@rakomi/react-native 0.0.0 → 0.2.0

package/dist/index.cjs

@@ -0,0 +1,2788 @@
+'use strict';
+
+var react = require('react');
+var sdkCore = require('@rakomi/sdk-core');
+var jose = require('jose');
+var jsxRuntime = require('react/jsx-runtime');
+
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/internal/ceremony-lock.ts
+function createCeremonyLock() {
+  let held = false;
+  return {
+    tryAcquire() {
+      if (held) return false;
+      held = true;
+      return true;
+    },
+    release() {
+      held = false;
+    },
+    get held() {
+      return held;
+    }
+  };
+}
+
+// src/internal/canonical-url.ts
+var CanonicalizeUrlError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+    this.name = "CanonicalizeUrlError";
+  }
+  code;
+};
+function collapsePath(path) {
+  const collapsed = path.replace(/\/{2,}/g, "/");
+  if (collapsed.length > 1 && collapsed.endsWith("/")) {
+    return collapsed.slice(0, -1);
+  }
+  return collapsed;
+}
+function lowercasePercentHex(s) {
+  return s.replace(/%([0-9A-Fa-f]{2})/g, (_m, h) => `%${h.toLowerCase()}`);
+}
+function canonicalizeUrl(input, options = {}) {
+  const version = options.version ?? "rfc9449-2023";
+  if (version !== "rfc9449-2023") {
+    throw new CanonicalizeUrlError("unsupported_version", `unsupported canonicalize-url version: ${version}`);
+  }
+  let url;
+  try {
+    url = new URL(input);
+  } catch {
+    throw new CanonicalizeUrlError("invalid_url", "invalid url");
+  }
+  if (url.protocol === "https:" && url.port === "443" || url.protocol === "http:" && url.port === "80") {
+    url.port = "";
+  }
+  url.search = "";
+  url.hash = "";
+  const normalizedPath = collapsePath(lowercasePercentHex(url.pathname));
+  const host = url.host;
+  return `${url.protocol}//${host}${normalizedPath}`;
+}
+
+// src/internal/dpop-session.ts
+var DpopSession = class {
+  prover;
+  baseUrl;
+  onDowngrade;
+  _bound = false;
+  _downgraded = false;
+  _downgradeNotified = false;
+  _boundJkt;
+  constructor(options) {
+    this.prover = options.prover;
+    this.baseUrl = options.baseUrl.endsWith("/") ? options.baseUrl.slice(0, -1) : options.baseUrl;
+    this.onDowngrade = options.onDowngrade;
+  }
+  /**
+   * `true` once the server has confirmed (`token_type === "DPoP"`) that this
+   * session's key is sender-bound. The SDK attaches a refresh proof IFF this is
+   * `true`. Starts `false`; set by observing issuance/refresh responses.
+   */
+  get isBound() {
+    return this._bound;
+  }
+  /**
+   * `true` if a session that presented a DPoP proof was returned as `Bearer` by
+   * the server (a security downgrade — flag off / server-side downgrade).
+   */
+  get isDowngraded() {
+    return this._downgraded;
+  }
+  /** The committed RFC 7638 thumbprint (`jkt`) of the session keypair, once bound. */
+  get boundJkt() {
+    return this._boundJkt;
+  }
+  async resolveProof(htm, target, opts) {
+    const absolute = /^[a-z][a-z0-9+.-]*:\/\//i.test(target) ? target : `${this.baseUrl}${target}`;
+    const htu = canonicalizeUrl(absolute);
+    const input = { htm, htu, ...opts?.nonce !== void 0 ? { nonce: opts.nonce } : {} };
+    return this.prover.createProof(input);
+  }
+  async jktHint() {
+    return this.prover.jktHint();
+  }
+  async observeTokenType(tokenType, attachedProof) {
+    if (tokenType === "DPoP") {
+      this._bound = true;
+      this._downgraded = false;
+      if (this._boundJkt === void 0) {
+        this._boundJkt = await this.prover.jktHint();
+      }
+      return;
+    }
+    this._bound = false;
+    if (attachedProof) {
+      this._downgraded = true;
+      if (!this._downgradeNotified) {
+        this._downgradeNotified = true;
+        this.onDowngrade?.({ reason: "server_returned_bearer" });
+      }
+    }
+  }
+};
+function createDpopSession(options) {
+  return new DpopSession(options);
+}
+
+// src/internal/compose-signals.ts
+function composeSignals(caller, internal) {
+  if (caller === void 0) {
+    return { signal: internal, dispose: () => void 0 };
+  }
+  const controller = new AbortController();
+  const abort = (reason) => {
+    if (!controller.signal.aborted) controller.abort(reason);
+  };
+  const onCaller = () => abort(caller.reason);
+  const onInternal = () => abort(internal.reason);
+  if (caller.aborted) {
+    abort(caller.reason);
+  } else if (internal.aborted) {
+    abort(internal.reason);
+  } else {
+    caller.addEventListener("abort", onCaller, { once: true });
+    internal.addEventListener("abort", onInternal, { once: true });
+  }
+  let disposed = false;
+  return {
+    signal: controller.signal,
+    dispose: () => {
+      if (disposed) return;
+      disposed = true;
+      caller.removeEventListener("abort", onCaller);
+      internal.removeEventListener("abort", onInternal);
+    }
+  };
+}
+
+// src/internal/http-client.ts
+function createRnHttpClient(options = {}) {
+  const baseUrl = options.baseUrl?.replace(/\/$/, "") ?? "";
+  const timeout = options.defaultTimeoutMs ?? 3e4;
+  return {
+    fetch: async (url, init = {}) => {
+      const fullUrl = url.startsWith("http://") || url.startsWith("https://") ? url : `${baseUrl}${url.startsWith("/") ? "" : "/"}${url}`;
+      const controller = new AbortController();
+      const timedOut = Object.assign(new Error("request timed out"), { name: "TimeoutError" });
+      const timer = setTimeout(() => controller.abort(timedOut), timeout);
+      const composed = composeSignals(init.signal, controller.signal);
+      let response;
+      try {
+        response = await fetch(fullUrl, {
+          method: init.method ?? "GET",
+          headers: init.headers,
+          body: init.body,
+          redirect: "error",
+          signal: composed.signal
+        });
+      } catch (err2) {
+        clearTimeout(timer);
+        composed.dispose();
+        throw err2;
+      }
+      clearTimeout(timer);
+      const body = response.body;
+      const streaming = body !== null && body !== void 0 && typeof body.pipeThrough === "function" && typeof TransformStream !== "undefined";
+      if (!streaming) {
+        composed.dispose();
+        return response;
+      }
+      const release = new TransformStream({
+        flush: () => composed.dispose()
+      });
+      const piped = body.pipeThrough(release);
+      const wrapped = new Response(piped, {
+        status: response.status,
+        statusText: response.statusText,
+        headers: response.headers
+      });
+      composed.signal.addEventListener("abort", () => composed.dispose(), { once: true });
+      return wrapped;
+    }
+  };
+}
+function err(cls, message) {
+  return { ok: false, error: { class: cls, code: `auth/${cls}`, message } };
+}
+function proverUnavailable(message = "DPoP prover unavailable") {
+  return err("dpop_prover_unavailable", message);
+}
+async function refreshWithDpop(input) {
+  const session = input.dpopSession;
+  const bound = session?.isBound === true;
+  if (!bound || !session) {
+    const result2 = await sdkCore.refreshAccessToken({
+      http: input.http,
+      tokenEndpoint: input.tokenEndpoint,
+      refreshToken: input.refreshToken,
+      clientId: input.clientId
+    });
+    if (result2.ok) {
+      await session?.observeTokenType(result2.tokens.token_type, false);
+      return { ok: true, tokens: result2.tokens, attachedProof: false };
+    }
+    return mapFailure(result2, false);
+  }
+  let proof;
+  try {
+    proof = await session.resolveProof("POST", input.tokenEndpoint);
+  } catch (e) {
+    return proverUnavailable(e instanceof Error ? e.message : "DPoP prover threw");
+  }
+  if (!proof) return proverUnavailable("DPoP prover returned an empty proof");
+  let result = await sdkCore.refreshAccessToken({
+    http: input.http,
+    tokenEndpoint: input.tokenEndpoint,
+    refreshToken: input.refreshToken,
+    clientId: input.clientId,
+    dpopProof: proof
+  });
+  if (!result.ok && result.dpopNonce !== void 0) {
+    let retryProof;
+    try {
+      retryProof = await session.resolveProof("POST", input.tokenEndpoint, { nonce: result.dpopNonce });
+    } catch (e) {
+      return proverUnavailable(e instanceof Error ? e.message : "DPoP prover threw on nonce retry");
+    }
+    if (!retryProof) return proverUnavailable("DPoP prover returned an empty proof on nonce retry");
+    result = await sdkCore.refreshAccessToken({
+      http: input.http,
+      tokenEndpoint: input.tokenEndpoint,
+      refreshToken: input.refreshToken,
+      clientId: input.clientId,
+      dpopProof: retryProof
+    });
+  }
+  if (result.ok) {
+    await session.observeTokenType(result.tokens.token_type, true);
+    return { ok: true, tokens: result.tokens, attachedProof: true };
+  }
+  return mapFailure(result, true);
+}
+function mapFailure(result, attachedProof) {
+  const message = result.error.message ?? "refresh failed";
+  if (attachedProof && (result.dpopProofRejected || result.dpopNonce !== void 0)) {
+    return err("invalid_dpop_proof", message);
+  }
+  if (result.error.code === "REFRESH_FAILED" && result.error.reason === "network") {
+    return err("network", message);
+  }
+  return err("invalid_refresh_token", message);
+}
+
+// src/internal/token-runtime.ts
+var RETRY_DELAYS_MS = [2e3, 8e3, 3e4];
+function bytesToBase64Url(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i++) binary += String.fromCharCode(bytes[i]);
+  const std = btoa(binary);
+  return std.replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function deriveDefaultJwksUri(tokenEndpoint) {
+  try {
+    const url = new URL(tokenEndpoint);
+    return `${url.origin}/.well-known/jwks.json`;
+  } catch {
+    return tokenEndpoint.replace(/\/[^/]*$/, "") + "/.well-known/jwks.json";
+  }
+}
+var RAKOMI_PLATFORM_ISSUER_DEFAULT = "https://api.rakomi.com";
+var RAKOMI_PLATFORM_AUDIENCE_DEFAULT = "https://api.rakomi.com";
+function deriveDefaultIssuer(_tokenEndpoint) {
+  return RAKOMI_PLATFORM_ISSUER_DEFAULT;
+}
+var REFRESH_TOKEN_PREFIX = "v1:";
+var REFRESH_BUFFER_SECONDS = 60;
+var TokenRuntime = class _TokenRuntime {
+  clientId;
+  tenantId;
+  tokenEndpoint;
+  storage;
+  http;
+  crypto;
+  biometric;
+  biometricEnabled;
+  biometricStrict;
+  biometricPrompt;
+  dispatch;
+  dpopSession;
+  emitEvent;
+  now;
+  setTimeoutFn;
+  clearTimeoutFn;
+  storageKeyResolved = null;
+  jwksKeyResolved = null;
+  jwksCache = null;
+  jwksUri;
+  jwksTtlMs;
+  expectedIssuer;
+  expectedAudience;
+  accessToken = null;
+  expiresAtMs = null;
+  currentUser = null;
+  currentSession = null;
+  refreshInFlight = null;
+  refreshAttempts = 0;
+  retryTimer = null;
+  destroyed = false;
+  offlineStaleCycles = 0;
+  static MAX_OFFLINE_STALE_CYCLES = 3;
+  submitNonces = /* @__PURE__ */ new Map();
+  static NONCE_TTL_MS = 5 * 60 * 1e3;
+  static MAX_PENDING_NONCES = 100;
+  constructor(options) {
+    this.clientId = options.clientId;
+    this.tenantId = options.tenantId;
+    this.tokenEndpoint = options.tokenEndpoint;
+    this.storage = options.storage;
+    this.http = options.http;
+    this.crypto = options.crypto;
+    this.biometric = options.biometric;
+    this.biometricEnabled = options.biometricEnabled ?? false;
+    this.biometricStrict = options.biometricStrict ?? false;
+    this.biometricPrompt = options.biometricPrompt ?? "Authenticate to continue";
+    this.dispatch = options.dispatch;
+    this.dpopSession = options.dpopSession;
+    this.emitEvent = options.onEvent;
+    this.now = options.now ?? Date.now;
+    this.setTimeoutFn = options.setTimeout ?? globalThis.setTimeout.bind(globalThis);
+    this.clearTimeoutFn = options.clearTimeout ?? globalThis.clearTimeout.bind(globalThis);
+    this.jwksUri = options.jwksUri ?? deriveDefaultJwksUri(options.tokenEndpoint);
+    this.jwksTtlMs = options.jwksTtlMs ?? 24 * 60 * 60 * 1e3;
+    this.expectedIssuer = options.expectedIssuer ?? deriveDefaultIssuer(options.tokenEndpoint);
+    this.expectedAudience = options.expectedAudience ?? RAKOMI_PLATFORM_AUDIENCE_DEFAULT;
+  }
+  /**
+  * Issue a one-time submit nonce for an authentication ceremony.
+  *
+  * every public-surface `submitOAuthTokens` call MUST present a nonce
+  * issued by an in-flight flow. Nonces are 32 bytes, base64url, single-use, 5-minute TTL.
+  */
+  async beginAuthFlow() {
+    const bytes = await this.crypto.getRandomBytes(32);
+    const nonce = bytesToBase64Url(bytes);
+    this.submitNonces.set(nonce, this.now() + _TokenRuntime.NONCE_TTL_MS);
+    this.gcExpiredNonces();
+    while (this.submitNonces.size > _TokenRuntime.MAX_PENDING_NONCES) {
+      const oldest = this.submitNonces.keys().next().value;
+      if (oldest === void 0) break;
+      this.submitNonces.delete(oldest);
+    }
+    return nonce;
+  }
+  gcExpiredNonces() {
+    const cutoff = this.now();
+    for (const [nonce, expiresAt] of this.submitNonces) {
+      if (expiresAt < cutoff) this.submitNonces.delete(nonce);
+    }
+  }
+  consumeNonce(nonce) {
+    this.gcExpiredNonces();
+    const entry = this.submitNonces.get(nonce);
+    if (entry === void 0) return false;
+    this.submitNonces.delete(nonce);
+    return true;
+  }
+  /**
+  * Validate a submit nonce — public for Provider-layer nonce gate.
+  * Internal class paths (refresh, restore) bypass this; external consumer-facing
+  * surfaces (`Provider.submitOAuthTokens`) MUST call this BEFORE invoking `setTokens`.
+  */
+  validateSubmitNonce(nonce) {
+    return this.consumeNonce(nonce);
+  }
+  /**
+  * Persist tokens after a successful sign-in or refresh. Updates in-memory state,
+  * writes refresh token to secure storage, and dispatches `SIGN_IN_SUCCESS` /
+  * `REFRESH_SUCCESS` to the FSM.
+  *
+  * Internal API — the consumer-facing tokens-write surface is `Provider.submitOAuthTokens`,
+  * which gates this with `validateSubmitNonce`.
+  */
+  async setTokens(response, source = "sign_in") {
+    const user = sdkCore.decodeUser(response.access_token);
+    if (!user) {
+      this.dispatch({ type: "SIGN_IN_FAILED", error: { code: "SIGN_IN_FAILED", message: "Invalid or missing JWT claims" } });
+      return;
+    }
+    if (this.currentUser && this.currentUser.id !== user.id) {
+      await this.clear({ code: "SIGN_IN_FAILED", message: "session_mismatch on token set" });
+      return;
+    }
+    const sessionDecoded = sdkCore.decodeSession(response.access_token, response.expires_in);
+    if (!sessionDecoded) {
+      this.dispatch({ type: "SIGN_IN_FAILED", error: { code: "SIGN_IN_FAILED", message: "Invalid session claims" } });
+      return;
+    }
+    const clampedExpiresIn = Math.max(10, Math.min(86400, Math.floor(response.expires_in)));
+    this.accessToken = response.access_token;
+    this.expiresAtMs = this.now() + clampedExpiresIn * 1e3;
+    this.refreshAttempts = 0;
+    this.currentUser = user;
+    this.currentSession = { ...sessionDecoded, isExpiringSoon: false };
+    if (response.refresh_token) {
+      const key = await this.resolveStorageKey();
+      await this.storage.setItem(key, REFRESH_TOKEN_PREFIX + response.refresh_token, {
+        keychainAccessible: "AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY",
+        requireAuthentication: this.biometricEnabled,
+        authenticationPrompt: this.biometricEnabled ? this.biometricPrompt : void 0
+      });
+    }
+    if (source === "refresh") {
+      this.dispatch({ type: "REFRESH_SUCCESS", session: this.currentSession });
+    } else if (source === "sign_in") {
+      this.dispatch({ type: "SIGN_IN_SUCCESS", user, session: this.currentSession });
+    }
+  }
+  /**
+   * Public token getter — returns a `TokenResult` shape compatible with `useAuth().getToken`.
+   * Refreshes proactively if within the refresh buffer; deduplicates concurrent callers.
+   */
+  getToken = async () => {
+    const valid = this.getValidAccessToken();
+    if (valid) {
+      const expiresIn2 = Math.max(0, Math.floor(((this.expiresAtMs ?? 0) - this.now()) / 1e3));
+      return { ok: true, token: valid, tokenType: "Bearer", headers: {}, expiresIn: expiresIn2 };
+    }
+    const success = await this.performRefresh();
+    if (!success || !this.accessToken || this.expiresAtMs === null) {
+      return { ok: false, error: { code: "REFRESH_FAILED", reason: "expired", message: "No valid token available" } };
+    }
+    const expiresIn = Math.max(0, Math.floor((this.expiresAtMs - this.now()) / 1e3));
+    return { ok: true, token: this.accessToken, tokenType: "Bearer", headers: {}, expiresIn };
+  };
+  /**
+   * Try to restore session from persisted refresh token. Called once on Provider mount.
+   * Triggers a refresh — on success dispatches RESTORE_SUCCESS; on failure RESTORE_FAILED.
+   */
+  async restore() {
+    const success = await this.performRefresh({ duringRestore: true });
+    if (success && this.currentUser && this.currentSession) {
+      this.dispatch({ type: "RESTORE_SUCCESS", user: this.currentUser, session: this.currentSession });
+      return true;
+    }
+    this.dispatch({ type: "RESTORE_FAILED" });
+    return false;
+  }
+  /**
+   * Foreground refresh — called by Provider AppState handler. Dispatches REFRESH_START
+   * and kicks a single in-flight refresh. No-op if no refresh token / already in flight.
+   */
+  async refreshOnForeground() {
+    if (this.refreshInFlight) return;
+    if (!this.currentUser) return;
+    this.dispatch({ type: "REFRESH_START" });
+    await this.performRefresh();
+  }
+  /**
+   * Clear all auth state. GDPR Art. 17 erasure.
+   */
+  async clear(error) {
+    this.accessToken = null;
+    this.expiresAtMs = null;
+    this.currentUser = null;
+    this.currentSession = null;
+    this.refreshInFlight = null;
+    this.refreshAttempts = 0;
+    if (this.retryTimer) {
+      this.clearTimeoutFn(this.retryTimer);
+      this.retryTimer = null;
+    }
+    try {
+      const key = await this.resolveStorageKey();
+      await this.storage.removeItem(key);
+    } catch {
+    }
+    if (error) {
+      this.dispatch({ type: "REFRESH_REVOKED", error });
+    } else {
+      this.dispatch({ type: "SIGN_OUT" });
+    }
+  }
+  /**
+  * Verify a JWT against the cached JWKS (offline-capable).
+  *
+  * uses `jose.createLocalJWKSet` so verification is purely local once
+  * the JWKS document has been fetched and cached. The cache is preloaded from `KeyValueStore`
+  * on cold-start (slot `jwks_cache`) and refreshed on TTL miss; on persistent network failure
+  * the stale-while-error fallback keeps verification working until the cached doc itself expires.
+  */
+  async verifyAccessToken(token) {
+    try {
+      const cache = await this.getOrCreateJwksCache();
+      const keySet = await cache.getKeySet();
+      const result = await jose.jwtVerify(token, keySet, {
+        issuer: this.expectedIssuer,
+        audience: this.expectedAudience,
+        algorithms: ["RS256"]
+      });
+      return { ok: true, payload: result.payload };
+    } catch (err2) {
+      return { ok: false, reason: err2 instanceof Error ? err2.message : "verify failed" };
+    }
+  }
+  destroy() {
+    this.destroyed = true;
+    if (this.retryTimer) {
+      this.clearTimeoutFn(this.retryTimer);
+      this.retryTimer = null;
+    }
+    this.refreshInFlight = null;
+  }
+  async resolveStorageKey() {
+    if (this.storageKeyResolved) return this.storageKeyResolved;
+    this.storageKeyResolved = await sdkCore.deriveTenantStorageKey(this.crypto, this.tenantId, "refresh_token");
+    return this.storageKeyResolved;
+  }
+  async resolveJwksKey() {
+    if (this.jwksKeyResolved) return this.jwksKeyResolved;
+    this.jwksKeyResolved = await sdkCore.deriveTenantStorageKey(this.crypto, this.tenantId, "jwks_cache");
+    return this.jwksKeyResolved;
+  }
+  async getOrCreateJwksCache() {
+    if (this.jwksCache) return this.jwksCache;
+    const key = await this.resolveJwksKey();
+    let initial;
+    try {
+      const raw = await this.storage.getItem(key);
+      if (raw) {
+        const parsed = JSON.parse(raw);
+        if (parsed.document && typeof parsed.fetchedAt === "number") {
+          initial = { document: parsed.document, fetchedAt: parsed.fetchedAt };
+        }
+      }
+    } catch {
+    }
+    this.jwksCache = sdkCore.createJwksCache({
+      ttlMs: this.jwksTtlMs,
+      fetchJwks: async () => {
+        const response = await this.http.fetch(this.jwksUri, { method: "GET", headers: { Accept: "application/json" } });
+        if (!response.ok) {
+          throw new Error(`JWKS fetch failed: HTTP ${response.status}`);
+        }
+        return await response.json();
+      },
+      initial,
+      onFetched: (document, fetchedAt) => {
+        void this.storage.setItem(key, JSON.stringify({ document, fetchedAt })).catch(() => void 0);
+      }
+    });
+    return this.jwksCache;
+  }
+  getValidAccessToken() {
+    if (!this.accessToken || this.expiresAtMs === null) return null;
+    if (this.now() >= this.expiresAtMs - REFRESH_BUFFER_SECONDS * 1e3) return null;
+    return this.accessToken;
+  }
+  async performRefresh(opts = {}) {
+    if (this.refreshInFlight) return this.refreshInFlight;
+    this.refreshInFlight = this.doRefresh(opts).finally(() => {
+      this.refreshInFlight = null;
+    });
+    return this.refreshInFlight;
+  }
+  async doRefresh(opts) {
+    if (this.destroyed) return false;
+    this.emitEvent?.({ type: "refresh_started" });
+    if (this.biometricEnabled && this.biometric) {
+      const available = await this.biometric.isAvailable();
+      if (!available) {
+        this.emitEvent?.({ type: "biometric_failed", metadata: { reason: "unavailable" } });
+        if (!opts.duringRestore) {
+          await this.clear({ code: "REFRESH_FAILED", reason: "revoked", message: "Biometric unavailable" });
+        }
+        return false;
+      }
+      const result2 = await this.biometric.authenticate({ promptMessage: this.biometricPrompt, strict: this.biometricStrict });
+      if (!result2.success) {
+        this.emitEvent?.({ type: "biometric_failed", metadata: { reason: result2.reason } });
+        if (!opts.duringRestore) {
+          if (result2.reason === "lockout" || result2.reason === "not_enrolled") {
+            await this.clear({ code: "REFRESH_FAILED", reason: "revoked", message: `Biometric ${result2.reason}` });
+          }
+        }
+        return false;
+      }
+    }
+    const key = await this.resolveStorageKey();
+    let raw;
+    try {
+      raw = await this.storage.getItem(key, {
+        requireAuthentication: this.biometricEnabled,
+        authenticationPrompt: this.biometricEnabled ? this.biometricPrompt : void 0
+      });
+    } catch {
+      raw = null;
+    }
+    if (!raw) {
+      this.emitEvent?.({ type: "refresh_failed", metadata: { reason: "no_refresh_token" } });
+      return false;
+    }
+    if (!raw.startsWith(REFRESH_TOKEN_PREFIX)) {
+      await this.storage.removeItem(key).catch(() => void 0);
+      this.emitEvent?.({ type: "refresh_failed", metadata: { reason: "invalid_storage_prefix" } });
+      return false;
+    }
+    const refreshToken = raw.slice(REFRESH_TOKEN_PREFIX.length);
+    if (this.dpopSession?.isBound) {
+      const dResult = await refreshWithDpop({
+        http: this.http,
+        tokenEndpoint: this.tokenEndpoint,
+        refreshToken,
+        clientId: this.clientId,
+        dpopSession: this.dpopSession
+      });
+      if (!dResult.ok) {
+        return this.handleDpopRefreshFailure(dResult.error, opts.duringRestore ?? false);
+      }
+      this.emitEvent?.({ type: "refresh_succeeded" });
+      this.refreshAttempts = 0;
+      this.offlineStaleCycles = 0;
+      await this.setTokens(dResult.tokens, opts.duringRestore ? "restore" : "refresh");
+      return true;
+    }
+    const result = await sdkCore.refreshAccessToken({
+      http: this.http,
+      tokenEndpoint: this.tokenEndpoint,
+      refreshToken,
+      clientId: this.clientId
+    });
+    if (!result.ok) {
+      this.emitEvent?.({ type: "refresh_failed", metadata: { code: result.error.code } });
+      if (this.isAuthError(result.error)) {
+        await this.clear(result.error);
+        return false;
+      }
+      return this.scheduleRetry(result.error, opts.duringRestore ?? false);
+    }
+    this.emitEvent?.({ type: "refresh_succeeded" });
+    this.refreshAttempts = 0;
+    this.offlineStaleCycles = 0;
+    await this.setTokens(result.tokens, opts.duringRestore ? "restore" : "refresh");
+    return true;
+  }
+  isAuthError(error) {
+    return error.code === "REFRESH_FAILED" && (error.reason === "expired" || error.reason === "revoked");
+  }
+  /**
+  * Map a DPoP-refresh failure (three-class taxonomy) onto the FSM. The
+  * distinct `code` is emitted as telemetry, so consumers can tell an
+  * `auth/invalid_dpop_proof` spike apart from `auth/invalid_refresh_token`
+  * (the classes are kept distinct deliberately).
+  */
+  async handleDpopRefreshFailure(error, duringRestore) {
+    this.emitEvent?.({ type: "dpop_refresh_failed", metadata: { code: error.code } });
+    if (error.class === "network") {
+      return this.scheduleRetry({ code: "REFRESH_FAILED", reason: "network", message: error.message }, duringRestore);
+    }
+    if (error.class === "dpop_prover_unavailable") {
+      this.emitEvent?.({ type: "refresh_failed", metadata: { reason: "dpop_prover_unavailable" } });
+      return false;
+    }
+    await this.clear({ code: "REFRESH_FAILED", reason: "revoked", message: error.message });
+    return false;
+  }
+  scheduleRetry(error, duringRestore) {
+    if (this.refreshAttempts >= RETRY_DELAYS_MS.length) {
+      if (!duringRestore && this.accessToken && this.expiresAtMs !== null && this.now() < this.expiresAtMs) {
+        this.refreshAttempts = 0;
+        this.offlineStaleCycles += 1;
+        if (this.offlineStaleCycles >= _TokenRuntime.MAX_OFFLINE_STALE_CYCLES) {
+          this.offlineStaleCycles = 0;
+          void this.clear({ code: "REFRESH_FAILED", reason: "revoked", message: "Refresh chronically failing \u2014 session lost" });
+          return false;
+        }
+        this.dispatch({ type: "OFFLINE_STALE" });
+        return false;
+      }
+      void this.clear({ code: "REFRESH_FAILED", reason: "network", message: "Refresh exhausted retries" });
+      return false;
+    }
+    const delay = RETRY_DELAYS_MS[this.refreshAttempts];
+    this.refreshAttempts++;
+    this.emitEvent?.({ type: "network_retry", metadata: { delayMs: delay, attempt: this.refreshAttempts } });
+    if (!duringRestore) {
+      this.dispatch({ type: "REFRESH_NETWORK_ERROR", error });
+    }
+    if (this.retryTimer) this.clearTimeoutFn(this.retryTimer);
+    this.retryTimer = this.setTimeoutFn(() => {
+      this.retryTimer = null;
+      void this.performRefresh();
+    }, delay);
+    return false;
+  }
+};
+
+// src/native/expo-adapter.ts
+function createDefaultExpoAdapter(options = {}) {
+  const crypto = createExpoCrypto();
+  const storage = createExpoSecureStore({ tokenCache: options.tokenCache });
+  const browser = createExpoBrowser();
+  const deepLink = createExpoDeepLink();
+  const biometric = createExpoBiometricGate();
+  const appLifecycle = createRnAppLifecycle();
+  const connectivity = createNetInfoConnectivity();
+  return {
+    crypto,
+    storage,
+    browser,
+    deepLink,
+    biometric,
+    appLifecycle,
+    connectivity
+  };
+}
+function createExpoCrypto() {
+  let mod = null;
+  async function load() {
+    if (!mod) {
+      mod = await import('expo-crypto').catch(() => null);
+      if (!mod) {
+        throw new Error(
+          "@rakomi/react-native: expo-crypto is required for the default adapter. Install it (Expo-managed) or pass a custom nativeAdapter (bare RN)."
+        );
+      }
+    }
+    return mod;
+  }
+  return {
+    getRandomBytes: async (n) => {
+      const m = await load();
+      const result = await m.getRandomBytesAsync(n);
+      return new Uint8Array(result);
+    },
+    digestSha256: async (input) => {
+      const m = await load();
+      let str = "";
+      for (let i = 0; i < input.length; i++) str += String.fromCharCode(input[i]);
+      const hex = await m.digestStringAsync(
+        m.CryptoDigestAlgorithm.SHA256,
+        str,
+        { encoding: m.CryptoEncoding.HEX }
+      );
+      const bytes = new Uint8Array(hex.length / 2);
+      for (let i = 0; i < bytes.length; i++) {
+        bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);
+      }
+      return bytes;
+    }
+  };
+}
+function createExpoSecureStore(opts) {
+  if (opts.tokenCache) {
+    const tc = opts.tokenCache;
+    return {
+      getItem: (key) => tc.getToken(key),
+      setItem: async (key, value) => {
+        await tc.saveToken(key, value);
+      },
+      removeItem: (key) => tc.clearToken(key)
+    };
+  }
+  let mod = null;
+  async function load() {
+    if (!mod) {
+      mod = await import('expo-secure-store').catch(() => null);
+      if (!mod) {
+        throw new Error(
+          "@rakomi/react-native: expo-secure-store is required for the default adapter. Install it (Expo-managed) or pass `tokenCache` / a custom nativeAdapter."
+        );
+      }
+    }
+    return mod;
+  }
+  return {
+    getItem: async (key, options) => {
+      const m = await load();
+      return m.getItemAsync(key, {
+        requireAuthentication: options?.requireAuthentication,
+        authenticationPrompt: options?.authenticationPrompt
+      });
+    },
+    setItem: async (key, value, options) => {
+      const m = await load();
+      const accessibility = mapKeychainAccessible(
+        m,
+        options?.keychainAccessible ?? "AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY"
+      );
+      await m.setItemAsync(key, value, {
+        keychainAccessible: accessibility,
+        requireAuthentication: options?.requireAuthentication,
+        authenticationPrompt: options?.authenticationPrompt
+      });
+    },
+    removeItem: async (key) => {
+      const m = await load();
+      await m.deleteItemAsync(key);
+    }
+  };
+}
+function mapKeychainAccessible(m, level) {
+  switch (level) {
+    case "WHEN_UNLOCKED":
+      return m.WHEN_UNLOCKED;
+    case "AFTER_FIRST_UNLOCK":
+      return m.AFTER_FIRST_UNLOCK;
+    case "WHEN_UNLOCKED_THIS_DEVICE_ONLY":
+      return m.WHEN_UNLOCKED_THIS_DEVICE_ONLY;
+    case "AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY":
+      return m.AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY;
+    case "WHEN_PASSCODE_SET_THIS_DEVICE_ONLY":
+      return m.WHEN_PASSCODE_SET_THIS_DEVICE_ONLY;
+  }
+}
+function createExpoBrowser() {
+  let mod = null;
+  async function load() {
+    if (!mod) {
+      mod = await import('expo-web-browser').catch(() => null);
+      if (!mod) {
+        throw new Error("@rakomi/react-native: expo-web-browser is required for OAuth flows.");
+      }
+    }
+    return mod;
+  }
+  return {
+    openAuthSession: async (authUrl, redirectUri, options) => {
+      const m = await load();
+      const result = await m.openAuthSessionAsync(authUrl, redirectUri, {
+        preferEphemeralSession: options?.preferEphemeralSession ?? true
+      });
+      if (result.type === "success" && result.url) {
+        return { type: "success", url: result.url };
+      }
+      if (result.type === "cancel") return { type: "cancel" };
+      if (result.type === "dismiss") return { type: "dismiss" };
+      if (result.type === "locked") return { type: "locked" };
+      return { type: "cancel" };
+    }
+  };
+}
+function createExpoDeepLink() {
+  let mod = null;
+  async function load() {
+    if (!mod) {
+      mod = await import('expo-linking').catch(() => null);
+      if (!mod) {
+        throw new Error("@rakomi/react-native: expo-linking is required for OAuth deep-link callback.");
+      }
+    }
+    return mod;
+  }
+  return {
+    getInitialUrl: async () => {
+      const m = await load();
+      return m.getInitialURL();
+    },
+    addListener: (listener) => {
+      let sub = null;
+      void load().then((m) => {
+        sub = m.addEventListener("url", (event) => listener(event.url));
+      });
+      return {
+        remove: () => {
+          sub?.remove();
+        }
+      };
+    }
+  };
+}
+function createExpoBiometricGate() {
+  let mod = null;
+  async function load() {
+    if (mod !== null) return mod;
+    try {
+      mod = await import('expo-local-authentication');
+    } catch {
+      mod = null;
+    }
+    return mod;
+  }
+  return {
+    isAvailable: async () => {
+      const m = await load();
+      if (!m) return false;
+      const has = await m.hasHardwareAsync();
+      if (!has) return false;
+      const enrolled = await m.isEnrolledAsync();
+      return enrolled;
+    },
+    authenticate: async ({ promptMessage, strict = false }) => {
+      const m = await load();
+      if (!m) return { success: false, reason: "unavailable" };
+      const result = await m.authenticateAsync({
+        promptMessage,
+        disableDeviceFallback: strict,
+        fallbackLabel: "Use passcode"
+      });
+      if (result.success) return { success: true };
+      switch (result.error) {
+        case "user_cancel":
+        case "system_cancel":
+        case "app_cancel":
+          return { success: false, reason: "cancelled" };
+        case "lockout":
+        case "lockout_permanent":
+          return { success: false, reason: "lockout" };
+        case "not_enrolled":
+          return { success: false, reason: "not_enrolled" };
+        case "not_available":
+        case "no_space":
+          return { success: false, reason: "unavailable" };
+        default:
+          return { success: false, reason: "unknown" };
+      }
+    }
+  };
+}
+function createRnAppLifecycle() {
+  let rn = null;
+  let pending = null;
+  async function ensure() {
+    if (rn) return rn;
+    if (!pending) {
+      pending = import('react-native').then((m) => {
+        rn = m.default ?? m;
+        return rn;
+      });
+    }
+    return pending;
+  }
+  void ensure().catch(() => void 0);
+  return {
+    addStateChangeListener: (listener) => {
+      let sub = null;
+      void ensure().then((r) => {
+        sub = r.AppState.addEventListener("change", (next) => {
+          listener(coerceAppState(next));
+        });
+      });
+      return { remove: () => sub?.remove() };
+    },
+    getCurrent: () => rn ? coerceAppState(rn.AppState.currentState) : "unknown"
+  };
+}
+function coerceAppState(value) {
+  if (value === "active" || value === "background" || value === "inactive") return value;
+  return "unknown";
+}
+function createNetInfoConnectivity() {
+  let mod = null;
+  async function load() {
+    if (mod !== null) return mod;
+    try {
+      mod = (await import('@react-native-community/netinfo')).default ?? null;
+    } catch {
+      mod = null;
+    }
+    return mod;
+  }
+  return {
+    isConnected: async () => {
+      const m = await load();
+      if (!m) return true;
+      const state = await m.fetch();
+      return state.isConnected ?? true;
+    },
+    addListener: (listener) => {
+      let unsubscribe = null;
+      void load().then((m) => {
+        if (!m) return;
+        unsubscribe = m.addEventListener((state) => listener(state.isConnected ?? true));
+      });
+      return { remove: () => unsubscribe?.() };
+    }
+  };
+}
+var RakomiContext = react.createContext(null);
+var APP_STATE_DEBOUNCE_MS = 300;
+function RakomiProvider(props) {
+  const adapter = react.useMemo(() => {
+    const built = props.nativeAdapter ?? createDefaultExpoAdapter({ tokenCache: props.tokenCache });
+    return Object.freeze(built);
+  }, [props.nativeAdapter, props.tokenCache]);
+  const http = react.useMemo(() => createRnHttpClient({ baseUrl: props.baseUrl }), [props.baseUrl]);
+  const events = react.useMemo(() => new sdkCore.EventLog(props.onEvent), [props.onEvent]);
+  const [snapshot, dispatch] = react.useReducer(sdkCore.reduce, sdkCore.INITIAL_SNAPSHOT);
+  const passkeyCeremonyLock = react.useRef(createCeremonyLock()).current;
+  const translate = react.useMemo(
+    () => sdkCore.createTranslator(props.locale ?? "en", props.translations),
+    [props.locale, props.translations]
+  );
+  const dpopSession = react.useMemo(() => {
+    if (!adapter.dpopProver) return void 0;
+    return createDpopSession({
+      prover: adapter.dpopProver,
+      baseUrl: props.baseUrl ?? "",
+      onDowngrade: () => {
+        events.push({ type: "sign_in_failed", severity: "security", metadata: { reason: "dpop_downgrade" } });
+      }
+    });
+  }, [adapter, props.baseUrl, events]);
+  const runtime = react.useMemo(() => {
+    const tokenEndpoint = props.tokenEndpoint ?? `${(props.baseUrl ?? "").replace(/\/$/, "")}/oauth/token`;
+    return new TokenRuntime({
+      clientId: props.publishableKey,
+      tenantId: props.tenantId ?? props.publishableKey,
+      tokenEndpoint,
+      storage: adapter.storage,
+      http,
+      crypto: adapter.crypto,
+      biometric: adapter.biometric,
+      biometricEnabled: props.biometric ?? false,
+      biometricStrict: props.biometricStrict ?? false,
+      biometricPrompt: props.biometricPrompt ?? "Authenticate to continue",
+      dispatch,
+      dpopSession,
+      onEvent: ({ type, metadata }) => {
+        if (type === "biometric_failed") {
+          events.push({ type: "biometric_failed", severity: "warning", metadata });
+        } else if (type === "network_retry") {
+          events.push({ type: "network_retry", severity: "warning", metadata });
+        } else if (type === "refresh_started") {
+          events.push({ type: "refresh_started", severity: "info", metadata });
+        } else if (type === "refresh_succeeded") {
+          events.push({ type: "refresh_succeeded", severity: "info", metadata });
+        } else if (type === "refresh_failed") {
+          events.push({ type: "refresh_failed", severity: "warning", metadata });
+        }
+      }
+    });
+  }, [adapter, http, props.publishableKey, props.tenantId, props.baseUrl, props.tokenEndpoint, props.biometric, props.biometricStrict, props.biometricPrompt, events, dpopSession]);
+  react.useEffect(() => {
+    void runtime.restore();
+    return () => runtime.destroy();
+  }, [runtime]);
+  const debounceTimer = react.useRef(null);
+  react.useEffect(() => {
+    const sub = adapter.appLifecycle.addStateChangeListener((next) => {
+      if (next !== "active") return;
+      if (debounceTimer.current) clearTimeout(debounceTimer.current);
+      debounceTimer.current = setTimeout(() => {
+        events.push({ type: "app_state_foreground", severity: "info" });
+        void runtime.refreshOnForeground();
+      }, APP_STATE_DEBOUNCE_MS);
+    });
+    return () => {
+      sub.remove();
+      if (debounceTimer.current) clearTimeout(debounceTimer.current);
+    };
+  }, [adapter, events, runtime]);
+  react.useEffect(() => {
+    const bg = adapter.backgroundTask;
+    if (!bg) return void 0;
+    let unregister = null;
+    void (async () => {
+      try {
+        const ok = await bg.isAvailable();
+        if (!ok) return;
+        unregister = await bg.register(async () => {
+          await runtime.refreshOnForeground();
+        });
+      } catch {
+      }
+    })();
+    return () => {
+      if (unregister) void unregister().catch(() => void 0);
+    };
+  }, [adapter, runtime]);
+  react.useEffect(() => {
+    const sub = adapter.connectivity.addListener((isConnected) => {
+      if (isConnected) {
+        events.push({ type: "offline_queue_drained", severity: "info" });
+        dispatch({ type: "BACK_ONLINE" });
+        void runtime.refreshOnForeground();
+      } else {
+        dispatch({ type: "OFFLINE_STALE" });
+      }
+    });
+    return () => sub.remove();
+  }, [adapter, events, runtime]);
+  react.useEffect(() => {
+    if (props.deepLinkAutoHandle === false) return void 0;
+    const sub = adapter.deepLink.addListener(() => {
+      events.push({ type: "deep_link_received", severity: "info" });
+    });
+    void adapter.deepLink.getInitialUrl().then((url) => {
+      if (url) {
+        events.push({ type: "deep_link_received", severity: "info", metadata: { coldStart: true } });
+      }
+    }).catch(() => void 0);
+    return () => sub.remove();
+  }, [adapter, events, props.deepLinkAutoHandle]);
+  const signOut = react.useMemo(
+    () => async () => {
+      events.push({ type: "signed_out", severity: "info" });
+      await runtime.clear();
+    },
+    [events, runtime]
+  );
+  const getToken = react.useMemo(() => () => runtime.getToken(), [runtime]);
+  const submitOAuthTokens = react.useMemo(
+    () => async (tokens, nonce) => {
+      if (!runtime.validateSubmitNonce(nonce)) {
+        events.push({ type: "sign_in_failed", severity: "security", error: { code: "CSRF_MISMATCH", message: "Submit nonce missing or expired" } });
+        dispatch({ type: "SIGN_IN_FAILED", error: { code: "CSRF_MISMATCH", message: "Submit nonce missing or expired" } });
+        return;
+      }
+      await runtime.setTokens(tokens, "sign_in");
+    },
+    [runtime, events]
+  );
+  const beginAuthFlow = react.useMemo(() => () => runtime.beginAuthFlow(), [runtime]);
+  const value = react.useMemo(
+    () => ({
+      publishableKey: props.publishableKey,
+      baseUrl: props.baseUrl ?? "",
+      redirectUri: props.redirectUri,
+      adapter,
+      http,
+      snapshot,
+      state: snapshot.state,
+      isSignedIn: sdkCore.isSignedIn(snapshot),
+      user: snapshot.user,
+      events,
+      locale: props.locale ?? "en",
+      translate,
+      dispatch,
+      signOut,
+      getToken,
+      submitOAuthTokens,
+      passkeyCeremonyLock,
+      beginAuthFlow,
+      dpopSession
+    }),
+    [adapter, http, snapshot, events, props.publishableKey, props.baseUrl, props.redirectUri, props.locale, translate, signOut, getToken, submitOAuthTokens, beginAuthFlow, dpopSession, passkeyCeremonyLock]
+  );
+  return /* @__PURE__ */ jsxRuntime.jsx(RakomiContext.Provider, { value, children: props.children });
+}
+function useRakomiContext() {
+  const ctx = react.useContext(RakomiContext);
+  if (!ctx) {
+    throw new Error("useRakomi*() must be called inside a <RakomiProvider>.");
+  }
+  return ctx;
+}
+function useAuth() {
+  const ctx = useRakomiContext();
+  const { snapshot, signOut, state, getToken } = ctx;
+  const signIn = async (_options) => {
+    return { status: "error", error: { code: "INVALID_CONFIG", message: "sign-in flow not yet wired in 0.1.0" } };
+  };
+  const switchOrganization = async (_orgId) => ({ status: "error", error: { code: "INVALID_CONFIG", message: "switchOrganization not yet wired" } });
+  if (state === "idle") {
+    return {
+      isLoaded: true,
+      isSignedIn: false,
+      userId: null,
+      user: null,
+      sessionId: null,
+      error: snapshot.error,
+      state,
+      signIn,
+      signOut,
+      getToken
+    };
+  }
+  if (state === "authenticating") {
+    return {
+      isLoaded: false,
+      isSignedIn: void 0,
+      userId: void 0,
+      user: void 0,
+      sessionId: void 0,
+      error: null,
+      state,
+      signIn,
+      signOut,
+      getToken
+    };
+  }
+  if (snapshot.user && snapshot.session) {
+    return {
+      isLoaded: true,
+      isSignedIn: true,
+      userId: snapshot.user.id,
+      user: snapshot.user,
+      sessionId: snapshot.session.id,
+      error: snapshot.error,
+      state,
+      isExpiringSoon: snapshot.session.isExpiringSoon ?? false,
+      has: (params) => {
+        if (params.permission && sdkCore.hasPermission(snapshot.user, params.permission)) return true;
+        if (params.role && sdkCore.hasRole(snapshot.user, params.role)) return true;
+        return false;
+      },
+      signIn,
+      signOut,
+      getToken,
+      switchOrganization
+    };
+  }
+  return {
+    isLoaded: true,
+    isSignedIn: false,
+    userId: null,
+    user: null,
+    sessionId: null,
+    error: snapshot.error,
+    state,
+    signIn,
+    signOut,
+    getToken
+  };
+}
+
+// src/hooks/use-session.ts
+function useSession() {
+  const { snapshot } = useRakomiContext();
+  return {
+    isLoaded: snapshot.state !== "authenticating",
+    isSignedIn: snapshot.state === "authenticated" || snapshot.state === "refreshing" || snapshot.state === "offline_stale",
+    session: snapshot.session
+  };
+}
+
+// src/hooks/use-user.ts
+function useUser() {
+  const { snapshot } = useRakomiContext();
+  return {
+    isLoaded: snapshot.state !== "authenticating",
+    isSignedIn: snapshot.state === "authenticated" || snapshot.state === "refreshing" || snapshot.state === "offline_stale",
+    user: snapshot.user
+  };
+}
+
+// src/hooks/index.ts
+function useFlag(flag, options) {
+  const { user } = useRakomiContext();
+  const flags = user?.rawClaims["feature_flags"] ?? {};
+  const value = flags[flag] ?? options?.defaultValue;
+  return {
+    isLoaded: !!user,
+    value,
+    isEnabled: value === true
+  };
+}
+function useOrganization() {
+  const { user } = useRakomiContext();
+  const { org_id: orgId, org_role: orgRole, org_memberships: orgMemberships } = sdkCore.extractOrgClaims(
+    user?.rawClaims ?? {}
+  );
+  return {
+    isLoaded: !!user,
+    organization: orgId && orgRole ? { orgId, orgRole, orgMemberships: orgMemberships ?? [] } : null
+  };
+}
+function useOrganizationList() {
+  const { user } = useRakomiContext();
+  const { org_memberships: organizations } = sdkCore.extractOrgClaims(user?.rawClaims ?? {});
+  return {
+    isLoaded: !!user,
+    organizations: organizations ?? []
+  };
+}
+function useLinkedAccounts() {
+  const { user } = useRakomiContext();
+  const methods = user?.rawClaims["linked_methods"] ?? [];
+  return {
+    isLoaded: !!user,
+    methods,
+    link: async () => ({ status: "error" }),
+    unlink: async () => ({ status: "error" })
+  };
+}
+function useTranslation() {
+  const { translate, locale } = useRakomiContext();
+  return react.useMemo(() => ({ t: translate, locale }), [translate, locale]);
+}
+var authConfigCache = /* @__PURE__ */ new Map();
+function useAuthConfig() {
+  const { baseUrl, http, publishableKey } = useRakomiContext();
+  const [config, setConfig] = react.useState(null);
+  const [isLoaded, setIsLoaded] = react.useState(false);
+  react.useEffect(() => {
+    if (!baseUrl) return;
+    const cacheKey = `${baseUrl}|${publishableKey}`;
+    let cached2 = authConfigCache.get(cacheKey);
+    if (!cached2) {
+      cached2 = (async () => {
+        try {
+          const response = await http.fetch(`${baseUrl}/v1/auth/config`, {
+            method: "GET",
+            headers: { Accept: "application/json", "X-API-Key": publishableKey }
+          });
+          if (!response.ok) return null;
+          const raw = await response.json();
+          return sdkCore.parseAuthConfigResponse(raw, baseUrl);
+        } catch {
+          return null;
+        }
+      })();
+      authConfigCache.set(cacheKey, cached2);
+    }
+    let cancelled = false;
+    void cached2.then((value) => {
+      if (!cancelled) {
+        setConfig(value);
+        setIsLoaded(true);
+      }
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [baseUrl, http, publishableKey]);
+  return { isLoaded, config };
+}
+function useBranding() {
+  const { config, isLoaded } = useAuthConfig();
+  return {
+    isLoaded,
+    branding: config?.branding ?? null
+  };
+}
+function useAnonymousSignin() {
+  return {
+    isLoaded: true,
+    signInAnonymously: async () => ({ status: "error" })
+  };
+}
+var baasPlansCache = /* @__PURE__ */ new Map();
+function useBaasPlans({ tenantSlug }) {
+  const { baseUrl, http, publishableKey } = useRakomiContext();
+  const [plans, setPlans] = react.useState([]);
+  const [isLoaded, setIsLoaded] = react.useState(false);
+  const [error, setError] = react.useState(null);
+  react.useEffect(() => {
+    if (!baseUrl || !tenantSlug) return;
+    const cacheKey = `${baseUrl}|${tenantSlug}`;
+    let cached2 = baasPlansCache.get(cacheKey);
+    if (!cached2) {
+      cached2 = (async () => {
+        try {
+          const response = await http.fetch(`${baseUrl}/v1/billing/baas/${encodeURIComponent(tenantSlug)}/public-plans`, {
+            method: "GET",
+            headers: { Accept: "application/json", "X-API-Key": publishableKey }
+          });
+          if (response.status === 404) return [];
+          if (!response.ok) return { error: `HTTP ${response.status}` };
+          const json = await response.json();
+          return json.data ?? [];
+        } catch (err2) {
+          return { error: err2 instanceof Error ? err2.message : "Network request failed" };
+        }
+      })();
+      baasPlansCache.set(cacheKey, cached2);
+    }
+    let cancelled = false;
+    void cached2.then((value) => {
+      if (cancelled) return;
+      if (Array.isArray(value)) {
+        setPlans(value);
+        setError(null);
+      } else {
+        setError(value.error);
+      }
+      setIsLoaded(true);
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [baseUrl, http, publishableKey, tenantSlug]);
+  return { isLoaded, plans, error };
+}
+function useBaasSubscription({ tenantSlug }) {
+  const { baseUrl, http, publishableKey, getToken } = useRakomiContext();
+  const [subscription, setSubscription] = react.useState(null);
+  const [isLoaded, setIsLoaded] = react.useState(false);
+  const [error, setError] = react.useState(null);
+  react.useEffect(() => {
+    if (!baseUrl || !tenantSlug) return;
+    let cancelled = false;
+    void (async () => {
+      try {
+        const tokenResult = await getToken();
+        const headers = { Accept: "application/json", "X-API-Key": publishableKey };
+        if (tokenResult.ok) headers["Authorization"] = `Bearer ${tokenResult.token}`;
+        const response = await http.fetch(`${baseUrl}/v1/billing/baas/${encodeURIComponent(tenantSlug)}/user/subscription`, {
+          method: "GET",
+          headers
+        });
+        if (cancelled) return;
+        if (response.status === 404) {
+          setSubscription(null);
+          setError(null);
+        } else if (response.ok) {
+          const json = await response.json();
+          setSubscription(json);
+          setError(null);
+        } else {
+          setError(`HTTP ${response.status}`);
+        }
+      } catch (err2) {
+        if (!cancelled) setError(err2 instanceof Error ? err2.message : "Network request failed");
+      } finally {
+        if (!cancelled) setIsLoaded(true);
+      }
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [baseUrl, http, publishableKey, tenantSlug, getToken]);
+  return { isLoaded, subscription, error };
+}
+function SignedIn({ children }) {
+  const { isSignedIn } = useRakomiContext();
+  return isSignedIn ? /* @__PURE__ */ jsxRuntime.jsx(jsxRuntime.Fragment, { children }) : null;
+}
+function SignedOut({ children }) {
+  const { isSignedIn } = useRakomiContext();
+  return isSignedIn ? null : /* @__PURE__ */ jsxRuntime.jsx(jsxRuntime.Fragment, { children });
+}
+function Protect({ children, fallback = null, permission, role }) {
+  const { user, isSignedIn } = useRakomiContext();
+  if (!isSignedIn || !user) return /* @__PURE__ */ jsxRuntime.jsx(jsxRuntime.Fragment, { children: fallback });
+  if (permission && !sdkCore.hasPermission(user, permission)) return /* @__PURE__ */ jsxRuntime.jsx(jsxRuntime.Fragment, { children: fallback });
+  if (role && !sdkCore.hasRole(user, role)) return /* @__PURE__ */ jsxRuntime.jsx(jsxRuntime.Fragment, { children: fallback });
+  return /* @__PURE__ */ jsxRuntime.jsx(jsxRuntime.Fragment, { children });
+}
+function Feature({ flag, children, fallback = null }) {
+  const { user } = useRakomiContext();
+  const flags = user?.rawClaims["feature_flags"] ?? {};
+  return flags[flag] === true ? /* @__PURE__ */ jsxRuntime.jsx(jsxRuntime.Fragment, { children }) : /* @__PURE__ */ jsxRuntime.jsx(jsxRuntime.Fragment, { children: fallback });
+}
+
+// src/internal/rn-primitives.ts
+var cached = null;
+function loadRnPrimitives() {
+  if (cached) return cached;
+  cached = __require("react-native");
+  return cached;
+}
+var PKCE_STORAGE_KEY = "rakomi.oauth.pkce.in-flight";
+async function startSocialSignIn(input) {
+  const { adapter, http } = input;
+  const pkce = await sdkCore.generatePkce(adapter.crypto);
+  const state = await sdkCore.issueState(adapter.crypto, adapter.storage);
+  const pkceRecord = JSON.stringify({ codeVerifier: pkce.codeVerifier });
+  await adapter.storage.setItem(PKCE_STORAGE_KEY, pkceRecord, { keychainAccessible: "AFTER_FIRST_UNLOCK_THIS_DEVICE_ONLY" });
+  const authUrl = sdkCore.buildAuthorizationUrl({
+    authorizationEndpoint: input.authorizationEndpoint,
+    clientId: input.clientId,
+    redirectUri: input.redirectUri,
+    state: state.state,
+    codeChallenge: pkce.codeChallenge,
+    codeChallengeMethod: "S256",
+    scope: input.scope,
+    provider: input.provider,
+    acrValues: input.acrValues
+  });
+  const result = await adapter.browser.openAuthSession(authUrl, input.redirectUri, {
+    preferEphemeralSession: input.preferEphemeralSession ?? true
+  });
+  if (result.type !== "success") {
+    await adapter.storage.removeItem(PKCE_STORAGE_KEY).catch(() => void 0);
+    if (result.type === "cancel") {
+      return { ok: false, error: { code: "OAUTH_CALLBACK_ERROR", oauthError: "oauth_user_cancelled", description: "User cancelled the sign-in flow" } };
+    }
+    if (result.type === "dismiss") {
+      return { ok: false, error: { code: "OAUTH_CALLBACK_ERROR", oauthError: "oauth_user_cancelled", description: "Sign-in dismissed" } };
+    }
+    if (result.type === "locked") {
+      return { ok: false, error: { code: "OAUTH_CALLBACK_ERROR", oauthError: "oauth_locked", description: "iOS auto-fill locked the auth session" } };
+    }
+    return { ok: false, error: { code: "SIGN_IN_FAILED", message: "unknown browser auth result" } };
+  }
+  const url = result.url;
+  const parsed = parseCallback(url, input.redirectUri);
+  if (!parsed.ok) {
+    await adapter.storage.removeItem(PKCE_STORAGE_KEY).catch(() => void 0);
+    return { ok: false, error: parsed.error };
+  }
+  const stateCheck = await sdkCore.consumeState(adapter.storage, state.storageKey, parsed.state);
+  if (!stateCheck.ok) {
+    await adapter.storage.removeItem(PKCE_STORAGE_KEY).catch(() => void 0);
+    return {
+      ok: false,
+      error: {
+        code: "OAUTH_CALLBACK_ERROR",
+        oauthError: "oauth_state_mismatch",
+        description: `State validation failed (${stateCheck.reason})`
+      }
+    };
+  }
+  const pkceRecovered = await adapter.storage.getItem(PKCE_STORAGE_KEY);
+  await adapter.storage.removeItem(PKCE_STORAGE_KEY).catch(() => void 0);
+  if (!pkceRecovered) {
+    return { ok: false, error: { code: "CODE_EXCHANGE_FAILED", message: "PKCE verifier missing" } };
+  }
+  let codeVerifier;
+  try {
+    const parsedPkce = JSON.parse(pkceRecovered);
+    if (typeof parsedPkce.codeVerifier !== "string") throw new TypeError("bad PKCE record");
+    codeVerifier = parsedPkce.codeVerifier;
+  } catch {
+    return { ok: false, error: { code: "CODE_EXCHANGE_FAILED", message: "PKCE record corrupted" } };
+  }
+  let dpopProof;
+  if (input.dpopSession) {
+    try {
+      dpopProof = await input.dpopSession.resolveProof("POST", input.tokenEndpoint);
+    } catch (e) {
+      return {
+        ok: false,
+        error: {
+          code: "CODE_EXCHANGE_FAILED",
+          message: `DPoP prover unavailable at issuance: ${e instanceof Error ? e.message : "signer threw"}`
+        }
+      };
+    }
+  }
+  const exchange = await sdkCore.exchangeAuthCode({
+    http,
+    tokenEndpoint: input.tokenEndpoint,
+    code: parsed.code,
+    codeVerifier,
+    redirectUri: input.redirectUri,
+    clientId: input.clientId,
+    ...dpopProof !== void 0 ? { dpopProof } : {}
+  });
+  if (!exchange.ok) return exchange;
+  if (input.dpopSession) {
+    await input.dpopSession.observeTokenType(exchange.tokens.token_type, dpopProof !== void 0);
+  }
+  return {
+    ok: true,
+    tokens: {
+      access_token: exchange.tokens.access_token,
+      refresh_token: exchange.tokens.refresh_token,
+      expires_in: exchange.tokens.expires_in,
+      token_type: exchange.tokens.token_type
+    }
+  };
+}
+function parseCallback(callbackUrl, expectedRedirectUri) {
+  const expected = matchSchemeAndHost(expectedRedirectUri);
+  const actual = matchSchemeAndHost(callbackUrl);
+  if (!expected || !actual || expected.scheme !== actual.scheme || expected.host !== actual.host) {
+    return {
+      ok: false,
+      error: {
+        code: "OAUTH_CALLBACK_ERROR",
+        oauthError: "oauth_redirect_mismatch",
+        description: "Callback redirect URI scheme/host changed mid-flow (confused-deputy guard)"
+      }
+    };
+  }
+  const queryStart = callbackUrl.indexOf("?");
+  const query = queryStart >= 0 ? callbackUrl.slice(queryStart + 1) : "";
+  const params = new URLSearchParams(query);
+  const error = params.get("error");
+  if (error) {
+    return {
+      ok: false,
+      error: sdkCore.parseOAuthCallbackError(error, params.get("error_description") ?? void 0)
+    };
+  }
+  const code = params.get("code");
+  const state = params.get("state");
+  if (!code || !state) {
+    return {
+      ok: false,
+      error: {
+        code: "OAUTH_CALLBACK_ERROR",
+        oauthError: "oauth_missing_params",
+        description: "Callback URL missing code or state"
+      }
+    };
+  }
+  return { ok: true, code, state };
+}
+function matchSchemeAndHost(url) {
+  const m = url.match(/^([a-z][a-z0-9+.-]*):\/\/([^/?#]*)/i);
+  if (!m) return null;
+  return { scheme: m[1].toLowerCase(), host: m[2].toLowerCase() };
+}
+function SignIn(props) {
+  const ctx = useRakomiContext();
+  const { View, Text, TextInput, Pressable } = loadRnPrimitives();
+  const [step, setStep] = react.useState({ kind: "methods" });
+  const [code, setCode] = react.useState("");
+  const [busy, setBusy] = react.useState(false);
+  const tokenEndpoint = props.tokenEndpoint ?? "/v1/auth/oauth/callback";
+  const authorizationEndpoint = props.authorizationEndpoint ?? "/oauth/authorize";
+  const totpVerifyEndpoint = props.totpVerifyEndpoint ?? "/v1/auth/mfa/totp/verify";
+  const providers = props.providers ?? ["google"];
+  async function onProviderPress(provider) {
+    if (busy) return;
+    setBusy(true);
+    ctx.events.push({ type: "sign_in_attempted", severity: "info", metadata: { provider } });
+    const outcome = await startSocialSignIn({
+      adapter: ctx.adapter,
+      http: ctx.http,
+      authorizationEndpoint,
+      tokenEndpoint,
+      clientId: ctx.publishableKey,
+      redirectUri: ctx.redirectUri,
+      provider,
+      ...ctx.dpopSession ? { dpopSession: ctx.dpopSession } : {}
+    });
+    if (outcome.ok) {
+      ctx.events.push({ type: "signed_in", severity: "info" });
+      setStep({ kind: "success" });
+    } else {
+      ctx.events.push({ type: "sign_in_failed", severity: "warning", error: outcome.error });
+      setStep({ kind: "error", error: outcome.error });
+    }
+    setBusy(false);
+  }
+  async function onTotpSubmit() {
+    if (busy || step.kind !== "awaiting_mfa") return;
+    setBusy(true);
+    const result = await sdkCore.verifyTotp({
+      http: ctx.http,
+      endpoint: totpVerifyEndpoint,
+      challengeToken: step.challengeToken,
+      code
+    });
+    if (result.ok) {
+      ctx.events.push({ type: "signed_in", severity: "info", metadata: { method: "mfa_totp" } });
+      setStep({ kind: "success" });
+    } else {
+      if (result.error.code === "SIGN_IN_FAILED" && /unavailable/i.test(result.error.message)) {
+        const e = new sdkCore.MfaStepUpUnavailableError(result.error.message);
+        ctx.events.push({ type: "sign_in_failed", severity: "warning", metadata: { reason: "mfa_step_up_unavailable", guidance: e.guidance } });
+      }
+      setStep({ kind: "error", error: result.error });
+    }
+    setBusy(false);
+  }
+  if (step.kind === "success") {
+    return /* @__PURE__ */ jsxRuntime.jsx(View, { style: props.style, accessibilityRole: "alert", children: /* @__PURE__ */ jsxRuntime.jsx(Text, { accessibilityLabel: ctx.translate("common.continue"), children: ctx.translate("common.continue") }) });
+  }
+  if (step.kind === "awaiting_mfa") {
+    return /* @__PURE__ */ jsxRuntime.jsxs(View, { style: props.style, children: [
+      /* @__PURE__ */ jsxRuntime.jsx(Text, { accessibilityRole: "header", children: ctx.translate("signin.mfa.title") }),
+      /* @__PURE__ */ jsxRuntime.jsx(
+        TextInput,
+        {
+          accessibilityLabel: ctx.translate("signin.mfa.code"),
+          accessibilityHint: ctx.translate("signin.mfa.code"),
+          keyboardType: "number-pad",
+          textContentType: "oneTimeCode",
+          autoComplete: "sms-otp",
+          maxLength: 6,
+          value: code,
+          onChangeText: (t) => setCode(t.replace(/\D/g, "").slice(0, 6))
+        }
+      ),
+      /* @__PURE__ */ jsxRuntime.jsx(
+        Pressable,
+        {
+          accessibilityRole: "button",
+          accessibilityLabel: ctx.translate("signin.mfa.submit"),
+          onPress: onTotpSubmit,
+          disabled: busy || code.length !== 6,
+          children: /* @__PURE__ */ jsxRuntime.jsx(Text, { children: ctx.translate("signin.mfa.submit") })
+        }
+      )
+    ] });
+  }
+  return /* @__PURE__ */ jsxRuntime.jsxs(View, { style: props.style, children: [
+    /* @__PURE__ */ jsxRuntime.jsx(Text, { accessibilityRole: "header", children: props.title ?? ctx.translate("signin.title") }),
+    providers.map((provider) => /* @__PURE__ */ jsxRuntime.jsx(
+      Pressable,
+      {
+        accessibilityRole: "button",
+        accessibilityLabel: `Sign in with ${provider}`,
+        onPress: () => onProviderPress(provider),
+        disabled: busy,
+        children: /* @__PURE__ */ jsxRuntime.jsxs(Text, { children: [
+          "Sign in with ",
+          provider
+        ] })
+      },
+      provider
+    )),
+    step.kind === "error" ? /* @__PURE__ */ jsxRuntime.jsx(Text, { accessibilityRole: "alert", accessibilityLabel: ctx.translate("common.error.unknown"), children: "description" in step.error ? step.error.description : "message" in step.error ? step.error.message : ctx.translate("common.error.unknown") }) : null
+  ] });
+}
+function SignUp(props) {
+  const ctx = useRakomiContext();
+  const { View, Text, TextInput, Pressable } = loadRnPrimitives();
+  const [email, setEmail] = react.useState("");
+  const [password, setPassword] = react.useState("");
+  const [busy, setBusy] = react.useState(false);
+  const [step, setStep] = react.useState({ kind: "form" });
+  const strength = password ? sdkCore.scorePassword(password) : null;
+  const returnTo = props.returnTo && sdkCore.isSafeUrl(props.returnTo, ["http", "https", "rakomi"]) ? props.returnTo : void 0;
+  async function onSubmit() {
+    if (busy) return;
+    setBusy(true);
+    ctx.events.push({ type: "sign_in_attempted", severity: "info", metadata: { mode: "register" } });
+    try {
+      const response = await ctx.http.fetch(props.registerEndpoint ?? "/v1/auth/register", {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Accept: "application/json" },
+        body: JSON.stringify({ email, password, returnTo })
+      });
+      if (!response.ok) {
+        setStep({ kind: "error", error: { code: "SIGN_IN_FAILED", message: `Register failed (${response.status})` } });
+      } else {
+        setStep({ kind: "verification_required" });
+      }
+    } catch (err2) {
+      setStep({ kind: "error", error: { code: "NETWORK_ERROR", message: err2 instanceof Error ? err2.message : "network" } });
+    } finally {
+      setBusy(false);
+    }
+  }
+  if (step.kind === "verification_required") {
+    return /* @__PURE__ */ jsxRuntime.jsxs(View, { style: props.style, accessibilityRole: "alert", children: [
+      /* @__PURE__ */ jsxRuntime.jsx(Text, { children: ctx.translate("signup.title") }),
+      /* @__PURE__ */ jsxRuntime.jsx(Text, { children: ctx.translate("common.continue") })
+    ] });
+  }
+  return /* @__PURE__ */ jsxRuntime.jsxs(View, { style: props.style, children: [
+    /* @__PURE__ */ jsxRuntime.jsx(Text, { accessibilityRole: "header", children: ctx.translate("signup.title") }),
+    /* @__PURE__ */ jsxRuntime.jsx(
+      TextInput,
+      {
+        accessibilityLabel: ctx.translate("signup.email"),
+        keyboardType: "email-address",
+        textContentType: "emailAddress",
+        autoComplete: "email",
+        autoCapitalize: "none",
+        value: email,
+        onChangeText: setEmail
+      }
+    ),
+    /* @__PURE__ */ jsxRuntime.jsx(
+      TextInput,
+      {
+        accessibilityLabel: ctx.translate("signup.password"),
+        secureTextEntry: true,
+        textContentType: "newPassword",
+        autoComplete: "password-new",
+        value: password,
+        onChangeText: setPassword
+      }
+    ),
+    strength ? /* @__PURE__ */ jsxRuntime.jsxs(Text, { accessibilityLabel: `Password strength: ${strength}`, children: [
+      "Strength: ",
+      strength
+    ] }) : null,
+    /* @__PURE__ */ jsxRuntime.jsx(
+      Pressable,
+      {
+        accessibilityRole: "button",
+        accessibilityLabel: ctx.translate("signup.submit"),
+        onPress: onSubmit,
+        disabled: busy || !email || !password,
+        children: /* @__PURE__ */ jsxRuntime.jsx(Text, { children: ctx.translate("signup.submit") })
+      }
+    ),
+    step.kind === "error" ? /* @__PURE__ */ jsxRuntime.jsx(Text, { accessibilityRole: "alert", children: "message" in step.error ? step.error.message : ctx.translate("common.error.unknown") }) : null
+  ] });
+}
+function UserButton(props) {
+  const ctx = useRakomiContext();
+  const { View, Text, Pressable } = loadRnPrimitives();
+  const [expanded, setExpanded] = react.useState(false);
+  const user = ctx.user;
+  if (!user) return null;
+  const initials = (user.email || "?").slice(0, 2).toUpperCase();
+  return /* @__PURE__ */ jsxRuntime.jsxs(View, { style: props.style, children: [
+    /* @__PURE__ */ jsxRuntime.jsx(
+      Pressable,
+      {
+        accessibilityRole: "button",
+        accessibilityLabel: `Account menu for ${user.email}`,
+        onPress: () => setExpanded((v) => !v),
+        children: /* @__PURE__ */ jsxRuntime.jsxs(View, { children: [
+          /* @__PURE__ */ jsxRuntime.jsx(Text, { accessibilityLabel: `Avatar ${initials}`, children: initials }),
+          props.showName !== false ? /* @__PURE__ */ jsxRuntime.jsx(Text, { children: user.email }) : null
+        ] })
+      }
+    ),
+    expanded ? /* @__PURE__ */ jsxRuntime.jsx(View, { accessibilityRole: "menu", children: /* @__PURE__ */ jsxRuntime.jsx(
+      Pressable,
+      {
+        accessibilityRole: "menuitem",
+        accessibilityLabel: "Sign out",
+        onPress: () => {
+          setExpanded(false);
+          void ctx.signOut();
+        },
+        children: /* @__PURE__ */ jsxRuntime.jsx(Text, { children: "Sign out" })
+      }
+    ) }) : null
+  ] });
+}
+function UserProfile(props) {
+  react.useEffect(() => {
+    if (typeof __DEV__ !== "undefined" && __DEV__) {
+      console.warn("[@rakomi/react-native] <UserProfile /> is in preview until 0.2.0 \u2014 feedback welcome.");
+    }
+  }, []);
+  const ctx = useRakomiContext();
+  const { View, Text } = loadRnPrimitives();
+  const user = ctx.user;
+  if (!user) {
+    return /* @__PURE__ */ jsxRuntime.jsx(View, { style: props.style, children: /* @__PURE__ */ jsxRuntime.jsx(Text, { children: "Not signed in" }) });
+  }
+  return /* @__PURE__ */ jsxRuntime.jsxs(View, { style: props.style, accessibilityRole: "summary", children: [
+    /* @__PURE__ */ jsxRuntime.jsx(Text, { accessibilityRole: "header", children: user.email || "Anonymous user" }),
+    /* @__PURE__ */ jsxRuntime.jsxs(Text, { children: [
+      "ID: ",
+      user.id
+    ] }),
+    /* @__PURE__ */ jsxRuntime.jsxs(Text, { children: [
+      "Tenant: ",
+      user.tenantId
+    ] }),
+    user.roles.length > 0 ? /* @__PURE__ */ jsxRuntime.jsxs(Text, { children: [
+      "Roles: ",
+      user.roles.join(", ")
+    ] }) : null,
+    user.permissions.length > 0 ? /* @__PURE__ */ jsxRuntime.jsxs(Text, { children: [
+      "Permissions: ",
+      user.permissions.length
+    ] }) : null,
+    user.mfaVerified ? /* @__PURE__ */ jsxRuntime.jsx(Text, { accessibilityLabel: "MFA verified", children: "MFA: verified" }) : null
+  ] });
+}
+
+// src/native/dpop-prover.ts
+function createNativeDpopProver(options) {
+  const mod = options.module;
+  return {
+    async createProof(input) {
+      const proof = await mod.createDpopProof(input.htm, input.htu, input.nonce ?? null);
+      if (typeof proof !== "string" || proof.length === 0) {
+        throw new Error("native DPoP signer returned an empty proof");
+      }
+      return proof;
+    },
+    async jktHint() {
+      return mod.dpopJktThumbprint();
+    }
+  };
+}
+
+// src/native/passkey-envelope.ts
+var BASE64URL = /^[A-Za-z0-9_-]+$/;
+var RULES = {
+  registration: {
+    required: ["id", "rawId", "response.clientDataJSON", "response.attestationObject"],
+    base64url: ["id", "rawId", "response.clientDataJSON", "response.attestationObject"],
+    requiredStringArray: ["response.transports"],
+    requiredObject: ["clientExtensionResults"],
+    keep: ["id", "rawId", "type", "authenticatorAttachment", "clientExtensionResults"],
+    keepInResponse: [
+      "clientDataJSON",
+      "attestationObject",
+      "authenticatorData",
+      "publicKey",
+      "publicKeyAlgorithm"
+    ],
+    keepStringArrayInResponse: ["transports"]
+  },
+  assertion: {
+    required: [
+      "id",
+      "rawId",
+      "response.clientDataJSON",
+      "response.authenticatorData",
+      "response.signature"
+    ],
+    base64url: [
+      "id",
+      "rawId",
+      "response.clientDataJSON",
+      "response.authenticatorData",
+      "response.signature",
+      "response.userHandle"
+    ],
+    requiredStringArray: [],
+    requiredObject: ["clientExtensionResults"],
+    keep: ["id", "rawId", "type", "authenticatorAttachment", "clientExtensionResults"],
+    keepInResponse: ["clientDataJSON", "authenticatorData", "signature", "userHandle"],
+    keepStringArrayInResponse: []
+  }
+};
+var CredentialEnvelopeError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "CredentialEnvelopeError";
+  }
+};
+function isRecord(value) {
+  return typeof value === "object" && value !== null;
+}
+function readPath(envelope, path) {
+  const dot = path.indexOf(".");
+  if (dot === -1) return envelope[path];
+  const parent = envelope[path.slice(0, dot)];
+  return isRecord(parent) ? parent[path.slice(dot + 1)] : void 0;
+}
+function assertW3cCredentialEnvelope(kind, parsed) {
+  if (!isRecord(parsed)) {
+    throw new CredentialEnvelopeError(
+      `the native module returned a ${parsed === null ? "null" : typeof parsed}; the contract is a JSON object`
+    );
+  }
+  if (parsed["type"] !== "public-key") {
+    throw new CredentialEnvelopeError(`'type' must be the string "public-key" (W3C WebAuthn L3)`);
+  }
+  if (!isRecord(parsed["response"])) {
+    throw new CredentialEnvelopeError(`'response' is missing or is not an object`);
+  }
+  const rule = RULES[kind];
+  for (const path of rule.required) {
+    const value = readPath(parsed, path);
+    if (typeof value !== "string" || value.length === 0) {
+      throw new CredentialEnvelopeError(
+        `'${path}' is required on a ${kind} response and must be a non-empty string (W3C WebAuthn L3 JSON serialization)`
+      );
+    }
+  }
+  for (const path of rule.requiredStringArray) {
+    const value = readPath(parsed, path);
+    if (!Array.isArray(value) || value.some((entry) => typeof entry !== "string")) {
+      throw new CredentialEnvelopeError(
+        `'${path}' is required on a ${kind} response and must be an array of strings (W3C WebAuthn L3). The server stores it and replays it into allowCredentials \u2014 omitting it silently breaks cross-device sign-in later, on another device.`
+      );
+    }
+  }
+  for (const path of rule.requiredObject) {
+    const value = readPath(parsed, path);
+    if (!isRecord(value)) {
+      throw new CredentialEnvelopeError(
+        `'${path}' is required on a ${kind} response and must be an object (an empty object is fine)`
+      );
+    }
+  }
+  for (const path of rule.base64url) {
+    const value = readPath(parsed, path);
+    if (value === void 0 || value === null) continue;
+    if (typeof value !== "string" || !BASE64URL.test(value)) {
+      throw new CredentialEnvelopeError(
+        `'${path}' is not unpadded base64url (RFC 4648 \xA75). On iOS, Data.base64EncodedString() emits standard base64 (RFC 4648 \xA74, with '+', '/' and '=' padding) \u2014 use the URL-safe, unpadded variant.`
+      );
+    }
+  }
+}
+function sanitizeCredentialEnvelope(kind, parsed) {
+  assertW3cCredentialEnvelope(kind, parsed);
+  const envelope = parsed;
+  const source = envelope["response"];
+  const rule = RULES[kind];
+  const response = /* @__PURE__ */ Object.create(null);
+  for (const key of rule.keepInResponse) {
+    const value = source[key];
+    if (typeof value === "string" || typeof value === "number") response[key] = value;
+  }
+  for (const key of rule.keepStringArrayInResponse) {
+    const value = source[key];
+    if (Array.isArray(value)) response[key] = value.filter((entry) => typeof entry === "string");
+  }
+  const projected = /* @__PURE__ */ Object.create(null);
+  for (const key of rule.keep) {
+    const value = envelope[key];
+    if (value !== void 0) projected[key] = value;
+  }
+  projected["response"] = response;
+  return projected;
+}
+
+// src/native/passkey-adapter.ts
+var NATIVE_CODE_TO_KIND = Object.assign(/* @__PURE__ */ Object.create(null), {
+  PASSKEY_CANCELLED: "cancelled",
+  PASSKEY_UNSUPPORTED: "unsupported",
+  PASSKEY_NO_CREDENTIAL: "cancelled"
+});
+function isRecord2(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeNativeRejection(err2) {
+  const code = isRecord2(err2) ? err2["code"] : void 0;
+  if (typeof code === "string") {
+    const kind = NATIVE_CODE_TO_KIND[code];
+    if (kind !== void 0) {
+      throw new sdkCore.PasskeyCeremonyError(kind);
+    }
+  }
+  throw err2;
+}
+function assertNever(value) {
+  throw new sdkCore.PasskeyCeremonyError("failed", `unhandled ceremony-error kind: ${String(value)}`);
+}
+function describeKind(kind) {
+  switch (kind) {
+    case "cancelled":
+      return "the user dismissed the passkey sheet";
+    case "unsupported":
+      return "this platform cannot run a passkey ceremony";
+    case "failed":
+      return "the passkey ceremony failed";
+    default:
+      return assertNever(kind);
+  }
+}
+function createNativePasskeyAdapter(options) {
+  const mod = options.module;
+  let inFlight = null;
+  const candidate = mod;
+  const missing = ["isPasskeySupported", "createPasskey", "getPasskey"].filter(
+    (method) => typeof candidate?.[method] !== "function"
+  );
+  if (missing.length > 0) {
+    throw new Error(
+      `native passkey module is missing: ${missing.join(", ")} \u2014 it does not satisfy NativePasskeyModuleSpec`
+    );
+  }
+  async function runCeremony(kind, requestJson, ceremonyOptions) {
+    const signal = ceremonyOptions?.signal;
+    if (signal?.aborted === true) {
+      throw new sdkCore.PasskeyCeremonyError("cancelled", describeKind("cancelled"));
+    }
+    const ticket = /* @__PURE__ */ Symbol("passkey-ceremony");
+    inFlight = ticket;
+    const onAbort = () => {
+      if (inFlight !== ticket) return;
+      try {
+        void Promise.resolve(mod.cancelPasskeyRequest?.()).catch(() => void 0);
+      } catch {
+      }
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
+    let raw;
+    try {
+      raw = await (kind === "registration" ? mod.createPasskey(requestJson) : mod.getPasskey(requestJson));
+    } catch (err2) {
+      normalizeNativeRejection(err2);
+    } finally {
+      signal?.removeEventListener("abort", onAbort);
+      if (inFlight === ticket) inFlight = null;
+    }
+    if (typeof raw !== "string") {
+      throw new CredentialEnvelopeError(
+        `the native module returned ${raw === null ? "null" : `a ${typeof raw}`}; the contract is a JSON string \u2014 wrap a module with an object API so it stringifies its argument and its result`
+      );
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(raw);
+    } catch {
+      throw new CredentialEnvelopeError(
+        "the native module returned a string that is not valid JSON (a double-encoded response does this)"
+      );
+    }
+    return sanitizeCredentialEnvelope(kind, parsed);
+  }
+  async function ceremonyOrMalformed(kind, requestJson, ceremonyOptions) {
+    try {
+      return await runCeremony(kind, requestJson, ceremonyOptions);
+    } catch (err2) {
+      if (err2 instanceof CredentialEnvelopeError) {
+        return { rakomiEnvelopeViolation: err2.message };
+      }
+      throw err2;
+    }
+  }
+  return {
+    async isSupported() {
+      try {
+        return await mod.isPasskeySupported() === true;
+      } catch {
+        return false;
+      }
+    },
+    hasPlatformAuthenticator() {
+      return probePlatformAuthenticator(mod);
+    },
+    createCredential(creationOptions, ceremonyOptions) {
+      return ceremonyOrMalformed(
+        "registration",
+        JSON.stringify(creationOptions),
+        ceremonyOptions
+      );
+    },
+    getCredential(requestOptions, ceremonyOptions) {
+      return ceremonyOrMalformed(
+        "assertion",
+        JSON.stringify(requestOptions),
+        ceremonyOptions
+      );
+    }
+  };
+}
+async function probePlatformAuthenticator(mod) {
+  if (typeof mod.isPlatformAuthenticatorAvailable !== "function") return null;
+  try {
+    const available = await mod.isPlatformAuthenticatorAvailable();
+    return typeof available === "boolean" ? available : null;
+  } catch {
+    return null;
+  }
+}
+
+// src/internal/webhook-verify.ts
+var RKSEC_PREFIX = "rksec_";
+var EXPECTED_KEY_LENGTH = 32;
+var DEFAULT_WEBHOOK_TOLERANCE = 300;
+var MAX_WEBHOOK_TOLERANCE = 600;
+function getHeader(headers, name) {
+  const lower = name.toLowerCase();
+  for (const key of Object.keys(headers)) {
+    if (key.toLowerCase() === lower) {
+      const value = headers[key];
+      const v = Array.isArray(value) ? value[0] : value;
+      return v?.trim();
+    }
+  }
+  return void 0;
+}
+function base64ToBytes(input, urlSafe) {
+  try {
+    let s = urlSafe ? input.replace(/-/g, "+").replace(/_/g, "/") : input;
+    const pad = s.length % 4;
+    if (pad) s += "=".repeat(4 - pad);
+    const bin = atob(s);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++) out[i] = bin.charCodeAt(i);
+    return out;
+  } catch {
+    return null;
+  }
+}
+function deriveKey(secret) {
+  const encoded = secret.startsWith(RKSEC_PREFIX) ? secret.slice(RKSEC_PREFIX.length) : secret;
+  const key = base64ToBytes(encoded, true);
+  if (!key || key.length !== EXPECTED_KEY_LENGTH) return null;
+  return key;
+}
+function timingSafeEqual(a, b) {
+  let diff = a.length ^ b.length;
+  const len = Math.min(a.length, b.length);
+  for (let i = 0; i < len; i++) diff |= a[i] ^ b[i];
+  return diff === 0;
+}
+function toArrayBuffer(u) {
+  const out = new ArrayBuffer(u.byteLength);
+  new Uint8Array(out).set(u);
+  return out;
+}
+async function hmacSha256(key, data) {
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle) {
+    throw new Error("WebCrypto subtle is unavailable \u2014 a crypto polyfill (e.g. expo-crypto) is required");
+  }
+  const cryptoKey = await subtle.importKey(
+    "raw",
+    toArrayBuffer(key),
+    { name: "HMAC", hash: "SHA-256" },
+    false,
+    ["sign"]
+  );
+  const sig = await subtle.sign("HMAC", cryptoKey, toArrayBuffer(data));
+  return new Uint8Array(sig);
+}
+function toBytes(body) {
+  return typeof body === "string" ? new TextEncoder().encode(body) : body;
+}
+function bytesToUtf8(body) {
+  return typeof body === "string" ? body : new TextDecoder("utf-8", { fatal: false }).decode(body);
+}
+async function verifyWebhook(body, headers, secret, tolerance = DEFAULT_WEBHOOK_TOLERANCE) {
+  const signature = getHeader(headers, "webhook-signature");
+  const timestampStr = getHeader(headers, "webhook-timestamp");
+  const webhookId = getHeader(headers, "webhook-id");
+  if (!signature || !timestampStr || !webhookId) {
+    return { ok: false, error: "missing_header" };
+  }
+  if (!/^-?\d+$/.test(timestampStr)) {
+    return { ok: false, error: "missing_header" };
+  }
+  const timestamp = parseInt(timestampStr, 10);
+  const now = Math.floor(Date.now() / 1e3);
+  const diff = now - timestamp;
+  if (diff > tolerance) return { ok: false, error: "timestamp_too_old" };
+  if (diff < -tolerance) return { ok: false, error: "timestamp_too_new" };
+  const key = deriveKey(secret);
+  if (!key) return { ok: false, error: "invalid_secret" };
+  const bodyString = bytesToUtf8(body);
+  const signedContent = `${webhookId}.${timestampStr}.${bodyString}`;
+  const expected = await hmacSha256(key, toBytes(signedContent));
+  let matched = false;
+  for (const raw of signature.split(" ")) {
+    const entry = raw.trim();
+    if (!entry.startsWith("v1,")) continue;
+    const candidate = base64ToBytes(entry.slice(3), false);
+    if (!candidate || candidate.length !== EXPECTED_KEY_LENGTH) continue;
+    if (timingSafeEqual(expected, candidate)) {
+      matched = true;
+      break;
+    }
+  }
+  if (!matched) return { ok: false, error: "invalid_signature" };
+  let payload;
+  try {
+    payload = JSON.parse(bodyString);
+    if (typeof payload !== "object" || payload === null) return { ok: false, error: "invalid_body" };
+  } catch {
+    return { ok: false, error: "invalid_body" };
+  }
+  const deliveryId = getHeader(headers, "x-rakomi-delivery-id") ?? webhookId;
+  const eventType = getHeader(headers, "x-rakomi-event") ?? "";
+  return { ok: true, data: { webhookId, deliveryId, eventType, timestamp, payload } };
+}
+async function verifyPublisherWebhook(body, headers, secret, tolerance = DEFAULT_WEBHOOK_TOLERANCE) {
+  if (!secret.startsWith(RKSEC_PREFIX)) return { ok: false, error: "invalid_secret" };
+  const clamped = Math.min(Math.max(0, tolerance), MAX_WEBHOOK_TOLERANCE);
+  return verifyWebhook(body, headers, secret, clamped);
+}
+var CEREMONY_ACTIONS = /* @__PURE__ */ new Set(["signIn", "register", "stepUp"]);
+function platformProbe(adapter) {
+  const candidate = adapter.hasPlatformAuthenticator;
+  return typeof candidate === "function" ? candidate.bind(adapter) : void 0;
+}
+function sessionIdentity(token) {
+  const payload = sdkCore.decodeJwtPayload(token);
+  if (payload === null) return null;
+  const subject = payload["sub"];
+  const session = payload["sid"];
+  if (typeof subject !== "string" || !subject) return null;
+  if (typeof session !== "string" || !session) return null;
+  return { subject, session };
+}
+var notSupported = () => sdkCore.passkeyError(
+  "PASSKEY_NOT_SUPPORTED",
+  "no passkey ceremony adapter is wired: pass one on `nativeAdapter.passkeys` (see createNativePasskeyAdapter)"
+);
+function usePasskeys(options = {}) {
+  const ctx = useRakomiContext();
+  const {
+    adapter: nativeAdapter,
+    http,
+    baseUrl,
+    publishableKey,
+    getToken,
+    beginAuthFlow,
+    submitOAuthTokens,
+    passkeyCeremonyLock
+  } = ctx;
+  const [isSupported, setIsSupported] = react.useState(null);
+  const [hasPlatformAuthenticator, setHasPlatformAuthenticator] = react.useState(null);
+  const [passkeys, setPasskeys] = react.useState(void 0);
+  const [error, setError] = react.useState(null);
+  const [isSigningIn, setIsSigningIn] = react.useState(false);
+  const [isRegistering, setIsRegistering] = react.useState(false);
+  const [isSteppingUp, setIsSteppingUp] = react.useState(false);
+  const [isLoading, setIsLoading] = react.useState(false);
+  const [isMutating, setIsMutating] = react.useState(false);
+  const adapter = options.adapter ?? nativeAdapter.passkeys;
+  const mountedRef = react.useRef(true);
+  const busyRef = react.useRef({
+    signIn: false,
+    register: false,
+    stepUp: false,
+    list: false,
+    mutate: false
+  });
+  const inFlightRef = react.useRef(/* @__PURE__ */ new Set());
+  react.useEffect(() => {
+    mountedRef.current = true;
+    const inFlight = inFlightRef.current;
+    return () => {
+      mountedRef.current = false;
+      for (const controller of inFlight) controller.abort();
+      inFlight.clear();
+    };
+  }, []);
+  react.useEffect(() => {
+    if (adapter === void 0) {
+      setIsSupported(false);
+      setHasPlatformAuthenticator(null);
+      return;
+    }
+    let cancelled = false;
+    void (async () => {
+      const [supported, platform] = await Promise.all([
+        Promise.resolve(adapter.isSupported()).catch(() => false),
+        Promise.resolve(platformProbe(adapter)?.() ?? null).catch(() => null)
+      ]);
+      if (cancelled || !mountedRef.current) return;
+      setIsSupported(supported === true);
+      setHasPlatformAuthenticator(typeof platform === "boolean" ? platform : null);
+    })();
+    return () => {
+      cancelled = true;
+    };
+  }, [adapter]);
+  const setBusy = react.useCallback((key, value) => {
+    busyRef.current[key] = value;
+    if (key === "signIn") setIsSigningIn(value);
+    else if (key === "register") setIsRegistering(value);
+    else if (key === "stepUp") setIsSteppingUp(value);
+    else if (key === "list") setIsLoading(value);
+    else setIsMutating(value);
+  }, []);
+  const requireSession = react.useCallback(async () => {
+    const expired = () => sdkCore.passkeyError("PASSKEY_SESSION_EXPIRED", "you must be signed in to manage passkeys");
+    const token = await getToken();
+    if (!token.ok) {
+      const err2 = token.error;
+      if (err2.code === "NETWORK_ERROR" || err2.code === "REFRESH_FAILED" && err2.reason === "network") {
+        return sdkCore.passkeyError("PASSKEY_NETWORK_ERROR", err2.message);
+      }
+      return expired();
+    }
+    const user = sdkCore.decodeUser(token.token);
+    if (user === null) return expired();
+    return { accessToken: token.token, userId: user.id };
+  }, [getToken]);
+  const runAction = react.useCallback(
+    async (key, guarded, run, onSuccess) => {
+      const refuse = (result) => {
+        if (!result.ok && mountedRef.current) setError(result.error);
+        return result;
+      };
+      if (busyRef.current[key]) return refuse(guarded);
+      const isCeremony = CEREMONY_ACTIONS.has(key);
+      if (isCeremony && !passkeyCeremonyLock.tryAcquire()) return refuse(guarded);
+      setBusy(key, true);
+      setError(null);
+      const controller = new AbortController();
+      inFlightRef.current.add(controller);
+      try {
+        const result = await run(controller.signal);
+        if (!result.ok && mountedRef.current) setError(result.error);
+        if (result.ok && mountedRef.current) onSuccess?.(result);
+        return result;
+      } finally {
+        inFlightRef.current.delete(controller);
+        busyRef.current[key] = false;
+        if (isCeremony) passkeyCeremonyLock.release();
+        if (mountedRef.current) setBusy(key, false);
+      }
+    },
+    [passkeyCeremonyLock, setBusy]
+  );
+  const busyResult = react.useCallback(
+    (action) => ({
+      ok: false,
+      error: sdkCore.passkeyError("PASSKEY_INVALID_INPUT", `a passkey ${action} is already in progress`)
+    }),
+    []
+  );
+  const unsupported = react.useCallback(() => {
+    const result = { ok: false, error: notSupported() };
+    if (mountedRef.current) setError(result.error);
+    return Promise.resolve(result);
+  }, []);
+  const sessionFailure = (session) => !("accessToken" in session);
+  const signInWithPasskey = react.useCallback(
+    (input = {}) => {
+      if (adapter === void 0) return unsupported();
+      return runAction("signIn", busyResult("sign-in"), async (signal) => {
+        const result = await sdkCore.assertPasskey({
+          http,
+          baseUrl,
+          clientId: publishableKey,
+          adapter,
+          ...input.userHandle === void 0 ? {} : { userHandle: input.userHandle },
+          signal
+        });
+        if (!result.ok) return result;
+        const failed = (message) => ({
+          ok: false,
+          error: sdkCore.passkeyError("PASSKEY_REQUEST_FAILED", message)
+        });
+        let nonce;
+        try {
+          nonce = await beginAuthFlow();
+        } catch (err2) {
+          return failed(
+            `the passkey was accepted but the session could not be started: ${err2 instanceof Error ? err2.message : "unknown error"}`
+          );
+        }
+        const tokens = result.tokens;
+        if (nativeAdapter.dpopProver !== void 0 && tokens.token_type !== "DPoP") {
+          return failed(
+            "the passkey was accepted but the session was refused: this app is configured for sender-constrained (DPoP) sessions, and the passkey sign-in returned an unbound bearer session. Storing it would silently downgrade the app\u2019s security posture."
+          );
+        }
+        try {
+          await submitOAuthTokens(tokens, nonce);
+        } catch (err2) {
+          return failed(
+            `the passkey was accepted but the session could not be stored: ${err2 instanceof Error ? err2.message : "unknown error"}`
+          );
+        }
+        const confirmed = await getToken();
+        if (!confirmed.ok) {
+          return failed(
+            "the passkey was accepted but the session was not established (the token submission was rejected)"
+          );
+        }
+        const submitted = sessionIdentity(tokens.access_token);
+        const live = sessionIdentity(confirmed.token);
+        if (submitted === null || live === null) {
+          if (confirmed.token !== tokens.access_token) {
+            return failed("the passkey was accepted but the resulting session token could not be read");
+          }
+          return result;
+        }
+        if (live.subject !== submitted.subject || live.session !== submitted.session) {
+          return failed(
+            "the passkey was accepted but the session was not established (the token submission was rejected)"
+          );
+        }
+        return result;
+      });
+    },
+    [
+      adapter,
+      baseUrl,
+      beginAuthFlow,
+      busyResult,
+      getToken,
+      http,
+      publishableKey,
+      runAction,
+      submitOAuthTokens,
+      unsupported
+    ]
+  );
+  const stepUpWithPasskey = react.useCallback(() => {
+    if (adapter === void 0) return unsupported();
+    return runAction("stepUp", busyResult("step-up"), async (signal) => {
+      const session = await requireSession();
+      if (sessionFailure(session)) return { ok: false, error: session };
+      return sdkCore.stepUpWithPasskey({
+        http,
+        baseUrl,
+        clientId: publishableKey,
+        accessToken: session.accessToken,
+        adapter,
+        signal
+      });
+    });
+  }, [adapter, baseUrl, busyResult, http, publishableKey, requireSession, runAction, unsupported]);
+  const registerPasskey = react.useCallback(
+    (input) => {
+      if (adapter === void 0) return unsupported();
+      return runAction("register", busyResult("registration"), async (signal) => {
+        const session = await requireSession();
+        if (sessionFailure(session)) return { ok: false, error: session };
+        return sdkCore.registerPasskey({
+          http,
+          baseUrl,
+          clientId: publishableKey,
+          accessToken: session.accessToken,
+          stepUpToken: input.stepUpToken,
+          adapter,
+          ...input.nickname === void 0 ? {} : { nickname: input.nickname },
+          signal
+        });
+      });
+    },
+    [adapter, baseUrl, busyResult, http, publishableKey, requireSession, runAction, unsupported]
+  );
+  const listPasskeys = react.useCallback(
+    (input) => runAction(
+      "list",
+      busyResult("list"),
+      async (signal) => {
+        const session = await requireSession();
+        if (sessionFailure(session)) return { ok: false, error: session };
+        return sdkCore.listPasskeys({
+          http,
+          baseUrl,
+          clientId: publishableKey,
+          accessToken: session.accessToken,
+          stepUpToken: input.stepUpToken,
+          userId: session.userId,
+          signal
+        });
+      },
+      (result) => {
+        if (result.ok) setPasskeys(result.data);
+      }
+    ),
+    [baseUrl, busyResult, http, publishableKey, requireSession, runAction]
+  );
+  const renamePasskey = react.useCallback(
+    (input) => runAction(
+      "mutate",
+      busyResult("mutation"),
+      async (signal) => {
+        const session = await requireSession();
+        if (sessionFailure(session)) return { ok: false, error: session };
+        return sdkCore.renamePasskey({
+          http,
+          baseUrl,
+          clientId: publishableKey,
+          accessToken: session.accessToken,
+          stepUpToken: input.stepUpToken,
+          userId: session.userId,
+          passkeyId: input.passkeyId,
+          nickname: input.nickname,
+          signal
+        });
+      },
+      (result) => {
+        if (!result.ok) return;
+        setPasskeys(
+          (current) => current?.map((passkey) => passkey.id === result.passkey.id ? result.passkey : passkey)
+        );
+      }
+    ),
+    [baseUrl, busyResult, http, publishableKey, requireSession, runAction]
+  );
+  const deletePasskey = react.useCallback(
+    (input) => runAction(
+      "mutate",
+      busyResult("mutation"),
+      async (signal) => {
+        const session = await requireSession();
+        if (sessionFailure(session)) return { ok: false, error: session };
+        return sdkCore.deletePasskey({
+          http,
+          baseUrl,
+          clientId: publishableKey,
+          accessToken: session.accessToken,
+          stepUpToken: input.stepUpToken,
+          userId: session.userId,
+          passkeyId: input.passkeyId,
+          signal
+        });
+      },
+      (result) => {
+        if (result.ok) {
+          setPasskeys((current) => current?.filter((passkey) => passkey.id !== input.passkeyId));
+        }
+      }
+    ),
+    [baseUrl, busyResult, http, publishableKey, requireSession, runAction]
+  );
+  return {
+    isSupported,
+    hasPlatformAuthenticator,
+    passkeys,
+    error,
+    isSigningIn,
+    isRegistering,
+    isSteppingUp,
+    isLoading,
+    isMutating,
+    signInWithPasskey,
+    stepUpWithPasskey,
+    registerPasskey,
+    listPasskeys,
+    renamePasskey,
+    deletePasskey
+  };
+}
+
+// src/hooks/use-submit-oauth-tokens.ts
+function useSubmitOAuthTokens() {
+  const ctx = useRakomiContext();
+  return async (tokens) => {
+    const nonce = await ctx.beginAuthFlow();
+    await ctx.submitOAuthTokens(tokens, nonce);
+  };
+}
+function useMagicLink() {
+  const ctx = useRakomiContext();
+  return {
+    request: async (email) => {
+      ctx.events.push({ type: "sign_in_attempted", severity: "info", metadata: { method: "magic_link" } });
+      return sdkCore.requestMagicLink({ http: ctx.http, baseUrl: ctx.baseUrl, clientId: ctx.publishableKey, email });
+    },
+    verify: async (token) => {
+      const result = await sdkCore.verifyMagicLink({ http: ctx.http, baseUrl: ctx.baseUrl, clientId: ctx.publishableKey, token });
+      if (result.ok && "tokens" in result) {
+        const nonce = await ctx.beginAuthFlow();
+        await ctx.submitOAuthTokens(result.tokens, nonce);
+      } else if (!result.ok && "error" in result) {
+        emitError(ctx.events, result.error);
+      }
+      return result;
+    }
+  };
+}
+function useEmailOtp() {
+  const ctx = useRakomiContext();
+  return {
+    request: async (email, mode) => {
+      ctx.events.push({ type: "sign_in_attempted", severity: "info", metadata: { method: "email_otp", mode } });
+      return sdkCore.requestEmailOtp({ http: ctx.http, baseUrl: ctx.baseUrl, clientId: ctx.publishableKey, email, mode });
+    },
+    verify: async (email, code) => {
+      const result = await sdkCore.verifyEmailOtp({ http: ctx.http, baseUrl: ctx.baseUrl, clientId: ctx.publishableKey, email, code });
+      if (result.ok && "tokens" in result) {
+        const nonce = await ctx.beginAuthFlow();
+        await ctx.submitOAuthTokens(result.tokens, nonce);
+      } else if (!result.ok && "error" in result) {
+        emitError(ctx.events, result.error);
+      }
+      return result;
+    }
+  };
+}
+function useRegister() {
+  const ctx = useRakomiContext();
+  return {
+    register: async (email, password) => {
+      ctx.events.push({ type: "sign_in_attempted", severity: "info", metadata: { method: "register" } });
+      return sdkCore.register({ http: ctx.http, baseUrl: ctx.baseUrl, clientId: ctx.publishableKey, email, password });
+    }
+  };
+}
+function emitError(events, error) {
+  events.push({ type: "sign_in_failed", severity: "warning", error });
+}
+function useMfa() {
+  const ctx = useRakomiContext();
+  return {
+    verifyTotp: async (challengeToken, code, endpoint) => {
+      const url = endpoint ?? `${ctx.baseUrl}/v1/auth/mfa/totp/verify`;
+      const result = await sdkCore.verifyTotp({ http: ctx.http, endpoint: url, challengeToken, code });
+      if (result.ok) {
+        const nonce = await ctx.beginAuthFlow();
+        await ctx.submitOAuthTokens({
+          access_token: result.tokens.access_token,
+          token_type: result.tokens.token_type,
+          expires_in: result.tokens.expires_in,
+          refresh_token: result.tokens.refresh_token
+        }, nonce);
+        ctx.events.push({ type: "signed_in", severity: "info", metadata: { method: "mfa_totp" } });
+        return { ok: true };
+      }
+      emitError(ctx.events, result.error);
+      return { ok: false, error: result.error };
+    }
+  };
+}
+
+Object.defineProperty(exports, "MfaStepUpRequiredError", {
+  enumerable: true,
+  get: function () { return sdkCore.MfaStepUpRequiredError; }
+});
+Object.defineProperty(exports, "MfaStepUpUnavailableError", {
+  enumerable: true,
+  get: function () { return sdkCore.MfaStepUpUnavailableError; }
+});
+Object.defineProperty(exports, "base64url", {
+  enumerable: true,
+  get: function () { return sdkCore.base64url; }
+});
+Object.defineProperty(exports, "createTranslator", {
+  enumerable: true,
+  get: function () { return sdkCore.createTranslator; }
+});
+Object.defineProperty(exports, "decodeJwtPayload", {
+  enumerable: true,
+  get: function () { return sdkCore.decodeJwtPayload; }
+});
+Object.defineProperty(exports, "decodeSession", {
+  enumerable: true,
+  get: function () { return sdkCore.decodeSession; }
+});
+Object.defineProperty(exports, "decodeUser", {
+  enumerable: true,
+  get: function () { return sdkCore.decodeUser; }
+});
+Object.defineProperty(exports, "generatePkce", {
+  enumerable: true,
+  get: function () { return sdkCore.generatePkce; }
+});
+Object.defineProperty(exports, "getErrorMessage", {
+  enumerable: true,
+  get: function () { return sdkCore.getErrorMessage; }
+});
+Object.defineProperty(exports, "hasPermission", {
+  enumerable: true,
+  get: function () { return sdkCore.hasPermission; }
+});
+Object.defineProperty(exports, "hasRole", {
+  enumerable: true,
+  get: function () { return sdkCore.hasRole; }
+});
+Object.defineProperty(exports, "isSafeUrl", {
+  enumerable: true,
+  get: function () { return sdkCore.isSafeUrl; }
+});
+Object.defineProperty(exports, "networkError", {
+  enumerable: true,
+  get: function () { return sdkCore.networkError; }
+});
+Object.defineProperty(exports, "parseOAuthCallbackError", {
+  enumerable: true,
+  get: function () { return sdkCore.parseOAuthCallbackError; }
+});
+Object.defineProperty(exports, "parseTokenEndpointError", {
+  enumerable: true,
+  get: function () { return sdkCore.parseTokenEndpointError; }
+});
+Object.defineProperty(exports, "scorePassword", {
+  enumerable: true,
+  get: function () { return sdkCore.scorePassword; }
+});
+Object.defineProperty(exports, "selectPluralForm", {
+  enumerable: true,
+  get: function () { return sdkCore.selectPluralForm; }
+});
+exports.DEFAULT_WEBHOOK_TOLERANCE = DEFAULT_WEBHOOK_TOLERANCE;
+exports.DpopSession = DpopSession;
+exports.Feature = Feature;
+exports.MAX_WEBHOOK_TOLERANCE = MAX_WEBHOOK_TOLERANCE;
+exports.Protect = Protect;
+exports.RakomiProvider = RakomiProvider;
+exports.SignIn = SignIn;
+exports.SignUp = SignUp;
+exports.SignedIn = SignedIn;
+exports.SignedOut = SignedOut;
+exports.UserButton = UserButton;
+exports.UserProfile = UserProfile;
+exports.createDefaultExpoAdapter = createDefaultExpoAdapter;
+exports.createDpopSession = createDpopSession;
+exports.createNativeDpopProver = createNativeDpopProver;
+exports.createNativePasskeyAdapter = createNativePasskeyAdapter;
+exports.createRnHttpClient = createRnHttpClient;
+exports.startSocialSignIn = startSocialSignIn;
+exports.useAnonymousSignin = useAnonymousSignin;
+exports.useAuth = useAuth;
+exports.useAuthConfig = useAuthConfig;
+exports.useBaasPlans = useBaasPlans;
+exports.useBaasSubscription = useBaasSubscription;
+exports.useBranding = useBranding;
+exports.useEmailOtp = useEmailOtp;
+exports.useFlag = useFlag;
+exports.useLinkedAccounts = useLinkedAccounts;
+exports.useMagicLink = useMagicLink;
+exports.useMfa = useMfa;
+exports.useOrganization = useOrganization;
+exports.useOrganizationList = useOrganizationList;
+exports.usePasskeys = usePasskeys;
+exports.useRegister = useRegister;
+exports.useSession = useSession;
+exports.useSubmitOAuthTokens = useSubmitOAuthTokens;
+exports.useTranslation = useTranslation;
+exports.useUser = useUser;
+exports.verifyPublisherWebhook = verifyPublisherWebhook;
+exports.verifyWebhook = verifyWebhook;