@rakomi/react-native 0.0.0 → 0.1.0

package/dist/index.js

@@ -0,0 +1,2004 @@
+import { createContext, useMemo, useReducer, useEffect, useRef, useState, useContext } from 'react';
+import { EventLog, reduce, INITIAL_SNAPSHOT, createTranslator, isSignedIn, hasPermission, hasRole, generatePkce, issueState, buildAuthorizationUrl, consumeState, exchangeAuthCode, parseOAuthCallbackError, scorePassword, isSafeUrl, verifyMagicLink, requestMagicLink, verifyEmailOtp, requestEmailOtp, register, verifyTotp, MfaStepUpUnavailableError, decodeUser, decodeSession, deriveTenantStorageKey, createJwksCache, refreshAccessToken } from '@rakomi/sdk-core';
+export { MfaStepUpRequiredError, MfaStepUpUnavailableError, base64url, createTranslator, decodeJwtPayload, decodeSession, decodeUser, generatePkce, getErrorMessage, hasPermission, hasRole, isSafeUrl, networkError, parseOAuthCallbackError, parseTokenEndpointError, scorePassword, selectPluralForm } from '@rakomi/sdk-core';
+import { jwtVerify } from 'jose';
+import { jsx, Fragment, jsxs } from 'react/jsx-runtime';
+
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/internal/canonical-url.ts
+var CanonicalizeUrlError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "CanonicalizeUrlError";
+  }
+  code;
+};
+function collapsePath(path) {
+  const collapsed = path.replace(/\/{2,}/g, "/");
+  if (collapsed.length > 1 && collapsed.endsWith("/")) {
+    return collapsed.slice(0, -1);
+  }
+  return collapsed;
+}
+function lowercasePercentHex(s) {
+  return s.replace(/%([0-9A-Fa-f]{2})/g, (_m, h) => `%${h.toLowerCase()}`);
+}
+function canonicalizeUrl(input, options = {}) {
+  const version = options.version ?? "rfc9449-2023";
+  if (version !== "rfc9449-2023") {
+    throw new CanonicalizeUrlError("unsupported_version", `unsupported canonicalize-url version: ${version}`);
+  }
+  let url;
+  try {
+    url = new URL(input);
+  } catch {
+    throw new CanonicalizeUrlError("invalid_url", "invalid url");
+  }
+  if (url.protocol === "https:" && url.port === "443" || url.protocol === "http:" && url.port === "80") {
+    url.port = "";
+  }
+  url.search = "";
+  url.hash = "";
+  const normalizedPath = collapsePath(lowercasePercentHex(url.pathname));
+  const host = url.host;
+  return `${url.protocol}//${host}${normalizedPath}`;
+}
+
+// src/internal/dpop-session.ts
+var DpopSession = class {
+  prover;
+  baseUrl;
+  onDowngrade;
+  _bound = false;
+  _downgraded = false;
+  _downgradeNotified = false;
+  _boundJkt;
+  constructor(options) {
+    this.prover = options.prover;
+    this.baseUrl = options.baseUrl.endsWith("/") ? options.baseUrl.slice(0, -1) : options.baseUrl;
+    this.onDowngrade = options.onDowngrade;
+  }
+  /**
+   * `true` once the server has confirmed (`token_type === "DPoP"`) that this
+   * session's key is sender-bound. The SDK attaches a refresh proof IFF this is
+   * `true`. Starts `false`; set by observing issuance/refresh responses.
+   */
+  get isBound() {
+    return this._bound;
+  }
+  /**
+   * `true` if a session that presented a DPoP proof was returned as `Bearer` by
+   * the server (a security downgrade — flag off / server-side downgrade).
+   */
+  get isDowngraded() {
+    return this._downgraded;
+  }
+  /** The committed RFC 7638 thumbprint (`jkt`) of the session keypair, once bound. */
+  get boundJkt() {
+    return this._boundJkt;
+  }
+  async resolveProof(htm, target, opts) {
+    const absolute = /^[a-z][a-z0-9+.-]*:\/\//i.test(target) ? target : `${this.baseUrl}${target}`;
+    const htu = canonicalizeUrl(absolute);
+    const input = { htm, htu, ...opts?.nonce !== void 0 ? { nonce: opts.nonce } : {} };
+    return this.prover.createProof(input);
+  }
+  async jktHint() {
+    return this.prover.jktHint();
+  }
+  async observeTokenType(tokenType, attachedProof) {
+    if (tokenType === "DPoP") {
+      this._bound = true;
+      this._downgraded = false;
+      if (this._boundJkt === void 0) {
+        this._boundJkt = await this.prover.jktHint();
+      }
+      return;
+    }
+    this._bound = false;
+    if (attachedProof) {
+      this._downgraded = true;
+      if (!this._downgradeNotified) {
+        this._downgradeNotified = true;
+        this.onDowngrade?.({ reason: "server_returned_bearer" });
+      }
+    }
+  }
+};
+function createDpopSession(options) {
+  return new DpopSession(options);
+}
+
+// src/internal/http-client.ts
+function createRnHttpClient(options = {}) {
+  const baseUrl = options.baseUrl?.replace(/\/$/, "") ?? "";
+  const timeout = options.defaultTimeoutMs ?? 3e4;
+  return {
+    fetch: async (url, init = {}) => {
+      const fullUrl = url.startsWith("http://") || url.startsWith("https://") ? url : `${baseUrl}${url.startsWith("/") ? "" : "/"}${url}`;
+      const controller = new AbortController();
+      const timer = setTimeout(() => controller.abort(), timeout);
+      try {
+        return await fetch(fullUrl, {
+          method: init.method ?? "GET",
+          headers: init.headers,
+          body: init.body,
+          redirect: "error",
+          signal: init.signal ?? controller.signal
+        });
+      } finally {
+        clearTimeout(timer);
+      }
+    }
+  };
+}
+function err(cls, message) {
+  return { ok: false, error: { class: cls, code: `auth/${cls}`, message } };
+}
+function proverUnavailable(message = "DPoP prover unavailable") {
+  return err("dpop_prover_unavailable", message);
+}
+async function refreshWithDpop(input) {
+  const session = input.dpopSession;
+  const bound = session?.isBound === true;
+  if (!bound || !session) {
+    const result2 = await refreshAccessToken({
+      http: input.http,
+      tokenEndpoint: input.tokenEndpoint,
+      refreshToken: input.refreshToken,
+      clientId: input.clientId
+    });
+    if (result2.ok) {
+      await session?.observeTokenType(result2.tokens.token_type, false);
+      return { ok: true, tokens: result2.tokens, attachedProof: false };
+    }
+    return mapFailure(result2, false);
+  }
+  let proof;
+  try {
+    proof = await session.resolveProof("POST", input.tokenEndpoint);
+  } catch (e) {
+    return proverUnavailable(e instanceof Error ? e.message : "DPoP prover threw");
+  }
+  if (!proof) return proverUnavailable("DPoP prover returned an empty proof");
+  let result = await refreshAccessToken({
+    http: input.http,
+    tokenEndpoint: input.tokenEndpoint,
+    refreshToken: input.refreshToken,
+    clientId: input.clientId,
+    dpopProof: proof
+  });
+  if (!result.ok && result.dpopNonce !== void 0) {
+    let retryProof;
+    try {
+      retryProof = await session.resolveProof("POST", input.tokenEndpoint, { nonce: result.dpopNonce });
+    } catch (e) {
+      return proverUnavailable(e instanceof Error ? e.message : "DPoP prover threw on nonce retry");
+    }
+    if (!retryProof) return proverUnavailable("DPoP prover returned an empty proof on nonce retry");
+    result = await refreshAccessToken({
+      http: input.http,
+      tokenEndpoint: input.tokenEndpoint,
+      refreshToken: input.refreshToken,
+      clientId: input.clientId,
+      dpopProof: retryProof
+    });
+  }
+  if (result.ok) {
+    await session.observeTokenType(result.tokens.token_type, true);
+    return { ok: true, tokens: result.tokens, attachedProof: true };
+  }
+  return mapFailure(result, true);
+}
+function mapFailure(result, attachedProof) {
+  const message = result.error.message ?? "refresh failed";
+  if (attachedProof && (result.dpopProofRejected || result.dpopNonce !== void 0)) {
+    return err("invalid_dpop_proof", message);
+  }
+  if (result.error.code === "REFRESH_FAILED" && result.error.reason === "network") {
+    return err("network", message);
+  }
+  return err("invalid_refresh_token", message);
+}
+
+// src/internal/token-runtime.ts
+var RETRY_DELAYS_MS = [2e3, 8e3, 3e4];
+function bytesToBase64Url(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
+  const std = btoa(binary);
+  return std.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function deriveDefaultJwksUri(tokenEndpoint) {
+  try {
+    const url = new URL(tokenEndpoint);
+    return `${url.origin}/.well-known/jwks.json`;
+  } catch {
+    return tokenEndpoint.replace(/\/[^/]*$/, "") + "/.well-known/jwks.json";
+  }
+}
+var RAKOMI_PLATFORM_ISSUER_DEFAULT = "https://rakomi.com";
+var RAKOMI_PLATFORM_AUDIENCE_DEFAULT = "https://rakomi.com";
+function deriveDefaultIssuer(_tokenEndpoint) {
+  return RAKOMI_PLATFORM_ISSUER_DEFAULT;
+}
+var REFRESH_TOKEN_PREFIX = "v1:";
+var REFRESH_BUFFER_SECONDS = 60;
+var TokenRuntime = class _TokenRuntime {
+  clientId;
+  tenantId;
+  tokenEndpoint;
+  storage;
+  http;
+  crypto;
+  biometric;
+  biometricEnabled;
+  biometricStrict;
+  biometricPrompt;
+  dispatch;
+  dpopSession;
+  emitEvent;
+  now;
+  setTimeoutFn;
+  clearTimeoutFn;
+  storageKeyResolved = null;
+  jwksKeyResolved = null;
+  jwksCache = null;
+  jwksUri;
+  jwksTtlMs;
+  expectedIssuer;
+  expectedAudience;
+  accessToken = null;
+  expiresAtMs = null;
+  currentUser = null;
+  currentSession = null;
+  refreshInFlight = null;
+  refreshAttempts = 0;
+  retryTimer = null;
+  destroyed = false;
+  offlineStaleCycles = 0;
+  static MAX_OFFLINE_STALE_CYCLES = 3;
+  submitNonces = /* @__PURE__ */ new Map();
+  static NONCE_TTL_MS = 5 * 60 * 1e3;
+  static MAX_PENDING_NONCES = 100;
+  constructor(options) {
+    this.clientId = options.clientId;
+    this.tenantId = options.tenantId;
+    this.tokenEndpoint = options.tokenEndpoint;
+    this.storage = options.storage;
+    this.http = options.http;
+    this.crypto = options.crypto;
+    this.biometric = options.biometric;
+    this.biometricEnabled = options.biometricEnabled ?? false;
+    this.biometricStrict = options.biometricStrict ?? false;
+    this.biometricPrompt = options.biometricPrompt ?? "Authenticate to continue";
+    this.dispatch = options.dispatch;
+    this.dpopSession = options.dpopSession;
+    this.emitEvent = options.onEvent;
+    this.now = options.now ?? Date.now;
+    this.setTimeoutFn = options.setTimeout ?? globalThis.setTimeout.bind(globalThis);
+    this.clearTimeoutFn = options.clearTimeout ?? globalThis.clearTimeout.bind(globalThis);
+    this.jwksUri = options.jwksUri ?? deriveDefaultJwksUri(options.tokenEndpoint);
+    this.jwksTtlMs = options.jwksTtlMs ?? 24 * 60 * 60 * 1e3;
+    this.expectedIssuer = options.expectedIssuer ?? deriveDefaultIssuer(options.tokenEndpoint);
+    this.expectedAudience = options.expectedAudience ?? RAKOMI_PLATFORM_AUDIENCE_DEFAULT;
+  }
+  /**
+  * Issue a one-time submit nonce for an authentication ceremony.
+  *
+  * every public-surface `submitOAuthTokens` call MUST present a nonce
+  * issued by an in-flight flow. Nonces are 32 bytes, base64url, single-use, 5-minute TTL.
+  */
+  async beginAuthFlow() {
+    const bytes = await this.crypto.getRandomBytes(32);
+    const nonce = bytesToBase64Url(bytes);
+    this.submitNonces.set(nonce, this.now() + _TokenRuntime.NONCE_TTL_MS);
+    this.gcExpiredNonces();
+    while (this.submitNonces.size > _TokenRuntime.MAX_PENDING_NONCES) {
+      const oldest = this.submitNonces.keys().next().value;
+      if (oldest === void 0) break;
+      this.submitNonces.delete(oldest);
+    }
+    return nonce;
+  }
+  gcExpiredNonces() {
+    const cutoff = this.now();
+    for (const [nonce, expiresAt] of this.submitNonces) {
+      if (expiresAt < cutoff) this.submitNonces.delete(nonce);
+    }
+  }
+  consumeNonce(nonce) {
+    this.gcExpiredNonces();
+    const entry = this.submitNonces.get(nonce);
+    if (entry === void 0) return false;
+    this.submitNonces.delete(nonce);
+    return true;
+  }
+  /**
+  * Validate a submit nonce — public for Provider-layer nonce gate.
+  * Internal class paths (refresh, restore) bypass this; external consumer-facing
+  * surfaces (`Provider.submitOAuthTokens`) MUST call this BEFORE invoking `setTokens`.
+  */
+  validateSubmitNonce(nonce) {
+    return this.consumeNonce(nonce);
+  }
+  /**
+  * Persist tokens after a successful sign-in or refresh. Updates in-memory state,
+  * writes refresh token to secure storage, and dispatches `SIGN_IN_SUCCESS` /
+  * `REFRESH_SUCCESS` to the FSM.
+  *
+  * Internal API — the consumer-facing tokens-write surface is `Provider.submitOAuthTokens`,
+  * which gates this with `validateSubmitNonce`.
+  */
+  async setTokens(response, source = "sign_in") {
+    const user = decodeUser(response.access_token);
+    if (!user) {
+      this.dispatch({ type: "SIGN_IN_FAILED", error: { code: "SIGN_IN_FAILED", message: "Invalid or missing JWT claims" } });
+      return;
+    }
+    if (this.currentUser && this.currentUser.id !== user.id) {
+      await this.clear({ code: "SIGN_IN_FAILED", message: "session_mismatch on token set" });
+      return;
+    }
+    const sessionDecoded = decodeSession(response.access_token, response.expires_in);
+    if (!sessionDecoded) {
+      this.dispatch({ type: "SIGN_IN_FAILED", error: { code: "SIGN_IN_FAILED", message: "Invalid session claims" } });
+      return;
+    }
+    const clampedExpiresIn = Math.max(10, Math.min(86400, Math.floor(response.expires_in)));
+    this.accessToken = response.access_token;
+    this.expiresAtMs = this.now() + clampedExpiresIn * 1e3;
+    this.refreshAttempts = 0;
+    this.currentUser = user;
+    this.currentSession = { ...sessionDecoded, isExpiringSoon: false };
+    if (response.refresh_token) {
+      const key = await this.resolveStorageKey();
+      await this.storage.setItem(key, REFRESH_TOKEN_PREFIX + response.refresh_token, {
+        keychainAccessible: "AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY",
+        requireAuthentication: this.biometricEnabled,
+        authenticationPrompt: this.biometricEnabled ? this.biometricPrompt : void 0
+      });
+    }
+    if (source === "refresh") {
+      this.dispatch({ type: "REFRESH_SUCCESS", session: this.currentSession });
+    } else if (source === "sign_in") {
+      this.dispatch({ type: "SIGN_IN_SUCCESS", user, session: this.currentSession });
+    }
+  }
+  /**
+   * Public token getter — returns a `TokenResult` shape compatible with `useAuth().getToken`.
+   * Refreshes proactively if within the refresh buffer; deduplicates concurrent callers.
+   */
+  getToken = async () => {
+    const valid = this.getValidAccessToken();
+    if (valid) {
+      const expiresIn2 = Math.max(0, Math.floor(((this.expiresAtMs ?? 0) - this.now()) / 1e3));
+      return { ok: true, token: valid, tokenType: "Bearer", headers: {}, expiresIn: expiresIn2 };
+    }
+    const success = await this.performRefresh();
+    if (!success || !this.accessToken || this.expiresAtMs === null) {
+      return { ok: false, error: { code: "REFRESH_FAILED", reason: "expired", message: "No valid token available" } };
+    }
+    const expiresIn = Math.max(0, Math.floor((this.expiresAtMs - this.now()) / 1e3));
+    return { ok: true, token: this.accessToken, tokenType: "Bearer", headers: {}, expiresIn };
+  };
+  /**
+   * Try to restore session from persisted refresh token. Called once on Provider mount.
+   * Triggers a refresh — on success dispatches RESTORE_SUCCESS; on failure RESTORE_FAILED.
+   */
+  async restore() {
+    const success = await this.performRefresh({ duringRestore: true });
+    if (success && this.currentUser && this.currentSession) {
+      this.dispatch({ type: "RESTORE_SUCCESS", user: this.currentUser, session: this.currentSession });
+      return true;
+    }
+    this.dispatch({ type: "RESTORE_FAILED" });
+    return false;
+  }
+  /**
+   * Foreground refresh — called by Provider AppState handler. Dispatches REFRESH_START
+   * and kicks a single in-flight refresh. No-op if no refresh token / already in flight.
+   */
+  async refreshOnForeground() {
+    if (this.refreshInFlight) return;
+    if (!this.currentUser) return;
+    this.dispatch({ type: "REFRESH_START" });
+    await this.performRefresh();
+  }
+  /**
+   * Clear all auth state. GDPR Art. 17 erasure.
+   */
+  async clear(error) {
+    this.accessToken = null;
+    this.expiresAtMs = null;
+    this.currentUser = null;
+    this.currentSession = null;
+    this.refreshInFlight = null;
+    this.refreshAttempts = 0;
+    if (this.retryTimer) {
+      this.clearTimeoutFn(this.retryTimer);
+      this.retryTimer = null;
+    }
+    try {
+      const key = await this.resolveStorageKey();
+      await this.storage.removeItem(key);
+    } catch {
+    }
+    if (error) {
+      this.dispatch({ type: "REFRESH_REVOKED", error });
+    } else {
+      this.dispatch({ type: "SIGN_OUT" });
+    }
+  }
+  /**
+  * Verify a JWT against the cached JWKS (offline-capable).
+  *
+  * uses `jose.createLocalJWKSet` so verification is purely local once
+  * the JWKS document has been fetched and cached. The cache is preloaded from `KeyValueStore`
+  * on cold-start (slot `jwks_cache`) and refreshed on TTL miss; on persistent network failure
+  * the stale-while-error fallback keeps verification working until the cached doc itself expires.
+  */
+  async verifyAccessToken(token) {
+    try {
+      const cache = await this.getOrCreateJwksCache();
+      const keySet = await cache.getKeySet();
+      const result = await jwtVerify(token, keySet, {
+        issuer: this.expectedIssuer,
+        audience: this.expectedAudience,
+        algorithms: ["RS256"]
+      });
+      return { ok: true, payload: result.payload };
+    } catch (err2) {
+      return { ok: false, reason: err2 instanceof Error ? err2.message : "verify failed" };
+    }
+  }
+  destroy() {
+    this.destroyed = true;
+    if (this.retryTimer) {
+      this.clearTimeoutFn(this.retryTimer);
+      this.retryTimer = null;
+    }
+    this.refreshInFlight = null;
+  }
+  async resolveStorageKey() {
+    if (this.storageKeyResolved) return this.storageKeyResolved;
+    this.storageKeyResolved = await deriveTenantStorageKey(this.crypto, this.tenantId, "refresh_token");
+    return this.storageKeyResolved;
+  }
+  async resolveJwksKey() {
+    if (this.jwksKeyResolved) return this.jwksKeyResolved;
+    this.jwksKeyResolved = await deriveTenantStorageKey(this.crypto, this.tenantId, "jwks_cache");
+    return this.jwksKeyResolved;
+  }
+  async getOrCreateJwksCache() {
+    if (this.jwksCache) return this.jwksCache;
+    const key = await this.resolveJwksKey();
+    let initial;
+    try {
+      const raw = await this.storage.getItem(key);
+      if (raw) {
+        const parsed = JSON.parse(raw);
+        if (parsed.document && typeof parsed.fetchedAt === "number") {
+          initial = { document: parsed.document, fetchedAt: parsed.fetchedAt };
+        }
+      }
+    } catch {
+    }
+    this.jwksCache = createJwksCache({
+      ttlMs: this.jwksTtlMs,
+      fetchJwks: async () => {
+        const response = await this.http.fetch(this.jwksUri, { method: "GET", headers: { Accept: "application/json" } });
+        if (!response.ok) {
+          throw new Error(`JWKS fetch failed: HTTP ${response.status}`);
+        }
+        return await response.json();
+      },
+      initial,
+      onFetched: (document, fetchedAt) => {
+        void this.storage.setItem(key, JSON.stringify({ document, fetchedAt })).catch(() => void 0);
+      }
+    });
+    return this.jwksCache;
+  }
+  getValidAccessToken() {
+    if (!this.accessToken || this.expiresAtMs === null) return null;
+    if (this.now() >= this.expiresAtMs - REFRESH_BUFFER_SECONDS * 1e3) return null;
+    return this.accessToken;
+  }
+  async performRefresh(opts = {}) {
+    if (this.refreshInFlight) return this.refreshInFlight;
+    this.refreshInFlight = this.doRefresh(opts).finally(() => {
+      this.refreshInFlight = null;
+    });
+    return this.refreshInFlight;
+  }
+  async doRefresh(opts) {
+    if (this.destroyed) return false;
+    this.emitEvent?.({ type: "refresh_started" });
+    if (this.biometricEnabled && this.biometric) {
+      const available = await this.biometric.isAvailable();
+      if (!available) {
+        this.emitEvent?.({ type: "biometric_failed", metadata: { reason: "unavailable" } });
+        if (!opts.duringRestore) {
+          await this.clear({ code: "REFRESH_FAILED", reason: "revoked", message: "Biometric unavailable" });
+        }
+        return false;
+      }
+      const result2 = await this.biometric.authenticate({ promptMessage: this.biometricPrompt, strict: this.biometricStrict });
+      if (!result2.success) {
+        this.emitEvent?.({ type: "biometric_failed", metadata: { reason: result2.reason } });
+        if (!opts.duringRestore) {
+          if (result2.reason === "lockout" || result2.reason === "not_enrolled") {
+            await this.clear({ code: "REFRESH_FAILED", reason: "revoked", message: `Biometric ${result2.reason}` });
+          }
+        }
+        return false;
+      }
+    }
+    const key = await this.resolveStorageKey();
+    let raw;
+    try {
+      raw = await this.storage.getItem(key, {
+        requireAuthentication: this.biometricEnabled,
+        authenticationPrompt: this.biometricEnabled ? this.biometricPrompt : void 0
+      });
+    } catch {
+      raw = null;
+    }
+    if (!raw) {
+      this.emitEvent?.({ type: "refresh_failed", metadata: { reason: "no_refresh_token" } });
+      return false;
+    }
+    if (!raw.startsWith(REFRESH_TOKEN_PREFIX)) {
+      await this.storage.removeItem(key).catch(() => void 0);
+      this.emitEvent?.({ type: "refresh_failed", metadata: { reason: "invalid_storage_prefix" } });
+      return false;
+    }
+    const refreshToken = raw.slice(REFRESH_TOKEN_PREFIX.length);
+    if (this.dpopSession?.isBound) {
+      const dResult = await refreshWithDpop({
+        http: this.http,
+        tokenEndpoint: this.tokenEndpoint,
+        refreshToken,
+        clientId: this.clientId,
+        dpopSession: this.dpopSession
+      });
+      if (!dResult.ok) {
+        return this.handleDpopRefreshFailure(dResult.error, opts.duringRestore ?? false);
+      }
+      this.emitEvent?.({ type: "refresh_succeeded" });
+      this.refreshAttempts = 0;
+      this.offlineStaleCycles = 0;
+      await this.setTokens(dResult.tokens, opts.duringRestore ? "restore" : "refresh");
+      return true;
+    }
+    const result = await refreshAccessToken({
+      http: this.http,
+      tokenEndpoint: this.tokenEndpoint,
+      refreshToken,
+      clientId: this.clientId
+    });
+    if (!result.ok) {
+      this.emitEvent?.({ type: "refresh_failed", metadata: { code: result.error.code } });
+      if (this.isAuthError(result.error)) {
+        await this.clear(result.error);
+        return false;
+      }
+      return this.scheduleRetry(result.error, opts.duringRestore ?? false);
+    }
+    this.emitEvent?.({ type: "refresh_succeeded" });
+    this.refreshAttempts = 0;
+    this.offlineStaleCycles = 0;
+    await this.setTokens(result.tokens, opts.duringRestore ? "restore" : "refresh");
+    return true;
+  }
+  isAuthError(error) {
+    return error.code === "REFRESH_FAILED" && (error.reason === "expired" || error.reason === "revoked");
+  }
+  /**
+  * Map a DPoP-refresh failure (three-class taxonomy) onto the FSM. The
+  * distinct `code` is emitted as telemetry, so consumers can tell an
+  * `auth/invalid_dpop_proof` spike apart from `auth/invalid_refresh_token`
+  * (the classes are kept distinct deliberately).
+  */
+  async handleDpopRefreshFailure(error, duringRestore) {
+    this.emitEvent?.({ type: "dpop_refresh_failed", metadata: { code: error.code } });
+    if (error.class === "network") {
+      return this.scheduleRetry({ code: "REFRESH_FAILED", reason: "network", message: error.message }, duringRestore);
+    }
+    if (error.class === "dpop_prover_unavailable") {
+      this.emitEvent?.({ type: "refresh_failed", metadata: { reason: "dpop_prover_unavailable" } });
+      return false;
+    }
+    await this.clear({ code: "REFRESH_FAILED", reason: "revoked", message: error.message });
+    return false;
+  }
+  scheduleRetry(error, duringRestore) {
+    if (this.refreshAttempts >= RETRY_DELAYS_MS.length) {
+      if (!duringRestore && this.accessToken && this.expiresAtMs !== null && this.now() < this.expiresAtMs) {
+        this.refreshAttempts = 0;
+        this.offlineStaleCycles += 1;
+        if (this.offlineStaleCycles >= _TokenRuntime.MAX_OFFLINE_STALE_CYCLES) {
+          this.offlineStaleCycles = 0;
+          void this.clear({ code: "REFRESH_FAILED", reason: "revoked", message: "Refresh chronically failing \u2014 session lost" });
+          return false;
+        }
+        this.dispatch({ type: "OFFLINE_STALE" });
+        return false;
+      }
+      void this.clear({ code: "REFRESH_FAILED", reason: "network", message: "Refresh exhausted retries" });
+      return false;
+    }
+    const delay = RETRY_DELAYS_MS[this.refreshAttempts];
+    this.refreshAttempts++;
+    this.emitEvent?.({ type: "network_retry", metadata: { delayMs: delay, attempt: this.refreshAttempts } });
+    if (!duringRestore) {
+      this.dispatch({ type: "REFRESH_NETWORK_ERROR", error });
+    }
+    if (this.retryTimer) this.clearTimeoutFn(this.retryTimer);
+    this.retryTimer = this.setTimeoutFn(() => {
+      this.retryTimer = null;
+      void this.performRefresh();
+    }, delay);
+    return false;
+  }
+};
+
+// src/native/expo-adapter.ts
+function createDefaultExpoAdapter(options = {}) {
+  const crypto = createExpoCrypto();
+  const storage = createExpoSecureStore({ tokenCache: options.tokenCache });
+  const browser = createExpoBrowser();
+  const deepLink = createExpoDeepLink();
+  const biometric = createExpoBiometricGate();
+  const appLifecycle = createRnAppLifecycle();
+  const connectivity = createNetInfoConnectivity();
+  return {
+    crypto,
+    storage,
+    browser,
+    deepLink,
+    biometric,
+    appLifecycle,
+    connectivity
+  };
+}
+function createExpoCrypto() {
+  let mod = null;
+  async function load() {
+    if (!mod) {
+      mod = await import('expo-crypto').catch(() => null);
+      if (!mod) {
+        throw new Error(
+          "@rakomi/react-native: expo-crypto is required for the default adapter. Install it (Expo-managed) or pass a custom nativeAdapter (bare RN)."
+        );
+      }
+    }
+    return mod;
+  }
+  return {
+    getRandomBytes: async (n) => {
+      const m = await load();
+      const result = await m.getRandomBytesAsync(n);
+      return new Uint8Array(result);
+    },
+    digestSha256: async (input) => {
+      const m = await load();
+      let str = "";
+      for (let i = 0; i < input.length; i++) str += String.fromCharCode(input[i]);
+      const hex = await m.digestStringAsync(
+        m.CryptoDigestAlgorithm.SHA256,
+        str,
+        { encoding: m.CryptoEncoding.HEX }
+      );
+      const bytes = new Uint8Array(hex.length / 2);
+      for (let i = 0; i < bytes.length; i++) {
+        bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+      }
+      return bytes;
+    }
+  };
+}
+function createExpoSecureStore(opts) {
+  if (opts.tokenCache) {
+    const tc = opts.tokenCache;
+    return {
+      getItem: (key) => tc.getToken(key),
+      setItem: async (key, value) => {
+        await tc.saveToken(key, value);
+      },
+      removeItem: (key) => tc.clearToken(key)
+    };
+  }
+  let mod = null;
+  async function load() {
+    if (!mod) {
+      mod = await import('expo-secure-store').catch(() => null);
+      if (!mod) {
+        throw new Error(
+          "@rakomi/react-native: expo-secure-store is required for the default adapter. Install it (Expo-managed) or pass `tokenCache` / a custom nativeAdapter."
+        );
+      }
+    }
+    return mod;
+  }
+  return {
+    getItem: async (key, options) => {
+      const m = await load();
+      return m.getItemAsync(key, {
+        requireAuthentication: options?.requireAuthentication,
+        authenticationPrompt: options?.authenticationPrompt
+      });
+    },
+    setItem: async (key, value, options) => {
+      const m = await load();
+      const accessibility = mapKeychainAccessible(
+        m,
+        options?.keychainAccessible ?? "AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY"
+      );
+      await m.setItemAsync(key, value, {
+        keychainAccessible: accessibility,
+        requireAuthentication: options?.requireAuthentication,
+        authenticationPrompt: options?.authenticationPrompt
+      });
+    },
+    removeItem: async (key) => {
+      const m = await load();
+      await m.deleteItemAsync(key);
+    }
+  };
+}
+function mapKeychainAccessible(m, level) {
+  switch (level) {
+    case "WHEN_UNLOCKED":
+      return m.WHEN_UNLOCKED;
+    case "AFTER_FIRST_UNLOCK":
+      return m.AFTER_FIRST_UNLOCK;
+    case "WHEN_UNLOCKED_THIS_DEVICE_ONLY":
+      return m.WHEN_UNLOCKED_THIS_DEVICE_ONLY;
+    case "AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY":
+      return m.AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY;
+    case "WHEN_PASSCODE_SET_THIS_DEVICE_ONLY":
+      return m.WHEN_PASSCODE_SET_THIS_DEVICE_ONLY;
+  }
+}
+function createExpoBrowser() {
+  let mod = null;
+  async function load() {
+    if (!mod) {
+      mod = await import('expo-web-browser').catch(() => null);
+      if (!mod) {
+        throw new Error("@rakomi/react-native: expo-web-browser is required for OAuth flows.");
+      }
+    }
+    return mod;
+  }
+  return {
+    openAuthSession: async (authUrl, redirectUri, options) => {
+      const m = await load();
+      const result = await m.openAuthSessionAsync(authUrl, redirectUri, {
+        preferEphemeralSession: options?.preferEphemeralSession ?? true
+      });
+      if (result.type === "success" && result.url) {
+        return { type: "success", url: result.url };
+      }
+      if (result.type === "cancel") return { type: "cancel" };
+      if (result.type === "dismiss") return { type: "dismiss" };
+      if (result.type === "locked") return { type: "locked" };
+      return { type: "cancel" };
+    }
+  };
+}
+function createExpoDeepLink() {
+  let mod = null;
+  async function load() {
+    if (!mod) {
+      mod = await import('expo-linking').catch(() => null);
+      if (!mod) {
+        throw new Error("@rakomi/react-native: expo-linking is required for OAuth deep-link callback.");
+      }
+    }
+    return mod;
+  }
+  return {
+    getInitialUrl: async () => {
+      const m = await load();
+      return m.getInitialURL();
+    },
+    addListener: (listener) => {
+      let sub = null;
+      void load().then((m) => {
+        sub = m.addEventListener("url", (event) => listener(event.url));
+      });
+      return {
+        remove: () => {
+          sub?.remove();
+        }
+      };
+    }
+  };
+}
+function createExpoBiometricGate() {
+  let mod = null;
+  async function load() {
+    if (mod !== null) return mod;
+    try {
+      mod = await import('expo-local-authentication');
+    } catch {
+      mod = null;
+    }
+    return mod;
+  }
+  return {
+    isAvailable: async () => {
+      const m = await load();
+      if (!m) return false;
+      const has = await m.hasHardwareAsync();
+      if (!has) return false;
+      const enrolled = await m.isEnrolledAsync();
+      return enrolled;
+    },
+    authenticate: async ({ promptMessage, strict = false }) => {
+      const m = await load();
+      if (!m) return { success: false, reason: "unavailable" };
+      const result = await m.authenticateAsync({
+        promptMessage,
+        disableDeviceFallback: strict,
+        fallbackLabel: "Use passcode"
+      });
+      if (result.success) return { success: true };
+      switch (result.error) {
+        case "user_cancel":
+        case "system_cancel":
+        case "app_cancel":
+          return { success: false, reason: "cancelled" };
+        case "lockout":
+        case "lockout_permanent":
+          return { success: false, reason: "lockout" };
+        case "not_enrolled":
+          return { success: false, reason: "not_enrolled" };
+        case "not_available":
+        case "no_space":
+          return { success: false, reason: "unavailable" };
+        default:
+          return { success: false, reason: "unknown" };
+      }
+    }
+  };
+}
+function createRnAppLifecycle() {
+  let rn = null;
+  let pending = null;
+  async function ensure() {
+    if (rn) return rn;
+    if (!pending) {
+      pending = import('react-native').then((m) => {
+        rn = m.default ?? m;
+        return rn;
+      });
+    }
+    return pending;
+  }
+  void ensure().catch(() => void 0);
+  return {
+    addStateChangeListener: (listener) => {
+      let sub = null;
+      void ensure().then((r) => {
+        sub = r.AppState.addEventListener("change", (next) => {
+          listener(coerceAppState(next));
+        });
+      });
+      return { remove: () => sub?.remove() };
+    },
+    getCurrent: () => rn ? coerceAppState(rn.AppState.currentState) : "unknown"
+  };
+}
+function coerceAppState(value) {
+  if (value === "active" || value === "background" || value === "inactive") return value;
+  return "unknown";
+}
+function createNetInfoConnectivity() {
+  let mod = null;
+  async function load() {
+    if (mod !== null) return mod;
+    try {
+      mod = (await import('@react-native-community/netinfo')).default ?? null;
+    } catch {
+      mod = null;
+    }
+    return mod;
+  }
+  return {
+    isConnected: async () => {
+      const m = await load();
+      if (!m) return true;
+      const state = await m.fetch();
+      return state.isConnected ?? true;
+    },
+    addListener: (listener) => {
+      let unsubscribe = null;
+      void load().then((m) => {
+        if (!m) return;
+        unsubscribe = m.addEventListener((state) => listener(state.isConnected ?? true));
+      });
+      return { remove: () => unsubscribe?.() };
+    }
+  };
+}
+var RakomiContext = createContext(null);
+var APP_STATE_DEBOUNCE_MS = 300;
+function RakomiProvider(props) {
+  const adapter = useMemo(() => {
+    const built = props.nativeAdapter ?? createDefaultExpoAdapter({ tokenCache: props.tokenCache });
+    return Object.freeze(built);
+  }, [props.nativeAdapter, props.tokenCache]);
+  const http = useMemo(() => createRnHttpClient({ baseUrl: props.baseUrl }), [props.baseUrl]);
+  const events = useMemo(() => new EventLog(props.onEvent), [props.onEvent]);
+  const [snapshot, dispatch] = useReducer(reduce, INITIAL_SNAPSHOT);
+  const translate = useMemo(
+    () => createTranslator(props.locale ?? "en", props.translations),
+    [props.locale, props.translations]
+  );
+  const dpopSession = useMemo(() => {
+    if (!adapter.dpopProver) return void 0;
+    return createDpopSession({
+      prover: adapter.dpopProver,
+      baseUrl: props.baseUrl ?? "",
+      onDowngrade: () => {
+        events.push({ type: "sign_in_failed", severity: "security", metadata: { reason: "dpop_downgrade" } });
+      }
+    });
+  }, [adapter, props.baseUrl, events]);
+  const runtime = useMemo(() => {
+    const tokenEndpoint = props.tokenEndpoint ?? `${(props.baseUrl ?? "").replace(/\/$/, "")}/oauth/token`;
+    return new TokenRuntime({
+      clientId: props.publishableKey,
+      tenantId: props.tenantId ?? props.publishableKey,
+      tokenEndpoint,
+      storage: adapter.storage,
+      http,
+      crypto: adapter.crypto,
+      biometric: adapter.biometric,
+      biometricEnabled: props.biometric ?? false,
+      biometricStrict: props.biometricStrict ?? false,
+      biometricPrompt: props.biometricPrompt ?? "Authenticate to continue",
+      dispatch,
+      dpopSession,
+      onEvent: ({ type, metadata }) => {
+        if (type === "biometric_failed") {
+          events.push({ type: "biometric_failed", severity: "warning", metadata });
+        } else if (type === "network_retry") {
+          events.push({ type: "network_retry", severity: "warning", metadata });
+        } else if (type === "refresh_started") {
+          events.push({ type: "refresh_started", severity: "info", metadata });
+        } else if (type === "refresh_succeeded") {
+          events.push({ type: "refresh_succeeded", severity: "info", metadata });
+        } else if (type === "refresh_failed") {
+          events.push({ type: "refresh_failed", severity: "warning", metadata });
+        }
+      }
+    });
+  }, [adapter, http, props.publishableKey, props.tenantId, props.baseUrl, props.tokenEndpoint, props.biometric, props.biometricStrict, props.biometricPrompt, events, dpopSession]);
+  useEffect(() => {
+    void runtime.restore();
+    return () => runtime.destroy();
+  }, [runtime]);
+  const debounceTimer = useRef(null);
+  useEffect(() => {
+    const sub = adapter.appLifecycle.addStateChangeListener((next) => {
+      if (next !== "active") return;
+      if (debounceTimer.current) clearTimeout(debounceTimer.current);
+      debounceTimer.current = setTimeout(() => {
+        events.push({ type: "app_state_foreground", severity: "info" });
+        void runtime.refreshOnForeground();
+      }, APP_STATE_DEBOUNCE_MS);
+    });
+    return () => {
+      sub.remove();
+      if (debounceTimer.current) clearTimeout(debounceTimer.current);
+    };
+  }, [adapter, events, runtime]);
+  useEffect(() => {
+    const bg = adapter.backgroundTask;
+    if (!bg) return void 0;
+    let unregister = null;
+    void (async () => {
+      try {
+        const ok = await bg.isAvailable();
+        if (!ok) return;
+        unregister = await bg.register(async () => {
+          await runtime.refreshOnForeground();
+        });
+      } catch {
+      }
+    })();
+    return () => {
+      if (unregister) void unregister().catch(() => void 0);
+    };
+  }, [adapter, runtime]);
+  useEffect(() => {
+    const sub = adapter.connectivity.addListener((isConnected) => {
+      if (isConnected) {
+        events.push({ type: "offline_queue_drained", severity: "info" });
+        dispatch({ type: "BACK_ONLINE" });
+        void runtime.refreshOnForeground();
+      } else {
+        dispatch({ type: "OFFLINE_STALE" });
+      }
+    });
+    return () => sub.remove();
+  }, [adapter, events, runtime]);
+  useEffect(() => {
+    if (props.deepLinkAutoHandle === false) return void 0;
+    const sub = adapter.deepLink.addListener(() => {
+      events.push({ type: "deep_link_received", severity: "info" });
+    });
+    void adapter.deepLink.getInitialUrl().then((url) => {
+      if (url) {
+        events.push({ type: "deep_link_received", severity: "info", metadata: { coldStart: true } });
+      }
+    }).catch(() => void 0);
+    return () => sub.remove();
+  }, [adapter, events, props.deepLinkAutoHandle]);
+  const signOut = useMemo(
+    () => async () => {
+      events.push({ type: "signed_out", severity: "info" });
+      await runtime.clear();
+    },
+    [events, runtime]
+  );
+  const getToken = useMemo(() => () => runtime.getToken(), [runtime]);
+  const submitOAuthTokens = useMemo(
+    () => async (tokens, nonce) => {
+      if (!runtime.validateSubmitNonce(nonce)) {
+        events.push({ type: "sign_in_failed", severity: "security", error: { code: "CSRF_MISMATCH", message: "Submit nonce missing or expired" } });
+        dispatch({ type: "SIGN_IN_FAILED", error: { code: "CSRF_MISMATCH", message: "Submit nonce missing or expired" } });
+        return;
+      }
+      await runtime.setTokens(tokens, "sign_in");
+    },
+    [runtime, events]
+  );
+  const beginAuthFlow = useMemo(() => () => runtime.beginAuthFlow(), [runtime]);
+  const value = useMemo(
+    () => ({
+      publishableKey: props.publishableKey,
+      baseUrl: props.baseUrl ?? "",
+      redirectUri: props.redirectUri,
+      adapter,
+      http,
+      snapshot,
+      state: snapshot.state,
+      isSignedIn: isSignedIn(snapshot),
+      user: snapshot.user,
+      events,
+      locale: props.locale ?? "en",
+      translate,
+      dispatch,
+      signOut,
+      getToken,
+      submitOAuthTokens,
+      beginAuthFlow,
+      dpopSession
+    }),
+    [adapter, http, snapshot, events, props.publishableKey, props.baseUrl, props.redirectUri, props.locale, translate, signOut, getToken, submitOAuthTokens, beginAuthFlow, dpopSession]
+  );
+  return /* @__PURE__ */ jsx(RakomiContext.Provider, { value, children: props.children });
+}
+function useRakomiContext() {
+  const ctx = useContext(RakomiContext);
+  if (!ctx) {
+    throw new Error("useRakomi*() must be called inside a <RakomiProvider>.");
+  }
+  return ctx;
+}
+function useAuth() {
+  const ctx = useRakomiContext();
+  const { snapshot, signOut, state, getToken } = ctx;
+  const signIn = async (_options) => {
+    return { status: "error", error: { code: "INVALID_CONFIG", message: "sign-in flow not yet wired in 0.1.0" } };
+  };
+  const switchOrganization = async (_orgId) => ({ status: "error", error: { code: "INVALID_CONFIG", message: "switchOrganization not yet wired" } });
+  if (state === "idle") {
+    return {
+      isLoaded: true,
+      isSignedIn: false,
+      userId: null,
+      user: null,
+      sessionId: null,
+      error: snapshot.error,
+      state,
+      signIn,
+      signOut,
+      getToken
+    };
+  }
+  if (state === "authenticating") {
+    return {
+      isLoaded: false,
+      isSignedIn: void 0,
+      userId: void 0,
+      user: void 0,
+      sessionId: void 0,
+      error: null,
+      state,
+      signIn,
+      signOut,
+      getToken
+    };
+  }
+  if (snapshot.user && snapshot.session) {
+    return {
+      isLoaded: true,
+      isSignedIn: true,
+      userId: snapshot.user.id,
+      user: snapshot.user,
+      sessionId: snapshot.session.id,
+      error: snapshot.error,
+      state,
+      isExpiringSoon: snapshot.session.isExpiringSoon ?? false,
+      has: (params) => {
+        if (params.permission && hasPermission(snapshot.user, params.permission)) return true;
+        if (params.role && hasRole(snapshot.user, params.role)) return true;
+        return false;
+      },
+      signIn,
+      signOut,
+      getToken,
+      switchOrganization
+    };
+  }
+  return {
+    isLoaded: true,
+    isSignedIn: false,
+    userId: null,
+    user: null,
+    sessionId: null,
+    error: snapshot.error,
+    state,
+    signIn,
+    signOut,
+    getToken
+  };
+}
+
+// src/hooks/use-session.ts
+function useSession() {
+  const { snapshot } = useRakomiContext();
+  return {
+    isLoaded: snapshot.state !== "authenticating",
+    isSignedIn: snapshot.state === "authenticated" || snapshot.state === "refreshing" || snapshot.state === "offline_stale",
+    session: snapshot.session
+  };
+}
+
+// src/hooks/use-user.ts
+function useUser() {
+  const { snapshot } = useRakomiContext();
+  return {
+    isLoaded: snapshot.state !== "authenticating",
+    isSignedIn: snapshot.state === "authenticated" || snapshot.state === "refreshing" || snapshot.state === "offline_stale",
+    user: snapshot.user
+  };
+}
+
+// src/hooks/index.ts
+function useFlag(flag, options) {
+  const { user } = useRakomiContext();
+  const flags = user?.rawClaims["feature_flags"] ?? {};
+  const value = flags[flag] ?? options?.defaultValue;
+  return {
+    isLoaded: !!user,
+    value,
+    isEnabled: value === true
+  };
+}
+function useOrganization() {
+  const { user } = useRakomiContext();
+  const orgId = user?.rawClaims["org_id"];
+  const orgRole = user?.rawClaims["org_role"];
+  const orgMemberships = user?.rawClaims["org_memberships"] ?? [];
+  return {
+    isLoaded: !!user,
+    organization: orgId && orgRole ? { orgId, orgRole, orgMemberships } : null
+  };
+}
+function useOrganizationList() {
+  const { user } = useRakomiContext();
+  return {
+    isLoaded: !!user,
+    organizations: user?.rawClaims["org_memberships"] ?? []
+  };
+}
+function useLinkedAccounts() {
+  const { user } = useRakomiContext();
+  const methods = user?.rawClaims["linked_methods"] ?? [];
+  return {
+    isLoaded: !!user,
+    methods,
+    link: async () => ({ status: "error" }),
+    unlink: async () => ({ status: "error" })
+  };
+}
+function useTranslation() {
+  const { translate, locale } = useRakomiContext();
+  return useMemo(() => ({ t: translate, locale }), [translate, locale]);
+}
+var authConfigCache = /* @__PURE__ */ new Map();
+function useAuthConfig() {
+  const { baseUrl, http, publishableKey } = useRakomiContext();
+  const [config, setConfig] = useState(null);
+  const [isLoaded, setIsLoaded] = useState(false);
+  useEffect(() => {
+    if (!baseUrl) return;
+    const cacheKey = `${baseUrl}|${publishableKey}`;
+    let cached2 = authConfigCache.get(cacheKey);
+    if (!cached2) {
+      cached2 = (async () => {
+        try {
+          const response = await http.fetch(`${baseUrl}/v1/auth/config`, {
+            method: "GET",
+            headers: { Accept: "application/json", "X-API-Key": publishableKey }
+          });
+          if (!response.ok) return null;
+          return await response.json();
+        } catch {
+          return null;
+        }
+      })();
+      authConfigCache.set(cacheKey, cached2);
+    }
+    let cancelled = false;
+    void cached2.then((value) => {
+      if (!cancelled) {
+        setConfig(value);
+        setIsLoaded(true);
+      }
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [baseUrl, http, publishableKey]);
+  return { isLoaded, config };
+}
+function useBranding() {
+  const { config, isLoaded } = useAuthConfig();
+  return {
+    isLoaded,
+    branding: config?.branding ?? null
+  };
+}
+function useAnonymousSignin() {
+  return {
+    isLoaded: true,
+    signInAnonymously: async () => ({ status: "error" })
+  };
+}
+var baasPlansCache = /* @__PURE__ */ new Map();
+function useBaasPlans({ tenantSlug }) {
+  const { baseUrl, http, publishableKey } = useRakomiContext();
+  const [plans, setPlans] = useState([]);
+  const [isLoaded, setIsLoaded] = useState(false);
+  const [error, setError] = useState(null);
+  useEffect(() => {
+    if (!baseUrl || !tenantSlug) return;
+    const cacheKey = `${baseUrl}|${tenantSlug}`;
+    let cached2 = baasPlansCache.get(cacheKey);
+    if (!cached2) {
+      cached2 = (async () => {
+        try {
+          const response = await http.fetch(`${baseUrl}/v1/billing/baas/${encodeURIComponent(tenantSlug)}/public-plans`, {
+            method: "GET",
+            headers: { Accept: "application/json", "X-API-Key": publishableKey }
+          });
+          if (response.status === 404) return [];
+          if (!response.ok) return { error: `HTTP ${response.status}` };
+          const json = await response.json();
+          return json.data ?? [];
+        } catch (err2) {
+          return { error: err2 instanceof Error ? err2.message : "Network request failed" };
+        }
+      })();
+      baasPlansCache.set(cacheKey, cached2);
+    }
+    let cancelled = false;
+    void cached2.then((value) => {
+      if (cancelled) return;
+      if (Array.isArray(value)) {
+        setPlans(value);
+        setError(null);
+      } else {
+        setError(value.error);
+      }
+      setIsLoaded(true);
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [baseUrl, http, publishableKey, tenantSlug]);
+  return { isLoaded, plans, error };
+}
+function useBaasSubscription({ tenantSlug }) {
+  const { baseUrl, http, publishableKey, getToken } = useRakomiContext();
+  const [subscription, setSubscription] = useState(null);
+  const [isLoaded, setIsLoaded] = useState(false);
+  const [error, setError] = useState(null);
+  useEffect(() => {
+    if (!baseUrl || !tenantSlug) return;
+    let cancelled = false;
+    void (async () => {
+      try {
+        const tokenResult = await getToken();
+        const headers = { Accept: "application/json", "X-API-Key": publishableKey };
+        if (tokenResult.ok) headers["Authorization"] = `Bearer ${tokenResult.token}`;
+        const response = await http.fetch(`${baseUrl}/v1/billing/baas/${encodeURIComponent(tenantSlug)}/user/subscription`, {
+          method: "GET",
+          headers
+        });
+        if (cancelled) return;
+        if (response.status === 404) {
+          setSubscription(null);
+          setError(null);
+        } else if (response.ok) {
+          const json = await response.json();
+          setSubscription(json);
+          setError(null);
+        } else {
+          setError(`HTTP ${response.status}`);
+        }
+      } catch (err2) {
+        if (!cancelled) setError(err2 instanceof Error ? err2.message : "Network request failed");
+      } finally {
+        if (!cancelled) setIsLoaded(true);
+      }
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [baseUrl, http, publishableKey, tenantSlug, getToken]);
+  return { isLoaded, subscription, error };
+}
+function SignedIn({ children }) {
+  const { isSignedIn } = useRakomiContext();
+  return isSignedIn ? /* @__PURE__ */ jsx(Fragment, { children }) : null;
+}
+function SignedOut({ children }) {
+  const { isSignedIn } = useRakomiContext();
+  return isSignedIn ? null : /* @__PURE__ */ jsx(Fragment, { children });
+}
+function Protect({ children, fallback = null, permission, role }) {
+  const { user, isSignedIn } = useRakomiContext();
+  if (!isSignedIn || !user) return /* @__PURE__ */ jsx(Fragment, { children: fallback });
+  if (permission && !hasPermission(user, permission)) return /* @__PURE__ */ jsx(Fragment, { children: fallback });
+  if (role && !hasRole(user, role)) return /* @__PURE__ */ jsx(Fragment, { children: fallback });
+  return /* @__PURE__ */ jsx(Fragment, { children });
+}
+function Feature({ flag, children, fallback = null }) {
+  const { user } = useRakomiContext();
+  const flags = user?.rawClaims["feature_flags"] ?? {};
+  return flags[flag] === true ? /* @__PURE__ */ jsx(Fragment, { children }) : /* @__PURE__ */ jsx(Fragment, { children: fallback });
+}
+
+// src/internal/rn-primitives.ts
+var cached = null;
+function loadRnPrimitives() {
+  if (cached) return cached;
+  cached = __require("react-native");
+  return cached;
+}
+var PKCE_STORAGE_KEY = "rakomi.oauth.pkce.in-flight";
+async function startSocialSignIn(input) {
+  const { adapter, http } = input;
+  const pkce = await generatePkce(adapter.crypto);
+  const state = await issueState(adapter.crypto, adapter.storage);
+  const pkceRecord = JSON.stringify({ codeVerifier: pkce.codeVerifier });
+  await adapter.storage.setItem(PKCE_STORAGE_KEY, pkceRecord, { keychainAccessible: "AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY" });
+  const authUrl = buildAuthorizationUrl({
+    authorizationEndpoint: input.authorizationEndpoint,
+    clientId: input.clientId,
+    redirectUri: input.redirectUri,
+    state: state.state,
+    codeChallenge: pkce.codeChallenge,
+    codeChallengeMethod: "S256",
+    scope: input.scope,
+    provider: input.provider,
+    acrValues: input.acrValues
+  });
+  const result = await adapter.browser.openAuthSession(authUrl, input.redirectUri, {
+    preferEphemeralSession: input.preferEphemeralSession ?? true
+  });
+  if (result.type !== "success") {
+    await adapter.storage.removeItem(PKCE_STORAGE_KEY).catch(() => void 0);
+    if (result.type === "cancel") {
+      return { ok: false, error: { code: "OAUTH_CALLBACK_ERROR", oauthError: "oauth_user_cancelled", description: "User cancelled the sign-in flow" } };
+    }
+    if (result.type === "dismiss") {
+      return { ok: false, error: { code: "OAUTH_CALLBACK_ERROR", oauthError: "oauth_user_cancelled", description: "Sign-in dismissed" } };
+    }
+    if (result.type === "locked") {
+      return { ok: false, error: { code: "OAUTH_CALLBACK_ERROR", oauthError: "oauth_locked", description: "iOS auto-fill locked the auth session" } };
+    }
+    return { ok: false, error: { code: "SIGN_IN_FAILED", message: "unknown browser auth result" } };
+  }
+  const url = result.url;
+  const parsed = parseCallback(url, input.redirectUri);
+  if (!parsed.ok) {
+    await adapter.storage.removeItem(PKCE_STORAGE_KEY).catch(() => void 0);
+    return { ok: false, error: parsed.error };
+  }
+  const stateCheck = await consumeState(adapter.storage, state.storageKey, parsed.state);
+  if (!stateCheck.ok) {
+    await adapter.storage.removeItem(PKCE_STORAGE_KEY).catch(() => void 0);
+    return {
+      ok: false,
+      error: {
+        code: "OAUTH_CALLBACK_ERROR",
+        oauthError: "oauth_state_mismatch",
+        description: `State validation failed (${stateCheck.reason})`
+      }
+    };
+  }
+  const pkceRecovered = await adapter.storage.getItem(PKCE_STORAGE_KEY);
+  await adapter.storage.removeItem(PKCE_STORAGE_KEY).catch(() => void 0);
+  if (!pkceRecovered) {
+    return { ok: false, error: { code: "CODE_EXCHANGE_FAILED", message: "PKCE verifier missing" } };
+  }
+  let codeVerifier;
+  try {
+    const parsedPkce = JSON.parse(pkceRecovered);
+    if (typeof parsedPkce.codeVerifier !== "string") throw new TypeError("bad PKCE record");
+    codeVerifier = parsedPkce.codeVerifier;
+  } catch {
+    return { ok: false, error: { code: "CODE_EXCHANGE_FAILED", message: "PKCE record corrupted" } };
+  }
+  let dpopProof;
+  if (input.dpopSession) {
+    try {
+      dpopProof = await input.dpopSession.resolveProof("POST", input.tokenEndpoint);
+    } catch (e) {
+      return {
+        ok: false,
+        error: {
+          code: "CODE_EXCHANGE_FAILED",
+          message: `DPoP prover unavailable at issuance: ${e instanceof Error ? e.message : "signer threw"}`
+        }
+      };
+    }
+  }
+  const exchange = await exchangeAuthCode({
+    http,
+    tokenEndpoint: input.tokenEndpoint,
+    code: parsed.code,
+    codeVerifier,
+    redirectUri: input.redirectUri,
+    clientId: input.clientId,
+    ...dpopProof !== void 0 ? { dpopProof } : {}
+  });
+  if (!exchange.ok) return exchange;
+  if (input.dpopSession) {
+    await input.dpopSession.observeTokenType(exchange.tokens.token_type, dpopProof !== void 0);
+  }
+  return {
+    ok: true,
+    tokens: {
+      access_token: exchange.tokens.access_token,
+      refresh_token: exchange.tokens.refresh_token,
+      expires_in: exchange.tokens.expires_in,
+      token_type: exchange.tokens.token_type
+    }
+  };
+}
+function parseCallback(callbackUrl, expectedRedirectUri) {
+  const expected = matchSchemeAndHost(expectedRedirectUri);
+  const actual = matchSchemeAndHost(callbackUrl);
+  if (!expected || !actual || expected.scheme !== actual.scheme || expected.host !== actual.host) {
+    return {
+      ok: false,
+      error: {
+        code: "OAUTH_CALLBACK_ERROR",
+        oauthError: "oauth_redirect_mismatch",
+        description: "Callback redirect URI scheme/host changed mid-flow (confused-deputy guard)"
+      }
+    };
+  }
+  const queryStart = callbackUrl.indexOf("?");
+  const query = queryStart >= 0 ? callbackUrl.slice(queryStart + 1) : "";
+  const params = new URLSearchParams(query);
+  const error = params.get("error");
+  if (error) {
+    return {
+      ok: false,
+      error: parseOAuthCallbackError(error, params.get("error_description") ?? void 0)
+    };
+  }
+  const code = params.get("code");
+  const state = params.get("state");
+  if (!code || !state) {
+    return {
+      ok: false,
+      error: {
+        code: "OAUTH_CALLBACK_ERROR",
+        oauthError: "oauth_missing_params",
+        description: "Callback URL missing code or state"
+      }
+    };
+  }
+  return { ok: true, code, state };
+}
+function matchSchemeAndHost(url) {
+  const m = url.match(/^([a-z][a-z0-9+.-]*):\/\/([^/?#]*)/i);
+  if (!m) return null;
+  return { scheme: m[1].toLowerCase(), host: m[2].toLowerCase() };
+}
+function SignIn(props) {
+  const ctx = useRakomiContext();
+  const { View, Text, TextInput, Pressable } = loadRnPrimitives();
+  const [step, setStep] = useState({ kind: "methods" });
+  const [code, setCode] = useState("");
+  const [busy, setBusy] = useState(false);
+  const tokenEndpoint = props.tokenEndpoint ?? "/v1/auth/oauth/callback";
+  const authorizationEndpoint = props.authorizationEndpoint ?? "/oauth/authorize";
+  const totpVerifyEndpoint = props.totpVerifyEndpoint ?? "/v1/auth/mfa/totp/verify";
+  const providers = props.providers ?? ["google"];
+  async function onProviderPress(provider) {
+    if (busy) return;
+    setBusy(true);
+    ctx.events.push({ type: "sign_in_attempted", severity: "info", metadata: { provider } });
+    const outcome = await startSocialSignIn({
+      adapter: ctx.adapter,
+      http: ctx.http,
+      authorizationEndpoint,
+      tokenEndpoint,
+      clientId: ctx.publishableKey,
+      redirectUri: ctx.redirectUri,
+      provider,
+      ...ctx.dpopSession ? { dpopSession: ctx.dpopSession } : {}
+    });
+    if (outcome.ok) {
+      ctx.events.push({ type: "signed_in", severity: "info" });
+      setStep({ kind: "success" });
+    } else {
+      ctx.events.push({ type: "sign_in_failed", severity: "warning", error: outcome.error });
+      setStep({ kind: "error", error: outcome.error });
+    }
+    setBusy(false);
+  }
+  async function onTotpSubmit() {
+    if (busy || step.kind !== "awaiting_mfa") return;
+    setBusy(true);
+    const result = await verifyTotp({
+      http: ctx.http,
+      endpoint: totpVerifyEndpoint,
+      challengeToken: step.challengeToken,
+      code
+    });
+    if (result.ok) {
+      ctx.events.push({ type: "signed_in", severity: "info", metadata: { method: "mfa_totp" } });
+      setStep({ kind: "success" });
+    } else {
+      if (result.error.code === "SIGN_IN_FAILED" && /unavailable/i.test(result.error.message)) {
+        const e = new MfaStepUpUnavailableError(result.error.message);
+        ctx.events.push({ type: "sign_in_failed", severity: "warning", metadata: { reason: "mfa_step_up_unavailable", guidance: e.guidance } });
+      }
+      setStep({ kind: "error", error: result.error });
+    }
+    setBusy(false);
+  }
+  if (step.kind === "success") {
+    return /* @__PURE__ */ jsx(View, { style: props.style, accessibilityRole: "alert", children: /* @__PURE__ */ jsx(Text, { accessibilityLabel: ctx.translate("common.continue"), children: ctx.translate("common.continue") }) });
+  }
+  if (step.kind === "awaiting_mfa") {
+    return /* @__PURE__ */ jsxs(View, { style: props.style, children: [
+      /* @__PURE__ */ jsx(Text, { accessibilityRole: "header", children: ctx.translate("signin.mfa.title") }),
+      /* @__PURE__ */ jsx(
+        TextInput,
+        {
+          accessibilityLabel: ctx.translate("signin.mfa.code"),
+          accessibilityHint: ctx.translate("signin.mfa.code"),
+          keyboardType: "number-pad",
+          textContentType: "oneTimeCode",
+          autoComplete: "sms-otp",
+          maxLength: 6,
+          value: code,
+          onChangeText: (t) => setCode(t.replace(/\D/g, "").slice(0, 6))
+        }
+      ),
+      /* @__PURE__ */ jsx(
+        Pressable,
+        {
+          accessibilityRole: "button",
+          accessibilityLabel: ctx.translate("signin.mfa.submit"),
+          onPress: onTotpSubmit,
+          disabled: busy || code.length !== 6,
+          children: /* @__PURE__ */ jsx(Text, { children: ctx.translate("signin.mfa.submit") })
+        }
+      )
+    ] });
+  }
+  return /* @__PURE__ */ jsxs(View, { style: props.style, children: [
+    /* @__PURE__ */ jsx(Text, { accessibilityRole: "header", children: props.title ?? ctx.translate("signin.title") }),
+    providers.map((provider) => /* @__PURE__ */ jsx(
+      Pressable,
+      {
+        accessibilityRole: "button",
+        accessibilityLabel: `Sign in with ${provider}`,
+        onPress: () => onProviderPress(provider),
+        disabled: busy,
+        children: /* @__PURE__ */ jsxs(Text, { children: [
+          "Sign in with ",
+          provider
+        ] })
+      },
+      provider
+    )),
+    step.kind === "error" ? /* @__PURE__ */ jsx(Text, { accessibilityRole: "alert", accessibilityLabel: ctx.translate("common.error.unknown"), children: "description" in step.error ? step.error.description : "message" in step.error ? step.error.message : ctx.translate("common.error.unknown") }) : null
+  ] });
+}
+function SignUp(props) {
+  const ctx = useRakomiContext();
+  const { View, Text, TextInput, Pressable } = loadRnPrimitives();
+  const [email, setEmail] = useState("");
+  const [password, setPassword] = useState("");
+  const [busy, setBusy] = useState(false);
+  const [step, setStep] = useState({ kind: "form" });
+  const strength = password ? scorePassword(password) : null;
+  const returnTo = props.returnTo && isSafeUrl(props.returnTo, ["http", "https", "rakomi"]) ? props.returnTo : void 0;
+  async function onSubmit() {
+    if (busy) return;
+    setBusy(true);
+    ctx.events.push({ type: "sign_in_attempted", severity: "info", metadata: { mode: "register" } });
+    try {
+      const response = await ctx.http.fetch(props.registerEndpoint ?? "/v1/auth/register", {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Accept: "application/json" },
+        body: JSON.stringify({ email, password, returnTo })
+      });
+      if (!response.ok) {
+        setStep({ kind: "error", error: { code: "SIGN_IN_FAILED", message: `Register failed (${response.status})` } });
+      } else {
+        setStep({ kind: "verification_required" });
+      }
+    } catch (err2) {
+      setStep({ kind: "error", error: { code: "NETWORK_ERROR", message: err2 instanceof Error ? err2.message : "network" } });
+    } finally {
+      setBusy(false);
+    }
+  }
+  if (step.kind === "verification_required") {
+    return /* @__PURE__ */ jsxs(View, { style: props.style, accessibilityRole: "alert", children: [
+      /* @__PURE__ */ jsx(Text, { children: ctx.translate("signup.title") }),
+      /* @__PURE__ */ jsx(Text, { children: ctx.translate("common.continue") })
+    ] });
+  }
+  return /* @__PURE__ */ jsxs(View, { style: props.style, children: [
+    /* @__PURE__ */ jsx(Text, { accessibilityRole: "header", children: ctx.translate("signup.title") }),
+    /* @__PURE__ */ jsx(
+      TextInput,
+      {
+        accessibilityLabel: ctx.translate("signup.email"),
+        keyboardType: "email-address",
+        textContentType: "emailAddress",
+        autoComplete: "email",
+        autoCapitalize: "none",
+        value: email,
+        onChangeText: setEmail
+      }
+    ),
+    /* @__PURE__ */ jsx(
+      TextInput,
+      {
+        accessibilityLabel: ctx.translate("signup.password"),
+        secureTextEntry: true,
+        textContentType: "newPassword",
+        autoComplete: "password-new",
+        value: password,
+        onChangeText: setPassword
+      }
+    ),
+    strength ? /* @__PURE__ */ jsxs(Text, { accessibilityLabel: `Password strength: ${strength}`, children: [
+      "Strength: ",
+      strength
+    ] }) : null,
+    /* @__PURE__ */ jsx(
+      Pressable,
+      {
+        accessibilityRole: "button",
+        accessibilityLabel: ctx.translate("signup.submit"),
+        onPress: onSubmit,
+        disabled: busy || !email || !password,
+        children: /* @__PURE__ */ jsx(Text, { children: ctx.translate("signup.submit") })
+      }
+    ),
+    step.kind === "error" ? /* @__PURE__ */ jsx(Text, { accessibilityRole: "alert", children: "message" in step.error ? step.error.message : ctx.translate("common.error.unknown") }) : null
+  ] });
+}
+function UserButton(props) {
+  const ctx = useRakomiContext();
+  const { View, Text, Pressable } = loadRnPrimitives();
+  const [expanded, setExpanded] = useState(false);
+  const user = ctx.user;
+  if (!user) return null;
+  const initials = (user.email || "?").slice(0, 2).toUpperCase();
+  return /* @__PURE__ */ jsxs(View, { style: props.style, children: [
+    /* @__PURE__ */ jsx(
+      Pressable,
+      {
+        accessibilityRole: "button",
+        accessibilityLabel: `Account menu for ${user.email}`,
+        onPress: () => setExpanded((v) => !v),
+        children: /* @__PURE__ */ jsxs(View, { children: [
+          /* @__PURE__ */ jsx(Text, { accessibilityLabel: `Avatar ${initials}`, children: initials }),
+          props.showName !== false ? /* @__PURE__ */ jsx(Text, { children: user.email }) : null
+        ] })
+      }
+    ),
+    expanded ? /* @__PURE__ */ jsx(View, { accessibilityRole: "menu", children: /* @__PURE__ */ jsx(
+      Pressable,
+      {
+        accessibilityRole: "menuitem",
+        accessibilityLabel: "Sign out",
+        onPress: () => {
+          setExpanded(false);
+          void ctx.signOut();
+        },
+        children: /* @__PURE__ */ jsx(Text, { children: "Sign out" })
+      }
+    ) }) : null
+  ] });
+}
+function UserProfile(props) {
+  useEffect(() => {
+    if (typeof __DEV__ !== "undefined" && __DEV__) {
+      console.warn("[@rakomi/react-native] <UserProfile /> is in preview until 0.2.0 \u2014 feedback welcome.");
+    }
+  }, []);
+  const ctx = useRakomiContext();
+  const { View, Text } = loadRnPrimitives();
+  const user = ctx.user;
+  if (!user) {
+    return /* @__PURE__ */ jsx(View, { style: props.style, children: /* @__PURE__ */ jsx(Text, { children: "Not signed in" }) });
+  }
+  return /* @__PURE__ */ jsxs(View, { style: props.style, accessibilityRole: "summary", children: [
+    /* @__PURE__ */ jsx(Text, { accessibilityRole: "header", children: user.email || "Anonymous user" }),
+    /* @__PURE__ */ jsxs(Text, { children: [
+      "ID: ",
+      user.id
+    ] }),
+    /* @__PURE__ */ jsxs(Text, { children: [
+      "Tenant: ",
+      user.tenantId
+    ] }),
+    user.roles.length > 0 ? /* @__PURE__ */ jsxs(Text, { children: [
+      "Roles: ",
+      user.roles.join(", ")
+    ] }) : null,
+    user.permissions.length > 0 ? /* @__PURE__ */ jsxs(Text, { children: [
+      "Permissions: ",
+      user.permissions.length
+    ] }) : null,
+    user.mfaVerified ? /* @__PURE__ */ jsx(Text, { accessibilityLabel: "MFA verified", children: "MFA: verified" }) : null
+  ] });
+}
+
+// src/native/dpop-prover.ts
+function createNativeDpopProver(options) {
+  const mod = options.module;
+  return {
+    async createProof(input) {
+      const proof = await mod.createDpopProof(input.htm, input.htu, input.nonce ?? null);
+      if (typeof proof !== "string" || proof.length === 0) {
+        throw new Error("native DPoP signer returned an empty proof");
+      }
+      return proof;
+    },
+    async jktHint() {
+      return mod.dpopJktThumbprint();
+    }
+  };
+}
+
+// src/internal/webhook-verify.ts
+var RKSEC_PREFIX = "rksec_";
+var EXPECTED_KEY_LENGTH = 32;
+var DEFAULT_WEBHOOK_TOLERANCE = 300;
+var MAX_WEBHOOK_TOLERANCE = 600;
+function getHeader(headers, name) {
+  const lower = name.toLowerCase();
+  for (const key of Object.keys(headers)) {
+    if (key.toLowerCase() === lower) {
+      const value = headers[key];
+      const v = Array.isArray(value) ? value[0] : value;
+      return v?.trim();
+    }
+  }
+  return void 0;
+}
+function base64ToBytes(input, urlSafe) {
+  try {
+    let s = urlSafe ? input.replace(/-/g, "+").replace(/_/g, "/") : input;
+    const pad = s.length % 4;
+    if (pad) s += "=".repeat(4 - pad);
+    const bin = atob(s);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+    return out;
+  } catch {
+    return null;
+  }
+}
+function deriveKey(secret) {
+  const encoded = secret.startsWith(RKSEC_PREFIX) ? secret.slice(RKSEC_PREFIX.length) : secret;
+  const key = base64ToBytes(encoded, true);
+  if (!key || key.length !== EXPECTED_KEY_LENGTH) return null;
+  return key;
+}
+function timingSafeEqual(a, b) {
+  let diff = a.length ^ b.length;
+  const len = Math.min(a.length, b.length);
+  for (let i = 0; i < len; i++) diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+function toArrayBuffer(u) {
+  const out = new ArrayBuffer(u.byteLength);
+  new Uint8Array(out).set(u);
+  return out;
+}
+async function hmacSha256(key, data) {
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle) {
+    throw new Error("WebCrypto subtle is unavailable \u2014 a crypto polyfill (e.g. expo-crypto) is required");
+  }
+  const cryptoKey = await subtle.importKey(
+    "raw",
+    toArrayBuffer(key),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const sig = await subtle.sign("HMAC", cryptoKey, toArrayBuffer(data));
+  return new Uint8Array(sig);
+}
+function toBytes(body) {
+  return typeof body === "string" ? new TextEncoder().encode(body) : body;
+}
+function bytesToUtf8(body) {
+  return typeof body === "string" ? body : new TextDecoder("utf-8", { fatal: false }).decode(body);
+}
+async function verifyWebhook(body, headers, secret, tolerance = DEFAULT_WEBHOOK_TOLERANCE) {
+  const signature = getHeader(headers, "webhook-signature");
+  const timestampStr = getHeader(headers, "webhook-timestamp");
+  const webhookId = getHeader(headers, "webhook-id");
+  if (!signature || !timestampStr || !webhookId) {
+    return { ok: false, error: "missing_header" };
+  }
+  if (!/^-?\d+$/.test(timestampStr)) {
+    return { ok: false, error: "missing_header" };
+  }
+  const timestamp = parseInt(timestampStr, 10);
+  const now = Math.floor(Date.now() / 1e3);
+  const diff = now - timestamp;
+  if (diff > tolerance) return { ok: false, error: "timestamp_too_old" };
+  if (diff < -tolerance) return { ok: false, error: "timestamp_too_new" };
+  const key = deriveKey(secret);
+  if (!key) return { ok: false, error: "invalid_secret" };
+  const bodyString = bytesToUtf8(body);
+  const signedContent = `${webhookId}.${timestampStr}.${bodyString}`;
+  const expected = await hmacSha256(key, toBytes(signedContent));
+  let matched = false;
+  for (const raw of signature.split(" ")) {
+    const entry = raw.trim();
+    if (!entry.startsWith("v1,")) continue;
+    const candidate = base64ToBytes(entry.slice(3), false);
+    if (!candidate || candidate.length !== EXPECTED_KEY_LENGTH) continue;
+    if (timingSafeEqual(expected, candidate)) {
+      matched = true;
+      break;
+    }
+  }
+  if (!matched) return { ok: false, error: "invalid_signature" };
+  let payload;
+  try {
+    payload = JSON.parse(bodyString);
+    if (typeof payload !== "object" || payload === null) return { ok: false, error: "invalid_body" };
+  } catch {
+    return { ok: false, error: "invalid_body" };
+  }
+  const deliveryId = getHeader(headers, "x-rakomi-delivery-id") ?? webhookId;
+  const eventType = getHeader(headers, "x-rakomi-event") ?? "";
+  return { ok: true, data: { webhookId, deliveryId, eventType, timestamp, payload } };
+}
+async function verifyPublisherWebhook(body, headers, secret, tolerance = DEFAULT_WEBHOOK_TOLERANCE) {
+  if (!secret.startsWith(RKSEC_PREFIX)) return { ok: false, error: "invalid_secret" };
+  const clamped = Math.min(Math.max(0, tolerance), MAX_WEBHOOK_TOLERANCE);
+  return verifyWebhook(body, headers, secret, clamped);
+}
+
+// src/hooks/use-submit-oauth-tokens.ts
+function useSubmitOAuthTokens() {
+  const ctx = useRakomiContext();
+  return async (tokens) => {
+    const nonce = await ctx.beginAuthFlow();
+    await ctx.submitOAuthTokens(tokens, nonce);
+  };
+}
+function useMagicLink() {
+  const ctx = useRakomiContext();
+  return {
+    request: async (email) => {
+      ctx.events.push({ type: "sign_in_attempted", severity: "info", metadata: { method: "magic_link" } });
+      return requestMagicLink({ http: ctx.http, baseUrl: ctx.baseUrl, clientId: ctx.publishableKey, email });
+    },
+    verify: async (token) => {
+      const result = await verifyMagicLink({ http: ctx.http, baseUrl: ctx.baseUrl, clientId: ctx.publishableKey, token });
+      if (result.ok && "tokens" in result) {
+        const nonce = await ctx.beginAuthFlow();
+        await ctx.submitOAuthTokens(result.tokens, nonce);
+      } else if (!result.ok && "error" in result) {
+        emitError(ctx.events, result.error);
+      }
+      return result;
+    }
+  };
+}
+function useEmailOtp() {
+  const ctx = useRakomiContext();
+  return {
+    request: async (email, mode) => {
+      ctx.events.push({ type: "sign_in_attempted", severity: "info", metadata: { method: "email_otp", mode } });
+      return requestEmailOtp({ http: ctx.http, baseUrl: ctx.baseUrl, clientId: ctx.publishableKey, email, mode });
+    },
+    verify: async (email, code) => {
+      const result = await verifyEmailOtp({ http: ctx.http, baseUrl: ctx.baseUrl, clientId: ctx.publishableKey, email, code });
+      if (result.ok && "tokens" in result) {
+        const nonce = await ctx.beginAuthFlow();
+        await ctx.submitOAuthTokens(result.tokens, nonce);
+      } else if (!result.ok && "error" in result) {
+        emitError(ctx.events, result.error);
+      }
+      return result;
+    }
+  };
+}
+function useRegister() {
+  const ctx = useRakomiContext();
+  return {
+    register: async (email, password) => {
+      ctx.events.push({ type: "sign_in_attempted", severity: "info", metadata: { method: "register" } });
+      return register({ http: ctx.http, baseUrl: ctx.baseUrl, clientId: ctx.publishableKey, email, password });
+    }
+  };
+}
+function emitError(events, error) {
+  events.push({ type: "sign_in_failed", severity: "warning", error });
+}
+function useMfa() {
+  const ctx = useRakomiContext();
+  return {
+    verifyTotp: async (challengeToken, code, endpoint) => {
+      const url = endpoint ?? `${ctx.baseUrl}/v1/auth/mfa/totp/verify`;
+      const result = await verifyTotp({ http: ctx.http, endpoint: url, challengeToken, code });
+      if (result.ok) {
+        const nonce = await ctx.beginAuthFlow();
+        await ctx.submitOAuthTokens({
+          access_token: result.tokens.access_token,
+          token_type: result.tokens.token_type,
+          expires_in: result.tokens.expires_in,
+          refresh_token: result.tokens.refresh_token
+        }, nonce);
+        ctx.events.push({ type: "signed_in", severity: "info", metadata: { method: "mfa_totp" } });
+        return { ok: true };
+      }
+      emitError(ctx.events, result.error);
+      return { ok: false, error: result.error };
+    }
+  };
+}
+
+export { DEFAULT_WEBHOOK_TOLERANCE, DpopSession, Feature, MAX_WEBHOOK_TOLERANCE, Protect, RakomiProvider, SignIn, SignUp, SignedIn, SignedOut, UserButton, UserProfile, createDefaultExpoAdapter, createDpopSession, createNativeDpopProver, createRnHttpClient, startSocialSignIn, useAnonymousSignin, useAuth, useAuthConfig, useBaasPlans, useBaasSubscription, useBranding, useEmailOtp, useFlag, useLinkedAccounts, useMagicLink, useMfa, useOrganization, useOrganizationList, useRegister, useSession, useSubmitOAuthTokens, useTranslation, useUser, verifyPublisherWebhook, verifyWebhook };