,EAAM;AAChB;;;AC1JO,IAAM,eAAN,MAAmB;AAAA,EAAnB,WAAA,GAAA;AACL,IAAA,IAAA,CAAQ,KAAA,GAA0B,MAAA;AAClC,IAAA,IAAA,CAAQ,SAAA,uBAAgB,GAAA,EAAmC;AAAA,EAAA;AAAA,EAE3D,IAAI,OAAA,GAAU;AACZ,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EACd;AAAA,EAEA,WAAW,IAAA,EAAwB;AACjC,IAAA,IAAA,CAAK,KAAA,GAAQ,IAAA;AACb,IAAA,IAAA,CAAK,UAAU,OAAA,CAAQ,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAC,CAAA;AAAA,EACvC;AAAA,EAEA,UAAU,EAAA,EAAmC;AAC3C,IAAA,IAAA,CAAK,SAAA,CAAU,IAAI,EAAE,CAAA;AACrB,IAAA,OAAO,MAAM,IAAA,CAAK,SAAA,CAAU,MAAA,CAAO,EAAE,CAAA;AAAA,EACvC;AACF;;;ACVO,IAAM,YAAN,MAAgB;AAAA,EAQrB,YAAY,QAAA,EAA6B;AALzC,IAAA,IAAA,CAAQ,iBAAA,GAAoB,CAAA;AAC5B,IAAA,IAAA,CAAQ,oBAAA,GAAuB,CAAA;AAC/B,IAAA,IAAA,CAAQ,kBAAA,GAAqB,KAAA;AAI3B,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAAA,EAClB;AAAA,EAEA,QAAQ,GAAA,EAAa;AACnB,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AACX,IAAA,IAAA,CAAK,kBAAA,GAAqB,KAAA;AAC1B,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,SAAA,CAAU,GAAG,CAAA;AAE/B,IAAA,IAAA,CAAK,MAAA,CAAO,SAAS,MAAM;AACzB,MAAA,IAAA,CAAK,iBAAA,GAAoB,CAAA;AACzB,MAAA,IAAA,CAAK,SAAS,MAAA,IAAS;AAAA,IACzB,CAAA;AACA,IAAA,IAAA,CAAK,MAAA,CAAO,SAAA,GAAY,CAAC,CAAA,KAAoB;AAC3C,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAA,CAAE,IAAI,CAAA;AAC9B,QAAA,IAAA,CAAK,QAAA,CAAS,YAAY,IAAI,CAAA;AAAA,MAChC,SAAS,GAAA,EAAK;AACZ,QAAA,OAAA,CAAQ,KAAA,CAAM,2BAA2B,GAAG,CAAA;AAAA,MAC9C;AAAA,IACF,CAAA;AACA,IAAA,IAAA,CAAK,MAAA,CAAO,OAAA,GAAU,CAAC,CAAA,KAAa;AAClC,MAAA,IAAA,CAAK,QAAA,CAAS,UAAU,CAAC,CAAA;AAAA,IAC3B,CAAA;AACA,IAAA,IAAA,CAAK,MAAA,CAAO,OAAA,GAAU,CAAC,CAAA,KAAkB;AACvC,MAAA,IAAA,CAAK,QAAA,CAAS,UAAU,CAAC,CAAA;AAGzB,MAAA,IAAI,CAAC,KAAK,kBAAA,EAAoB;AAC5B,QAAA,IAAA,CAAK,gBAAA,EAAiB;AAAA,MACxB;AAAA,IACF,CAAA;AAAA,EACF;AAAA,EAEQ,gBAAA,GAAmB;AACzB,IAAA,IAAI,IAAA,CAAK,iBAAA,IAAqB,IAAA,CAAK,oBAAA,EAAsB;AACvD,MAAA,OAAA,CAAQ,MAAM,uCAAkC,CAAA;AAChD,MAAA;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,iBAAA,EAAA;AAEL,IAAA,MAAM,QAAQ,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,iBAAiB,CAAA,GAAI,GAAA;AACpD,IAAA,UAAA,CAAW,MAAM;AACf,MAAA,IAAI,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,OAAA,CAAQ,KAAK,GAAG,CAAA;AAAA,IACrC,GAAG,KAAK,CAAA;AAAA,EACV;AAAA,EACA,KAAK,OAAA,EAAyB;AAC5B,IAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,UAAA,KAAe,SAAA,CAAU,IAAA,EAAM;AAC9C,MAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAAA,IAC1C;AAAA,EACF;AAAA,EAEA,KAAA,GAAQ;AACN,IAAA,IAAA,CAAK,kBAAA,GAAqB,IAAA;AAC1B,IAAA,IAAA,CAAK,QAAQ,KAAA,EAAM;AAAA,EACrB;AACF;;;AC1EO,IAAM,OAAA,GAAU;;;ACyBhB,IAAM,wBAAN,MAA4B;AAAA,EAgBjC,YAAY,MAAA,EAA2B;AAfvC,IAAA,IAAA,CAAiB,MAAA,GAAS,IAAI,cAAA,EAAc;AAC5C,IAAA,IAAA,CAAiB,YAAA,GAAe,IAAI,YAAA,EAAa;AAGjD,IAAA,IAAA,CAAQ,SAAA,GAAY,EAAA;AACpB,IAAA,IAAA,CAAQ,UAAA,GAA4B,IAAA;AAIpC,IAAA,IAAA,CAAQ,YAEJ,EAAC;AAKH,IAAA,IAAI,CAAC,MAAA,CAAO,SAAA,EAAW,MAAM,IAAI,MAAM,mBAAmB,CAAA;AAC1D,IAAA,IAAI,CAAC,MAAA,CAAO,SAAA,EAAW,MAAM,IAAI,MAAM,mBAAmB,CAAA;AAC1D,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,EAAU,MAAM,IAAI,MAAM,kBAAkB,CAAA;AAExD,IAAA,IAAA,CAAK,MAAA,GAAS;AAAA,MACZ,cAAA,EAAgB,KAAA;AAAA,MAChB,WAAA,EAAa,KAAA;AAAA,MACb,GAAG;AAAA,KACL;AAGA,IAAA,IAAA,CAAK,YAAA,CAAa,UAAU,CAAC,CAAA,KAAM,KAAK,IAAA,CAAK,OAAA,EAAS,CAAC,CAAC,CAAA;AACxD,IAAA,IAAA,CAAK,wBAAA,EAAyB;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,EAAA,CACE,OACA,EAAA,EACA;AAlEJ,IAAA,IAAA,EAAA;AAmEI,IAAA,CAAA,EAAA,GAAA,IAAA,CAAK,SAAA,EAAL,KAAA,CAAA,KAAA,EAAA,CAAA,KAAA,CAAA,mBAA0B,IAAI,GAAA,EAAI,CAAA;AAClC,IAAA,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,CAAG,GAAA,CAAI,EAAE,CAAA;AAC7B,IAAA,OAAO,MAAM,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,CAAG,OAAO,EAAE,CAAA;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,KAAA,GAAQ;AACZ,IAAA,IAAI,IAAA,CAAK,YAAA,CAAa,OAAA,KAAY,MAAA,EAAQ;AAC1C,IAAA,IAAA,CAAK,YAAA,EAAa;AAClB,IAAA,gBAAA,EAAiB;AACjB,IAAA,IAAA,CAAK,YAAA,CAAa,WAAW,cAAc,CAAA;AAE3C,IAAA,IAAI;AACF,MAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,aAAA,EAAc;AAGvC,MAAA,IAAA,CAAK,UAAA,GAAa,IAAA,CAAK,MAAA,CAAO,oBAAA,EAAqB;AACnD,MAAA,IAAA,CAAK,SAAA,GAAY,MAAA,CAAO,UAAA,EAAW,GAAI,OAAO,UAAA,EAAW;AAEzD,MAAA,IAAA,CAAK,SAAA,GAAY,IAAI,SAAA,CAAU;AAAA,QAC7B,QAAQ,MAAM;AAEZ,UAAA,IAAA,CAAK,UAAW,IAAA,CAAK;AAAA,YACnB,IAAA,EAAM,UAAA;AAAA,YACN,WAAW,IAAA,CAAK,SAAA;AAAA,YAChB,GAAG,IAAA,CAAK;AAAA,WACT,CAAA;AACD,UAAA,IAAA,CAAK,YAAA,CAAa,WAAW,eAAe,CAAA;AAAA,QAC9C,CAAA;AAAA,QACA,SAAA,EAAW,CAAC,GAAA,KAAwB,IAAA,CAAK,cAAc,GAAG,CAAA;AAAA,QAC1D,SAAS,MAAM,IAAA,CAAK,KAAK,IAAI,KAAA,CAAM,6BAA6B,CAAC;AAAA,OAClE,CAAA;AAED,MAAA,IAAA,CAAK,SAAA,CAAU,QAAQ,KAAK,CAAA;AAC5B,MAAA,MAAM,KAAK,cAAA,EAAe;AAAA,IAC5B,SAAS,GAAA,EAAK;AACZ,MAAA,IAAA,CAAK,KAAK,GAAA,YAAe,KAAA,GAAQ,MAAM,IAAI,KAAA,CAAM,cAAc,CAAC,CAAA;AAAA,IAClE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,IAAA,GAAO;AACL,IAAA,IAAA,CAAK,UAAU,KAAK,CAAA;AAAA,EACtB;AAAA;AAAA;AAAA,EAKA,MAAc,aAAA,GAAiC;AAC7C,IAAA,MAAM,EAAE,SAAA,EAAW,SAAA,EAAW,QAAA,KAAa,IAAA,CAAK,MAAA;AAChD,IAAA,MAAM,MAAM,MAAM,KAAA;AAAA,MAChB,GAAG,OAAO,CAAA,kBAAA,EAAqB,SAAS,CAAA,WAAA,EAAc,QAAQ,eAAe,SAAS,CAAA;AAAA,KACxF;AAEA,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,KAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,MAAA,MAAM,IAAI,MAAM,KAAK,CAAA;AAAA,IACvB;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,OAAO,IAAA,CAAK,SAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,cAAA,GAAiB;AAC7B,IAAA,MAAM,OAAA,GAAU;AAAA,MACd,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,SAAA,EAAW,KAAK,MAAA,CAAO,SAAA;AAAA,MACvB,QAAA,EAAU,KAAK,MAAA,CAAO,QAAA;AAAA,MACtB,SAAA,EAAW,KAAK,MAAA,CAAO,SAAA;AAAA,MACvB,GAAA,EAAK,OAAO,QAAA,CAAS;AAAA,KACvB;AAEA,IAAA,MAAM,WAAA,GACJ,KAAK,MAAA,CAAO,WAAA,IACZ,CAAC,sBAAA,CAAuB,IAAA,CAAK,UAAU,SAAS,CAAA;AAElD,IAAA,IAAI,CAAC,WAAA,IAAe,IAAA,CAAK,UAAA,EAAY;AAEnC,MAAA,gBAAA,CAAiB,IAAA,CAAK,SAAA,EAAW,IAAA,CAAK,UAAA,EAAY,IAAI,GAAM,CAAA;AAC5D,MAAA,IAAA,CAAK,IAAA;AAAA,QACH,UAAA;AAAA,QACA,CAAA,wCAAA,EAA2C,kBAAA;AAAA,UACzC,IAAA,CAAK;AAAA,SACN,CAAA,YAAA,EAAe,kBAAA;AAAA,UACd,IAAA,CAAK;AAAA,SACN,CAAA,WAAA,EAAc,kBAAA,CAAmB,IAAA,CAAK,MAAA,CAAO,SAAS,CAAC,CAAA,UAAA,EACtD,IAAA,CAAK,MAAA,CAAO,QACd,CAAA,WAAA,EAAc,kBAAA;AAAA,UACZ,KAAK,MAAA,CAAO;AAAA,SACb,CAAA,KAAA,EAAQ,kBAAA,CAAmB,MAAA,CAAO,QAAA,CAAS,IAAI,CAAC,CAAA;AAAA,OACnD;AAAA,IACF,CAAA,MAAO;AACL,MAAA,MAAM,KAAK,MAAMG,uBAAA,CAAO,UAAU,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA,EAAG;AAAA,QACzD,IAAA,EAAM,WAAA;AAAA,QACN,KAAA,EAAO,CAAA;AAAA,QACP,KAAA,EAAO,EAAE,KAAA,EAAO,SAAA,EAAW,MAAM,WAAA;AAAY,OAC9C,CAAA;AACD,MAAA,IAAA,CAAK,IAAA,CAAK,MAAM,EAAE,CAAA;AAAA,IACpB;AAAA,EACF;AAAA;AAAA,EAGQ,cAAc,GAAA,EAAqB;AACzC,IAAA,QAAQ,IAAI,IAAA;AAAM,MAChB,KAAK,QAAA;AACH,QAAA,IAAA,CAAK,YAAA,CAAa,WAAW,QAAQ,CAAA;AACrC,QAAA,IAAA,CAAK,UAAW,IAAA,CAAK;AAAA,UACnB,IAAA,EAAM,cAAA;AAAA,UACN,WAAW,IAAA,CAAK,SAAA;AAAA,UAChB,GAAG,IAAA,CAAK,MAAA;AAAA,UACR,GAAA,EAAK,OAAO,QAAA,CAAS;AAAA,SACtB,CAAA;AACD,QAAA;AAAA,MAEF,KAAK,oBAAA;AAEH,QAAA,IAAA,CAAK,kBAAkB,GAAG,CAAA;AAC1B,QAAA;AAAA,MAEF,KAAK,kBAAA;AACH,QAAA,IAAA,CAAK,IAAA,CAAK,IAAI,KAAA,CAAM,iDAAiD,CAAC,CAAA;AACtE,QAAA,IAAA,CAAK,mBAAA,EAAoB;AACzB,QAAA;AAAA,MAEF,KAAK,WAAA;AAEH,QAAA,IAAA,CAAK,UAAU,IAAI,CAAA;AACnB,QAAA,IAAA,CAAK,mBAAA,EAAoB;AACzB,QAAA;AAAA;AACJ,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,kBAAkB,GAAA,EAAqB;AAC7C,IAAA,IAAI,CAAC,KAAK,UAAA,IAAc,CAAC,IAAI,MAAA,IAAU,CAAC,IAAI,KAAA,EAAO;AACjD,MAAA,IAAA,CAAK,IAAA,CAAK,IAAI,KAAA,CAAM,gCAAgC,CAAC,CAAA;AACrD,MAAA,IAAA,CAAK,mBAAA,EAAoB;AACzB,MAAA;AAAA,IACF;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAY,IAAA,CAAK,MAAA,CAAO,gBAAA,CAAiB;AAAA,QAC7C,WAAW,EAAE,MAAA,EAAQ,IAAI,MAAA,EAAQ,KAAA,EAAO,IAAI,KAAA,EAAM;AAAA,QAClD,WAAW,IAAA,CAAK;AAAA,OACjB,CAAA;AAED,MAAA,IAAI,CAAC,SAAA,EAAW;AACd,QAAA,IAAA,CAAK,IAAA,CAAK,IAAI,KAAA,CAAM,6BAA6B,CAAC,CAAA;AAClD,QAAA,IAAA,CAAK,mBAAA,EAAoB;AACzB,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,MAAA,GAAyB,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA;AAEnD,MAAA,IAAA,CAAK,IAAA,CAAK,WAAW,MAAM,CAAA;AAC3B,MAAA,IAAA,CAAK,YAAA,CAAa,WAAW,eAAe,CAAA;AAG5C,MAAA,IAAA,CAAK,WAAW,IAAA,CAAK;AAAA,QACnB,IAAA,EAAM,SAAA;AAAA,QACN,WAAW,IAAA,CAAK;AAAA,OACjB,CAAA;AAAA,IACH,CAAA,CAAA,MAAQ;AACN,MAAA,IAAA,CAAK,IAAA,CAAK,IAAI,KAAA,CAAM,uCAAuC,CAAC,CAAA;AAC5D,MAAA,IAAA,CAAK,mBAAA,EAAoB;AAAA,IAC3B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,eAAe,MAAA,EAAqB;AAChD,IAAA,IAAI;AACF,MAAA,MAAM,MAAM,MAAM,KAAA;AAAA,QAChB,CAAA,EAAG,OAAO,CAAA,oBAAA,EAAuB,MAAA,CAAO,SAAS,CAAA;AAAA,OACnD;AAEA,MAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,MAAM,IAAI,MAAM,iBAAiB,CAAA;AAE9C,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,MAAA,MAAM,SAAA,GAAY,IAAA,CAAK,MAAA,CAAO,gBAAA,CAAiB;AAAA,QAC7C,WAAW,EAAE,MAAA,EAAQ,KAAK,MAAA,EAAQ,KAAA,EAAO,KAAK,KAAA,EAAM;AAAA,QACpD,WAAW,MAAA,CAAO;AAAA,OACnB,CAAA;AAED,MAAA,IAAI,CAAC,SAAA,EAAW;AACd,QAAA,IAAA,CAAK,IAAA,CAAK,IAAI,KAAA,CAAM,sBAAsB,CAAC,CAAA;AAC3C,QAAA,IAAA,CAAK,mBAAA,EAAoB;AACzB,QAAA;AAAA,MACF;AACA,MAAA,MAAM,MAAA,GAAyB,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA;AACnD,MAAA,IAAA,CAAK,IAAA,CAAK,WAAW,MAAM,CAAA;AAC3B,MAAA,gBAAA,EAAiB;AAAA,IACnB,CAAA,CAAA,MAAQ;AACN,MAAA,IAAA,CAAK,IAAA,CAAK,IAAI,KAAA,CAAM,yBAAyB,CAAC,CAAA;AAC9C,MAAA,IAAA,CAAK,mBAAA,EAAoB;AAAA,IAC3B;AAAA,EACF;AAAA,EAEQ,wBAAA,GAA2B;AACjC,IAAA,IAAA,CAAK,oBAAoB,YAAY;AACnC,MAAA,IAAI,QAAA,CAAS,oBAAoB,SAAA,EAAW;AAE5C,MAAA,MAAM,SAAS,cAAA,EAAe;AAC9B,MAAA,IAAI,CAAC,MAAA,EAAQ;AACb,MAAA,MAAM,IAAA,CAAK,eAAe,MAAM,CAAA;AAAA,IAClC,CAAA;AAEA,IAAA,QAAA,CAAS,gBAAA,CAAiB,kBAAA,EAAoB,IAAA,CAAK,iBAAiB,CAAA;AAAA,EACtE;AAAA,EAEQ,wBAAA,GAA2B;AACjC,IAAA,IAAI,KAAK,iBAAA,EAAmB;AAC1B,MAAA,QAAA,CAAS,mBAAA,CAAoB,kBAAA,EAAoB,IAAA,CAAK,iBAAiB,CAAA;AACvE,MAAA,IAAA,CAAK,iBAAA,GAAoB,MAAA;AAAA,IAC3B;AAAA,EACF;AAAA;AAAA,EAGQ,UAAU,OAAA,EAAkB;AAClC,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,IAAA,CAAK,WAAW,IAAA,CAAK;AAAA,QACnB,IAAA,EAAM,mBAAA;AAAA,QACN,WAAW,IAAA,CAAK,SAAA;AAAA,QAChB,SAAA,EAAW,KAAK,MAAA,CAAO,SAAA;AAAA,QACvB,SAAA,EAAW,KAAK,MAAA,CAAO,SAAA;AAAA,QACvB,QAAA,EAAU,KAAK,MAAA,CAAO;AAAA,OACvB,CAAA;AAAA,IACH;AAEA,IAAA,IAAA,CAAK,WAAW,KAAA,EAAM;AACtB,IAAA,gBAAA,EAAiB;AACjB,IAAA,IAAA,CAAK,YAAA,EAAa;AAElB,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,CAAO,cAAA,EAAgB;AAC/B,MAAA,IAAA,CAAK,wBAAA,EAAyB;AAAA,IAChC;AACA,IAAA,IAAA,CAAK,YAAA,CAAa,UAAA,CAAW,OAAA,GAAU,WAAA,GAAc,MAAM,CAAA;AAAA,EAC7D;AAAA,EAEQ,mBAAA,GAAsB;AAC5B,IAAA,IAAA,CAAK,YAAA,CAAa,WAAW,MAAM,CAAA;AACnC,IAAA,IAAA,CAAK,WAAW,KAAA,EAAM;AACtB,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,CAAO,cAAA,EAAgB;AACjC,IAAA,UAAA,CAAW,MAAM;AACf,MAAA,IAAA,CAAK,KAAA,EAAM;AAAA,IACb,GAAG,GAAG,CAAA;AAAA,EACR;AAAA,EAEQ,YAAA,GAAe;AACrB,IAAA,IAAA,CAAK,SAAA,GAAY,EAAA;AACjB,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAAA,EACpB;AAAA;AAAA,EAGA,OAAA,GAAU;AACR,IAAA,IAAA,CAAK,wBAAA,EAAyB;AAC9B,IAAA,IAAA,CAAK,WAAW,KAAA,EAAM;AACtB,IAAA,IAAA,CAAK,YAAY,EAAC;AAAA,EACpB;AAAA,EAEQ,IAAA,CACN,OACA,OAAA,EACA;AACA,IAAA,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,EAAG,OAAA,CAAQ,CAAC,EAAA,KAAO,EAAA,CAAG,OAAO,CAAC,CAAA;AAAA,EACpD;AAAA,EAEQ,KAAK,GAAA,EAAY;AACvB,IAAA,IAAA,CAAK,IAAA,CAAK,SAAS,GAAG,CAAA;AACtB,IAAA,IAAA,CAAK,YAAA,CAAa,WAAW,OAAO,CAAA;AAAA,EACtC;AACF","file":"index.js","sourcesContent":["import nacl from \"tweetnacl\";\nimport { decodeBase64, encodeBase64 } from \"tweetnacl-util\";\n\ninterface EncryptedMessage {\n  cipher: string; // Base64 encoded\n  nonce: string; // Base64 encoded\n}\n\nexport class CryptoService {\n  generateSymmetricKey(): string {\n    const key = nacl.randomBytes(32);\n    return encodeBase64(key);\n  }\n\n  /**\n   * Encrypt with symmetric key (secret-key encryption)\n   * Use this when both parties share the same secret key\n   * @param plaintext - Message to encrypt\n   * @param keyString - Symmetric key (base64)\n   * @returns Encrypted message with nonce\n   */\n  encryptSymmetric({\n    plaintext,\n    keyString,\n  }: {\n    plaintext: string;\n    keyString: string;\n  }): EncryptedMessage {\n    const key = decodeBase64(keyString);\n    const nonce = nacl.randomBytes(24);\n\n    const messageBytes = new TextEncoder().encode(plaintext);\n\n    const ciphertext = nacl.secretbox(messageBytes, nonce, key);\n\n    return {\n      cipher: encodeBase64(ciphertext),\n      nonce: encodeBase64(nonce),\n    };\n  }\n\n  /**\n   * Decrypt with symmetric key\n   * @param encrypted - Encrypted message with nonce\n   * @param keyString - Symmetric key (base64)\n   * @returns Decrypted plaintext\n   */\n  decryptSymmetric({\n    encrypted,\n    keyString,\n  }: {\n    encrypted: EncryptedMessage;\n    keyString: string;\n  }): string | null {\n    try {\n      const key = decodeBase64(keyString);\n      const ciphertextBytes = decodeBase64(encrypted.cipher);\n      const nonceBytes = decodeBase64(encrypted.nonce);\n\n      const decrypted = nacl.secretbox.open(ciphertextBytes, nonceBytes, key);\n\n      if (!decrypted) {\n        throw new Error(\"Decryption failed - invalid key or corrupted data\");\n      }\n\n      const decoded = new TextDecoder().decode(decrypted);\n      return decoded;\n    } catch (error) {\n      console.error(\"Decryption failed\", error);\n      return null;\n    }\n  }\n}\n\nexport default CryptoService;\nexport type { EncryptedMessage };\n","// hybridStorage.ts\n/**\n * Hybrid storage: Try sessionStorage first, fallback to memory\n * Best of both worlds - survives page refresh but auto-cleans\n */\n\ninterface StorageOptions {\n  ttlMs?: number;\n  useSessionStorage?: boolean;\n}\n\nclass AuthStorage {\n  private readonly prefix = \"pelican_auth_\";\n  private readonly defaultTTL = 5 * 60 * 1000; // 5 minutes\n  private memoryCache: Map<string, { value: any; expiresAt: number }> =\n    new Map();\n\n  /**\n   * Store auth session with automatic cleanup\n   */\n  set(key: string, value: any, options: StorageOptions = {}): void {\n    const { ttlMs = this.defaultTTL, useSessionStorage = true } = options;\n\n    const expiresAt = Date.now() + ttlMs;\n    const data = { value, expiresAt };\n\n    // Try sessionStorage first\n    if (useSessionStorage) {\n      try {\n        sessionStorage.setItem(`${this.prefix}${key}`, JSON.stringify(data));\n      } catch (error) {\n        console.warn(\"SessionStorage unavailable, using memory:\", error);\n        this.setMemory(key, data);\n      }\n    } else {\n      this.setMemory(key, data);\n    }\n  }\n\n  /**\n   * Get stored value if not expired\n   */\n  get(key: string): any | null {\n    // Try sessionStorage first\n    try {\n      const stored = sessionStorage.getItem(`${this.prefix}${key}`);\n      if (stored) {\n        const data = JSON.parse(stored);\n\n        // Check expiration\n        if (Date.now() > data.expiresAt) {\n          this.remove(key);\n          return null;\n        }\n\n        return data.value;\n      }\n    } catch (error) {\n      // Fallback to memory\n    }\n\n    // Try memory cache\n    return this.getMemory(key);\n  }\n\n  /**\n   * Remove specific key\n   */\n  remove(key: string): void {\n    try {\n      sessionStorage.removeItem(`${this.prefix}${key}`);\n    } catch (error) {\n      // Ignore\n    }\n    this.memoryCache.delete(key);\n  }\n\n  /**\n   * Clear all auth data\n   */\n  clear(): void {\n    // Clear sessionStorage\n    try {\n      Object.keys(sessionStorage).forEach((key) => {\n        if (key.startsWith(this.prefix)) {\n          sessionStorage.removeItem(key);\n        }\n      });\n    } catch (error) {\n      // Ignore\n    }\n\n    // Clear memory\n    this.memoryCache.clear();\n  }\n\n  // ========================================\n  // Memory cache helpers\n  // ========================================\n\n  private setMemory(\n    key: string,\n    data: { value: any; expiresAt: number }\n  ): void {\n    this.memoryCache.set(key, data);\n\n    // Schedule cleanup\n    const ttl = data.expiresAt - Date.now();\n    setTimeout(() => {\n      this.memoryCache.delete(key);\n    }, ttl);\n  }\n\n  private getMemory(key: string): any | null {\n    const data = this.memoryCache.get(key);\n    if (!data) return null;\n\n    if (Date.now() > data.expiresAt) {\n      this.memoryCache.delete(key);\n      return null;\n    }\n\n    return data.value;\n  }\n}\n\n// Singleton instance\nconst storage = new AuthStorage();\n\n// ========================================\n// Convenience functions for auth flow\n// ========================================\n\nexport interface AuthSession {\n  sessionId: string;\n  sessionKey: string;\n}\n\nexport const storeAuthSession = (\n  sessionId: string,\n  sessionKey: string,\n  ttlMs?: number\n): void => {\n  storage.set(\"session\", { sessionId, sessionKey }, { ttlMs });\n};\n\nexport const getAuthSession = (): AuthSession | null => {\n  return storage.get(\"session\");\n};\n\nexport const clearAuthSession = (): void => {\n  storage.remove(\"session\");\n};\n\nexport const clearAllAuthData = (): void => {\n  storage.clear();\n};\n\nexport default storage;\n","import type { PelicanAuthState } from \"../types/types\";\n\nexport class StateMachine {\n  private state: PelicanAuthState = \"idle\";\n  private listeners = new Set<(s: PelicanAuthState) => void>();\n\n  get current() {\n    return this.state;\n  }\n\n  transition(next: PelicanAuthState) {\n    this.state = next;\n    this.listeners.forEach((l) => l(next));\n  }\n\n  subscribe(fn: (s: PelicanAuthState) => void) {\n    this.listeners.add(fn);\n    return () => this.listeners.delete(fn);\n  }\n}\n","import { ISocketMessage } from \"../types/types\";\n\ntype TransportHandlers = {\n  onOpen?: () => void;\n  onMessage?: (msg: ISocketMessage) => void;\n  onError?: (err: Event) => void;\n  onClose?: (ev: CloseEvent) => void;\n};\n\nexport class Transport {\n  private socket?: WebSocket;\n  private handlers: TransportHandlers;\n  private reconnectAttempts = 0;\n  private maxReconnectAttempts = 5;\n  private isExplicitlyClosed = false;\n  private url?: string;\n\n  constructor(handlers: TransportHandlers) {\n    this.handlers = handlers;\n  }\n\n  connect(url: string) {\n    this.url = url;\n    this.isExplicitlyClosed = false;\n    this.socket = new WebSocket(url);\n\n    this.socket.onopen = () => {\n      this.reconnectAttempts = 0;\n      this.handlers.onOpen?.();\n    };\n    this.socket.onmessage = (e: MessageEvent) => {\n      try {\n        const data = JSON.parse(e.data);\n        this.handlers.onMessage?.(data);\n      } catch (err) {\n        console.error(\"Failed to parse message\", err);\n      }\n    };\n    this.socket.onerror = (e: Event) => {\n      this.handlers.onError?.(e);\n    };\n    this.socket.onclose = (e: CloseEvent) => {\n      this.handlers.onClose?.(e);\n\n      // Only reconnect if the user didn't call .close() manually\n      if (!this.isExplicitlyClosed) {\n        this.attemptReconnect();\n      }\n    };\n  }\n\n  private attemptReconnect() {\n    if (this.reconnectAttempts >= this.maxReconnectAttempts) {\n      console.error(\"❌ Max reconnect attempts reached\");\n      return;\n    }\n\n    this.reconnectAttempts++;\n\n    const delay = Math.pow(2, this.reconnectAttempts) * 500;\n    setTimeout(() => {\n      if (this.url) this.connect(this.url);\n    }, delay);\n  }\n  send(payload: ISocketMessage) {\n    if (this.socket?.readyState === WebSocket.OPEN) {\n      this.socket.send(JSON.stringify(payload));\n    }\n  }\n\n  close() {\n    this.isExplicitlyClosed = true;\n    this.socket?.close();\n  }\n}\n","export const BASEURL = \"https://identityapi.pelicanidentity.com\";\n","import CryptoService from \"../utilities/crypto\";\nimport QRCode from \"qrcode\";\nimport {\n  PelicanAuthConfig,\n  PelicanAuthEventMap,\n  ISocketMessage,\n  IdentityResult,\n} from \"../types/types\";\nimport {\n  storeAuthSession,\n  getAuthSession,\n  clearAuthSession,\n  AuthSession,\n} from \"../utilities/storage\";\nimport { StateMachine } from \"../utilities/stateMachine\";\nimport { Transport } from \"../utilities/transport\";\n\nimport { BASEURL } from \"../constants\";\n\ntype Listener<T> = (payload: T) => void;\n\n/**\n * PelicanAuth SDK\n * Handles cross-device authentication via WebSockets and E2EE (End-to-End Encryption).\n */\nexport class PelicanAuthentication {\n  private readonly crypto = new CryptoService();\n  private readonly stateMachine = new StateMachine();\n\n  private transport?: Transport;\n  private sessionId = \"\";\n  private sessionKey: string | null = null;\n\n  private visibilityHandler?: () => void;\n\n  private listeners: {\n    [K in keyof PelicanAuthEventMap]?: Set<Listener<any>>;\n  } = {};\n\n  private readonly config: Required<PelicanAuthConfig>;\n\n  constructor(config: PelicanAuthConfig) {\n    if (!config.publicKey) throw new Error(\"Missing publicKey\");\n    if (!config.projectId) throw new Error(\"Missing projectId\");\n    if (!config.authType) throw new Error(\"Missing authType\");\n\n    this.config = {\n      continuousMode: false,\n      forceQRCode: false,\n      ...config,\n    };\n\n    // Sync internal state machine changes with the 'state' event\n    this.stateMachine.subscribe((s) => this.emit(\"state\", s));\n    this.attachVisibilityRecovery();\n  }\n\n  /* -------------------- public API -------------------- */\n\n  /**\n   * Subscribe to SDK events (qr, deeplink, success, error, state)\n   * @returns Unsubscribe function\n   */\n  on<K extends keyof PelicanAuthEventMap>(\n    event: K,\n    cb: Listener<PelicanAuthEventMap[K]>\n  ) {\n    this.listeners[event] ??= new Set();\n    this.listeners[event]!.add(cb);\n    return () => this.listeners[event]!.delete(cb);\n  }\n\n  /**\n   * Initializes the authentication flow.\n   * Fetches a relay, establishes a WebSocket, and generates the E2EE session key.\n   */\n  async start() {\n    if (this.stateMachine.current !== \"idle\") return;\n    this.resetSession();\n    clearAuthSession();\n    this.stateMachine.transition(\"initializing\");\n\n    try {\n      const relay = await this.fetchRelayUrl();\n\n      // Generate a fresh symmetric key for this specific session\n      this.sessionKey = this.crypto.generateSymmetricKey();\n      this.sessionId = crypto.randomUUID() + crypto.randomUUID();\n\n      this.transport = new Transport({\n        onOpen: () => {\n          // Register this browser session with the relay\n          this.transport!.send({\n            type: \"register\",\n            sessionID: this.sessionId,\n            ...this.config,\n          });\n          this.stateMachine.transition(\"awaiting-pair\");\n        },\n        onMessage: (msg: ISocketMessage) => this.handleMessage(msg),\n        onError: () => this.fail(new Error(\"WebSocket connection failed\")),\n      });\n\n      this.transport.connect(relay);\n      await this.emitEntryPoint();\n    } catch (err) {\n      this.fail(err instanceof Error ? err : new Error(\"Start failed\"));\n    }\n  }\n\n  /**\n   * Manually stops the authentication process and closes connections.\n   */\n  stop() {\n    this.terminate(false);\n  }\n\n  /* -------------------- internals -------------------- */\n\n  /** Fetches the WebSocket Relay URL from the backend */\n  private async fetchRelayUrl(): Promise<string> {\n    const { publicKey, projectId, authType } = this.config;\n    const res = await fetch(\n      `${BASEURL}/relay?public_key=${publicKey}&auth_type=${authType}&project_id=${projectId}`\n    );\n\n    if (!res.ok) {\n      const error = await res.text();\n      throw new Error(error);\n    }\n\n    const json = await res.json();\n    return json.relay_url;\n  }\n\n  /**\n   * Decides whether to show a QR code (Desktop) or a Deep Link (Mobile).\n   */\n  private async emitEntryPoint() {\n    const payload = {\n      sessionID: this.sessionId,\n      sessionKey: this.sessionKey,\n      publicKey: this.config.publicKey,\n      authType: this.config.authType,\n      projectId: this.config.projectId,\n      url: window.location.href,\n    };\n\n    const shouldUseQR =\n      this.config.forceQRCode ||\n      !/Android|iPhone|iPad/i.test(navigator.userAgent);\n\n    if (!shouldUseQR && this.sessionKey) {\n      // For mobile: Store session locally so we can recover when the user returns from the app\n      storeAuthSession(this.sessionId, this.sessionKey, 5 * 60_000);\n      this.emit(\n        \"deeplink\",\n        `pelicanvault://auth/deep-link?sessionID=${encodeURIComponent(\n          this.sessionId\n        )}&sessionKey=${encodeURIComponent(\n          this.sessionKey\n        )}&publicKey=${encodeURIComponent(this.config.publicKey)}&authType=${\n          this.config.authType\n        }&projectId=${encodeURIComponent(\n          this.config.projectId\n        )}&url=${encodeURIComponent(window.location.href)}`\n      );\n    } else {\n      const qr = await QRCode.toDataURL(JSON.stringify(payload), {\n        type: \"image/png\",\n        scale: 3,\n        color: { light: \"#ffffff\", dark: \"#424242ff\" },\n      });\n      this.emit(\"qr\", qr);\n    }\n  }\n\n  /** Main WebSocket message router */\n  private handleMessage(msg: ISocketMessage) {\n    switch (msg.type) {\n      case \"paired\":\n        this.stateMachine.transition(\"paired\");\n        this.transport!.send({\n          type: \"authenticate\",\n          sessionID: this.sessionId,\n          ...this.config,\n          url: window.location.href,\n        });\n        return;\n\n      case \"phone-auth-success\":\n        // Mobile device successfully authenticated and sent encrypted credentials\n        this.handleAuthSuccess(msg);\n        return;\n\n      case \"phone-terminated\":\n        this.fail(new Error(\"Authenticating device terminated the connection\"));\n        this.restartIfContinuous();\n        return;\n\n      case \"confirmed\":\n        // Handshake complete\n        this.terminate(true);\n        this.restartIfContinuous();\n        return;\n    }\n  }\n\n  /**\n   * Decrypts the identity payload received from the phone using the session key.\n   */\n  private handleAuthSuccess(msg: ISocketMessage) {\n    if (!this.sessionKey || !msg.cipher || !msg.nonce) {\n      this.fail(new Error(\"Invalid authentication payload\"));\n      this.restartIfContinuous();\n      return;\n    }\n\n    try {\n      const decrypted = this.crypto.decryptSymmetric({\n        encrypted: { cipher: msg.cipher, nonce: msg.nonce },\n        keyString: this.sessionKey,\n      });\n\n      if (!decrypted) {\n        this.fail(new Error(\"Invalid authentication data\"));\n        this.restartIfContinuous();\n        return;\n      }\n\n      const result: IdentityResult = JSON.parse(decrypted);\n\n      this.emit(\"success\", result);\n      this.stateMachine.transition(\"authenticated\");\n\n      // Signal to the relay/phone that we have received and decrypted the data\n      this.transport?.send({\n        type: \"confirm\",\n        sessionID: this.sessionId,\n      });\n    } catch {\n      this.fail(new Error(\"Failed to decrypt authentication data\"));\n      this.restartIfContinuous();\n    }\n  }\n\n  /**\n   * Logic to handle users returning to the browser tab after using the mobile app.\n   * Checks the server for a completed session that might have finished while in background.\n   */\n\n  private async getCachedEntry(cached: AuthSession) {\n    try {\n      const res = await fetch(\n        `${BASEURL}/session?session_id=${cached.sessionId}`\n      );\n\n      if (!res.ok) throw new Error(\"Invalid session\");\n\n      const data = await res.json();\n      const decrypted = this.crypto.decryptSymmetric({\n        encrypted: { cipher: data.cipher, nonce: data.nonce },\n        keyString: cached.sessionKey,\n      });\n\n      if (!decrypted) {\n        this.fail(new Error(\"Invalid session data\"));\n        this.restartIfContinuous();\n        return;\n      }\n      const result: IdentityResult = JSON.parse(decrypted);\n      this.emit(\"success\", result);\n      clearAuthSession();\n    } catch {\n      this.fail(new Error(\"Session recovery failed\"));\n      this.restartIfContinuous();\n    }\n  }\n\n  private attachVisibilityRecovery() {\n    this.visibilityHandler = async () => {\n      if (document.visibilityState !== \"visible\") return;\n\n      const cached = getAuthSession();\n      if (!cached) return;\n      await this.getCachedEntry(cached);\n    };\n\n    document.addEventListener(\"visibilitychange\", this.visibilityHandler);\n  }\n\n  private detachVisibilityRecovery() {\n    if (this.visibilityHandler) {\n      document.removeEventListener(\"visibilitychange\", this.visibilityHandler);\n      this.visibilityHandler = undefined;\n    }\n  }\n\n  /** Cleans up the current session state */\n  private terminate(success: boolean) {\n    if (!success) {\n      this.transport?.send({\n        type: \"client-terminated\",\n        sessionID: this.sessionId,\n        projectId: this.config.projectId,\n        publicKey: this.config.publicKey,\n        authType: this.config.authType,\n      });\n    }\n\n    this.transport?.close();\n    clearAuthSession();\n    this.resetSession();\n\n    if (!this.config.continuousMode) {\n      this.detachVisibilityRecovery();\n    }\n    this.stateMachine.transition(success ? \"confirmed\" : \"idle\");\n  }\n\n  private restartIfContinuous() {\n    this.stateMachine.transition(\"idle\");\n    this.transport?.close();\n    if (!this.config.continuousMode) return;\n    setTimeout(() => {\n      this.start();\n    }, 150);\n  }\n\n  private resetSession() {\n    this.sessionId = \"\";\n    this.sessionKey = null;\n  }\n\n  /** Completely destroys the instance and removes all listeners */\n  destroy() {\n    this.detachVisibilityRecovery();\n    this.transport?.close();\n    this.listeners = {};\n  }\n\n  private emit<K extends keyof PelicanAuthEventMap>(\n    event: K,\n    payload: PelicanAuthEventMap[K]\n  ) {\n    this.listeners[event]?.forEach((cb) => cb(payload));\n  }\n\n  private fail(err: Error) {\n    this.emit(\"error\", err);\n    this.stateMachine.transition(\"error\");\n  }\n}\n"]}

package/dist/index.mjs

@@ -234,7 +234,7 @@ var Transport = class {
 };
 
 // src/constants.ts
-var BASEURL = "http://192.168.1.2:8080";
+var BASEURL = "https://identityapi.pelicanidentity.com";
 
 // src/engine/engine.ts
 var PelicanAuthentication = class {
@@ -273,6 +273,7 @@ var PelicanAuthentication = class {
   async start() {
     if (this.stateMachine.current !== "idle") return;
     this.resetSession();
+    clearAuthSession();
     this.stateMachine.transition("initializing");
     try {
       const relay = await this.fetchRelayUrl();
@@ -310,7 +311,8 @@ var PelicanAuthentication = class {
       `${BASEURL}/relay?public_key=${publicKey}&auth_type=${authType}&project_id=${projectId}`
     );
     if (!res.ok) {
-      throw new Error("Failed to fetch relay URL");
+      const error = await res.text();
+      throw new Error(error);
     }
     const json = await res.json();
     return json.relay_url;
@@ -344,7 +346,7 @@ var PelicanAuthentication = class {
       const qr = await QRCode.toDataURL(JSON.stringify(payload), {
         type: "image/png",
         scale: 3,
-        color: { light: "#FFFFF5", dark: "#121212" }
+        color: { light: "#ffffff", dark: "#424242ff" }
       });
       this.emit("qr", qr);
     }
@@ -450,7 +452,6 @@ var PelicanAuthentication = class {
   }
   /** Cleans up the current session state */
   terminate(success) {
-    if (!this.transport) return;
     if (!success) {
       this.transport?.send({
         type: "client-terminated",
@@ -470,6 +471,7 @@ var PelicanAuthentication = class {
   }
   restartIfContinuous() {
     this.stateMachine.transition("idle");
+    this.transport?.close();
     if (!this.config.continuousMode) return;
     setTimeout(() => {
       this.start();

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/utilities/crypto.ts","../src/utilities/storage.ts","../src/utilities/stateMachine.ts","../src/utilities/transport.ts","../src/constants.ts","../src/engine/engine.ts"],"names":[],"mappings":";;;;;AAQO,IAAM,gBAAN,MAAoB;AAAA,EACzB,oBAAA,GAA+B;AAC7B,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,WAAA,CAAY,EAAE,CAAA;AAC/B,IAAA,OAAO,aAAa,GAAG,CAAA;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,gBAAA,CAAiB;AAAA,IACf,SAAA;AAAA,IACA;AAAA,GACF,EAGqB;AACnB,IAAA,MAAM,GAAA,GAAM,aAAa,SAAS,CAAA;AAClC,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,WAAA,CAAY,EAAE,CAAA;AAEjC,IAAA,MAAM,YAAA,GAAe,IAAI,WAAA,EAAY,CAAE,OAAO,SAAS,CAAA;AAEvD,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,SAAA,CAAU,YAAA,EAAc,OAAO,GAAG,CAAA;AAE1D,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,aAAa,UAAU,CAAA;AAAA,MAC/B,KAAA,EAAO,aAAa,KAAK;AAAA,KAC3B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,gBAAA,CAAiB;AAAA,IACf,SAAA;AAAA,IACA;AAAA,GACF,EAGkB;AAChB,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,aAAa,SAAS,CAAA;AAClC,MAAA,MAAM,eAAA,GAAkB,YAAA,CAAa,SAAA,CAAU,MAAM,CAAA;AACrD,MAAA,MAAM,UAAA,GAAa,YAAA,CAAa,SAAA,CAAU,KAAK,CAAA;AAE/C,MAAA,MAAM,YAAY,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,eAAA,EAAiB,YAAY,GAAG,CAAA;AAEtE,MAAA,IAAI,CAAC,SAAA,EAAW;AACd,QAAA,MAAM,IAAI,MAAM,mDAAmD,CAAA;AAAA,MACrE;AAEA,MAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY,CAAE,OAAO,SAAS,CAAA;AAClD,MAAA,OAAO,OAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,OAAA,CAAQ,KAAA,CAAM,qBAAqB,KAAK,CAAA;AACxC,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AACF;AAEA,IAAO,cAAA,GAAQ,aAAA;;;AC/Df,IAAM,cAAN,MAAkB;AAAA,EAAlB,WAAA,GAAA;AACE,IAAA,IAAA,CAAiB,MAAA,GAAS,eAAA;AAC1B,IAAA,IAAA,CAAiB,UAAA,GAAa,IAAI,EAAA,GAAK,GAAA;AACvC;AAAA,IAAA,IAAA,CAAQ,WAAA,uBACF,GAAA,EAAI;AAAA,EAAA;AAAA;AAAA;AAAA;AAAA,EAKV,GAAA,CAAI,GAAA,EAAa,KAAA,EAAY,OAAA,GAA0B,EAAC,EAAS;AAC/D,IAAA,MAAM,EAAE,KAAA,GAAQ,IAAA,CAAK,UAAA,EAAY,iBAAA,GAAoB,MAAK,GAAI,OAAA;AAE9D,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA;AAC/B,IAAA,MAAM,IAAA,GAAO,EAAE,KAAA,EAAO,SAAA,EAAU;AAGhC,IAAA,IAAI,iBAAA,EAAmB;AACrB,MAAA,IAAI;AACF,QAAA,cAAA,CAAe,OAAA,CAAQ,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AAAA,MACrE,SAAS,KAAA,EAAO;AACd,QAAA,OAAA,CAAQ,IAAA,CAAK,6CAA6C,KAAK,CAAA;AAC/D,QAAA,IAAA,CAAK,SAAA,CAAU,KAAK,IAAI,CAAA;AAAA,MAC1B;AAAA,IACF,CAAA,MAAO;AACL,MAAA,IAAA,CAAK,SAAA,CAAU,KAAK,IAAI,CAAA;AAAA,IAC1B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,GAAA,EAAyB;AAE3B,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,eAAe,OAAA,CAAQ,CAAA,EAAG,KAAK,MAAM,CAAA,EAAG,GAAG,CAAA,CAAE,CAAA;AAC5D,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA;AAG9B,QAAA,IAAI,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,SAAA,EAAW;AAC/B,UAAA,IAAA,CAAK,OAAO,GAAG,CAAA;AACf,UAAA,OAAO,IAAA;AAAA,QACT;AAEA,QAAA,OAAO,IAAA,CAAK,KAAA;AAAA,MACd;AAAA,IACF,SAAS,KAAA,EAAO;AAAA,IAEhB;AAGA,IAAA,OAAO,IAAA,CAAK,UAAU,GAAG,CAAA;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,GAAA,EAAmB;AACxB,IAAA,IAAI;AACF,MAAA,cAAA,CAAe,WAAW,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,EAAG,GAAG,CAAA,CAAE,CAAA;AAAA,IAClD,SAAS,KAAA,EAAO;AAAA,IAEhB;AACA,IAAA,IAAA,CAAK,WAAA,CAAY,OAAO,GAAG,CAAA;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA,EAKA,KAAA,GAAc;AAEZ,IAAA,IAAI;AACF,MAAA,MAAA,CAAO,IAAA,CAAK,cAAc,CAAA,CAAE,OAAA,CAAQ,CAAC,GAAA,KAAQ;AAC3C,QAAA,IAAI,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,MAAM,CAAA,EAAG;AAC/B,UAAA,cAAA,CAAe,WAAW,GAAG,CAAA;AAAA,QAC/B;AAAA,MACF,CAAC,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AAAA,IAEhB;AAGA,IAAA,IAAA,CAAK,YAAY,KAAA,EAAM;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA,EAMQ,SAAA,CACN,KACA,IAAA,EACM;AACN,IAAA,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,GAAA,EAAK,IAAI,CAAA;AAG9B,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,SAAA,GAAY,IAAA,CAAK,GAAA,EAAI;AACtC,IAAA,UAAA,CAAW,MAAM;AACf,MAAA,IAAA,CAAK,WAAA,CAAY,OAAO,GAAG,CAAA;AAAA,IAC7B,GAAG,GAAG,CAAA;AAAA,EACR;AAAA,EAEQ,UAAU,GAAA,EAAyB;AACzC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,GAAG,CAAA;AACrC,IAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAElB,IAAA,IAAI,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,SAAA,EAAW;AAC/B,MAAA,IAAA,CAAK,WAAA,CAAY,OAAO,GAAG,CAAA;AAC3B,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EACd;AACF,CAAA;AAGA,IAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAWzB,IAAM,gBAAA,GAAmB,CAC9B,SAAA,EACA,UAAA,EACA,KAAA,KACS;AACT,EAAA,OAAA,CAAQ,GAAA,CAAI,WAAW,EAAE,SAAA,EAAW,YAAW,EAAG,EAAE,OAAO,CAAA;AAC7D;AAEO,IAAM,iBAAiB,MAA0B;AACtD,EAAA,OAAO,OAAA,CAAQ,IAAI,SAAS,CAAA;AAC9B;AAEO,IAAM,mBAAmB,MAAY;AAC1C,EAAA,OAAA,CAAQ,OAAO,SAAS,CAAA;AAC1B;AAEO,IAAM,mBAAmB,MAAY;AAC1C,EAAA,OAAA,CAAQ,KAAA,EAAM;AAChB;;;AC1JO,IAAM,eAAN,MAAmB;AAAA,EAAnB,WAAA,GAAA;AACL,IAAA,IAAA,CAAQ,KAAA,GAA0B,MAAA;AAClC,IAAA,IAAA,CAAQ,SAAA,uBAAgB,GAAA,EAAmC;AAAA,EAAA;AAAA,EAE3D,IAAI,OAAA,GAAU;AACZ,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EACd;AAAA,EAEA,WAAW,IAAA,EAAwB;AACjC,IAAA,IAAA,CAAK,KAAA,GAAQ,IAAA;AACb,IAAA,IAAA,CAAK,UAAU,OAAA,CAAQ,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAC,CAAA;AAAA,EACvC;AAAA,EAEA,UAAU,EAAA,EAAmC;AAC3C,IAAA,IAAA,CAAK,SAAA,CAAU,IAAI,EAAE,CAAA;AACrB,IAAA,OAAO,MAAM,IAAA,CAAK,SAAA,CAAU,MAAA,CAAO,EAAE,CAAA;AAAA,EACvC;AACF;;;ACVO,IAAM,YAAN,MAAgB;AAAA,EAQrB,YAAY,QAAA,EAA6B;AALzC,IAAA,IAAA,CAAQ,iBAAA,GAAoB,CAAA;AAC5B,IAAA,IAAA,CAAQ,oBAAA,GAAuB,CAAA;AAC/B,IAAA,IAAA,CAAQ,kBAAA,GAAqB,KAAA;AAI3B,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAAA,EAClB;AAAA,EAEA,QAAQ,GAAA,EAAa;AACnB,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AACX,IAAA,IAAA,CAAK,kBAAA,GAAqB,KAAA;AAC1B,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,SAAA,CAAU,GAAG,CAAA;AAE/B,IAAA,IAAA,CAAK,MAAA,CAAO,SAAS,MAAM;AACzB,MAAA,IAAA,CAAK,iBAAA,GAAoB,CAAA;AACzB,MAAA,IAAA,CAAK,SAAS,MAAA,IAAS;AAAA,IACzB,CAAA;AACA,IAAA,IAAA,CAAK,MAAA,CAAO,SAAA,GAAY,CAAC,CAAA,KAAoB;AAC3C,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAA,CAAE,IAAI,CAAA;AAC9B,QAAA,IAAA,CAAK,QAAA,CAAS,YAAY,IAAI,CAAA;AAAA,MAChC,SAAS,GAAA,EAAK;AACZ,QAAA,OAAA,CAAQ,KAAA,CAAM,2BAA2B,GAAG,CAAA;AAAA,MAC9C;AAAA,IACF,CAAA;AACA,IAAA,IAAA,CAAK,MAAA,CAAO,OAAA,GAAU,CAAC,CAAA,KAAa;AAClC,MAAA,IAAA,CAAK,QAAA,CAAS,UAAU,CAAC,CAAA;AAAA,IAC3B,CAAA;AACA,IAAA,IAAA,CAAK,MAAA,CAAO,OAAA,GAAU,CAAC,CAAA,KAAkB;AACvC,MAAA,IAAA,CAAK,QAAA,CAAS,UAAU,CAAC,CAAA;AAGzB,MAAA,IAAI,CAAC,KAAK,kBAAA,EAAoB;AAC5B,QAAA,IAAA,CAAK,gBAAA,EAAiB;AAAA,MACxB;AAAA,IACF,CAAA;AAAA,EACF;AAAA,EAEQ,gBAAA,GAAmB;AACzB,IAAA,IAAI,IAAA,CAAK,iBAAA,IAAqB,IAAA,CAAK,oBAAA,EAAsB;AACvD,MAAA,OAAA,CAAQ,MAAM,uCAAkC,CAAA;AAChD,MAAA;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,iBAAA,EAAA;AAEL,IAAA,MAAM,QAAQ,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,iBAAiB,CAAA,GAAI,GAAA;AACpD,IAAA,UAAA,CAAW,MAAM;AACf,MAAA,IAAI,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,OAAA,CAAQ,KAAK,GAAG,CAAA;AAAA,IACrC,GAAG,KAAK,CAAA;AAAA,EACV;AAAA,EACA,KAAK,OAAA,EAAyB;AAC5B,IAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,UAAA,KAAe,SAAA,CAAU,IAAA,EAAM;AAC9C,MAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAAA,IAC1C;AAAA,EACF;AAAA,EAEA,KAAA,GAAQ;AACN,IAAA,IAAA,CAAK,kBAAA,GAAqB,IAAA;AAC1B,IAAA,IAAA,CAAK,QAAQ,KAAA,EAAM;AAAA,EACrB;AACF;;;AC1EO,IAAM,OAAA,GAAU;;;ACyBhB,IAAM,wBAAN,MAA4B;AAAA,EAgBjC,YAAY,MAAA,EAA2B;AAfvC,IAAA,IAAA,CAAiB,MAAA,GAAS,IAAI,cAAA,EAAc;AAC5C,IAAA,IAAA,CAAiB,YAAA,GAAe,IAAI,YAAA,EAAa;AAGjD,IAAA,IAAA,CAAQ,SAAA,GAAY,EAAA;AACpB,IAAA,IAAA,CAAQ,UAAA,GAA4B,IAAA;AAIpC,IAAA,IAAA,CAAQ,YAEJ,EAAC;AAKH,IAAA,IAAI,CAAC,MAAA,CAAO,SAAA,EAAW,MAAM,IAAI,MAAM,mBAAmB,CAAA;AAC1D,IAAA,IAAI,CAAC,MAAA,CAAO,SAAA,EAAW,MAAM,IAAI,MAAM,mBAAmB,CAAA;AAC1D,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,EAAU,MAAM,IAAI,MAAM,kBAAkB,CAAA;AAExD,IAAA,IAAA,CAAK,MAAA,GAAS;AAAA,MACZ,cAAA,EAAgB,KAAA;AAAA,MAChB,WAAA,EAAa,KAAA;AAAA,MACb,GAAG;AAAA,KACL;AAGA,IAAA,IAAA,CAAK,YAAA,CAAa,UAAU,CAAC,CAAA,KAAM,KAAK,IAAA,CAAK,OAAA,EAAS,CAAC,CAAC,CAAA;AACxD,IAAA,IAAA,CAAK,wBAAA,EAAyB;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,EAAA,CACE,OACA,EAAA,EACA;AAlEJ,IAAA,IAAA,EAAA;AAmEI,IAAA,CAAA,EAAA,GAAA,IAAA,CAAK,SAAA,EAAL,KAAA,CAAA,KAAA,EAAA,CAAA,KAAA,CAAA,mBAA0B,IAAI,GAAA,EAAI,CAAA;AAClC,IAAA,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,CAAG,GAAA,CAAI,EAAE,CAAA;AAC7B,IAAA,OAAO,MAAM,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,CAAG,OAAO,EAAE,CAAA;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,KAAA,GAAQ;AACZ,IAAA,IAAI,IAAA,CAAK,YAAA,CAAa,OAAA,KAAY,MAAA,EAAQ;AAE1C,IAAA,IAAA,CAAK,YAAA,EAAa;AAClB,IAAA,IAAA,CAAK,YAAA,CAAa,WAAW,cAAc,CAAA;AAE3C,IAAA,IAAI;AACF,MAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,aAAA,EAAc;AAGvC,MAAA,IAAA,CAAK,UAAA,GAAa,IAAA,CAAK,MAAA,CAAO,oBAAA,EAAqB;AACnD,MAAA,IAAA,CAAK,SAAA,GAAY,MAAA,CAAO,UAAA,EAAW,GAAI,OAAO,UAAA,EAAW;AAEzD,MAAA,IAAA,CAAK,SAAA,GAAY,IAAI,SAAA,CAAU;AAAA,QAC7B,QAAQ,MAAM;AAEZ,UAAA,IAAA,CAAK,UAAW,IAAA,CAAK;AAAA,YACnB,IAAA,EAAM,UAAA;AAAA,YACN,WAAW,IAAA,CAAK,SAAA;AAAA,YAChB,GAAG,IAAA,CAAK;AAAA,WACT,CAAA;AACD,UAAA,IAAA,CAAK,YAAA,CAAa,WAAW,eAAe,CAAA;AAAA,QAC9C,CAAA;AAAA,QACA,SAAA,EAAW,CAAC,GAAA,KAAwB,IAAA,CAAK,cAAc,GAAG,CAAA;AAAA,QAC1D,SAAS,MAAM,IAAA,CAAK,KAAK,IAAI,KAAA,CAAM,6BAA6B,CAAC;AAAA,OAClE,CAAA;AAED,MAAA,IAAA,CAAK,SAAA,CAAU,QAAQ,KAAK,CAAA;AAC5B,MAAA,MAAM,KAAK,cAAA,EAAe;AAAA,IAC5B,SAAS,GAAA,EAAK;AACZ,MAAA,IAAA,CAAK,KAAK,GAAA,YAAe,KAAA,GAAQ,MAAM,IAAI,KAAA,CAAM,cAAc,CAAC,CAAA;AAAA,IAClE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,IAAA,GAAO;AACL,IAAA,IAAA,CAAK,UAAU,KAAK,CAAA;AAAA,EACtB;AAAA;AAAA;AAAA,EAKA,MAAc,aAAA,GAAiC;AAC7C,IAAA,MAAM,EAAE,SAAA,EAAW,SAAA,EAAW,QAAA,KAAa,IAAA,CAAK,MAAA;AAChD,IAAA,MAAM,MAAM,MAAM,KAAA;AAAA,MAChB,GAAG,OAAO,CAAA,kBAAA,EAAqB,SAAS,CAAA,WAAA,EAAc,QAAQ,eAAe,SAAS,CAAA;AAAA,KACxF;AAEA,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAI,MAAM,2BAA2B,CAAA;AAAA,IAC7C;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,OAAO,IAAA,CAAK,SAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,cAAA,GAAiB;AAC7B,IAAA,MAAM,OAAA,GAAU;AAAA,MACd,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,SAAA,EAAW,KAAK,MAAA,CAAO,SAAA;AAAA,MACvB,QAAA,EAAU,KAAK,MAAA,CAAO,QAAA;AAAA,MACtB,SAAA,EAAW,KAAK,MAAA,CAAO,SAAA;AAAA,MACvB,GAAA,EAAK,OAAO,QAAA,CAAS;AAAA,KACvB;AAEA,IAAA,MAAM,WAAA,GACJ,KAAK,MAAA,CAAO,WAAA,IACZ,CAAC,sBAAA,CAAuB,IAAA,CAAK,UAAU,SAAS,CAAA;AAElD,IAAA,IAAI,CAAC,WAAA,IAAe,IAAA,CAAK,UAAA,EAAY;AAEnC,MAAA,gBAAA,CAAiB,IAAA,CAAK,SAAA,EAAW,IAAA,CAAK,UAAA,EAAY,IAAI,GAAM,CAAA;AAC5D,MAAA,IAAA,CAAK,IAAA;AAAA,QACH,UAAA;AAAA,QACA,CAAA,wCAAA,EAA2C,kBAAA;AAAA,UACzC,IAAA,CAAK;AAAA,SACN,CAAA,YAAA,EAAe,kBAAA;AAAA,UACd,IAAA,CAAK;AAAA,SACN,CAAA,WAAA,EAAc,kBAAA,CAAmB,IAAA,CAAK,MAAA,CAAO,SAAS,CAAC,CAAA,UAAA,EACtD,IAAA,CAAK,MAAA,CAAO,QACd,CAAA,WAAA,EAAc,kBAAA;AAAA,UACZ,KAAK,MAAA,CAAO;AAAA,SACb,CAAA,KAAA,EAAQ,kBAAA,CAAmB,MAAA,CAAO,QAAA,CAAS,IAAI,CAAC,CAAA;AAAA,OACnD;AAAA,IACF,CAAA,MAAO;AACL,MAAA,MAAM,KAAK,MAAM,MAAA,CAAO,UAAU,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA,EAAG;AAAA,QACzD,IAAA,EAAM,WAAA;AAAA,QACN,KAAA,EAAO,CAAA;AAAA,QACP,KAAA,EAAO,EAAE,KAAA,EAAO,SAAA,EAAW,MAAM,SAAA;AAAU,OAC5C,CAAA;AACD,MAAA,IAAA,CAAK,IAAA,CAAK,MAAM,EAAE,CAAA;AAAA,IACpB;AAAA,EACF;AAAA;AAAA,EAGQ,cAAc,GAAA,EAAqB;AACzC,IAAA,QAAQ,IAAI,IAAA;AAAM,MAChB,KAAK,QAAA;AACH,QAAA,IAAA,CAAK,YAAA,CAAa,WAAW,QAAQ,CAAA;AACrC,QAAA,IAAA,CAAK,UAAW,IAAA,CAAK;AAAA,UACnB,IAAA,EAAM,cAAA;AAAA,UACN,WAAW,IAAA,CAAK,SAAA;AAAA,UAChB,GAAG,IAAA,CAAK,MAAA;AAAA,UACR,GAAA,EAAK,OAAO,QAAA,CAAS;AAAA,SACtB,CAAA;AACD,QAAA;AAAA,MAEF,KAAK,oBAAA;AAEH,QAAA,IAAA,CAAK,kBAAkB,GAAG,CAAA;AAC1B,QAAA;AAAA,MAEF,KAAK,kBAAA;AACH,QAAA,IAAA,CAAK,IAAA,CAAK,IAAI,KAAA,CAAM,iDAAiD,CAAC,CAAA;AACtE,QAAA,IAAA,CAAK,mBAAA,EAAoB;AACzB,QAAA;AAAA,MAEF,KAAK,WAAA;AAEH,QAAA,IAAA,CAAK,UAAU,IAAI,CAAA;AACnB,QAAA,IAAA,CAAK,mBAAA,EAAoB;AACzB,QAAA;AAAA;AACJ,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,kBAAkB,GAAA,EAAqB;AAC7C,IAAA,IAAI,CAAC,KAAK,UAAA,IAAc,CAAC,IAAI,MAAA,IAAU,CAAC,IAAI,KAAA,EAAO;AACjD,MAAA,IAAA,CAAK,IAAA,CAAK,IAAI,KAAA,CAAM,gCAAgC,CAAC,CAAA;AACrD,MAAA,IAAA,CAAK,mBAAA,EAAoB;AACzB,MAAA;AAAA,IACF;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAY,IAAA,CAAK,MAAA,CAAO,gBAAA,CAAiB;AAAA,QAC7C,WAAW,EAAE,MAAA,EAAQ,IAAI,MAAA,EAAQ,KAAA,EAAO,IAAI,KAAA,EAAM;AAAA,QAClD,WAAW,IAAA,CAAK;AAAA,OACjB,CAAA;AAED,MAAA,IAAI,CAAC,SAAA,EAAW;AACd,QAAA,IAAA,CAAK,IAAA,CAAK,IAAI,KAAA,CAAM,6BAA6B,CAAC,CAAA;AAClD,QAAA,IAAA,CAAK,mBAAA,EAAoB;AACzB,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,MAAA,GAAyB,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA;AAEnD,MAAA,IAAA,CAAK,IAAA,CAAK,WAAW,MAAM,CAAA;AAC3B,MAAA,IAAA,CAAK,YAAA,CAAa,WAAW,eAAe,CAAA;AAG5C,MAAA,IAAA,CAAK,WAAW,IAAA,CAAK;AAAA,QACnB,IAAA,EAAM,SAAA;AAAA,QACN,WAAW,IAAA,CAAK;AAAA,OACjB,CAAA;AAAA,IACH,CAAA,CAAA,MAAQ;AACN,MAAA,IAAA,CAAK,IAAA,CAAK,IAAI,KAAA,CAAM,uCAAuC,CAAC,CAAA;AAC5D,MAAA,IAAA,CAAK,mBAAA,EAAoB;AAAA,IAC3B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,eAAe,MAAA,EAAqB;AAChD,IAAA,IAAI;AACF,MAAA,MAAM,MAAM,MAAM,KAAA;AAAA,QAChB,CAAA,EAAG,OAAO,CAAA,oBAAA,EAAuB,MAAA,CAAO,SAAS,CAAA;AAAA,OACnD;AAEA,MAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,MAAM,IAAI,MAAM,iBAAiB,CAAA;AAE9C,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,MAAA,MAAM,SAAA,GAAY,IAAA,CAAK,MAAA,CAAO,gBAAA,CAAiB;AAAA,QAC7C,WAAW,EAAE,MAAA,EAAQ,KAAK,MAAA,EAAQ,KAAA,EAAO,KAAK,KAAA,EAAM;AAAA,QACpD,WAAW,MAAA,CAAO;AAAA,OACnB,CAAA;AAED,MAAA,IAAI,CAAC,SAAA,EAAW;AACd,QAAA,IAAA,CAAK,IAAA,CAAK,IAAI,KAAA,CAAM,sBAAsB,CAAC,CAAA;AAC3C,QAAA,IAAA,CAAK,mBAAA,EAAoB;AACzB,QAAA;AAAA,MACF;AACA,MAAA,MAAM,MAAA,GAAyB,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA;AACnD,MAAA,IAAA,CAAK,IAAA,CAAK,WAAW,MAAM,CAAA;AAC3B,MAAA,gBAAA,EAAiB;AAAA,IACnB,CAAA,CAAA,MAAQ;AACN,MAAA,IAAA,CAAK,IAAA,CAAK,IAAI,KAAA,CAAM,yBAAyB,CAAC,CAAA;AAC9C,MAAA,IAAA,CAAK,mBAAA,EAAoB;AAAA,IAC3B;AAAA,EACF;AAAA,EAEQ,wBAAA,GAA2B;AACjC,IAAA,IAAA,CAAK,oBAAoB,YAAY;AACnC,MAAA,IAAI,QAAA,CAAS,oBAAoB,SAAA,EAAW;AAE5C,MAAA,MAAM,SAAS,cAAA,EAAe;AAC9B,MAAA,IAAI,CAAC,MAAA,EAAQ;AACb,MAAA,MAAM,IAAA,CAAK,eAAe,MAAM,CAAA;AAAA,IAClC,CAAA;AAEA,IAAA,QAAA,CAAS,gBAAA,CAAiB,kBAAA,EAAoB,IAAA,CAAK,iBAAiB,CAAA;AAAA,EACtE;AAAA,EAEQ,wBAAA,GAA2B;AACjC,IAAA,IAAI,KAAK,iBAAA,EAAmB;AAC1B,MAAA,QAAA,CAAS,mBAAA,CAAoB,kBAAA,EAAoB,IAAA,CAAK,iBAAiB,CAAA;AACvE,MAAA,IAAA,CAAK,iBAAA,GAAoB,MAAA;AAAA,IAC3B;AAAA,EACF;AAAA;AAAA,EAGQ,UAAU,OAAA,EAAkB;AAClC,IAAA,IAAI,CAAC,KAAK,SAAA,EAAW;AACrB,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,IAAA,CAAK,WAAW,IAAA,CAAK;AAAA,QACnB,IAAA,EAAM,mBAAA;AAAA,QACN,WAAW,IAAA,CAAK,SAAA;AAAA,QAChB,SAAA,EAAW,KAAK,MAAA,CAAO,SAAA;AAAA,QACvB,SAAA,EAAW,KAAK,MAAA,CAAO,SAAA;AAAA,QACvB,QAAA,EAAU,KAAK,MAAA,CAAO;AAAA,OACvB,CAAA;AAAA,IACH;AAEA,IAAA,IAAA,CAAK,WAAW,KAAA,EAAM;AACtB,IAAA,gBAAA,EAAiB;AACjB,IAAA,IAAA,CAAK,YAAA,EAAa;AAElB,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,CAAO,cAAA,EAAgB;AAC/B,MAAA,IAAA,CAAK,wBAAA,EAAyB;AAAA,IAChC;AACA,IAAA,IAAA,CAAK,YAAA,CAAa,UAAA,CAAW,OAAA,GAAU,WAAA,GAAc,MAAM,CAAA;AAAA,EAC7D;AAAA,EAEQ,mBAAA,GAAsB;AAC5B,IAAA,IAAA,CAAK,YAAA,CAAa,WAAW,MAAM,CAAA;AACnC,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,CAAO,cAAA,EAAgB;AACjC,IAAA,UAAA,CAAW,MAAM;AACf,MAAA,IAAA,CAAK,KAAA,EAAM;AAAA,IACb,GAAG,GAAG,CAAA;AAAA,EACR;AAAA,EAEQ,YAAA,GAAe;AACrB,IAAA,IAAA,CAAK,SAAA,GAAY,EAAA;AACjB,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAAA,EACpB;AAAA;AAAA,EAGA,OAAA,GAAU;AACR,IAAA,IAAA,CAAK,wBAAA,EAAyB;AAC9B,IAAA,IAAA,CAAK,WAAW,KAAA,EAAM;AACtB,IAAA,IAAA,CAAK,YAAY,EAAC;AAAA,EACpB;AAAA,EAEQ,IAAA,CACN,OACA,OAAA,EACA;AACA,IAAA,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,EAAG,OAAA,CAAQ,CAAC,EAAA,KAAO,EAAA,CAAG,OAAO,CAAC,CAAA;AAAA,EACpD;AAAA,EAEQ,KAAK,GAAA,EAAY;AACvB,IAAA,IAAA,CAAK,IAAA,CAAK,SAAS,GAAG,CAAA;AACtB,IAAA,IAAA,CAAK,YAAA,CAAa,WAAW,OAAO,CAAA;AAAA,EACtC;AACF","file":"index.mjs","sourcesContent":["import nacl from \"tweetnacl\";\nimport { decodeBase64, encodeBase64 } from \"tweetnacl-util\";\n\ninterface EncryptedMessage {\n  cipher: string; // Base64 encoded\n  nonce: string; // Base64 encoded\n}\n\nexport class CryptoService {\n  generateSymmetricKey(): string {\n    const key = nacl.randomBytes(32);\n    return encodeBase64(key);\n  }\n\n  /**\n   * Encrypt with symmetric key (secret-key encryption)\n   * Use this when both parties share the same secret key\n   * @param plaintext - Message to encrypt\n   * @param keyString - Symmetric key (base64)\n   * @returns Encrypted message with nonce\n   */\n  encryptSymmetric({\n    plaintext,\n    keyString,\n  }: {\n    plaintext: string;\n    keyString: string;\n  }): EncryptedMessage {\n    const key = decodeBase64(keyString);\n    const nonce = nacl.randomBytes(24);\n\n    const messageBytes = new TextEncoder().encode(plaintext);\n\n    const ciphertext = nacl.secretbox(messageBytes, nonce, key);\n\n    return {\n      cipher: encodeBase64(ciphertext),\n      nonce: encodeBase64(nonce),\n    };\n  }\n\n  /**\n   * Decrypt with symmetric key\n   * @param encrypted - Encrypted message with nonce\n   * @param keyString - Symmetric key (base64)\n   * @returns Decrypted plaintext\n   */\n  decryptSymmetric({\n    encrypted,\n    keyString,\n  }: {\n    encrypted: EncryptedMessage;\n    keyString: string;\n  }): string | null {\n    try {\n      const key = decodeBase64(keyString);\n      const ciphertextBytes = decodeBase64(encrypted.cipher);\n      const nonceBytes = decodeBase64(encrypted.nonce);\n\n      const decrypted = nacl.secretbox.open(ciphertextBytes, nonceBytes, key);\n\n      if (!decrypted) {\n        throw new Error(\"Decryption failed - invalid key or corrupted data\");\n      }\n\n      const decoded = new TextDecoder().decode(decrypted);\n      return decoded;\n    } catch (error) {\n      console.error(\"Decryption failed\", error);\n      return null;\n    }\n  }\n}\n\nexport default CryptoService;\nexport type { EncryptedMessage };\n","// hybridStorage.ts\n/**\n * Hybrid storage: Try sessionStorage first, fallback to memory\n * Best of both worlds - survives page refresh but auto-cleans\n */\n\ninterface StorageOptions {\n  ttlMs?: number;\n  useSessionStorage?: boolean;\n}\n\nclass AuthStorage {\n  private readonly prefix = \"pelican_auth_\";\n  private readonly defaultTTL = 5 * 60 * 1000; // 5 minutes\n  private memoryCache: Map<string, { value: any; expiresAt: number }> =\n    new Map();\n\n  /**\n   * Store auth session with automatic cleanup\n   */\n  set(key: string, value: any, options: StorageOptions = {}): void {\n    const { ttlMs = this.defaultTTL, useSessionStorage = true } = options;\n\n    const expiresAt = Date.now() + ttlMs;\n    const data = { value, expiresAt };\n\n    // Try sessionStorage first\n    if (useSessionStorage) {\n      try {\n        sessionStorage.setItem(`${this.prefix}${key}`, JSON.stringify(data));\n      } catch (error) {\n        console.warn(\"SessionStorage unavailable, using memory:\", error);\n        this.setMemory(key, data);\n      }\n    } else {\n      this.setMemory(key, data);\n    }\n  }\n\n  /**\n   * Get stored value if not expired\n   */\n  get(key: string): any | null {\n    // Try sessionStorage first\n    try {\n      const stored = sessionStorage.getItem(`${this.prefix}${key}`);\n      if (stored) {\n        const data = JSON.parse(stored);\n\n        // Check expiration\n        if (Date.now() > data.expiresAt) {\n          this.remove(key);\n          return null;\n        }\n\n        return data.value;\n      }\n    } catch (error) {\n      // Fallback to memory\n    }\n\n    // Try memory cache\n    return this.getMemory(key);\n  }\n\n  /**\n   * Remove specific key\n   */\n  remove(key: string): void {\n    try {\n      sessionStorage.removeItem(`${this.prefix}${key}`);\n    } catch (error) {\n      // Ignore\n    }\n    this.memoryCache.delete(key);\n  }\n\n  /**\n   * Clear all auth data\n   */\n  clear(): void {\n    // Clear sessionStorage\n    try {\n      Object.keys(sessionStorage).forEach((key) => {\n        if (key.startsWith(this.prefix)) {\n          sessionStorage.removeItem(key);\n        }\n      });\n    } catch (error) {\n      // Ignore\n    }\n\n    // Clear memory\n    this.memoryCache.clear();\n  }\n\n  // ========================================\n  // Memory cache helpers\n  // ========================================\n\n  private setMemory(\n    key: string,\n    data: { value: any; expiresAt: number }\n  ): void {\n    this.memoryCache.set(key, data);\n\n    // Schedule cleanup\n    const ttl = data.expiresAt - Date.now();\n    setTimeout(() => {\n      this.memoryCache.delete(key);\n    }, ttl);\n  }\n\n  private getMemory(key: string): any | null {\n    const data = this.memoryCache.get(key);\n    if (!data) return null;\n\n    if (Date.now() > data.expiresAt) {\n      this.memoryCache.delete(key);\n      return null;\n    }\n\n    return data.value;\n  }\n}\n\n// Singleton instance\nconst storage = new AuthStorage();\n\n// ========================================\n// Convenience functions for auth flow\n// ========================================\n\nexport interface AuthSession {\n  sessionId: string;\n  sessionKey: string;\n}\n\nexport const storeAuthSession = (\n  sessionId: string,\n  sessionKey: string,\n  ttlMs?: number\n): void => {\n  storage.set(\"session\", { sessionId, sessionKey }, { ttlMs });\n};\n\nexport const getAuthSession = (): AuthSession | null => {\n  return storage.get(\"session\");\n};\n\nexport const clearAuthSession = (): void => {\n  storage.remove(\"session\");\n};\n\nexport const clearAllAuthData = (): void => {\n  storage.clear();\n};\n\nexport default storage;\n","import type { PelicanAuthState } from \"../types/types\";\n\nexport class StateMachine {\n  private state: PelicanAuthState = \"idle\";\n  private listeners = new Set<(s: PelicanAuthState) => void>();\n\n  get current() {\n    return this.state;\n  }\n\n  transition(next: PelicanAuthState) {\n    this.state = next;\n    this.listeners.forEach((l) => l(next));\n  }\n\n  subscribe(fn: (s: PelicanAuthState) => void) {\n    this.listeners.add(fn);\n    return () => this.listeners.delete(fn);\n  }\n}\n","import { ISocketMessage } from \"../types/types\";\n\ntype TransportHandlers = {\n  onOpen?: () => void;\n  onMessage?: (msg: ISocketMessage) => void;\n  onError?: (err: Event) => void;\n  onClose?: (ev: CloseEvent) => void;\n};\n\nexport class Transport {\n  private socket?: WebSocket;\n  private handlers: TransportHandlers;\n  private reconnectAttempts = 0;\n  private maxReconnectAttempts = 5;\n  private isExplicitlyClosed = false;\n  private url?: string;\n\n  constructor(handlers: TransportHandlers) {\n    this.handlers = handlers;\n  }\n\n  connect(url: string) {\n    this.url = url;\n    this.isExplicitlyClosed = false;\n    this.socket = new WebSocket(url);\n\n    this.socket.onopen = () => {\n      this.reconnectAttempts = 0;\n      this.handlers.onOpen?.();\n    };\n    this.socket.onmessage = (e: MessageEvent) => {\n      try {\n        const data = JSON.parse(e.data);\n        this.handlers.onMessage?.(data);\n      } catch (err) {\n        console.error(\"Failed to parse message\", err);\n      }\n    };\n    this.socket.onerror = (e: Event) => {\n      this.handlers.onError?.(e);\n    };\n    this.socket.onclose = (e: CloseEvent) => {\n      this.handlers.onClose?.(e);\n\n      // Only reconnect if the user didn't call .close() manually\n      if (!this.isExplicitlyClosed) {\n        this.attemptReconnect();\n      }\n    };\n  }\n\n  private attemptReconnect() {\n    if (this.reconnectAttempts >= this.maxReconnectAttempts) {\n      console.error(\"❌ Max reconnect attempts reached\");\n      return;\n    }\n\n    this.reconnectAttempts++;\n\n    const delay = Math.pow(2, this.reconnectAttempts) * 500;\n    setTimeout(() => {\n      if (this.url) this.connect(this.url);\n    }, delay);\n  }\n  send(payload: ISocketMessage) {\n    if (this.socket?.readyState === WebSocket.OPEN) {\n      this.socket.send(JSON.stringify(payload));\n    }\n  }\n\n  close() {\n    this.isExplicitlyClosed = true;\n    this.socket?.close();\n  }\n}\n","export const BASEURL = \"http://192.168.1.2:8080\";\n","import CryptoService from \"../utilities/crypto\";\nimport QRCode from \"qrcode\";\nimport {\n  PelicanAuthConfig,\n  PelicanAuthEventMap,\n  ISocketMessage,\n  IdentityResult,\n} from \"../types/types\";\nimport {\n  storeAuthSession,\n  getAuthSession,\n  clearAuthSession,\n  AuthSession,\n} from \"../utilities/storage\";\nimport { StateMachine } from \"../utilities/stateMachine\";\nimport { Transport } from \"../utilities/transport\";\n\nimport { BASEURL } from \"../constants\";\n\ntype Listener<T> = (payload: T) => void;\n\n/**\n * PelicanAuth SDK\n * Handles cross-device authentication via WebSockets and E2EE (End-to-End Encryption).\n */\nexport class PelicanAuthentication {\n  private readonly crypto = new CryptoService();\n  private readonly stateMachine = new StateMachine();\n\n  private transport?: Transport;\n  private sessionId = \"\";\n  private sessionKey: string | null = null;\n\n  private visibilityHandler?: () => void;\n\n  private listeners: {\n    [K in keyof PelicanAuthEventMap]?: Set<Listener<any>>;\n  } = {};\n\n  private readonly config: Required<PelicanAuthConfig>;\n\n  constructor(config: PelicanAuthConfig) {\n    if (!config.publicKey) throw new Error(\"Missing publicKey\");\n    if (!config.projectId) throw new Error(\"Missing projectId\");\n    if (!config.authType) throw new Error(\"Missing authType\");\n\n    this.config = {\n      continuousMode: false,\n      forceQRCode: false,\n      ...config,\n    };\n\n    // Sync internal state machine changes with the 'state' event\n    this.stateMachine.subscribe((s) => this.emit(\"state\", s));\n    this.attachVisibilityRecovery();\n  }\n\n  /* -------------------- public API -------------------- */\n\n  /**\n   * Subscribe to SDK events (qr, deeplink, success, error, state)\n   * @returns Unsubscribe function\n   */\n  on<K extends keyof PelicanAuthEventMap>(\n    event: K,\n    cb: Listener<PelicanAuthEventMap[K]>\n  ) {\n    this.listeners[event] ??= new Set();\n    this.listeners[event]!.add(cb);\n    return () => this.listeners[event]!.delete(cb);\n  }\n\n  /**\n   * Initializes the authentication flow.\n   * Fetches a relay, establishes a WebSocket, and generates the E2EE session key.\n   */\n  async start() {\n    if (this.stateMachine.current !== \"idle\") return;\n\n    this.resetSession();\n    this.stateMachine.transition(\"initializing\");\n\n    try {\n      const relay = await this.fetchRelayUrl();\n\n      // Generate a fresh symmetric key for this specific session\n      this.sessionKey = this.crypto.generateSymmetricKey();\n      this.sessionId = crypto.randomUUID() + crypto.randomUUID();\n\n      this.transport = new Transport({\n        onOpen: () => {\n          // Register this browser session with the relay\n          this.transport!.send({\n            type: \"register\",\n            sessionID: this.sessionId,\n            ...this.config,\n          });\n          this.stateMachine.transition(\"awaiting-pair\");\n        },\n        onMessage: (msg: ISocketMessage) => this.handleMessage(msg),\n        onError: () => this.fail(new Error(\"WebSocket connection failed\")),\n      });\n\n      this.transport.connect(relay);\n      await this.emitEntryPoint();\n    } catch (err) {\n      this.fail(err instanceof Error ? err : new Error(\"Start failed\"));\n    }\n  }\n\n  /**\n   * Manually stops the authentication process and closes connections.\n   */\n  stop() {\n    this.terminate(false);\n  }\n\n  /* -------------------- internals -------------------- */\n\n  /** Fetches the WebSocket Relay URL from the backend */\n  private async fetchRelayUrl(): Promise<string> {\n    const { publicKey, projectId, authType } = this.config;\n    const res = await fetch(\n      `${BASEURL}/relay?public_key=${publicKey}&auth_type=${authType}&project_id=${projectId}`\n    );\n\n    if (!res.ok) {\n      throw new Error(\"Failed to fetch relay URL\");\n    }\n\n    const json = await res.json();\n    return json.relay_url;\n  }\n\n  /**\n   * Decides whether to show a QR code (Desktop) or a Deep Link (Mobile).\n   */\n  private async emitEntryPoint() {\n    const payload = {\n      sessionID: this.sessionId,\n      sessionKey: this.sessionKey,\n      publicKey: this.config.publicKey,\n      authType: this.config.authType,\n      projectId: this.config.projectId,\n      url: window.location.href,\n    };\n\n    const shouldUseQR =\n      this.config.forceQRCode ||\n      !/Android|iPhone|iPad/i.test(navigator.userAgent);\n\n    if (!shouldUseQR && this.sessionKey) {\n      // For mobile: Store session locally so we can recover when the user returns from the app\n      storeAuthSession(this.sessionId, this.sessionKey, 5 * 60_000);\n      this.emit(\n        \"deeplink\",\n        `pelicanvault://auth/deep-link?sessionID=${encodeURIComponent(\n          this.sessionId\n        )}&sessionKey=${encodeURIComponent(\n          this.sessionKey\n        )}&publicKey=${encodeURIComponent(this.config.publicKey)}&authType=${\n          this.config.authType\n        }&projectId=${encodeURIComponent(\n          this.config.projectId\n        )}&url=${encodeURIComponent(window.location.href)}`\n      );\n    } else {\n      const qr = await QRCode.toDataURL(JSON.stringify(payload), {\n        type: \"image/png\",\n        scale: 3,\n        color: { light: \"#FFFFF5\", dark: \"#121212\" },\n      });\n      this.emit(\"qr\", qr);\n    }\n  }\n\n  /** Main WebSocket message router */\n  private handleMessage(msg: ISocketMessage) {\n    switch (msg.type) {\n      case \"paired\":\n        this.stateMachine.transition(\"paired\");\n        this.transport!.send({\n          type: \"authenticate\",\n          sessionID: this.sessionId,\n          ...this.config,\n          url: window.location.href,\n        });\n        return;\n\n      case \"phone-auth-success\":\n        // Mobile device successfully authenticated and sent encrypted credentials\n        this.handleAuthSuccess(msg);\n        return;\n\n      case \"phone-terminated\":\n        this.fail(new Error(\"Authenticating device terminated the connection\"));\n        this.restartIfContinuous();\n        return;\n\n      case \"confirmed\":\n        // Handshake complete\n        this.terminate(true);\n        this.restartIfContinuous();\n        return;\n    }\n  }\n\n  /**\n   * Decrypts the identity payload received from the phone using the session key.\n   */\n  private handleAuthSuccess(msg: ISocketMessage) {\n    if (!this.sessionKey || !msg.cipher || !msg.nonce) {\n      this.fail(new Error(\"Invalid authentication payload\"));\n      this.restartIfContinuous();\n      return;\n    }\n\n    try {\n      const decrypted = this.crypto.decryptSymmetric({\n        encrypted: { cipher: msg.cipher, nonce: msg.nonce },\n        keyString: this.sessionKey,\n      });\n\n      if (!decrypted) {\n        this.fail(new Error(\"Invalid authentication data\"));\n        this.restartIfContinuous();\n        return;\n      }\n\n      const result: IdentityResult = JSON.parse(decrypted);\n\n      this.emit(\"success\", result);\n      this.stateMachine.transition(\"authenticated\");\n\n      // Signal to the relay/phone that we have received and decrypted the data\n      this.transport?.send({\n        type: \"confirm\",\n        sessionID: this.sessionId,\n      });\n    } catch {\n      this.fail(new Error(\"Failed to decrypt authentication data\"));\n      this.restartIfContinuous();\n    }\n  }\n\n  /**\n   * Logic to handle users returning to the browser tab after using the mobile app.\n   * Checks the server for a completed session that might have finished while in background.\n   */\n\n  private async getCachedEntry(cached: AuthSession) {\n    try {\n      const res = await fetch(\n        `${BASEURL}/session?session_id=${cached.sessionId}`\n      );\n\n      if (!res.ok) throw new Error(\"Invalid session\");\n\n      const data = await res.json();\n      const decrypted = this.crypto.decryptSymmetric({\n        encrypted: { cipher: data.cipher, nonce: data.nonce },\n        keyString: cached.sessionKey,\n      });\n\n      if (!decrypted) {\n        this.fail(new Error(\"Invalid session data\"));\n        this.restartIfContinuous();\n        return;\n      }\n      const result: IdentityResult = JSON.parse(decrypted);\n      this.emit(\"success\", result);\n      clearAuthSession();\n    } catch {\n      this.fail(new Error(\"Session recovery failed\"));\n      this.restartIfContinuous();\n    }\n  }\n\n  private attachVisibilityRecovery() {\n    this.visibilityHandler = async () => {\n      if (document.visibilityState !== \"visible\") return;\n\n      const cached = getAuthSession();\n      if (!cached) return;\n      await this.getCachedEntry(cached);\n    };\n\n    document.addEventListener(\"visibilitychange\", this.visibilityHandler);\n  }\n\n  private detachVisibilityRecovery() {\n    if (this.visibilityHandler) {\n      document.removeEventListener(\"visibilitychange\", this.visibilityHandler);\n      this.visibilityHandler = undefined;\n    }\n  }\n\n  /** Cleans up the current session state */\n  private terminate(success: boolean) {\n    if (!this.transport) return;\n    if (!success) {\n      this.transport?.send({\n        type: \"client-terminated\",\n        sessionID: this.sessionId,\n        projectId: this.config.projectId,\n        publicKey: this.config.publicKey,\n        authType: this.config.authType,\n      });\n    }\n\n    this.transport?.close();\n    clearAuthSession();\n    this.resetSession();\n\n    if (!this.config.continuousMode) {\n      this.detachVisibilityRecovery();\n    }\n    this.stateMachine.transition(success ? \"confirmed\" : \"idle\");\n  }\n\n  private restartIfContinuous() {\n    this.stateMachine.transition(\"idle\");\n    if (!this.config.continuousMode) return;\n    setTimeout(() => {\n      this.start();\n    }, 150);\n  }\n\n  private resetSession() {\n    this.sessionId = \"\";\n    this.sessionKey = null;\n  }\n\n  /** Completely destroys the instance and removes all listeners */\n  destroy() {\n    this.detachVisibilityRecovery();\n    this.transport?.close();\n    this.listeners = {};\n  }\n\n  private emit<K extends keyof PelicanAuthEventMap>(\n    event: K,\n    payload: PelicanAuthEventMap[K]\n  ) {\n    this.listeners[event]?.forEach((cb) => cb(payload));\n  }\n\n  private fail(err: Error) {\n    this.emit(\"error\", err);\n    this.stateMachine.transition(\"error\");\n  }\n}\n"]}
+{"version":3,"sources":["../src/utilities/crypto.ts","../src/utilities/storage.ts","../src/utilities/stateMachine.ts","../src/utilities/transport.ts","../src/constants.ts","../src/engine/engine.ts"],"names":[],"mappings":";;;;;AAQO,IAAM,gBAAN,MAAoB;AAAA,EACzB,oBAAA,GAA+B;AAC7B,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,WAAA,CAAY,EAAE,CAAA;AAC/B,IAAA,OAAO,aAAa,GAAG,CAAA;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,gBAAA,CAAiB;AAAA,IACf,SAAA;AAAA,IACA;AAAA,GACF,EAGqB;AACnB,IAAA,MAAM,GAAA,GAAM,aAAa,SAAS,CAAA;AAClC,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,WAAA,CAAY,EAAE,CAAA;AAEjC,IAAA,MAAM,YAAA,GAAe,IAAI,WAAA,EAAY,CAAE,OAAO,SAAS,CAAA;AAEvD,IAAA,MAAM,UAAA,GAAa,IAAA,CAAK,SAAA,CAAU,YAAA,EAAc,OAAO,GAAG,CAAA;AAE1D,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,aAAa,UAAU,CAAA;AAAA,MAC/B,KAAA,EAAO,aAAa,KAAK;AAAA,KAC3B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,gBAAA,CAAiB;AAAA,IACf,SAAA;AAAA,IACA;AAAA,GACF,EAGkB;AAChB,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,aAAa,SAAS,CAAA;AAClC,MAAA,MAAM,eAAA,GAAkB,YAAA,CAAa,SAAA,CAAU,MAAM,CAAA;AACrD,MAAA,MAAM,UAAA,GAAa,YAAA,CAAa,SAAA,CAAU,KAAK,CAAA;AAE/C,MAAA,MAAM,YAAY,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,eAAA,EAAiB,YAAY,GAAG,CAAA;AAEtE,MAAA,IAAI,CAAC,SAAA,EAAW;AACd,QAAA,MAAM,IAAI,MAAM,mDAAmD,CAAA;AAAA,MACrE;AAEA,MAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY,CAAE,OAAO,SAAS,CAAA;AAClD,MAAA,OAAO,OAAA;AAAA,IACT,SAAS,KAAA,EAAO;AACd,MAAA,OAAA,CAAQ,KAAA,CAAM,qBAAqB,KAAK,CAAA;AACxC,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,EACF;AACF;AAEA,IAAO,cAAA,GAAQ,aAAA;;;AC/Df,IAAM,cAAN,MAAkB;AAAA,EAAlB,WAAA,GAAA;AACE,IAAA,IAAA,CAAiB,MAAA,GAAS,eAAA;AAC1B,IAAA,IAAA,CAAiB,UAAA,GAAa,IAAI,EAAA,GAAK,GAAA;AACvC;AAAA,IAAA,IAAA,CAAQ,WAAA,uBACF,GAAA,EAAI;AAAA,EAAA;AAAA;AAAA;AAAA;AAAA,EAKV,GAAA,CAAI,GAAA,EAAa,KAAA,EAAY,OAAA,GAA0B,EAAC,EAAS;AAC/D,IAAA,MAAM,EAAE,KAAA,GAAQ,IAAA,CAAK,UAAA,EAAY,iBAAA,GAAoB,MAAK,GAAI,OAAA;AAE9D,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,GAAA,EAAI,GAAI,KAAA;AAC/B,IAAA,MAAM,IAAA,GAAO,EAAE,KAAA,EAAO,SAAA,EAAU;AAGhC,IAAA,IAAI,iBAAA,EAAmB;AACrB,MAAA,IAAI;AACF,QAAA,cAAA,CAAe,OAAA,CAAQ,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,EAAG,GAAG,CAAA,CAAA,EAAI,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AAAA,MACrE,SAAS,KAAA,EAAO;AACd,QAAA,OAAA,CAAQ,IAAA,CAAK,6CAA6C,KAAK,CAAA;AAC/D,QAAA,IAAA,CAAK,SAAA,CAAU,KAAK,IAAI,CAAA;AAAA,MAC1B;AAAA,IACF,CAAA,MAAO;AACL,MAAA,IAAA,CAAK,SAAA,CAAU,KAAK,IAAI,CAAA;AAAA,IAC1B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,IAAI,GAAA,EAAyB;AAE3B,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,eAAe,OAAA,CAAQ,CAAA,EAAG,KAAK,MAAM,CAAA,EAAG,GAAG,CAAA,CAAE,CAAA;AAC5D,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,MAAM,CAAA;AAG9B,QAAA,IAAI,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,SAAA,EAAW;AAC/B,UAAA,IAAA,CAAK,OAAO,GAAG,CAAA;AACf,UAAA,OAAO,IAAA;AAAA,QACT;AAEA,QAAA,OAAO,IAAA,CAAK,KAAA;AAAA,MACd;AAAA,IACF,SAAS,KAAA,EAAO;AAAA,IAEhB;AAGA,IAAA,OAAO,IAAA,CAAK,UAAU,GAAG,CAAA;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA,EAKA,OAAO,GAAA,EAAmB;AACxB,IAAA,IAAI;AACF,MAAA,cAAA,CAAe,WAAW,CAAA,EAAG,IAAA,CAAK,MAAM,CAAA,EAAG,GAAG,CAAA,CAAE,CAAA;AAAA,IAClD,SAAS,KAAA,EAAO;AAAA,IAEhB;AACA,IAAA,IAAA,CAAK,WAAA,CAAY,OAAO,GAAG,CAAA;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA,EAKA,KAAA,GAAc;AAEZ,IAAA,IAAI;AACF,MAAA,MAAA,CAAO,IAAA,CAAK,cAAc,CAAA,CAAE,OAAA,CAAQ,CAAC,GAAA,KAAQ;AAC3C,QAAA,IAAI,GAAA,CAAI,UAAA,CAAW,IAAA,CAAK,MAAM,CAAA,EAAG;AAC/B,UAAA,cAAA,CAAe,WAAW,GAAG,CAAA;AAAA,QAC/B;AAAA,MACF,CAAC,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AAAA,IAEhB;AAGA,IAAA,IAAA,CAAK,YAAY,KAAA,EAAM;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA,EAMQ,SAAA,CACN,KACA,IAAA,EACM;AACN,IAAA,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,GAAA,EAAK,IAAI,CAAA;AAG9B,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,SAAA,GAAY,IAAA,CAAK,GAAA,EAAI;AACtC,IAAA,UAAA,CAAW,MAAM;AACf,MAAA,IAAA,CAAK,WAAA,CAAY,OAAO,GAAG,CAAA;AAAA,IAC7B,GAAG,GAAG,CAAA;AAAA,EACR;AAAA,EAEQ,UAAU,GAAA,EAAyB;AACzC,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,WAAA,CAAY,GAAA,CAAI,GAAG,CAAA;AACrC,IAAA,IAAI,CAAC,MAAM,OAAO,IAAA;AAElB,IAAA,IAAI,IAAA,CAAK,GAAA,EAAI,GAAI,IAAA,CAAK,SAAA,EAAW;AAC/B,MAAA,IAAA,CAAK,WAAA,CAAY,OAAO,GAAG,CAAA;AAC3B,MAAA,OAAO,IAAA;AAAA,IACT;AAEA,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EACd;AACF,CAAA;AAGA,IAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAWzB,IAAM,gBAAA,GAAmB,CAC9B,SAAA,EACA,UAAA,EACA,KAAA,KACS;AACT,EAAA,OAAA,CAAQ,GAAA,CAAI,WAAW,EAAE,SAAA,EAAW,YAAW,EAAG,EAAE,OAAO,CAAA;AAC7D;AAEO,IAAM,iBAAiB,MAA0B;AACtD,EAAA,OAAO,OAAA,CAAQ,IAAI,SAAS,CAAA;AAC9B;AAEO,IAAM,mBAAmB,MAAY;AAC1C,EAAA,OAAA,CAAQ,OAAO,SAAS,CAAA;AAC1B;AAEO,IAAM,mBAAmB,MAAY;AAC1C,EAAA,OAAA,CAAQ,KAAA,EAAM;AAChB;;;AC1JO,IAAM,eAAN,MAAmB;AAAA,EAAnB,WAAA,GAAA;AACL,IAAA,IAAA,CAAQ,KAAA,GAA0B,MAAA;AAClC,IAAA,IAAA,CAAQ,SAAA,uBAAgB,GAAA,EAAmC;AAAA,EAAA;AAAA,EAE3D,IAAI,OAAA,GAAU;AACZ,IAAA,OAAO,IAAA,CAAK,KAAA;AAAA,EACd;AAAA,EAEA,WAAW,IAAA,EAAwB;AACjC,IAAA,IAAA,CAAK,KAAA,GAAQ,IAAA;AACb,IAAA,IAAA,CAAK,UAAU,OAAA,CAAQ,CAAC,CAAA,KAAM,CAAA,CAAE,IAAI,CAAC,CAAA;AAAA,EACvC;AAAA,EAEA,UAAU,EAAA,EAAmC;AAC3C,IAAA,IAAA,CAAK,SAAA,CAAU,IAAI,EAAE,CAAA;AACrB,IAAA,OAAO,MAAM,IAAA,CAAK,SAAA,CAAU,MAAA,CAAO,EAAE,CAAA;AAAA,EACvC;AACF;;;ACVO,IAAM,YAAN,MAAgB;AAAA,EAQrB,YAAY,QAAA,EAA6B;AALzC,IAAA,IAAA,CAAQ,iBAAA,GAAoB,CAAA;AAC5B,IAAA,IAAA,CAAQ,oBAAA,GAAuB,CAAA;AAC/B,IAAA,IAAA,CAAQ,kBAAA,GAAqB,KAAA;AAI3B,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAAA,EAClB;AAAA,EAEA,QAAQ,GAAA,EAAa;AACnB,IAAA,IAAA,CAAK,GAAA,GAAM,GAAA;AACX,IAAA,IAAA,CAAK,kBAAA,GAAqB,KAAA;AAC1B,IAAA,IAAA,CAAK,MAAA,GAAS,IAAI,SAAA,CAAU,GAAG,CAAA;AAE/B,IAAA,IAAA,CAAK,MAAA,CAAO,SAAS,MAAM;AACzB,MAAA,IAAA,CAAK,iBAAA,GAAoB,CAAA;AACzB,MAAA,IAAA,CAAK,SAAS,MAAA,IAAS;AAAA,IACzB,CAAA;AACA,IAAA,IAAA,CAAK,MAAA,CAAO,SAAA,GAAY,CAAC,CAAA,KAAoB;AAC3C,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,IAAA,CAAK,KAAA,CAAM,CAAA,CAAE,IAAI,CAAA;AAC9B,QAAA,IAAA,CAAK,QAAA,CAAS,YAAY,IAAI,CAAA;AAAA,MAChC,SAAS,GAAA,EAAK;AACZ,QAAA,OAAA,CAAQ,KAAA,CAAM,2BAA2B,GAAG,CAAA;AAAA,MAC9C;AAAA,IACF,CAAA;AACA,IAAA,IAAA,CAAK,MAAA,CAAO,OAAA,GAAU,CAAC,CAAA,KAAa;AAClC,MAAA,IAAA,CAAK,QAAA,CAAS,UAAU,CAAC,CAAA;AAAA,IAC3B,CAAA;AACA,IAAA,IAAA,CAAK,MAAA,CAAO,OAAA,GAAU,CAAC,CAAA,KAAkB;AACvC,MAAA,IAAA,CAAK,QAAA,CAAS,UAAU,CAAC,CAAA;AAGzB,MAAA,IAAI,CAAC,KAAK,kBAAA,EAAoB;AAC5B,QAAA,IAAA,CAAK,gBAAA,EAAiB;AAAA,MACxB;AAAA,IACF,CAAA;AAAA,EACF;AAAA,EAEQ,gBAAA,GAAmB;AACzB,IAAA,IAAI,IAAA,CAAK,iBAAA,IAAqB,IAAA,CAAK,oBAAA,EAAsB;AACvD,MAAA,OAAA,CAAQ,MAAM,uCAAkC,CAAA;AAChD,MAAA;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,iBAAA,EAAA;AAEL,IAAA,MAAM,QAAQ,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,iBAAiB,CAAA,GAAI,GAAA;AACpD,IAAA,UAAA,CAAW,MAAM;AACf,MAAA,IAAI,IAAA,CAAK,GAAA,EAAK,IAAA,CAAK,OAAA,CAAQ,KAAK,GAAG,CAAA;AAAA,IACrC,GAAG,KAAK,CAAA;AAAA,EACV;AAAA,EACA,KAAK,OAAA,EAAyB;AAC5B,IAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,UAAA,KAAe,SAAA,CAAU,IAAA,EAAM;AAC9C,MAAA,IAAA,CAAK,MAAA,CAAO,IAAA,CAAK,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAAA,IAC1C;AAAA,EACF;AAAA,EAEA,KAAA,GAAQ;AACN,IAAA,IAAA,CAAK,kBAAA,GAAqB,IAAA;AAC1B,IAAA,IAAA,CAAK,QAAQ,KAAA,EAAM;AAAA,EACrB;AACF;;;AC1EO,IAAM,OAAA,GAAU;;;ACyBhB,IAAM,wBAAN,MAA4B;AAAA,EAgBjC,YAAY,MAAA,EAA2B;AAfvC,IAAA,IAAA,CAAiB,MAAA,GAAS,IAAI,cAAA,EAAc;AAC5C,IAAA,IAAA,CAAiB,YAAA,GAAe,IAAI,YAAA,EAAa;AAGjD,IAAA,IAAA,CAAQ,SAAA,GAAY,EAAA;AACpB,IAAA,IAAA,CAAQ,UAAA,GAA4B,IAAA;AAIpC,IAAA,IAAA,CAAQ,YAEJ,EAAC;AAKH,IAAA,IAAI,CAAC,MAAA,CAAO,SAAA,EAAW,MAAM,IAAI,MAAM,mBAAmB,CAAA;AAC1D,IAAA,IAAI,CAAC,MAAA,CAAO,SAAA,EAAW,MAAM,IAAI,MAAM,mBAAmB,CAAA;AAC1D,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,EAAU,MAAM,IAAI,MAAM,kBAAkB,CAAA;AAExD,IAAA,IAAA,CAAK,MAAA,GAAS;AAAA,MACZ,cAAA,EAAgB,KAAA;AAAA,MAChB,WAAA,EAAa,KAAA;AAAA,MACb,GAAG;AAAA,KACL;AAGA,IAAA,IAAA,CAAK,YAAA,CAAa,UAAU,CAAC,CAAA,KAAM,KAAK,IAAA,CAAK,OAAA,EAAS,CAAC,CAAC,CAAA;AACxD,IAAA,IAAA,CAAK,wBAAA,EAAyB;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,EAAA,CACE,OACA,EAAA,EACA;AAlEJ,IAAA,IAAA,EAAA;AAmEI,IAAA,CAAA,EAAA,GAAA,IAAA,CAAK,SAAA,EAAL,KAAA,CAAA,KAAA,EAAA,CAAA,KAAA,CAAA,mBAA0B,IAAI,GAAA,EAAI,CAAA;AAClC,IAAA,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,CAAG,GAAA,CAAI,EAAE,CAAA;AAC7B,IAAA,OAAO,MAAM,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,CAAG,OAAO,EAAE,CAAA;AAAA,EAC/C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,KAAA,GAAQ;AACZ,IAAA,IAAI,IAAA,CAAK,YAAA,CAAa,OAAA,KAAY,MAAA,EAAQ;AAC1C,IAAA,IAAA,CAAK,YAAA,EAAa;AAClB,IAAA,gBAAA,EAAiB;AACjB,IAAA,IAAA,CAAK,YAAA,CAAa,WAAW,cAAc,CAAA;AAE3C,IAAA,IAAI;AACF,MAAA,MAAM,KAAA,GAAQ,MAAM,IAAA,CAAK,aAAA,EAAc;AAGvC,MAAA,IAAA,CAAK,UAAA,GAAa,IAAA,CAAK,MAAA,CAAO,oBAAA,EAAqB;AACnD,MAAA,IAAA,CAAK,SAAA,GAAY,MAAA,CAAO,UAAA,EAAW,GAAI,OAAO,UAAA,EAAW;AAEzD,MAAA,IAAA,CAAK,SAAA,GAAY,IAAI,SAAA,CAAU;AAAA,QAC7B,QAAQ,MAAM;AAEZ,UAAA,IAAA,CAAK,UAAW,IAAA,CAAK;AAAA,YACnB,IAAA,EAAM,UAAA;AAAA,YACN,WAAW,IAAA,CAAK,SAAA;AAAA,YAChB,GAAG,IAAA,CAAK;AAAA,WACT,CAAA;AACD,UAAA,IAAA,CAAK,YAAA,CAAa,WAAW,eAAe,CAAA;AAAA,QAC9C,CAAA;AAAA,QACA,SAAA,EAAW,CAAC,GAAA,KAAwB,IAAA,CAAK,cAAc,GAAG,CAAA;AAAA,QAC1D,SAAS,MAAM,IAAA,CAAK,KAAK,IAAI,KAAA,CAAM,6BAA6B,CAAC;AAAA,OAClE,CAAA;AAED,MAAA,IAAA,CAAK,SAAA,CAAU,QAAQ,KAAK,CAAA;AAC5B,MAAA,MAAM,KAAK,cAAA,EAAe;AAAA,IAC5B,SAAS,GAAA,EAAK;AACZ,MAAA,IAAA,CAAK,KAAK,GAAA,YAAe,KAAA,GAAQ,MAAM,IAAI,KAAA,CAAM,cAAc,CAAC,CAAA;AAAA,IAClE;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAKA,IAAA,GAAO;AACL,IAAA,IAAA,CAAK,UAAU,KAAK,CAAA;AAAA,EACtB;AAAA;AAAA;AAAA,EAKA,MAAc,aAAA,GAAiC;AAC7C,IAAA,MAAM,EAAE,SAAA,EAAW,SAAA,EAAW,QAAA,KAAa,IAAA,CAAK,MAAA;AAChD,IAAA,MAAM,MAAM,MAAM,KAAA;AAAA,MAChB,GAAG,OAAO,CAAA,kBAAA,EAAqB,SAAS,CAAA,WAAA,EAAc,QAAQ,eAAe,SAAS,CAAA;AAAA,KACxF;AAEA,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,KAAA,GAAQ,MAAM,GAAA,CAAI,IAAA,EAAK;AAC7B,MAAA,MAAM,IAAI,MAAM,KAAK,CAAA;AAAA,IACvB;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,OAAO,IAAA,CAAK,SAAA;AAAA,EACd;AAAA;AAAA;AAAA;AAAA,EAKA,MAAc,cAAA,GAAiB;AAC7B,IAAA,MAAM,OAAA,GAAU;AAAA,MACd,WAAW,IAAA,CAAK,SAAA;AAAA,MAChB,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,SAAA,EAAW,KAAK,MAAA,CAAO,SAAA;AAAA,MACvB,QAAA,EAAU,KAAK,MAAA,CAAO,QAAA;AAAA,MACtB,SAAA,EAAW,KAAK,MAAA,CAAO,SAAA;AAAA,MACvB,GAAA,EAAK,OAAO,QAAA,CAAS;AAAA,KACvB;AAEA,IAAA,MAAM,WAAA,GACJ,KAAK,MAAA,CAAO,WAAA,IACZ,CAAC,sBAAA,CAAuB,IAAA,CAAK,UAAU,SAAS,CAAA;AAElD,IAAA,IAAI,CAAC,WAAA,IAAe,IAAA,CAAK,UAAA,EAAY;AAEnC,MAAA,gBAAA,CAAiB,IAAA,CAAK,SAAA,EAAW,IAAA,CAAK,UAAA,EAAY,IAAI,GAAM,CAAA;AAC5D,MAAA,IAAA,CAAK,IAAA;AAAA,QACH,UAAA;AAAA,QACA,CAAA,wCAAA,EAA2C,kBAAA;AAAA,UACzC,IAAA,CAAK;AAAA,SACN,CAAA,YAAA,EAAe,kBAAA;AAAA,UACd,IAAA,CAAK;AAAA,SACN,CAAA,WAAA,EAAc,kBAAA,CAAmB,IAAA,CAAK,MAAA,CAAO,SAAS,CAAC,CAAA,UAAA,EACtD,IAAA,CAAK,MAAA,CAAO,QACd,CAAA,WAAA,EAAc,kBAAA;AAAA,UACZ,KAAK,MAAA,CAAO;AAAA,SACb,CAAA,KAAA,EAAQ,kBAAA,CAAmB,MAAA,CAAO,QAAA,CAAS,IAAI,CAAC,CAAA;AAAA,OACnD;AAAA,IACF,CAAA,MAAO;AACL,MAAA,MAAM,KAAK,MAAM,MAAA,CAAO,UAAU,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA,EAAG;AAAA,QACzD,IAAA,EAAM,WAAA;AAAA,QACN,KAAA,EAAO,CAAA;AAAA,QACP,KAAA,EAAO,EAAE,KAAA,EAAO,SAAA,EAAW,MAAM,WAAA;AAAY,OAC9C,CAAA;AACD,MAAA,IAAA,CAAK,IAAA,CAAK,MAAM,EAAE,CAAA;AAAA,IACpB;AAAA,EACF;AAAA;AAAA,EAGQ,cAAc,GAAA,EAAqB;AACzC,IAAA,QAAQ,IAAI,IAAA;AAAM,MAChB,KAAK,QAAA;AACH,QAAA,IAAA,CAAK,YAAA,CAAa,WAAW,QAAQ,CAAA;AACrC,QAAA,IAAA,CAAK,UAAW,IAAA,CAAK;AAAA,UACnB,IAAA,EAAM,cAAA;AAAA,UACN,WAAW,IAAA,CAAK,SAAA;AAAA,UAChB,GAAG,IAAA,CAAK,MAAA;AAAA,UACR,GAAA,EAAK,OAAO,QAAA,CAAS;AAAA,SACtB,CAAA;AACD,QAAA;AAAA,MAEF,KAAK,oBAAA;AAEH,QAAA,IAAA,CAAK,kBAAkB,GAAG,CAAA;AAC1B,QAAA;AAAA,MAEF,KAAK,kBAAA;AACH,QAAA,IAAA,CAAK,IAAA,CAAK,IAAI,KAAA,CAAM,iDAAiD,CAAC,CAAA;AACtE,QAAA,IAAA,CAAK,mBAAA,EAAoB;AACzB,QAAA;AAAA,MAEF,KAAK,WAAA;AAEH,QAAA,IAAA,CAAK,UAAU,IAAI,CAAA;AACnB,QAAA,IAAA,CAAK,mBAAA,EAAoB;AACzB,QAAA;AAAA;AACJ,EACF;AAAA;AAAA;AAAA;AAAA,EAKQ,kBAAkB,GAAA,EAAqB;AAC7C,IAAA,IAAI,CAAC,KAAK,UAAA,IAAc,CAAC,IAAI,MAAA,IAAU,CAAC,IAAI,KAAA,EAAO;AACjD,MAAA,IAAA,CAAK,IAAA,CAAK,IAAI,KAAA,CAAM,gCAAgC,CAAC,CAAA;AACrD,MAAA,IAAA,CAAK,mBAAA,EAAoB;AACzB,MAAA;AAAA,IACF;AAEA,IAAA,IAAI;AACF,MAAA,MAAM,SAAA,GAAY,IAAA,CAAK,MAAA,CAAO,gBAAA,CAAiB;AAAA,QAC7C,WAAW,EAAE,MAAA,EAAQ,IAAI,MAAA,EAAQ,KAAA,EAAO,IAAI,KAAA,EAAM;AAAA,QAClD,WAAW,IAAA,CAAK;AAAA,OACjB,CAAA;AAED,MAAA,IAAI,CAAC,SAAA,EAAW;AACd,QAAA,IAAA,CAAK,IAAA,CAAK,IAAI,KAAA,CAAM,6BAA6B,CAAC,CAAA;AAClD,QAAA,IAAA,CAAK,mBAAA,EAAoB;AACzB,QAAA;AAAA,MACF;AAEA,MAAA,MAAM,MAAA,GAAyB,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA;AAEnD,MAAA,IAAA,CAAK,IAAA,CAAK,WAAW,MAAM,CAAA;AAC3B,MAAA,IAAA,CAAK,YAAA,CAAa,WAAW,eAAe,CAAA;AAG5C,MAAA,IAAA,CAAK,WAAW,IAAA,CAAK;AAAA,QACnB,IAAA,EAAM,SAAA;AAAA,QACN,WAAW,IAAA,CAAK;AAAA,OACjB,CAAA;AAAA,IACH,CAAA,CAAA,MAAQ;AACN,MAAA,IAAA,CAAK,IAAA,CAAK,IAAI,KAAA,CAAM,uCAAuC,CAAC,CAAA;AAC5D,MAAA,IAAA,CAAK,mBAAA,EAAoB;AAAA,IAC3B;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAc,eAAe,MAAA,EAAqB;AAChD,IAAA,IAAI;AACF,MAAA,MAAM,MAAM,MAAM,KAAA;AAAA,QAChB,CAAA,EAAG,OAAO,CAAA,oBAAA,EAAuB,MAAA,CAAO,SAAS,CAAA;AAAA,OACnD;AAEA,MAAA,IAAI,CAAC,GAAA,CAAI,EAAA,EAAI,MAAM,IAAI,MAAM,iBAAiB,CAAA;AAE9C,MAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,MAAA,MAAM,SAAA,GAAY,IAAA,CAAK,MAAA,CAAO,gBAAA,CAAiB;AAAA,QAC7C,WAAW,EAAE,MAAA,EAAQ,KAAK,MAAA,EAAQ,KAAA,EAAO,KAAK,KAAA,EAAM;AAAA,QACpD,WAAW,MAAA,CAAO;AAAA,OACnB,CAAA;AAED,MAAA,IAAI,CAAC,SAAA,EAAW;AACd,QAAA,IAAA,CAAK,IAAA,CAAK,IAAI,KAAA,CAAM,sBAAsB,CAAC,CAAA;AAC3C,QAAA,IAAA,CAAK,mBAAA,EAAoB;AACzB,QAAA;AAAA,MACF;AACA,MAAA,MAAM,MAAA,GAAyB,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA;AACnD,MAAA,IAAA,CAAK,IAAA,CAAK,WAAW,MAAM,CAAA;AAC3B,MAAA,gBAAA,EAAiB;AAAA,IACnB,CAAA,CAAA,MAAQ;AACN,MAAA,IAAA,CAAK,IAAA,CAAK,IAAI,KAAA,CAAM,yBAAyB,CAAC,CAAA;AAC9C,MAAA,IAAA,CAAK,mBAAA,EAAoB;AAAA,IAC3B;AAAA,EACF;AAAA,EAEQ,wBAAA,GAA2B;AACjC,IAAA,IAAA,CAAK,oBAAoB,YAAY;AACnC,MAAA,IAAI,QAAA,CAAS,oBAAoB,SAAA,EAAW;AAE5C,MAAA,MAAM,SAAS,cAAA,EAAe;AAC9B,MAAA,IAAI,CAAC,MAAA,EAAQ;AACb,MAAA,MAAM,IAAA,CAAK,eAAe,MAAM,CAAA;AAAA,IAClC,CAAA;AAEA,IAAA,QAAA,CAAS,gBAAA,CAAiB,kBAAA,EAAoB,IAAA,CAAK,iBAAiB,CAAA;AAAA,EACtE;AAAA,EAEQ,wBAAA,GAA2B;AACjC,IAAA,IAAI,KAAK,iBAAA,EAAmB;AAC1B,MAAA,QAAA,CAAS,mBAAA,CAAoB,kBAAA,EAAoB,IAAA,CAAK,iBAAiB,CAAA;AACvE,MAAA,IAAA,CAAK,iBAAA,GAAoB,MAAA;AAAA,IAC3B;AAAA,EACF;AAAA;AAAA,EAGQ,UAAU,OAAA,EAAkB;AAClC,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,IAAA,CAAK,WAAW,IAAA,CAAK;AAAA,QACnB,IAAA,EAAM,mBAAA;AAAA,QACN,WAAW,IAAA,CAAK,SAAA;AAAA,QAChB,SAAA,EAAW,KAAK,MAAA,CAAO,SAAA;AAAA,QACvB,SAAA,EAAW,KAAK,MAAA,CAAO,SAAA;AAAA,QACvB,QAAA,EAAU,KAAK,MAAA,CAAO;AAAA,OACvB,CAAA;AAAA,IACH;AAEA,IAAA,IAAA,CAAK,WAAW,KAAA,EAAM;AACtB,IAAA,gBAAA,EAAiB;AACjB,IAAA,IAAA,CAAK,YAAA,EAAa;AAElB,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,CAAO,cAAA,EAAgB;AAC/B,MAAA,IAAA,CAAK,wBAAA,EAAyB;AAAA,IAChC;AACA,IAAA,IAAA,CAAK,YAAA,CAAa,UAAA,CAAW,OAAA,GAAU,WAAA,GAAc,MAAM,CAAA;AAAA,EAC7D;AAAA,EAEQ,mBAAA,GAAsB;AAC5B,IAAA,IAAA,CAAK,YAAA,CAAa,WAAW,MAAM,CAAA;AACnC,IAAA,IAAA,CAAK,WAAW,KAAA,EAAM;AACtB,IAAA,IAAI,CAAC,IAAA,CAAK,MAAA,CAAO,cAAA,EAAgB;AACjC,IAAA,UAAA,CAAW,MAAM;AACf,MAAA,IAAA,CAAK,KAAA,EAAM;AAAA,IACb,GAAG,GAAG,CAAA;AAAA,EACR;AAAA,EAEQ,YAAA,GAAe;AACrB,IAAA,IAAA,CAAK,SAAA,GAAY,EAAA;AACjB,IAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAAA,EACpB;AAAA;AAAA,EAGA,OAAA,GAAU;AACR,IAAA,IAAA,CAAK,wBAAA,EAAyB;AAC9B,IAAA,IAAA,CAAK,WAAW,KAAA,EAAM;AACtB,IAAA,IAAA,CAAK,YAAY,EAAC;AAAA,EACpB;AAAA,EAEQ,IAAA,CACN,OACA,OAAA,EACA;AACA,IAAA,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,EAAG,OAAA,CAAQ,CAAC,EAAA,KAAO,EAAA,CAAG,OAAO,CAAC,CAAA;AAAA,EACpD;AAAA,EAEQ,KAAK,GAAA,EAAY;AACvB,IAAA,IAAA,CAAK,IAAA,CAAK,SAAS,GAAG,CAAA;AACtB,IAAA,IAAA,CAAK,YAAA,CAAa,WAAW,OAAO,CAAA;AAAA,EACtC;AACF","file":"index.mjs","sourcesContent":["import nacl from \"tweetnacl\";\nimport { decodeBase64, encodeBase64 } from \"tweetnacl-util\";\n\ninterface EncryptedMessage {\n  cipher: string; // Base64 encoded\n  nonce: string; // Base64 encoded\n}\n\nexport class CryptoService {\n  generateSymmetricKey(): string {\n    const key = nacl.randomBytes(32);\n    return encodeBase64(key);\n  }\n\n  /**\n   * Encrypt with symmetric key (secret-key encryption)\n   * Use this when both parties share the same secret key\n   * @param plaintext - Message to encrypt\n   * @param keyString - Symmetric key (base64)\n   * @returns Encrypted message with nonce\n   */\n  encryptSymmetric({\n    plaintext,\n    keyString,\n  }: {\n    plaintext: string;\n    keyString: string;\n  }): EncryptedMessage {\n    const key = decodeBase64(keyString);\n    const nonce = nacl.randomBytes(24);\n\n    const messageBytes = new TextEncoder().encode(plaintext);\n\n    const ciphertext = nacl.secretbox(messageBytes, nonce, key);\n\n    return {\n      cipher: encodeBase64(ciphertext),\n      nonce: encodeBase64(nonce),\n    };\n  }\n\n  /**\n   * Decrypt with symmetric key\n   * @param encrypted - Encrypted message with nonce\n   * @param keyString - Symmetric key (base64)\n   * @returns Decrypted plaintext\n   */\n  decryptSymmetric({\n    encrypted,\n    keyString,\n  }: {\n    encrypted: EncryptedMessage;\n    keyString: string;\n  }): string | null {\n    try {\n      const key = decodeBase64(keyString);\n      const ciphertextBytes = decodeBase64(encrypted.cipher);\n      const nonceBytes = decodeBase64(encrypted.nonce);\n\n      const decrypted = nacl.secretbox.open(ciphertextBytes, nonceBytes, key);\n\n      if (!decrypted) {\n        throw new Error(\"Decryption failed - invalid key or corrupted data\");\n      }\n\n      const decoded = new TextDecoder().decode(decrypted);\n      return decoded;\n    } catch (error) {\n      console.error(\"Decryption failed\", error);\n      return null;\n    }\n  }\n}\n\nexport default CryptoService;\nexport type { EncryptedMessage };\n","// hybridStorage.ts\n/**\n * Hybrid storage: Try sessionStorage first, fallback to memory\n * Best of both worlds - survives page refresh but auto-cleans\n */\n\ninterface StorageOptions {\n  ttlMs?: number;\n  useSessionStorage?: boolean;\n}\n\nclass AuthStorage {\n  private readonly prefix = \"pelican_auth_\";\n  private readonly defaultTTL = 5 * 60 * 1000; // 5 minutes\n  private memoryCache: Map<string, { value: any; expiresAt: number }> =\n    new Map();\n\n  /**\n   * Store auth session with automatic cleanup\n   */\n  set(key: string, value: any, options: StorageOptions = {}): void {\n    const { ttlMs = this.defaultTTL, useSessionStorage = true } = options;\n\n    const expiresAt = Date.now() + ttlMs;\n    const data = { value, expiresAt };\n\n    // Try sessionStorage first\n    if (useSessionStorage) {\n      try {\n        sessionStorage.setItem(`${this.prefix}${key}`, JSON.stringify(data));\n      } catch (error) {\n        console.warn(\"SessionStorage unavailable, using memory:\", error);\n        this.setMemory(key, data);\n      }\n    } else {\n      this.setMemory(key, data);\n    }\n  }\n\n  /**\n   * Get stored value if not expired\n   */\n  get(key: string): any | null {\n    // Try sessionStorage first\n    try {\n      const stored = sessionStorage.getItem(`${this.prefix}${key}`);\n      if (stored) {\n        const data = JSON.parse(stored);\n\n        // Check expiration\n        if (Date.now() > data.expiresAt) {\n          this.remove(key);\n          return null;\n        }\n\n        return data.value;\n      }\n    } catch (error) {\n      // Fallback to memory\n    }\n\n    // Try memory cache\n    return this.getMemory(key);\n  }\n\n  /**\n   * Remove specific key\n   */\n  remove(key: string): void {\n    try {\n      sessionStorage.removeItem(`${this.prefix}${key}`);\n    } catch (error) {\n      // Ignore\n    }\n    this.memoryCache.delete(key);\n  }\n\n  /**\n   * Clear all auth data\n   */\n  clear(): void {\n    // Clear sessionStorage\n    try {\n      Object.keys(sessionStorage).forEach((key) => {\n        if (key.startsWith(this.prefix)) {\n          sessionStorage.removeItem(key);\n        }\n      });\n    } catch (error) {\n      // Ignore\n    }\n\n    // Clear memory\n    this.memoryCache.clear();\n  }\n\n  // ========================================\n  // Memory cache helpers\n  // ========================================\n\n  private setMemory(\n    key: string,\n    data: { value: any; expiresAt: number }\n  ): void {\n    this.memoryCache.set(key, data);\n\n    // Schedule cleanup\n    const ttl = data.expiresAt - Date.now();\n    setTimeout(() => {\n      this.memoryCache.delete(key);\n    }, ttl);\n  }\n\n  private getMemory(key: string): any | null {\n    const data = this.memoryCache.get(key);\n    if (!data) return null;\n\n    if (Date.now() > data.expiresAt) {\n      this.memoryCache.delete(key);\n      return null;\n    }\n\n    return data.value;\n  }\n}\n\n// Singleton instance\nconst storage = new AuthStorage();\n\n// ========================================\n// Convenience functions for auth flow\n// ========================================\n\nexport interface AuthSession {\n  sessionId: string;\n  sessionKey: string;\n}\n\nexport const storeAuthSession = (\n  sessionId: string,\n  sessionKey: string,\n  ttlMs?: number\n): void => {\n  storage.set(\"session\", { sessionId, sessionKey }, { ttlMs });\n};\n\nexport const getAuthSession = (): AuthSession | null => {\n  return storage.get(\"session\");\n};\n\nexport const clearAuthSession = (): void => {\n  storage.remove(\"session\");\n};\n\nexport const clearAllAuthData = (): void => {\n  storage.clear();\n};\n\nexport default storage;\n","import type { PelicanAuthState } from \"../types/types\";\n\nexport class StateMachine {\n  private state: PelicanAuthState = \"idle\";\n  private listeners = new Set<(s: PelicanAuthState) => void>();\n\n  get current() {\n    return this.state;\n  }\n\n  transition(next: PelicanAuthState) {\n    this.state = next;\n    this.listeners.forEach((l) => l(next));\n  }\n\n  subscribe(fn: (s: PelicanAuthState) => void) {\n    this.listeners.add(fn);\n    return () => this.listeners.delete(fn);\n  }\n}\n","import { ISocketMessage } from \"../types/types\";\n\ntype TransportHandlers = {\n  onOpen?: () => void;\n  onMessage?: (msg: ISocketMessage) => void;\n  onError?: (err: Event) => void;\n  onClose?: (ev: CloseEvent) => void;\n};\n\nexport class Transport {\n  private socket?: WebSocket;\n  private handlers: TransportHandlers;\n  private reconnectAttempts = 0;\n  private maxReconnectAttempts = 5;\n  private isExplicitlyClosed = false;\n  private url?: string;\n\n  constructor(handlers: TransportHandlers) {\n    this.handlers = handlers;\n  }\n\n  connect(url: string) {\n    this.url = url;\n    this.isExplicitlyClosed = false;\n    this.socket = new WebSocket(url);\n\n    this.socket.onopen = () => {\n      this.reconnectAttempts = 0;\n      this.handlers.onOpen?.();\n    };\n    this.socket.onmessage = (e: MessageEvent) => {\n      try {\n        const data = JSON.parse(e.data);\n        this.handlers.onMessage?.(data);\n      } catch (err) {\n        console.error(\"Failed to parse message\", err);\n      }\n    };\n    this.socket.onerror = (e: Event) => {\n      this.handlers.onError?.(e);\n    };\n    this.socket.onclose = (e: CloseEvent) => {\n      this.handlers.onClose?.(e);\n\n      // Only reconnect if the user didn't call .close() manually\n      if (!this.isExplicitlyClosed) {\n        this.attemptReconnect();\n      }\n    };\n  }\n\n  private attemptReconnect() {\n    if (this.reconnectAttempts >= this.maxReconnectAttempts) {\n      console.error(\"❌ Max reconnect attempts reached\");\n      return;\n    }\n\n    this.reconnectAttempts++;\n\n    const delay = Math.pow(2, this.reconnectAttempts) * 500;\n    setTimeout(() => {\n      if (this.url) this.connect(this.url);\n    }, delay);\n  }\n  send(payload: ISocketMessage) {\n    if (this.socket?.readyState === WebSocket.OPEN) {\n      this.socket.send(JSON.stringify(payload));\n    }\n  }\n\n  close() {\n    this.isExplicitlyClosed = true;\n    this.socket?.close();\n  }\n}\n","export const BASEURL = \"https://identityapi.pelicanidentity.com\";\n","import CryptoService from \"../utilities/crypto\";\nimport QRCode from \"qrcode\";\nimport {\n  PelicanAuthConfig,\n  PelicanAuthEventMap,\n  ISocketMessage,\n  IdentityResult,\n} from \"../types/types\";\nimport {\n  storeAuthSession,\n  getAuthSession,\n  clearAuthSession,\n  AuthSession,\n} from \"../utilities/storage\";\nimport { StateMachine } from \"../utilities/stateMachine\";\nimport { Transport } from \"../utilities/transport\";\n\nimport { BASEURL } from \"../constants\";\n\ntype Listener<T> = (payload: T) => void;\n\n/**\n * PelicanAuth SDK\n * Handles cross-device authentication via WebSockets and E2EE (End-to-End Encryption).\n */\nexport class PelicanAuthentication {\n  private readonly crypto = new CryptoService();\n  private readonly stateMachine = new StateMachine();\n\n  private transport?: Transport;\n  private sessionId = \"\";\n  private sessionKey: string | null = null;\n\n  private visibilityHandler?: () => void;\n\n  private listeners: {\n    [K in keyof PelicanAuthEventMap]?: Set<Listener<any>>;\n  } = {};\n\n  private readonly config: Required<PelicanAuthConfig>;\n\n  constructor(config: PelicanAuthConfig) {\n    if (!config.publicKey) throw new Error(\"Missing publicKey\");\n    if (!config.projectId) throw new Error(\"Missing projectId\");\n    if (!config.authType) throw new Error(\"Missing authType\");\n\n    this.config = {\n      continuousMode: false,\n      forceQRCode: false,\n      ...config,\n    };\n\n    // Sync internal state machine changes with the 'state' event\n    this.stateMachine.subscribe((s) => this.emit(\"state\", s));\n    this.attachVisibilityRecovery();\n  }\n\n  /* -------------------- public API -------------------- */\n\n  /**\n   * Subscribe to SDK events (qr, deeplink, success, error, state)\n   * @returns Unsubscribe function\n   */\n  on<K extends keyof PelicanAuthEventMap>(\n    event: K,\n    cb: Listener<PelicanAuthEventMap[K]>\n  ) {\n    this.listeners[event] ??= new Set();\n    this.listeners[event]!.add(cb);\n    return () => this.listeners[event]!.delete(cb);\n  }\n\n  /**\n   * Initializes the authentication flow.\n   * Fetches a relay, establishes a WebSocket, and generates the E2EE session key.\n   */\n  async start() {\n    if (this.stateMachine.current !== \"idle\") return;\n    this.resetSession();\n    clearAuthSession();\n    this.stateMachine.transition(\"initializing\");\n\n    try {\n      const relay = await this.fetchRelayUrl();\n\n      // Generate a fresh symmetric key for this specific session\n      this.sessionKey = this.crypto.generateSymmetricKey();\n      this.sessionId = crypto.randomUUID() + crypto.randomUUID();\n\n      this.transport = new Transport({\n        onOpen: () => {\n          // Register this browser session with the relay\n          this.transport!.send({\n            type: \"register\",\n            sessionID: this.sessionId,\n            ...this.config,\n          });\n          this.stateMachine.transition(\"awaiting-pair\");\n        },\n        onMessage: (msg: ISocketMessage) => this.handleMessage(msg),\n        onError: () => this.fail(new Error(\"WebSocket connection failed\")),\n      });\n\n      this.transport.connect(relay);\n      await this.emitEntryPoint();\n    } catch (err) {\n      this.fail(err instanceof Error ? err : new Error(\"Start failed\"));\n    }\n  }\n\n  /**\n   * Manually stops the authentication process and closes connections.\n   */\n  stop() {\n    this.terminate(false);\n  }\n\n  /* -------------------- internals -------------------- */\n\n  /** Fetches the WebSocket Relay URL from the backend */\n  private async fetchRelayUrl(): Promise<string> {\n    const { publicKey, projectId, authType } = this.config;\n    const res = await fetch(\n      `${BASEURL}/relay?public_key=${publicKey}&auth_type=${authType}&project_id=${projectId}`\n    );\n\n    if (!res.ok) {\n      const error = await res.text();\n      throw new Error(error);\n    }\n\n    const json = await res.json();\n    return json.relay_url;\n  }\n\n  /**\n   * Decides whether to show a QR code (Desktop) or a Deep Link (Mobile).\n   */\n  private async emitEntryPoint() {\n    const payload = {\n      sessionID: this.sessionId,\n      sessionKey: this.sessionKey,\n      publicKey: this.config.publicKey,\n      authType: this.config.authType,\n      projectId: this.config.projectId,\n      url: window.location.href,\n    };\n\n    const shouldUseQR =\n      this.config.forceQRCode ||\n      !/Android|iPhone|iPad/i.test(navigator.userAgent);\n\n    if (!shouldUseQR && this.sessionKey) {\n      // For mobile: Store session locally so we can recover when the user returns from the app\n      storeAuthSession(this.sessionId, this.sessionKey, 5 * 60_000);\n      this.emit(\n        \"deeplink\",\n        `pelicanvault://auth/deep-link?sessionID=${encodeURIComponent(\n          this.sessionId\n        )}&sessionKey=${encodeURIComponent(\n          this.sessionKey\n        )}&publicKey=${encodeURIComponent(this.config.publicKey)}&authType=${\n          this.config.authType\n        }&projectId=${encodeURIComponent(\n          this.config.projectId\n        )}&url=${encodeURIComponent(window.location.href)}`\n      );\n    } else {\n      const qr = await QRCode.toDataURL(JSON.stringify(payload), {\n        type: \"image/png\",\n        scale: 3,\n        color: { light: \"#ffffff\", dark: \"#424242ff\" },\n      });\n      this.emit(\"qr\", qr);\n    }\n  }\n\n  /** Main WebSocket message router */\n  private handleMessage(msg: ISocketMessage) {\n    switch (msg.type) {\n      case \"paired\":\n        this.stateMachine.transition(\"paired\");\n        this.transport!.send({\n          type: \"authenticate\",\n          sessionID: this.sessionId,\n          ...this.config,\n          url: window.location.href,\n        });\n        return;\n\n      case \"phone-auth-success\":\n        // Mobile device successfully authenticated and sent encrypted credentials\n        this.handleAuthSuccess(msg);\n        return;\n\n      case \"phone-terminated\":\n        this.fail(new Error(\"Authenticating device terminated the connection\"));\n        this.restartIfContinuous();\n        return;\n\n      case \"confirmed\":\n        // Handshake complete\n        this.terminate(true);\n        this.restartIfContinuous();\n        return;\n    }\n  }\n\n  /**\n   * Decrypts the identity payload received from the phone using the session key.\n   */\n  private handleAuthSuccess(msg: ISocketMessage) {\n    if (!this.sessionKey || !msg.cipher || !msg.nonce) {\n      this.fail(new Error(\"Invalid authentication payload\"));\n      this.restartIfContinuous();\n      return;\n    }\n\n    try {\n      const decrypted = this.crypto.decryptSymmetric({\n        encrypted: { cipher: msg.cipher, nonce: msg.nonce },\n        keyString: this.sessionKey,\n      });\n\n      if (!decrypted) {\n        this.fail(new Error(\"Invalid authentication data\"));\n        this.restartIfContinuous();\n        return;\n      }\n\n      const result: IdentityResult = JSON.parse(decrypted);\n\n      this.emit(\"success\", result);\n      this.stateMachine.transition(\"authenticated\");\n\n      // Signal to the relay/phone that we have received and decrypted the data\n      this.transport?.send({\n        type: \"confirm\",\n        sessionID: this.sessionId,\n      });\n    } catch {\n      this.fail(new Error(\"Failed to decrypt authentication data\"));\n      this.restartIfContinuous();\n    }\n  }\n\n  /**\n   * Logic to handle users returning to the browser tab after using the mobile app.\n   * Checks the server for a completed session that might have finished while in background.\n   */\n\n  private async getCachedEntry(cached: AuthSession) {\n    try {\n      const res = await fetch(\n        `${BASEURL}/session?session_id=${cached.sessionId}`\n      );\n\n      if (!res.ok) throw new Error(\"Invalid session\");\n\n      const data = await res.json();\n      const decrypted = this.crypto.decryptSymmetric({\n        encrypted: { cipher: data.cipher, nonce: data.nonce },\n        keyString: cached.sessionKey,\n      });\n\n      if (!decrypted) {\n        this.fail(new Error(\"Invalid session data\"));\n        this.restartIfContinuous();\n        return;\n      }\n      const result: IdentityResult = JSON.parse(decrypted);\n      this.emit(\"success\", result);\n      clearAuthSession();\n    } catch {\n      this.fail(new Error(\"Session recovery failed\"));\n      this.restartIfContinuous();\n    }\n  }\n\n  private attachVisibilityRecovery() {\n    this.visibilityHandler = async () => {\n      if (document.visibilityState !== \"visible\") return;\n\n      const cached = getAuthSession();\n      if (!cached) return;\n      await this.getCachedEntry(cached);\n    };\n\n    document.addEventListener(\"visibilitychange\", this.visibilityHandler);\n  }\n\n  private detachVisibilityRecovery() {\n    if (this.visibilityHandler) {\n      document.removeEventListener(\"visibilitychange\", this.visibilityHandler);\n      this.visibilityHandler = undefined;\n    }\n  }\n\n  /** Cleans up the current session state */\n  private terminate(success: boolean) {\n    if (!success) {\n      this.transport?.send({\n        type: \"client-terminated\",\n        sessionID: this.sessionId,\n        projectId: this.config.projectId,\n        publicKey: this.config.publicKey,\n        authType: this.config.authType,\n      });\n    }\n\n    this.transport?.close();\n    clearAuthSession();\n    this.resetSession();\n\n    if (!this.config.continuousMode) {\n      this.detachVisibilityRecovery();\n    }\n    this.stateMachine.transition(success ? \"confirmed\" : \"idle\");\n  }\n\n  private restartIfContinuous() {\n    this.stateMachine.transition(\"idle\");\n    this.transport?.close();\n    if (!this.config.continuousMode) return;\n    setTimeout(() => {\n      this.start();\n    }, 150);\n  }\n\n  private resetSession() {\n    this.sessionId = \"\";\n    this.sessionKey = null;\n  }\n\n  /** Completely destroys the instance and removes all listeners */\n  destroy() {\n    this.detachVisibilityRecovery();\n    this.transport?.close();\n    this.listeners = {};\n  }\n\n  private emit<K extends keyof PelicanAuthEventMap>(\n    event: K,\n    payload: PelicanAuthEventMap[K]\n  ) {\n    this.listeners[event]?.forEach((cb) => cb(payload));\n  }\n\n  private fail(err: Error) {\n    this.emit(\"error\", err);\n    this.stateMachine.transition(\"error\");\n  }\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pelican-identity/auth-core",
-  "version": "1.2.6",
+  "version": "1.2.8",
   "description": "Framework-agnostic authentication SDK for Pelican Identity",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",