@rdlabo/ionic-angular-kit 0.0.14 → 0.0.16

package/README.md

@@ -180,12 +180,22 @@ alertConfirm(options: {
 
 `watchKeyboard: true` (on `presentModal` options) expands a bottom sheet to full height when the native keyboard appears (iOS/Android only; no-op on web).
 
+**How `presentModal` decides required vs. optional props.** Props are inferred from the component's `input()` fields, and whether each prop is **required** or **optional** is decided by a single rule: *does the input's type include `undefined`?* A default value is not "optional" — providing a default removes `undefined` from the input's type, so a defaulted input becomes a **required** prop.
+
+| Declaration              | Input type      | Includes `undefined`? | Prop                              |
+| ------------------------ | --------------- | --------------------- | --------------------------------- |
+| `input.required<T>()`    | `T`             | No                    | required                          |
+| `input<T>(defaultValue)` | `T`             | No                    | **required** ← a default makes it required |
+| `input<T>()` (no arg)    | `T \| undefined`| Yes                   | optional                          |
+
+To make a prop **optional**, drop the default and use a bare `input<T>()` (its type is `T | undefined`), then apply your fallback where you read it (e.g. `this.enabled() ?? true`). If a component has at least one required input, the `componentProps` argument itself becomes mandatory; if it has no required inputs, `componentProps` may be omitted; a component with no `input()` fields at all accepts loose, untyped props.
+
 **Best practice — the modal launcher pattern.** Never call `modalController.create(...)` inline in a component. Instead, each modal/popover page exports a typed launcher next to itself and every call site goes through `KitOverlayController`:
 
 ```typescript
 // detail.page.ts — component declares its return type:
 export class DetailPage {
-  declare static modalReturn: DetailResult;
+  declare static readonly modalReturn: DetailResult;
   readonly item = input.required<Item>();
 }
 
@@ -540,6 +550,60 @@ await BrotherPrint.printImage({ ...settings, port: channel.port, channelInfo: ch
 
 ---
 
+### Firebase auth (`@rdlabo/ionic-angular-kit/auth-firebase`)
+
+A secondary entry point so only apps that use it pull in `@angular/fire` and `firebase`. It exists to **isolate `@angular/fire`**: the SDK is touched in exactly one place — the DI provider — so apps import `KIT_FIREBASE_AUTH` and call these functions, never `@angular/fire` directly. That keeps the eventual `@angular/fire` → modular `firebase/auth` swap provider-local.
+
+**Design principle: the kit performs no UI.** Every function runs the Firebase operation and nothing else; loading overlays, prompts and error alerts are app side effects. The flow functions take the uniform lifecycle hooks `{ before, success, error, finally }` and, rather than throwing, resolve value flows to `null` and boolean flows to `false`, handing the raw error to the `error` hook so the app presents it from its own dictionary. For anything the functions don't express, drop down to `firebase/auth` directly.
+
+```typescript
+// app.config.ts — @angular/fire lives only here
+provideKitFirebase({ firebaseConfig: environment.firebase }),
+provideKitFirebaseAnalytics(),
+```
+
+```typescript
+import { inject, Injectable } from '@angular/core';
+import {
+  KIT_FIREBASE_AUTH, kitSignIn, kitSignOut, kitResolveAuthStatus, kitReauthWithRetry,
+} from '@rdlabo/ionic-angular-kit/auth-firebase';
+import { updatePassword } from 'firebase/auth'; // escape hatch for the reauth mutation
+
+@Injectable({ providedIn: 'root' })
+export class AuthService {
+  readonly #auth = inject(KIT_FIREBASE_AUTH);
+
+  // Simple flow: hooks carry the app's side effects; errors go to the app's own dictionary.
+  signIn(email: string, password: string) {
+    return kitSignIn(this.#auth, email, password, {
+      error: (e) => this.presentError(e),
+      success: () => this.nav.navigateRoot('/'),
+    });
+  }
+
+  // Re-auth: the kit owns only the re-auth + wrong-password-retry mechanic; the app supplies
+  // the password prompt and the loading overlay, and catches the thrown (non-wrong-password) error.
+  async changePassword(currentEmail: string, newPassword: string) {
+    const ok = await kitReauthWithRetry(this.#auth, currentEmail, {
+      prompt: (retry) => this.promptPassword(retry),
+      mutate: (user) => updatePassword(user, newPassword),
+      withLoading: (run) => this.withLoading(run),
+    }).catch((e) => (this.presentError(e), false));
+    if (ok) this.overlay.alertClose({ header: 'Saved', message: '…' });
+  }
+}
+```
+
+Surface:
+
+- **DI** — `KIT_FIREBASE_AUTH` (`InjectionToken<Auth>`), `provideKitFirebase({ firebaseConfig })`, `provideKitFirebaseAnalytics()`.
+- **Flow functions** (uniform hooks + no-throw null/false) — `kitSignIn`, `kitSignUp` (create + send verification), `kitSignOut`, `kitSendPasswordReset`, `kitSendEmailVerification`, `kitUnlinkProvider`.
+- **Mechanics** — `kitReauthWithRetry` (app injects `prompt` / `withLoading` / `mutate`; boolean result, non-wrong-password errors thrown), `kitResolveAuthStatus` (`'user' | 'confirm' | 'required'` from the user; social counts as verified; `allowWhen` bypass), `kitAuthState`, `kitGetIdToken`.
+- **Error dictionary** — `KIT_DEFAULT_AUTH_TEXT` (importable canonical constant; the kit does not present it — the app renders its own alert).
+- **Social** (`@rdlabo/ionic-angular-kit/auth-firebase/social`, separate nested entry to isolate the Capacitor plugins) — `kitFacebookLogin`, `kitAppleLogin`, `kitFacebookLogout`; options carry the same `{ before, success, error, finally }` hooks (`success` receives the identity payload for a backend call).
+
+---
+
 ## Consumer Vitest setup notes
 
 When testing a consumer app that declares `@rdlabo/ionic-angular-kit` as a `file:` symlink dependency, add the following to your `vitest.config.ts`:

package/fesm2022/rdlabo-ionic-angular-kit-auth-firebase-social.mjs

@@ -0,0 +1,218 @@
+import { signInWithCredential, linkWithCredential, reauthenticateWithCredential, EmailAuthProvider, OAuthProvider, FacebookAuthProvider, reauthenticateWithPopup, signInWithPopup, linkWithPopup } from 'firebase/auth';
+import { Capacitor } from '@capacitor/core';
+import { FacebookLogin } from '@capacitor-community/facebook-login';
+import { SignInWithApple } from '@capacitor-community/apple-sign-in';
+
+/** Generate a random nonce for the Facebook OIDC (Limited Login) flow. */
+const generateNonce = (length = 16) => {
+    const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
+    let nonce = '';
+    for (let i = 0; i < length; i++) {
+        nonce += charset[Math.floor(Math.random() * charset.length)];
+    }
+    return nonce;
+};
+const classifyOAuthError = (e) => {
+    const code = e?.code;
+    if (code === 'auth/credential-already-in-use') {
+        return 'already-in-use';
+    }
+    if (code === 'auth/user-cancelled') {
+        return 'cancelled';
+    }
+    return 'other';
+};
+/**
+ * The shared 3-mode credential state machine (internal).
+ *
+ * @remarks
+ * `new` signs in with the credential, `link` links it, `credential` re-authenticates with the social
+ * credential and then links an email/password. Any Firebase error is classified and handed to
+ * `error` (returning `false`); on success the app's `success` hook (backend + feedback) runs with the
+ * identity payload, and it returns `true`.
+ */
+const applyOAuthCredential = async (auth, credential, mode, effects) => {
+    try {
+        if (mode.mode === 'new') {
+            await signInWithCredential(auth, credential);
+        }
+        else {
+            const user = auth.currentUser;
+            if (!user) {
+                throw new Error('kit social: no signed-in user to link/re-authenticate');
+            }
+            if (mode.mode === 'link') {
+                await linkWithCredential(user, credential);
+            }
+            else {
+                await reauthenticateWithCredential(user, credential);
+                await linkWithCredential(user, EmailAuthProvider.credential(mode.emailLogin.email, mode.emailLogin.password));
+            }
+        }
+    }
+    catch (e) {
+        await effects.error(classifyOAuthError(e), e);
+        return false;
+    }
+    await effects.success();
+    return true;
+};
+/** Await one animation frame where available (iOS WebView crash workaround; no-op off-browser). */
+const nextFrame = () => new Promise((resolve) => {
+    if (typeof requestAnimationFrame === 'function') {
+        requestAnimationFrame(() => resolve());
+    }
+    else {
+        resolve();
+    }
+});
+/**
+ * Facebook login / link, bundled: native plugin → credential → the shared 3-mode state machine.
+ *
+ * @remarks
+ * On iOS the credential is built from the OIDC token with a nonce (`OAuthProvider('facebook.com')`);
+ * elsewhere from the access token (`FacebookAuthProvider`). Returns `{ status: false }` on a
+ * cancelled/failed plugin login or a handled Firebase error (the app was already notified via the
+ * hooks).
+ */
+const kitFacebookLogin = async (auth, options) => {
+    await options.before?.();
+    try {
+        const nonce = generateNonce();
+        const event = await FacebookLogin.login({ permissions: options.permissions, nonce }).catch(() => undefined);
+        await nextFrame();
+        if (!event || !event.accessToken?.token) {
+            return { status: false };
+        }
+        const accessToken = event.accessToken.token;
+        const credential = Capacitor.isNativePlatform() && Capacitor.getPlatform() === 'ios'
+            ? new OAuthProvider('facebook.com').credential({ rawNonce: nonce, idToken: accessToken })
+            : FacebookAuthProvider.credential(accessToken);
+        const status = await applyOAuthCredential(auth, credential, options, {
+            success: () => options.success?.({ accessToken, mode: options.mode }),
+            error: (category, error) => options.error?.(category, error),
+        });
+        return { status };
+    }
+    finally {
+        await options.finally?.();
+    }
+};
+/**
+ * Log out of the Facebook SDK (best-effort; errors are ignored).
+ *
+ * @remarks
+ * Apps that offer Facebook login typically call this alongside the Firebase sign-out, so it lives
+ * here to keep the `@capacitor-community/facebook-login` import out of the app.
+ */
+const kitFacebookLogout = () => FacebookLogin.logout().catch(() => undefined);
+/**
+ * Sign in with Apple / link, bundled. Native uses the plugin; the web uses the Firebase popup.
+ *
+ * @remarks
+ * - **Native**: `SignInWithApple.authorize()` → `OAuthProvider('apple.com')` credential → the shared
+ *   3-mode state machine.
+ * - **Web**: `signInWithPopup` / `linkWithPopup` (with `email`/`name` scopes), or, for `credential`,
+ *   `reauthenticateWithPopup` then link the email/password. The identity payload for the backend is
+ *   synthesized from the popup result.
+ *
+ * Every failure path (including popup errors) is routed through `onError`.
+ */
+const kitAppleLogin = async (auth, options) => {
+    await options.before?.();
+    try {
+        if (Capacitor.isNativePlatform()) {
+            const authorize = await SignInWithApple.authorize().catch(() => undefined);
+            if (!authorize) {
+                return { status: false };
+            }
+            const r = authorize.response;
+            const response = {
+                user: r.user ?? null,
+                email: r.email ?? null,
+                givenName: r.givenName ?? null,
+                familyName: r.familyName ?? null,
+                identityToken: r.identityToken ?? null,
+                authorizationCode: r.authorizationCode ?? null,
+            };
+            const credential = new OAuthProvider('apple.com').credential({ idToken: response.identityToken ?? undefined });
+            const status = await applyOAuthCredential(auth, credential, options, {
+                success: () => options.success?.({ response, mode: options.mode }),
+                error: (category, error) => options.error?.(category, error),
+            });
+            return { status };
+        }
+        // Web: the popup performs the sign-in/link itself.
+        const provider = new OAuthProvider('apple.com');
+        provider.addScope('email');
+        provider.addScope('name');
+        if (options.mode === 'credential') {
+            const user = auth.currentUser;
+            try {
+                if (!user) {
+                    throw new Error('kit social: no signed-in user to re-authenticate');
+                }
+                await reauthenticateWithPopup(user, provider);
+                await linkWithCredential(user, EmailAuthProvider.credential(options.emailLogin.email, options.emailLogin.password));
+            }
+            catch (e) {
+                await options.error?.(classifyOAuthError(e), e);
+                return { status: false };
+            }
+            await options.success?.({ response: emptyAppleResponse(), mode: 'credential' });
+            return { status: true };
+        }
+        let result;
+        try {
+            result =
+                options.mode === 'new'
+                    ? await signInWithPopup(auth, provider)
+                    : await linkWithPopup(requireUser(auth), provider);
+        }
+        catch (e) {
+            await options.error?.(classifyOAuthError(e), e);
+            return { status: false };
+        }
+        const credential = OAuthProvider.credentialFromResult(result);
+        const response = {
+            ...emptyAppleResponse(),
+            email: result.user?.email ?? null,
+            identityToken: credential?.idToken ?? null,
+            authorizationCode: credential?.accessToken ?? null,
+        };
+        await options.success?.({ response, mode: options.mode });
+        return { status: true };
+    }
+    finally {
+        await options.finally?.();
+    }
+};
+const emptyAppleResponse = () => ({
+    user: null,
+    email: null,
+    givenName: null,
+    familyName: null,
+    identityToken: null,
+    authorizationCode: null,
+});
+const requireUser = (auth) => {
+    const user = auth.currentUser;
+    if (!user) {
+        throw new Error('kit social: no signed-in user to link');
+    }
+    return user;
+};
+
+// Social login (Facebook / Apple). Its own entry point so only apps that use it pull in the native
+// plugins `@capacitor-community/facebook-login` and `@capacitor-community/apple-sign-in`; the core
+// `auth-firebase` entry stays free of them.
+//
+// Public surface is curated: two bundled flows plus their option types. The nonce util, the error
+// classifier and the 3-mode credential state machine are internal implementation details.
+
+/**
+ * Generated bundle index. Do not edit.
+ */
+
+export { kitAppleLogin, kitFacebookLogin, kitFacebookLogout };
+//# sourceMappingURL=rdlabo-ionic-angular-kit-auth-firebase-social.mjs.map

package/fesm2022/rdlabo-ionic-angular-kit-auth-firebase-social.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"rdlabo-ionic-angular-kit-auth-firebase-social.mjs","sources":["../../../projects/kit/auth-firebase/social/src/kit-social.ts","../../../projects/kit/auth-firebase/social/src/public-api.ts","../../../projects/kit/auth-firebase/social/src/rdlabo-ionic-angular-kit-auth-firebase-social.ts"],"sourcesContent":["import type { Auth, AuthCredential } from 'firebase/auth';\nimport {\n  EmailAuthProvider,\n  FacebookAuthProvider,\n  linkWithCredential,\n  linkWithPopup,\n  OAuthProvider,\n  reauthenticateWithCredential,\n  reauthenticateWithPopup,\n  signInWithCredential,\n  signInWithPopup,\n} from 'firebase/auth';\nimport { Capacitor } from '@capacitor/core';\nimport { FacebookLogin } from '@capacitor-community/facebook-login';\nimport { SignInWithApple } from '@capacitor-community/apple-sign-in';\n\n/** How a social-credential failure is classified for the app's error hook. */\nexport type KitOAuthErrorCategory = 'already-in-use' | 'cancelled' | 'other';\n\n/** The mode a social login runs in. */\nexport type KitOAuthModeName = 'new' | 'link' | 'credential';\n\n/**\n * The mode discriminator. `'credential'` links an email/password to the (re-authenticated) social\n * account, so it requires the new email/password; `'new'` / `'link'` do not.\n */\nexport type KitOAuthMode =\n  | { mode: 'new' }\n  | { mode: 'link' }\n  | { mode: 'credential'; emailLogin: { email: string; password: string } };\n\n/**\n * The apple identity payload handed to the `success` hook for the backend call. Populated from the\n * native plugin on device, or synthesized from the popup result on the web.\n */\nexport interface KitAppleResponse {\n  user: string | null;\n  email: string | null;\n  givenName: string | null;\n  familyName: string | null;\n  identityToken: string | null;\n  authorizationCode: string | null;\n}\n\n/**\n * The uniform lifecycle hooks for a social flow — the same `before / success / error / finally`\n * shape as {@link KitFirebaseAuthService}'s hooks, so a call site reads the same everywhere. All are\n * optional; the kit renders nothing itself.\n *\n * @typeParam Info - the identity payload handed to {@link success} (Facebook access token / Apple\n * response), so an app can notify its backend and give feedback in one place.\n *\n * @remarks\n * `before` runs before the plugin login starts, `success` after the mode's Firebase op succeeds\n * (carrying the identity payload — do the backend call and the toast here), `error` on a classified\n * failure (`'cancelled'` is passed through so the app can stay silent on a user cancel), and\n * `finally` always. The kit swallows none of these errors.\n */\ninterface KitSocialHooks<Info> {\n  before?: () => void | Promise<unknown>;\n  success?: (info: Info) => void | Promise<unknown>;\n  error?: (category: KitOAuthErrorCategory, error: unknown) => void | Promise<unknown>;\n  finally?: () => void | Promise<unknown>;\n}\n\n/** Options for {@link kitFacebookLogin}. */\nexport type KitFacebookLoginOptions = KitOAuthMode &\n  KitSocialHooks<{ accessToken: string; mode: KitOAuthModeName }> & {\n    /** Facebook permissions to request. */\n    permissions: string[];\n  };\n\n/** Options for {@link kitAppleLogin}. */\nexport type KitAppleLoginOptions = KitOAuthMode & KitSocialHooks<{ response: KitAppleResponse; mode: KitOAuthModeName }>;\n\n/** Generate a random nonce for the Facebook OIDC (Limited Login) flow. */\nconst generateNonce = (length = 16): string => {\n  const charset = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';\n  let nonce = '';\n  for (let i = 0; i < length; i++) {\n    nonce += charset[Math.floor(Math.random() * charset.length)];\n  }\n  return nonce;\n};\n\nconst classifyOAuthError = (e: unknown): KitOAuthErrorCategory => {\n  const code = (e as { code?: string } | undefined)?.code;\n  if (code === 'auth/credential-already-in-use') {\n    return 'already-in-use';\n  }\n  if (code === 'auth/user-cancelled') {\n    return 'cancelled';\n  }\n  return 'other';\n};\n\n/**\n * The shared 3-mode credential state machine (internal).\n *\n * @remarks\n * `new` signs in with the credential, `link` links it, `credential` re-authenticates with the social\n * credential and then links an email/password. Any Firebase error is classified and handed to\n * `error` (returning `false`); on success the app's `success` hook (backend + feedback) runs with the\n * identity payload, and it returns `true`.\n */\nconst applyOAuthCredential = async (\n  auth: Auth,\n  credential: AuthCredential,\n  mode: KitOAuthMode,\n  effects: {\n    success: () => void | Promise<unknown>;\n    error: (category: KitOAuthErrorCategory, error: unknown) => void | Promise<unknown>;\n  },\n): Promise<boolean> => {\n  try {\n    if (mode.mode === 'new') {\n      await signInWithCredential(auth, credential);\n    } else {\n      const user = auth.currentUser;\n      if (!user) {\n        throw new Error('kit social: no signed-in user to link/re-authenticate');\n      }\n      if (mode.mode === 'link') {\n        await linkWithCredential(user, credential);\n      } else {\n        await reauthenticateWithCredential(user, credential);\n        await linkWithCredential(user, EmailAuthProvider.credential(mode.emailLogin.email, mode.emailLogin.password));\n      }\n    }\n  } catch (e) {\n    await effects.error(classifyOAuthError(e), e);\n    return false;\n  }\n  await effects.success();\n  return true;\n};\n\n/** Await one animation frame where available (iOS WebView crash workaround; no-op off-browser). */\nconst nextFrame = (): Promise<void> =>\n  new Promise<void>((resolve) => {\n    if (typeof requestAnimationFrame === 'function') {\n      requestAnimationFrame(() => resolve());\n    } else {\n      resolve();\n    }\n  });\n\n/**\n * Facebook login / link, bundled: native plugin → credential → the shared 3-mode state machine.\n *\n * @remarks\n * On iOS the credential is built from the OIDC token with a nonce (`OAuthProvider('facebook.com')`);\n * elsewhere from the access token (`FacebookAuthProvider`). Returns `{ status: false }` on a\n * cancelled/failed plugin login or a handled Firebase error (the app was already notified via the\n * hooks).\n */\nexport const kitFacebookLogin = async (\n  auth: Auth,\n  options: KitFacebookLoginOptions,\n): Promise<{ status: boolean }> => {\n  await options.before?.();\n  try {\n    const nonce = generateNonce();\n    const event = await FacebookLogin.login({ permissions: options.permissions, nonce }).catch(() => undefined);\n    await nextFrame();\n    if (!event || !event.accessToken?.token) {\n      return { status: false };\n    }\n    const accessToken = event.accessToken.token;\n    const credential: AuthCredential =\n      Capacitor.isNativePlatform() && Capacitor.getPlatform() === 'ios'\n        ? new OAuthProvider('facebook.com').credential({ rawNonce: nonce, idToken: accessToken })!\n        : FacebookAuthProvider.credential(accessToken);\n\n    const status = await applyOAuthCredential(auth, credential, options, {\n      success: () => options.success?.({ accessToken, mode: options.mode }),\n      error: (category, error) => options.error?.(category, error),\n    });\n    return { status };\n  } finally {\n    await options.finally?.();\n  }\n};\n\n/**\n * Log out of the Facebook SDK (best-effort; errors are ignored).\n *\n * @remarks\n * Apps that offer Facebook login typically call this alongside the Firebase sign-out, so it lives\n * here to keep the `@capacitor-community/facebook-login` import out of the app.\n */\nexport const kitFacebookLogout = (): Promise<void> => FacebookLogin.logout().catch(() => undefined);\n\n/**\n * Sign in with Apple / link, bundled. Native uses the plugin; the web uses the Firebase popup.\n *\n * @remarks\n * - **Native**: `SignInWithApple.authorize()` → `OAuthProvider('apple.com')` credential → the shared\n *   3-mode state machine.\n * - **Web**: `signInWithPopup` / `linkWithPopup` (with `email`/`name` scopes), or, for `credential`,\n *   `reauthenticateWithPopup` then link the email/password. The identity payload for the backend is\n *   synthesized from the popup result.\n *\n * Every failure path (including popup errors) is routed through `onError`.\n */\nexport const kitAppleLogin = async (auth: Auth, options: KitAppleLoginOptions): Promise<{ status: boolean }> => {\n  await options.before?.();\n  try {\n    if (Capacitor.isNativePlatform()) {\n      const authorize = await SignInWithApple.authorize().catch(() => undefined);\n      if (!authorize) {\n        return { status: false };\n      }\n      const r = authorize.response;\n      const response: KitAppleResponse = {\n        user: r.user ?? null,\n        email: r.email ?? null,\n        givenName: r.givenName ?? null,\n        familyName: r.familyName ?? null,\n        identityToken: r.identityToken ?? null,\n        authorizationCode: r.authorizationCode ?? null,\n      };\n      const credential = new OAuthProvider('apple.com').credential({ idToken: response.identityToken ?? undefined })!;\n      const status = await applyOAuthCredential(auth, credential, options, {\n        success: () => options.success?.({ response, mode: options.mode }),\n        error: (category, error) => options.error?.(category, error),\n      });\n      return { status };\n    }\n\n    // Web: the popup performs the sign-in/link itself.\n    const provider = new OAuthProvider('apple.com');\n    provider.addScope('email');\n    provider.addScope('name');\n\n    if (options.mode === 'credential') {\n      const user = auth.currentUser;\n      try {\n        if (!user) {\n          throw new Error('kit social: no signed-in user to re-authenticate');\n        }\n        await reauthenticateWithPopup(user, provider);\n        await linkWithCredential(\n          user,\n          EmailAuthProvider.credential(options.emailLogin.email, options.emailLogin.password),\n        );\n      } catch (e) {\n        await options.error?.(classifyOAuthError(e), e);\n        return { status: false };\n      }\n      await options.success?.({ response: emptyAppleResponse(), mode: 'credential' });\n      return { status: true };\n    }\n\n    let result;\n    try {\n      result =\n        options.mode === 'new'\n          ? await signInWithPopup(auth, provider)\n          : await linkWithPopup(requireUser(auth), provider);\n    } catch (e) {\n      await options.error?.(classifyOAuthError(e), e);\n      return { status: false };\n    }\n    const credential = OAuthProvider.credentialFromResult(result);\n    const response: KitAppleResponse = {\n      ...emptyAppleResponse(),\n      email: result.user?.email ?? null,\n      identityToken: credential?.idToken ?? null,\n      authorizationCode: credential?.accessToken ?? null,\n    };\n    await options.success?.({ response, mode: options.mode });\n    return { status: true };\n  } finally {\n    await options.finally?.();\n  }\n};\n\nconst emptyAppleResponse = (): KitAppleResponse => ({\n  user: null,\n  email: null,\n  givenName: null,\n  familyName: null,\n  identityToken: null,\n  authorizationCode: null,\n});\n\nconst requireUser = (auth: Auth) => {\n  const user = auth.currentUser;\n  if (!user) {\n    throw new Error('kit social: no signed-in user to link');\n  }\n  return user;\n};\n","// Social login (Facebook / Apple). Its own entry point so only apps that use it pull in the native\n// plugins `@capacitor-community/facebook-login` and `@capacitor-community/apple-sign-in`; the core\n// `auth-firebase` entry stays free of them.\n//\n// Public surface is curated: two bundled flows plus their option types. The nonce util, the error\n// classifier and the 3-mode credential state machine are internal implementation details.\nexport * from './kit-social';\n","/**\n * Generated bundle index. Do not edit.\n */\n\nexport * from './public-api';\n"],"names":[],"mappings":";;;;;AA2EA;AACA,MAAM,aAAa,GAAG,CAAC,MAAM,GAAG,EAAE,KAAY;IAC5C,MAAM,OAAO,GAAG,gEAAgE;IAChF,IAAI,KAAK,GAAG,EAAE;AACd,IAAA,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE;AAC/B,QAAA,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9D;AACA,IAAA,OAAO,KAAK;AACd,CAAC;AAED,MAAM,kBAAkB,GAAG,CAAC,CAAU,KAA2B;AAC/D,IAAA,MAAM,IAAI,GAAI,CAAmC,EAAE,IAAI;AACvD,IAAA,IAAI,IAAI,KAAK,gCAAgC,EAAE;AAC7C,QAAA,OAAO,gBAAgB;IACzB;AACA,IAAA,IAAI,IAAI,KAAK,qBAAqB,EAAE;AAClC,QAAA,OAAO,WAAW;IACpB;AACA,IAAA,OAAO,OAAO;AAChB,CAAC;AAED;;;;;;;;AAQG;AACH,MAAM,oBAAoB,GAAG,OAC3B,IAAU,EACV,UAA0B,EAC1B,IAAkB,EAClB,OAGC,KACmB;AACpB,IAAA,IAAI;AACF,QAAA,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE;AACvB,YAAA,MAAM,oBAAoB,CAAC,IAAI,EAAE,UAAU,CAAC;QAC9C;aAAO;AACL,YAAA,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW;YAC7B,IAAI,CAAC,IAAI,EAAE;AACT,gBAAA,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC;YAC1E;AACA,YAAA,IAAI,IAAI,CAAC,IAAI,KAAK,MAAM,EAAE;AACxB,gBAAA,MAAM,kBAAkB,CAAC,IAAI,EAAE,UAAU,CAAC;YAC5C;iBAAO;AACL,gBAAA,MAAM,4BAA4B,CAAC,IAAI,EAAE,UAAU,CAAC;gBACpD,MAAM,kBAAkB,CAAC,IAAI,EAAE,iBAAiB,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YAC/G;QACF;IACF;IAAE,OAAO,CAAC,EAAE;QACV,MAAM,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC7C,QAAA,OAAO,KAAK;IACd;AACA,IAAA,MAAM,OAAO,CAAC,OAAO,EAAE;AACvB,IAAA,OAAO,IAAI;AACb,CAAC;AAED;AACA,MAAM,SAAS,GAAG,MAChB,IAAI,OAAO,CAAO,CAAC,OAAO,KAAI;AAC5B,IAAA,IAAI,OAAO,qBAAqB,KAAK,UAAU,EAAE;AAC/C,QAAA,qBAAqB,CAAC,MAAM,OAAO,EAAE,CAAC;IACxC;SAAO;AACL,QAAA,OAAO,EAAE;IACX;AACF,CAAC,CAAC;AAEJ;;;;;;;;AAQG;AACI,MAAM,gBAAgB,GAAG,OAC9B,IAAU,EACV,OAAgC,KACA;AAChC,IAAA,MAAM,OAAO,CAAC,MAAM,IAAI;AACxB,IAAA,IAAI;AACF,QAAA,MAAM,KAAK,GAAG,aAAa,EAAE;QAC7B,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,SAAS,CAAC;QAC3G,MAAM,SAAS,EAAE;QACjB,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE;AACvC,YAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1B;AACA,QAAA,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,KAAK;AAC3C,QAAA,MAAM,UAAU,GACd,SAAS,CAAC,gBAAgB,EAAE,IAAI,SAAS,CAAC,WAAW,EAAE,KAAK;AAC1D,cAAE,IAAI,aAAa,CAAC,cAAc,CAAC,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,WAAW,EAAE;AACxF,cAAE,oBAAoB,CAAC,UAAU,CAAC,WAAW,CAAC;QAElD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE;AACnE,YAAA,OAAO,EAAE,MAAM,OAAO,CAAC,OAAO,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;AACrE,YAAA,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,KAAK,OAAO,CAAC,KAAK,GAAG,QAAQ,EAAE,KAAK,CAAC;AAC7D,SAAA,CAAC;QACF,OAAO,EAAE,MAAM,EAAE;IACnB;YAAU;AACR,QAAA,MAAM,OAAO,CAAC,OAAO,IAAI;IAC3B;AACF;AAEA;;;;;;AAMG;AACI,MAAM,iBAAiB,GAAG,MAAqB,aAAa,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,SAAS;AAElG;;;;;;;;;;;AAWG;AACI,MAAM,aAAa,GAAG,OAAO,IAAU,EAAE,OAA6B,KAAkC;AAC7G,IAAA,MAAM,OAAO,CAAC,MAAM,IAAI;AACxB,IAAA,IAAI;AACF,QAAA,IAAI,SAAS,CAAC,gBAAgB,EAAE,EAAE;AAChC,YAAA,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,MAAM,SAAS,CAAC;YAC1E,IAAI,CAAC,SAAS,EAAE;AACd,gBAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;YAC1B;AACA,YAAA,MAAM,CAAC,GAAG,SAAS,CAAC,QAAQ;AAC5B,YAAA,MAAM,QAAQ,GAAqB;AACjC,gBAAA,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI;AACpB,gBAAA,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI;AACtB,gBAAA,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;AAC9B,gBAAA,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;AAChC,gBAAA,aAAa,EAAE,CAAC,CAAC,aAAa,IAAI,IAAI;AACtC,gBAAA,iBAAiB,EAAE,CAAC,CAAC,iBAAiB,IAAI,IAAI;aAC/C;YACD,MAAM,UAAU,GAAG,IAAI,aAAa,CAAC,WAAW,CAAC,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,aAAa,IAAI,SAAS,EAAE,CAAE;YAC/G,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE;AACnE,gBAAA,OAAO,EAAE,MAAM,OAAO,CAAC,OAAO,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;AAClE,gBAAA,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,KAAK,OAAO,CAAC,KAAK,GAAG,QAAQ,EAAE,KAAK,CAAC;AAC7D,aAAA,CAAC;YACF,OAAO,EAAE,MAAM,EAAE;QACnB;;AAGA,QAAA,MAAM,QAAQ,GAAG,IAAI,aAAa,CAAC,WAAW,CAAC;AAC/C,QAAA,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC;AAC1B,QAAA,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;AAEzB,QAAA,IAAI,OAAO,CAAC,IAAI,KAAK,YAAY,EAAE;AACjC,YAAA,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW;AAC7B,YAAA,IAAI;gBACF,IAAI,CAAC,IAAI,EAAE;AACT,oBAAA,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC;gBACrE;AACA,gBAAA,MAAM,uBAAuB,CAAC,IAAI,EAAE,QAAQ,CAAC;gBAC7C,MAAM,kBAAkB,CACtB,IAAI,EACJ,iBAAiB,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,CACpF;YACH;YAAE,OAAO,CAAC,EAAE;AACV,gBAAA,MAAM,OAAO,CAAC,KAAK,GAAG,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC/C,gBAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;YAC1B;AACA,YAAA,MAAM,OAAO,CAAC,OAAO,GAAG,EAAE,QAAQ,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAC/E,YAAA,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE;QACzB;AAEA,QAAA,IAAI,MAAM;AACV,QAAA,IAAI;YACF,MAAM;gBACJ,OAAO,CAAC,IAAI,KAAK;AACf,sBAAE,MAAM,eAAe,CAAC,IAAI,EAAE,QAAQ;sBACpC,MAAM,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC;QACxD;QAAE,OAAO,CAAC,EAAE;AACV,YAAA,MAAM,OAAO,CAAC,KAAK,GAAG,kBAAkB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC/C,YAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE;QAC1B;QACA,MAAM,UAAU,GAAG,aAAa,CAAC,oBAAoB,CAAC,MAAM,CAAC;AAC7D,QAAA,MAAM,QAAQ,GAAqB;AACjC,YAAA,GAAG,kBAAkB,EAAE;AACvB,YAAA,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI;AACjC,YAAA,aAAa,EAAE,UAAU,EAAE,OAAO,IAAI,IAAI;AAC1C,YAAA,iBAAiB,EAAE,UAAU,EAAE,WAAW,IAAI,IAAI;SACnD;AACD,QAAA,MAAM,OAAO,CAAC,OAAO,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;AACzD,QAAA,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE;IACzB;YAAU;AACR,QAAA,MAAM,OAAO,CAAC,OAAO,IAAI;IAC3B;AACF;AAEA,MAAM,kBAAkB,GAAG,OAAyB;AAClD,IAAA,IAAI,EAAE,IAAI;AACV,IAAA,KAAK,EAAE,IAAI;AACX,IAAA,SAAS,EAAE,IAAI;AACf,IAAA,UAAU,EAAE,IAAI;AAChB,IAAA,aAAa,EAAE,IAAI;AACnB,IAAA,iBAAiB,EAAE,IAAI;AACxB,CAAA,CAAC;AAEF,MAAM,WAAW,GAAG,CAAC,IAAU,KAAI;AACjC,IAAA,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW;IAC7B,IAAI,CAAC,IAAI,EAAE;AACT,QAAA,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC;IAC1D;AACA,IAAA,OAAO,IAAI;AACb,CAAC;;ACrSD;AACA;AACA;AACA;AACA;AACA;;ACLA;;AAEG;;;;"}