@rool-dev/sdk 0.11.3-dev.5dfa2e5 → 0.11.3-dev.a6a4bb1

package/README.md

@@ -142,6 +142,74 @@ if (!authenticated) {
 if (!authenticated) throw new Error('Login required');
 ```
 
+### Native (Capacitor, Cordova, Tauri, ...)
+
+Use the native PKCE provider for JS app shells that sign in through an external
+system browser. `login()`/`signup()` open the auth server's `/authorize` page
+via the `openExternal` callback you supply; when the deep link returns, feed it
+to `client.handleAuthRedirect(url)` from your platform's deep-link handler. The
+code is exchanged for a session at `/token` and tokens are stored like the
+browser provider.
+
+```typescript
+import { RoolClient, NativePkceAuthProvider } from '@rool-dev/sdk';
+import { Browser } from '@capacitor/browser';
+import { App } from '@capacitor/app';
+
+const client = new RoolClient({
+  authProvider: new NativePkceAuthProvider({
+    redirectUri: 'roolandroidauth://auth/callback', // must match the server allowlist
+    defaultProvider: 'google',                       // 'google' | 'apple'
+    openExternal: (url) => Browser.open({ url }),
+  }),
+});
+
+// Complete sign-in when the OS hands the app its deep link.
+App.addListener('appUrlOpen', async ({ url }) => {
+  if (await client.handleAuthRedirect(url)) {
+    await Browser.close();
+    // Now authenticated — refresh your UI.
+  }
+});
+
+if (!(await client.initialize())) {
+  // Opens the system browser; completion arrives via the listener above.
+  await client.login('My App'); // pass { provider: 'apple' } to override the default
+}
+```
+
+#### Email + password and magic links (native)
+
+The native provider also supports email/password sign-in and magic links —
+no system browser, the server returns the token set as JSON directly.
+
+```typescript
+// Password sign-in
+const result = await client.signInWithPassword(email, password);
+if (result.status === 'signed_in') {
+  // authenticated — refresh your UI
+} else {
+  // status === 'verify_required': the email isn't verified yet and the server
+  // has emailed a magic link. Tell the user to check their inbox.
+}
+
+// Or request a magic link explicitly
+await client.requestMagicLink(email);
+```
+
+The magic link carries a `?verify=<token>` param; complete sign-in by passing
+that token to `client.verify(token)` once the link lands back in the app.
+
+> **⚠️ Magic links open the website, not the app, until Universal Links / App
+> Links are configured.** The emailed link is an `https://` URL for the Rool
+> web app. On native, an `https` link only re-opens your app if you've set up
+> [iOS Universal Links](https://developer.apple.com/ios/universal-links/) /
+> [Android App Links](https://developer.android.com/training/app-links) for that
+> domain (custom-scheme deep links don't apply to email links). **Without that
+> setup the magic link completes sign-in in the browser/website, not in the
+> native app** — so for now treat magic links on native as a website hand-off,
+> and prefer password or social sign-in for an in-app experience.
+
 ### Auth API
 
 | Method | Description |
@@ -150,6 +218,9 @@ if (!authenticated) throw new Error('Login required');
 | `login(appName, params?): Promise<void>` | Start login flow. |
 | `signup(appName, params?): Promise<void>` | Start signup flow. |
 | `verify(token): Promise<boolean>` | Complete email verification token flow; returns `false` when the active auth provider does not implement verification. |
+| `handleAuthRedirect(url): Promise<boolean>` | Complete a native PKCE sign-in from a deep-link callback URL. Returns `false` when the active auth provider does not implement it. |
+| `signInWithPassword(email, password): Promise<PasswordSignInResult>` | Email + password sign-in (native provider). Resolves `{ status: 'signed_in' }`, or `{ status: 'verify_required' }` when the email is unverified (a magic link was emailed). Rejects on bad credentials. |
+| `requestMagicLink(email): Promise<void>` | Email the user a magic sign-in link (native provider). See the caveat below — on native the link opens the **website**, not the app, until Universal Links / App Links are configured. |
 | `logout(): void` | Clear auth state and close open spaces. |
 | `isAuthenticated(): Promise<boolean>` | Whether credentials are held locally. No network call — a server outage does not read as logged out. |
 | `getAuthUser(): AuthUser` | Return auth identity decoded from the token. |
@@ -671,6 +742,10 @@ Archives include objects, metadata, channels/conversations, and file storage.
 ## Data Types
 
 ```typescript
+// Outcome of signInWithPassword. 'verify_required' means the account's email
+// isn't verified yet and the server has emailed a magic link.
+type PasswordSignInResult = { status: 'signed_in' | 'verify_required' };
+
 type FieldType =
   | { kind: 'string' }
   | { kind: 'number' }
@@ -717,10 +792,22 @@ interface SpaceInvite {
   useCount: number;
 }
 
-// Outcome of the invite email send; null when no email was involved (open link).
-// 'not_configured' means the server has no mail provider (local dev). Future
-// codes may appear; treat unknown values as not sent.
-type InviteEmailStatus = 'sent' | 'not_configured' | 'failed' | (string & {});
+// Outcome of the invite email send. Null when no email was involved (open link).
+// The invite is always minted and its `url` is usable regardless of this value;
+// only the email delivery is reflected here.
+// - 'sent': email dispatched
+// - 'not_configured': server has no mail provider (local dev)
+// - 'failed': provider rejected the send
+// - 'cooldown': a recent invite to this same address was already emailed
+// - 'rate_limited': the inviter hit their daily email-invite cap
+// Treat unknown values as not sent.
+type InviteEmailStatus =
+  | 'sent'
+  | 'not_configured'
+  | 'failed'
+  | 'cooldown'
+  | 'rate_limited'
+  | (string & {});
 
 interface SpaceInviteCreated {
   inviteId: string;

package/dist/auth-base.d.ts

@@ -0,0 +1,100 @@
+import type { AuthProvider, AuthUser } from './types.js';
+import { type Logger } from './logger.js';
+export interface BaseTokenAuthConfig {
+    /** Auth URL (e.g. https://rool.dev/auth). Injected by RoolClient if omitted. */
+    authUrl?: string;
+    /** Injected by RoolClient if omitted. */
+    logger?: Logger;
+    /** Injected by RoolClient if omitted, so auth-state reaches client events. */
+    onAuthStateChanged?: (authenticated: boolean) => void;
+}
+export declare abstract class BaseTokenAuthProvider implements AuthProvider {
+    protected logger: Logger;
+    private _authUrl;
+    private _onAuthStateChanged;
+    private refreshPromise;
+    private refreshTimeoutId;
+    private boundVisibilityHandler;
+    constructor(config?: BaseTokenAuthConfig);
+    setAuthUrl(url: string): void;
+    setLogger(logger: Logger): void;
+    setAuthStateChangedHandler(handler: (authenticated: boolean) => void): void;
+    abstract initialize(): boolean;
+    abstract login(appName: string, params?: Record<string, string>): Promise<void> | void;
+    abstract signup(appName: string, params?: Record<string, string>): Promise<void> | void;
+    /**
+     * Check if user is currently authenticated.
+     *
+     * This reports identity (do we hold credentials), NOT server reachability.
+     * It deliberately does not perform a network refresh: a backend outage must
+     * not read as "logged out". A genuinely invalid/expired refresh token
+     * surfaces later as a 401 on first real use, which clears tokens and fires
+     * onAuthStateChanged(false) — the only path that ends the session.
+     */
+    isAuthenticated(): Promise<boolean>;
+    /**
+     * Get current access token and rool token, refreshing if expired.
+     * Returns undefined if not authenticated.
+     */
+    getTokens(): Promise<{
+        accessToken: string;
+        roolToken: string;
+    } | undefined>;
+    /**
+     * Get auth identity decoded from JWT token.
+     */
+    getAuthUser(): AuthUser;
+    /**
+     * Complete an email verification flow. Exchanges a verify JWT (from the
+     * verification email link) for a fresh token set and signs the user in.
+     */
+    verify(token: string): Promise<boolean>;
+    /**
+     * Logout - clear all tokens and state.
+     */
+    logout(): void;
+    /**
+     * Destroy auth manager - clear refresh timers and listeners.
+     */
+    destroy(): void;
+    /** Auth URL without trailing slash */
+    protected get authBaseUrl(): string;
+    protected notifyAuthState(authenticated: boolean): void;
+    /** Persist a fresh token set and (re)arm the background refresh timer. */
+    protected acceptTokens(accessToken: string, refreshToken: string | null, roolToken: string | null, expiresAt: number): void;
+    /** Arm auto-refresh + visibility re-scheduling. Call from initialize(). */
+    protected initBase(): void;
+    /**
+     * Overridable hook: clear subclass-owned transient state on logout/cancel
+     * (e.g. an in-flight OAuth `state` or PKCE verifier). No-op by default.
+     */
+    protected clearTransientState(): void;
+    protected get storagePrefix(): string;
+    /** Build a storage key scoped to this auth endpoint. */
+    protected keyFor(name: string): string;
+    protected get storageKeys(): {
+        readonly access: `${string}access_token`;
+        readonly refresh: `${string}refresh_token`;
+        readonly rool: `${string}rool_token`;
+        readonly expiresAt: `${string}token_expires_at`;
+    };
+    protected readString(key: string): string | null;
+    protected writeString(key: string, value: string): void;
+    protected removeString(key: string): void;
+    protected scheduleTokenRefresh(): void;
+    protected writeTokens(accessToken: string | null, refreshToken: string | null, expiresAt: number | null): void;
+    protected writeRoolToken(token: string | null): void;
+    protected clearTokens(): void;
+    protected readAccessToken(): string | null;
+    protected readRoolToken(): string;
+    protected readExpiresAt(): number | null;
+    /**
+     * Get a short hash of the auth URL for scoping storage by endpoint.
+     */
+    private get endpointHash();
+    private tryRefreshToken;
+    private listenForVisibility;
+    private cancelScheduledRefresh;
+    private decodeAuthUser;
+}
+//# sourceMappingURL=auth-base.d.ts.map

package/dist/auth-base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-base.d.ts","sourceRoot":"","sources":["../src/auth-base.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,EAAiB,KAAK,MAAM,EAAE,MAAM,aAAa,CAAC;AAKzD,MAAM,WAAW,mBAAmB;IAChC,gFAAgF;IAChF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,OAAO,KAAK,IAAI,CAAC;CACzD;AAED,8BAAsB,qBAAsB,YAAW,YAAY;IAC/D,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,mBAAmB,CAAmC;IAC9D,OAAO,CAAC,cAAc,CAAiC;IACvD,OAAO,CAAC,gBAAgB,CAA8C;IACtE,OAAO,CAAC,sBAAsB,CAA6B;gBAE/C,MAAM,GAAE,mBAAwB;IAS5C,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAI7B,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAI/B,0BAA0B,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE,OAAO,KAAK,IAAI,GAAG,IAAI;IAK3E,QAAQ,CAAC,UAAU,IAAI,OAAO;IAC9B,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IACtF,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI;IAEvF;;;;;;;;OAQG;IACG,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAIzC;;;OAGG;IACG,SAAS,IAAI,OAAO,CAAC;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;IAiBlF;;OAEG;IACH,WAAW,IAAI,QAAQ;IAMvB;;;OAGG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IA4C7C;;OAEG;IACH,MAAM,IAAI,IAAI;IAOd;;OAEG;IACH,OAAO,IAAI,IAAI;IAYf,sCAAsC;IACtC,SAAS,KAAK,WAAW,IAAI,MAAM,CAElC;IAED,SAAS,CAAC,eAAe,CAAC,aAAa,EAAE,OAAO,GAAG,IAAI;IAIvD,0EAA0E;IAC1E,SAAS,CAAC,YAAY,CAClB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,SAAS,EAAE,MAAM,GAClB,IAAI;IAMP,2EAA2E;IAC3E,SAAS,CAAC,QAAQ,IAAI,IAAI;IAK1B;;;OAGG;IACH,SAAS,CAAC,mBAAmB,IAAI,IAAI;IAErC,SAAS,KAAK,aAAa,IAAI,MAAM,CAEpC;IAED,wDAAwD;IACxD,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAItC,SAAS,KAAK,WAAW;;;;;MAQxB;IAED,SAAS,CAAC,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAQhD,SAAS,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAQvD,SAAS,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAQzC,SAAS,CAAC,oBAAoB,IAAI,IAAI;IAmBtC,SAAS,CAAC,WAAW,CACjB,WAAW,EAAE,MAAM,GAAG,IAAI,EAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,EAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,GACzB,IAAI;IAoBP,SAAS,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAQpD,SAAS,CAAC,WAAW,IAAI,IAAI;IAK7B,SAAS,CAAC,eAAe,IAAI,MAAM,GAAG,IAAI;IAI1C,SAAS,CAAC,aAAa,IAAI,MAAM;IAIjC,SAAS,CAAC,aAAa,IAAI,MAAM,GAAG,IAAI;IAWxC;;OAEG;IACH,OAAO,KAAK,YAAY,GAQvB;YAEa,eAAe;IAoE7B,OAAO,CAAC,mBAAmB;IAY3B,OAAO,CAAC,sBAAsB;IAO9B,OAAO,CAAC,cAAc;CAYzB"}

package/dist/auth-base.js

@@ -0,0 +1,377 @@
+// =============================================================================
+// Base token auth provider
+// Shared machinery for browser-style providers: endpoint-scoped localStorage
+// token storage, expiry-aware getTokens with deduplicated background refresh,
+// visibility-driven re-scheduling, and JWT identity decode.
+//
+// Subclasses implement only how a session STARTS (login/signup) and how the
+// callback arrives — BrowserAuthProvider via a URL fragment,
+// NativePkceAuthProvider via a deep link + code exchange. Everything after the
+// tokens land (storage, refresh, decode) is shared here.
+// =============================================================================
+import { defaultLogger } from './logger.js';
+const REFRESH_BUFFER_MS = 15 * 60 * 1000; // Refresh 15 minutes before expiry
+const DEFAULT_STORAGE_PREFIX = 'rool_';
+export class BaseTokenAuthProvider {
+    logger;
+    _authUrl;
+    _onAuthStateChanged;
+    refreshPromise = null;
+    refreshTimeoutId = null;
+    boundVisibilityHandler = null;
+    constructor(config = {}) {
+        this._authUrl = (config.authUrl ?? '').replace(/\/+$/, '');
+        this.logger = config.logger ?? defaultLogger;
+        this._onAuthStateChanged = config.onAuthStateChanged ?? (() => { });
+    }
+    // Injection hooks — RoolClient's AuthManager calls these for providers it
+    // didn't construct itself, so a custom provider gets the resolved auth URL,
+    // logger, and a handler that bridges auth-state to client events.
+    setAuthUrl(url) {
+        this._authUrl = url.replace(/\/+$/, '');
+    }
+    setLogger(logger) {
+        this.logger = logger;
+    }
+    setAuthStateChangedHandler(handler) {
+        this._onAuthStateChanged = handler;
+    }
+    /**
+     * Check if user is currently authenticated.
+     *
+     * This reports identity (do we hold credentials), NOT server reachability.
+     * It deliberately does not perform a network refresh: a backend outage must
+     * not read as "logged out". A genuinely invalid/expired refresh token
+     * surfaces later as a 401 on first real use, which clears tokens and fires
+     * onAuthStateChanged(false) — the only path that ends the session.
+     */
+    async isAuthenticated() {
+        return this.readAccessToken() !== null;
+    }
+    /**
+     * Get current access token and rool token, refreshing if expired.
+     * Returns undefined if not authenticated.
+     */
+    async getTokens() {
+        const accessToken = this.readAccessToken();
+        if (!accessToken)
+            return undefined;
+        // Token expired or about to expire - try refresh
+        const expiresAt = this.readExpiresAt();
+        if (expiresAt && Date.now() >= expiresAt - REFRESH_BUFFER_MS) {
+            const refreshed = await this.tryRefreshToken();
+            if (!refreshed)
+                return undefined;
+            const refreshedToken = this.readAccessToken();
+            if (!refreshedToken)
+                return undefined;
+            return { accessToken: refreshedToken, roolToken: this.readRoolToken() };
+        }
+        return { accessToken, roolToken: this.readRoolToken() };
+    }
+    /**
+     * Get auth identity decoded from JWT token.
+     */
+    getAuthUser() {
+        const accessToken = this.readAccessToken();
+        if (!accessToken)
+            return { email: null, name: null };
+        return this.decodeAuthUser(accessToken);
+    }
+    /**
+     * Complete an email verification flow. Exchanges a verify JWT (from the
+     * verification email link) for a fresh token set and signs the user in.
+     */
+    async verify(token) {
+        let response;
+        try {
+            response = await fetch(`${this.authBaseUrl}/verify-and-signin`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ token }),
+            });
+        }
+        catch (error) {
+            this.logger.error('[RoolClient] verify network error:', error);
+            return false;
+        }
+        if (!response.ok) {
+            this.logger.warn(`[RoolClient] verify failed: ${response.status}`);
+            return false;
+        }
+        let data;
+        try {
+            data = await response.json();
+        }
+        catch (error) {
+            this.logger.error('[RoolClient] verify response parse error:', error);
+            return false;
+        }
+        const idToken = data.id_token ?? null;
+        const refreshToken = data.refresh_token ?? null;
+        const expiresAt = data.expires_in ? Date.now() + data.expires_in * 1000 : NaN;
+        if (!idToken || !Number.isFinite(expiresAt)) {
+            this.logger.error('[RoolClient] verify response missing id_token or expires_in');
+            return false;
+        }
+        this.acceptTokens(idToken, refreshToken, data.rool_token ?? null, expiresAt);
+        this.notifyAuthState(true);
+        return true;
+    }
+    /**
+     * Logout - clear all tokens and state.
+     */
+    logout() {
+        this.clearTokens();
+        this.clearTransientState();
+        this.cancelScheduledRefresh();
+        this.notifyAuthState(false);
+    }
+    /**
+     * Destroy auth manager - clear refresh timers and listeners.
+     */
+    destroy() {
+        this.cancelScheduledRefresh();
+        if (this.boundVisibilityHandler) {
+            document.removeEventListener('visibilitychange', this.boundVisibilityHandler);
+            this.boundVisibilityHandler = null;
+        }
+    }
+    // ===========================================================================
+    // Protected helpers for subclasses
+    // ===========================================================================
+    /** Auth URL without trailing slash */
+    get authBaseUrl() {
+        return this._authUrl;
+    }
+    notifyAuthState(authenticated) {
+        this._onAuthStateChanged(authenticated);
+    }
+    /** Persist a fresh token set and (re)arm the background refresh timer. */
+    acceptTokens(accessToken, refreshToken, roolToken, expiresAt) {
+        this.writeTokens(accessToken, refreshToken, expiresAt);
+        this.writeRoolToken(roolToken);
+        this.scheduleTokenRefresh();
+    }
+    /** Arm auto-refresh + visibility re-scheduling. Call from initialize(). */
+    initBase() {
+        this.scheduleTokenRefresh();
+        this.listenForVisibility();
+    }
+    /**
+     * Overridable hook: clear subclass-owned transient state on logout/cancel
+     * (e.g. an in-flight OAuth `state` or PKCE verifier). No-op by default.
+     */
+    clearTransientState() { }
+    get storagePrefix() {
+        return `${DEFAULT_STORAGE_PREFIX}${this.endpointHash}_`;
+    }
+    /** Build a storage key scoped to this auth endpoint. */
+    keyFor(name) {
+        return `${this.storagePrefix}${name}`;
+    }
+    get storageKeys() {
+        const prefix = this.storagePrefix;
+        return {
+            access: `${prefix}access_token`,
+            refresh: `${prefix}refresh_token`,
+            rool: `${prefix}rool_token`,
+            expiresAt: `${prefix}token_expires_at`,
+        };
+    }
+    readString(key) {
+        try {
+            return localStorage.getItem(key);
+        }
+        catch {
+            return null;
+        }
+    }
+    writeString(key, value) {
+        try {
+            localStorage.setItem(key, value);
+        }
+        catch {
+            // Ignore storage restrictions
+        }
+    }
+    removeString(key) {
+        try {
+            localStorage.removeItem(key);
+        }
+        catch {
+            // Ignore storage restrictions
+        }
+    }
+    scheduleTokenRefresh() {
+        this.cancelScheduledRefresh();
+        const expiresAt = this.readExpiresAt();
+        if (!expiresAt)
+            return;
+        const refreshAt = expiresAt - REFRESH_BUFFER_MS;
+        const delay = refreshAt - Date.now();
+        if (delay <= 0) {
+            // Already needs refresh
+            void this.tryRefreshToken();
+        }
+        else {
+            this.refreshTimeoutId = setTimeout(() => {
+                void this.tryRefreshToken();
+            }, delay);
+        }
+    }
+    writeTokens(accessToken, refreshToken, expiresAt) {
+        if (accessToken) {
+            localStorage.setItem(this.storageKeys.access, accessToken);
+        }
+        else {
+            localStorage.removeItem(this.storageKeys.access);
+        }
+        if (refreshToken) {
+            localStorage.setItem(this.storageKeys.refresh, refreshToken);
+        }
+        else {
+            localStorage.removeItem(this.storageKeys.refresh);
+        }
+        if (expiresAt !== null && Number.isFinite(expiresAt)) {
+            localStorage.setItem(this.storageKeys.expiresAt, Math.floor(expiresAt).toString());
+        }
+        else {
+            localStorage.removeItem(this.storageKeys.expiresAt);
+        }
+    }
+    writeRoolToken(token) {
+        if (token) {
+            localStorage.setItem(this.storageKeys.rool, token);
+        }
+        else {
+            localStorage.removeItem(this.storageKeys.rool);
+        }
+    }
+    clearTokens() {
+        this.writeTokens(null, null, null);
+        this.writeRoolToken(null);
+    }
+    readAccessToken() {
+        return localStorage.getItem(this.storageKeys.access);
+    }
+    readRoolToken() {
+        return localStorage.getItem(this.storageKeys.rool) ?? '';
+    }
+    readExpiresAt() {
+        const raw = localStorage.getItem(this.storageKeys.expiresAt);
+        if (!raw)
+            return null;
+        const parsed = Number.parseInt(raw, 10);
+        return Number.isFinite(parsed) ? parsed : null;
+    }
+    // ===========================================================================
+    // Private
+    // ===========================================================================
+    /**
+     * Get a short hash of the auth URL for scoping storage by endpoint.
+     */
+    get endpointHash() {
+        const url = this.authBaseUrl;
+        // Simple djb2 hash
+        let hash = 5381;
+        for (let i = 0; i < url.length; i++) {
+            hash = ((hash << 5) + hash) ^ url.charCodeAt(i);
+        }
+        return (hash >>> 0).toString(16).padStart(8, '0');
+    }
+    async tryRefreshToken() {
+        // Deduplicate concurrent refresh attempts
+        if (this.refreshPromise) {
+            return this.refreshPromise;
+        }
+        const refreshToken = localStorage.getItem(this.storageKeys.refresh);
+        if (!refreshToken)
+            return false;
+        const roolToken = localStorage.getItem(this.storageKeys.rool);
+        this.refreshPromise = (async () => {
+            let response;
+            try {
+                response = await fetch(`${this.authBaseUrl}/refresh`, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({
+                        refresh_token: refreshToken,
+                        rool_token: roolToken,
+                    }),
+                });
+            }
+            catch (error) {
+                // Network error - don't clear tokens, might work next time
+                this.logger.warn('[RoolClient] Token refresh network error:', error);
+                return false;
+            }
+            // 400/401 = refresh token is invalid, clear everything
+            if (response.status === 400 || response.status === 401) {
+                this.logger.warn('[RoolClient] Refresh token invalid, clearing credentials');
+                this.clearTokens();
+                this.notifyAuthState(false);
+                return false;
+            }
+            // Other HTTP errors - don't clear tokens, might be transient
+            if (!response.ok) {
+                this.logger.warn(`[RoolClient] Token refresh failed: ${response.status} ${response.statusText}`);
+                return false;
+            }
+            // Success - parse and store new tokens
+            try {
+                const data = await response.json();
+                const accessToken = data.id_token ?? null;
+                const nextRefreshToken = data.refresh_token ?? refreshToken;
+                const expiresAt = data.expires_in ? Date.now() + data.expires_in * 1000 : NaN;
+                if (!accessToken || !Number.isFinite(expiresAt)) {
+                    this.logger.error('[RoolClient] Refresh response missing id_token or expires_in');
+                    return false;
+                }
+                this.writeTokens(accessToken, nextRefreshToken, expiresAt);
+                this.writeRoolToken(data.rool_token ?? null);
+                this.scheduleTokenRefresh();
+                return true;
+            }
+            catch (error) {
+                this.logger.error('[RoolClient] Failed to parse refresh response:', error);
+                return false;
+            }
+        })().finally(() => {
+            this.refreshPromise = null;
+        });
+        return this.refreshPromise;
+    }
+    listenForVisibility() {
+        if (typeof document === 'undefined')
+            return;
+        if (this.boundVisibilityHandler)
+            return;
+        this.boundVisibilityHandler = () => {
+            if (document.visibilityState === 'visible') {
+                this.scheduleTokenRefresh();
+            }
+        };
+        document.addEventListener('visibilitychange', this.boundVisibilityHandler);
+    }
+    cancelScheduledRefresh() {
+        if (this.refreshTimeoutId !== null) {
+            clearTimeout(this.refreshTimeoutId);
+            this.refreshTimeoutId = null;
+        }
+    }
+    decodeAuthUser(accessToken) {
+        try {
+            const payload = JSON.parse(atob(accessToken.split('.')[1]));
+            return {
+                email: payload.email || null,
+                name: payload.name || null,
+            };
+        }
+        catch (error) {
+            this.logger.error('[RoolClient] Failed to decode token:', error);
+            return { email: null, name: null };
+        }
+    }
+}
+//# sourceMappingURL=auth-base.js.map

package/dist/auth-base.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-base.js","sourceRoot":"","sources":["../src/auth-base.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,2BAA2B;AAC3B,6EAA6E;AAC7E,8EAA8E;AAC9E,4DAA4D;AAC5D,EAAE;AACF,4EAA4E;AAC5E,6DAA6D;AAC7D,+EAA+E;AAC/E,yDAAyD;AACzD,gFAAgF;AAGhF,OAAO,EAAE,aAAa,EAAe,MAAM,aAAa,CAAC;AAEzD,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,mCAAmC;AAC7E,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAWvC,MAAM,OAAgB,qBAAqB;IAC7B,MAAM,CAAS;IACjB,QAAQ,CAAS;IACjB,mBAAmB,CAAmC;IACtD,cAAc,GAA4B,IAAI,CAAC;IAC/C,gBAAgB,GAAyC,IAAI,CAAC;IAC9D,sBAAsB,GAAwB,IAAI,CAAC;IAE3D,YAAY,SAA8B,EAAE;QACxC,IAAI,CAAC,QAAQ,GAAG,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,aAAa,CAAC;QAC7C,IAAI,CAAC,mBAAmB,GAAG,MAAM,CAAC,kBAAkB,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,0EAA0E;IAC1E,4EAA4E;IAC5E,kEAAkE;IAClE,UAAU,CAAC,GAAW;QAClB,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,SAAS,CAAC,MAAc;QACpB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC;IAED,0BAA0B,CAAC,OAAyC;QAChE,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC;IACvC,CAAC;IAOD;;;;;;;;OAQG;IACH,KAAK,CAAC,eAAe;QACjB,OAAO,IAAI,CAAC,eAAe,EAAE,KAAK,IAAI,CAAC;IAC3C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,SAAS;QACX,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAC3C,IAAI,CAAC,WAAW;YAAE,OAAO,SAAS,CAAC;QAEnC,iDAAiD;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,IAAI,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,GAAG,iBAAiB,EAAE,CAAC;YAC3D,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;YAC/C,IAAI,CAAC,SAAS;gBAAE,OAAO,SAAS,CAAC;YACjC,MAAM,cAAc,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;YAC9C,IAAI,CAAC,cAAc;gBAAE,OAAO,SAAS,CAAC;YACtC,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;QAC5E,CAAC;QAED,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC;IAC5D,CAAC;IAED;;OAEG;IACH,WAAW;QACP,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAC3C,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACrD,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa;QACtB,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACD,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,WAAW,oBAAoB,EAAE;gBAC5D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;aAClC,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,oCAAoC,EAAE,KAAK,CAAC,CAAC;YAC/D,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACnE,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,IAAI,IAKH,CAAC;QACF,IAAI,CAAC;YACD,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;YACtE,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;QACtC,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QAC9E,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;YACjF,OAAO,KAAK,CAAC;QACjB,CAAC;QAED,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,SAAS,CAAC,CAAC;QAC7E,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC;IAChB,CAAC;IAED;;OAEG;IACH,MAAM;QACF,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC3B,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9B,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,OAAO;QACH,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAC9B,IAAI,IAAI,CAAC,sBAAsB,EAAE,CAAC;YAC9B,QAAQ,CAAC,mBAAmB,CAAC,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC;YAC9E,IAAI,CAAC,sBAAsB,GAAG,IAAI,CAAC;QACvC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,mCAAmC;IACnC,8EAA8E;IAE9E,sCAAsC;IACtC,IAAc,WAAW;QACrB,OAAO,IAAI,CAAC,QAAQ,CAAC;IACzB,CAAC;IAES,eAAe,CAAC,aAAsB;QAC5C,IAAI,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC;IAC5C,CAAC;IAED,0EAA0E;IAChE,YAAY,CAClB,WAAmB,EACnB,YAA2B,EAC3B,SAAwB,EACxB,SAAiB;QAEjB,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;QACvD,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QAC/B,IAAI,CAAC,oBAAoB,EAAE,CAAC;IAChC,CAAC;IAED,2EAA2E;IACjE,QAAQ;QACd,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC5B,IAAI,CAAC,mBAAmB,EAAE,CAAC;IAC/B,CAAC;IAED;;;OAGG;IACO,mBAAmB,KAAU,CAAC;IAExC,IAAc,aAAa;QACvB,OAAO,GAAG,sBAAsB,GAAG,IAAI,CAAC,YAAY,GAAG,CAAC;IAC5D,CAAC;IAED,wDAAwD;IAC9C,MAAM,CAAC,IAAY;QACzB,OAAO,GAAG,IAAI,CAAC,aAAa,GAAG,IAAI,EAAE,CAAC;IAC1C,CAAC;IAED,IAAc,WAAW;QACrB,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC;QAClC,OAAO;YACH,MAAM,EAAE,GAAG,MAAM,cAAc;YAC/B,OAAO,EAAE,GAAG,MAAM,eAAe;YACjC,IAAI,EAAE,GAAG,MAAM,YAAY;YAC3B,SAAS,EAAE,GAAG,MAAM,kBAAkB;SAChC,CAAC;IACf,CAAC;IAES,UAAU,CAAC,GAAW;QAC5B,IAAI,CAAC;YACD,OAAO,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IAES,WAAW,CAAC,GAAW,EAAE,KAAa;QAC5C,IAAI,CAAC;YACD,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACL,8BAA8B;QAClC,CAAC;IACL,CAAC;IAES,YAAY,CAAC,GAAW;QAC9B,IAAI,CAAC;YACD,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACL,8BAA8B;QAClC,CAAC;IACL,CAAC;IAES,oBAAoB;QAC1B,IAAI,CAAC,sBAAsB,EAAE,CAAC;QAE9B,MAAM,SAAS,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;QACvC,IAAI,CAAC,SAAS;YAAE,OAAO;QAEvB,MAAM,SAAS,GAAG,SAAS,GAAG,iBAAiB,CAAC;QAChD,MAAM,KAAK,GAAG,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAErC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YACb,wBAAwB;YACxB,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;QAChC,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,gBAAgB,GAAG,UAAU,CAAC,GAAG,EAAE;gBACpC,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC;YAChC,CAAC,EAAE,KAAK,CAAC,CAAC;QACd,CAAC;IACL,CAAC;IAES,WAAW,CACjB,WAA0B,EAC1B,YAA2B,EAC3B,SAAwB;QAExB,IAAI,WAAW,EAAE,CAAC;YACd,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACJ,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC;QAED,IAAI,YAAY,EAAE,CAAC;YACf,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACjE,CAAC;aAAM,CAAC;YACJ,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACnD,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvF,CAAC;aAAM,CAAC;YACJ,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACxD,CAAC;IACL,CAAC;IAES,cAAc,CAAC,KAAoB;QACzC,IAAI,KAAK,EAAE,CAAC;YACR,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACJ,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;IACL,CAAC;IAES,WAAW;QACjB,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAES,eAAe;QACrB,OAAO,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC;IAES,aAAa;QACnB,OAAO,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAC7D,CAAC;IAES,aAAa;QACnB,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QAC7D,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACnD,CAAC;IAED,8EAA8E;IAC9E,UAAU;IACV,8EAA8E;IAE9E;;OAEG;IACH,IAAY,YAAY;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC;QAC7B,mBAAmB;QACnB,IAAI,IAAI,GAAG,IAAI,CAAC;QAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAClC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtD,CAAC;IAEO,KAAK,CAAC,eAAe;QACzB,0CAA0C;QAC1C,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,cAAc,CAAC;QAC/B,CAAC;QAED,MAAM,YAAY,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACpE,IAAI,CAAC,YAAY;YAAE,OAAO,KAAK,CAAC;QAChC,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAE9D,IAAI,CAAC,cAAc,GAAG,CAAC,KAAK,IAAI,EAAE;YAC9B,IAAI,QAAkB,CAAC;YACvB,IAAI,CAAC;gBACD,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,WAAW,UAAU,EAAE;oBAClD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;oBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;wBACjB,aAAa,EAAE,YAAY;wBAC3B,UAAU,EAAE,SAAS;qBACxB,CAAC;iBACL,CAAC,CAAC;YACP,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,2DAA2D;gBAC3D,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;gBACrE,OAAO,KAAK,CAAC;YACjB,CAAC;YAED,uDAAuD;YACvD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACrD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0DAA0D,CAAC,CAAC;gBAC7E,IAAI,CAAC,WAAW,EAAE,CAAC;gBACnB,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;gBAC5B,OAAO,KAAK,CAAC;YACjB,CAAC;YAED,6DAA6D;YAC7D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,sCAAsC,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;gBACjG,OAAO,KAAK,CAAC;YACjB,CAAC;YAED,uCAAuC;YACvC,IAAI,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBACnC,MAAM,WAAW,GAAkB,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC;gBACzD,MAAM,gBAAgB,GAAkB,IAAI,CAAC,aAAa,IAAI,YAAY,CAAC;gBAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;gBAE9E,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;oBAC9C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,8DAA8D,CAAC,CAAC;oBAClF,OAAO,KAAK,CAAC;gBACjB,CAAC;gBAED,IAAI,CAAC,WAAW,CAAC,WAAW,EAAE,gBAAgB,EAAE,SAAS,CAAC,CAAC;gBAC3D,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC;gBAC7C,IAAI,CAAC,oBAAoB,EAAE,CAAC;gBAC5B,OAAO,IAAI,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gDAAgD,EAAE,KAAK,CAAC,CAAC;gBAC3E,OAAO,KAAK,CAAC;YACjB,CAAC;QACL,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACd,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC/B,CAAC,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC,cAAc,CAAC;IAC/B,CAAC;IAEO,mBAAmB;QACvB,IAAI,OAAO,QAAQ,KAAK,WAAW;YAAE,OAAO;QAC5C,IAAI,IAAI,CAAC,sBAAsB;YAAE,OAAO;QAExC,IAAI,CAAC,sBAAsB,GAAG,GAAG,EAAE;YAC/B,IAAI,QAAQ,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;gBACzC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAChC,CAAC;QACL,CAAC,CAAC;QACF,QAAQ,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC/E,CAAC;IAEO,sBAAsB;QAC1B,IAAI,IAAI,CAAC,gBAAgB,KAAK,IAAI,EAAE,CAAC;YACjC,YAAY,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACpC,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QACjC,CAAC;IACL,CAAC;IAEO,cAAc,CAAC,WAAmB;QACtC,IAAI,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5D,OAAO;gBACH,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;gBAC5B,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,IAAI;aAC7B,CAAC;QACN,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;YACjE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;QACvC,CAAC;IACL,CAAC;CACJ"}