@smileid/usesmileid 12.0.0-beta01

package/dist/data/api/interceptors/gzip_interceptor.d.ts

@@ -0,0 +1,21 @@
+import type { Interceptor } from "../../../core/models/network_config";
+/**
+ * Interceptor that stamps `Accept-Encoding: gzip` on every outbound
+ * request so the server is invited to gzip its response. This is the
+ * same hint-only strategy iOS's `GzipRequestInterceptor` uses.
+ *
+ * Why hint-only on RN:
+ * - axios in React Native does not natively compress outbound bodies.
+ * - The SDK avoids pulling in a JS gzip dependency (`pako` etc.)
+ *   because every additional bundle byte ships to every partner app.
+ * - Stamping `Content-Encoding: gzip` without actually gzipping the
+ *   body — the prior behavior of this interceptor — was wrong: the
+ *   header told the server the body was gzipped when it was not.
+ *   Servers strict-parsing the header would reject the request.
+ *
+ * Partners whose backends require true request-body compression
+ * should add their own compressing interceptor in front of the SDK's
+ * network stack.
+ */
+export declare function createGzipInterceptor(): Interceptor;
+//# sourceMappingURL=gzip_interceptor.d.ts.map

package/dist/data/api/interceptors/gzip_interceptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gzip_interceptor.d.ts","sourceRoot":"","sources":["../../../../src/data/api/interceptors/gzip_interceptor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAEvE;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,IAAI,WAAW,CASnD"}

package/dist/data/api/interceptors/gzip_interceptor.js

@@ -0,0 +1,29 @@
+/**
+ * Interceptor that stamps `Accept-Encoding: gzip` on every outbound
+ * request so the server is invited to gzip its response. This is the
+ * same hint-only strategy iOS's `GzipRequestInterceptor` uses.
+ *
+ * Why hint-only on RN:
+ * - axios in React Native does not natively compress outbound bodies.
+ * - The SDK avoids pulling in a JS gzip dependency (`pako` etc.)
+ *   because every additional bundle byte ships to every partner app.
+ * - Stamping `Content-Encoding: gzip` without actually gzipping the
+ *   body — the prior behavior of this interceptor — was wrong: the
+ *   header told the server the body was gzipped when it was not.
+ *   Servers strict-parsing the header would reject the request.
+ *
+ * Partners whose backends require true request-body compression
+ * should add their own compressing interceptor in front of the SDK's
+ * network stack.
+ */
+export function createGzipInterceptor() {
+    return {
+        attach(client) {
+            client.interceptors.request.use((requestConfig) => {
+                requestConfig.headers.set("Accept-Encoding", "gzip");
+                return requestConfig;
+            });
+        },
+    };
+}
+//# sourceMappingURL=gzip_interceptor.js.map

package/dist/data/api/interceptors/gzip_interceptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gzip_interceptor.js","sourceRoot":"","sources":["../../../../src/data/api/interceptors/gzip_interceptor.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO;QACL,MAAM,CAAC,MAAqB;YAC1B,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,aAAa,EAAE,EAAE;gBAChD,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;gBACrD,OAAO,aAAa,CAAC;YACvB,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/data/api/interceptors/logging_interceptor.d.ts

@@ -0,0 +1,26 @@
+import type { AxiosInstance } from "axios";
+import { type NetworkLoggingConfig } from "../../../core/models/network_config";
+/**
+ * Logging interceptor.
+ *
+ * Levels:
+ *   - `none`:    silent
+ *   - `basic`:   request line + response status line
+ *   - `headers`: basic + request/response headers (with redaction)
+ *   - `body`:    headers + response body / error body (request body
+ *                is large — multipart binaries — and not logged)
+ *
+ * Header redaction: the auth interceptor adds sensitive headers
+ * (`SmileID-Token`, `smileid-partner-id`) and partners can extend
+ * the redaction list via
+ * `n.logging((l) => { l.redactHeaders = ['x-proxy-secret']; })`.
+ *
+ * One concrete security guard: redact list is case-insensitive —
+ * partners pass `'x-Partner-Token'` and we redact `'x-partner-token'`
+ * too.
+ */
+export declare function attachLoggingInterceptor(client: AxiosInstance, config: NetworkLoggingConfig): {
+    request: number;
+    response: number;
+};
+//# sourceMappingURL=logging_interceptor.d.ts.map

package/dist/data/api/interceptors/logging_interceptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging_interceptor.d.ts","sourceRoot":"","sources":["../../../../src/data/api/interceptors/logging_interceptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EAId,MAAM,OAAO,CAAC;AACf,OAAO,EAEL,KAAK,oBAAoB,EAC1B,MAAM,qCAAqC,CAAC;AAG7C;;;;;;;;;;;;;;;;;;GAkBG;AAKH,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,aAAa,EACrB,MAAM,EAAE,oBAAoB,GAC3B;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CA6BvC"}

package/dist/data/api/interceptors/logging_interceptor.js

@@ -0,0 +1,108 @@
+import { LogLevel, } from "../../../core/models/network_config";
+import { ALWAYS_REDACT, ALWAYS_REDACT_BODY_KEYS } from "./sensitive_headers";
+/**
+ * Logging interceptor.
+ *
+ * Levels:
+ *   - `none`:    silent
+ *   - `basic`:   request line + response status line
+ *   - `headers`: basic + request/response headers (with redaction)
+ *   - `body`:    headers + response body / error body (request body
+ *                is large — multipart binaries — and not logged)
+ *
+ * Header redaction: the auth interceptor adds sensitive headers
+ * (`SmileID-Token`, `smileid-partner-id`) and partners can extend
+ * the redaction list via
+ * `n.logging((l) => { l.redactHeaders = ['x-proxy-secret']; })`.
+ *
+ * One concrete security guard: redact list is case-insensitive —
+ * partners pass `'x-Partner-Token'` and we redact `'x-partner-token'`
+ * too.
+ */
+// Canonical redact set lives in a dedicated module so a new sensitive
+// header can be added in one place and picked up by every logging path.
+export function attachLoggingInterceptor(client, config) {
+    if (!config.enabled || config.level === LogLevel.none) {
+        // Attach no-op interceptors so `eject(...)` calls match.
+        const noopReq = client.interceptors.request.use((c) => c);
+        const noopRes = client.interceptors.response.use((r) => r);
+        return { request: noopReq, response: noopRes };
+    }
+    const partnerRedact = new Set(config.redactHeaders.map((h) => h.toLowerCase()));
+    const requestId = client.interceptors.request.use((c) => {
+        logRequest(c, config.level, partnerRedact);
+        return c;
+    });
+    const responseId = client.interceptors.response.use((response) => {
+        logResponse(response, config.level);
+        return response;
+    }, (error) => {
+        logError(error, config.level);
+        return Promise.reject(error);
+    });
+    return { request: requestId, response: responseId };
+}
+function logRequest(config, level, partnerRedact) {
+    const method = (config.method ?? "GET").toUpperCase();
+    const url = `${config.baseURL ?? ""}${config.url ?? ""}`;
+    // eslint-disable-next-line no-console
+    console.log(`[UseSmileID] → ${method} ${url}`);
+    if (level === LogLevel.headers || level === LogLevel.body) {
+        const redacted = redactHeaders(config.headers, partnerRedact);
+        // eslint-disable-next-line no-console
+        console.log("[UseSmileID]   headers:", redacted);
+    }
+}
+function logResponse(response, level) {
+    // eslint-disable-next-line no-console
+    console.log(`[UseSmileID] ← ${response.status} ${response.statusText} ${response.config.url ?? ""}`);
+    if (level === LogLevel.body) {
+        // eslint-disable-next-line no-console
+        console.log("[UseSmileID]   body:", redactBody(response.data));
+    }
+}
+function logError(error, level) {
+    const status = error.response?.status ?? "no-response";
+    // eslint-disable-next-line no-console
+    console.warn(`[UseSmileID] ✗ ${status} ${error.config?.url ?? ""} — ${error.message}`);
+    if (level === LogLevel.body && error.response) {
+        // eslint-disable-next-line no-console
+        console.warn("[UseSmileID]   body:", redactBody(error.response.data));
+    }
+}
+const MAX_REDACT_DEPTH = 6;
+/**
+ * Copy of `data` safe to log — sensitive keys masked, recursion capped
+ * at {@link MAX_REDACT_DEPTH}. Never mutates the input.
+ */
+function redactBody(data, depth = 0) {
+    if (depth >= MAX_REDACT_DEPTH)
+        return "<depth-limit>";
+    if (Array.isArray(data)) {
+        return data.map((item) => redactBody(item, depth + 1));
+    }
+    if (data !== null && typeof data === "object") {
+        const out = {};
+        for (const [key, value] of Object.entries(data)) {
+            out[key] = ALWAYS_REDACT_BODY_KEYS.has(key.toLowerCase())
+                ? "<redacted>"
+                : redactBody(value, depth + 1);
+        }
+        return out;
+    }
+    return data;
+}
+function redactHeaders(headers, partnerRedact) {
+    const out = {};
+    for (const [key, value] of Object.entries(headers ?? {})) {
+        const lower = key.toLowerCase();
+        if (ALWAYS_REDACT.has(lower) || partnerRedact.has(lower)) {
+            out[key] = "<redacted>";
+        }
+        else {
+            out[key] = value;
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=logging_interceptor.js.map

package/dist/data/api/interceptors/logging_interceptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging_interceptor.js","sourceRoot":"","sources":["../../../../src/data/api/interceptors/logging_interceptor.ts"],"names":[],"mappings":"AAMA,OAAO,EACL,QAAQ,GAET,MAAM,qCAAqC,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAE7E;;;;;;;;;;;;;;;;;;GAkBG;AAEH,sEAAsE;AACtE,wEAAwE;AAExE,MAAM,UAAU,wBAAwB,CACtC,MAAqB,EACrB,MAA4B;IAE5B,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtD,yDAAyD;QACzD,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3D,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,MAAM,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CACjD,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACtD,UAAU,CAAC,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QAC3C,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,CACjD,CAAC,QAAQ,EAAE,EAAE;QACX,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACpC,OAAO,QAAQ,CAAC;IAClB,CAAC,EACD,CAAC,KAAiB,EAAE,EAAE;QACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC,CACF,CAAC;IAEF,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;AACtD,CAAC;AAED,SAAS,UAAU,CACjB,MAAkC,EAClC,KAAoC,EACpC,aAAkC;IAElC,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IACtD,MAAM,GAAG,GAAG,GAAG,MAAM,CAAC,OAAO,IAAI,EAAE,GAAG,MAAM,CAAC,GAAG,IAAI,EAAE,EAAE,CAAC;IACzD,sCAAsC;IACtC,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;IAC/C,IAAI,KAAK,KAAK,QAAQ,CAAC,OAAO,IAAI,KAAK,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC1D,MAAM,QAAQ,GAAG,aAAa,CAC5B,MAAM,CAAC,OAA6C,EACpD,aAAa,CACd,CAAC;QACF,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAC;IACnD,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,QAAuB,EACvB,KAAoC;IAEpC,sCAAsC;IACtC,OAAO,CAAC,GAAG,CACT,kBAAkB,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,EAAE,CACxF,CAAC;IACF,IAAI,KAAK,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5B,sCAAsC;QACtC,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CACf,KAAiB,EACjB,KAAoC;IAEpC,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,EAAE,MAAM,IAAI,aAAa,CAAC;IACvD,sCAAsC;IACtC,OAAO,CAAC,IAAI,CACV,kBAAkB,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,GAAG,IAAI,EAAE,MAAM,KAAK,CAAC,OAAO,EAAE,CACzE,CAAC;IACF,IAAI,KAAK,KAAK,QAAQ,CAAC,IAAI,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC9C,sCAAsC;QACtC,OAAO,CAAC,IAAI,CAAC,sBAAsB,EAAE,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,MAAM,gBAAgB,GAAG,CAAC,CAAC;AAE3B;;;GAGG;AACH,SAAS,UAAU,CAAC,IAAa,EAAE,QAAgB,CAAC;IAClD,IAAI,KAAK,IAAI,gBAAgB;QAAE,OAAO,eAAe,CAAC;IACtD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC9C,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,GAAG,CAAC,GAAG,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACvD,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QACnC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,aAAa,CACpB,OAAgC,EAChC,aAAkC;IAElC,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAChC,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACzD,GAAG,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;QAC1B,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/data/api/interceptors/sensitive_headers.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Canonical list of HTTP headers the SDK redacts unconditionally from
+ * any partner-visible log line, regardless of whether the partner
+ * remembered to populate `redactHeaders` themselves.
+ *
+ * These headers carry credentials, session tokens, or partner-id signals
+ * that would let a bystander reading the console output impersonate the
+ * partner's backend. The logging interceptor replaces the value with
+ * `██` while preserving the header name, so the audit trail still
+ * shows the header was present.
+ *
+ * Partners can extend this set via
+ * `n.logging((l) => { l.redactHeaders = ['x-partner-proxy-secret']; })` —
+ * the auto-applied + partner-supplied lists are unioned before logging.
+ *
+ * Names are stored lowercase; the logging interceptor matches
+ * case-insensitively.
+ */
+export declare const ALWAYS_REDACT: ReadonlySet<string>;
+/**
+ * JSON body fields redacted unconditionally from `LogLevel.body` log
+ * lines — credentials the server may echo back (token exchange,
+ * signed-response envelopes). Matched case-insensitively by full key.
+ */
+export declare const ALWAYS_REDACT_BODY_KEYS: ReadonlySet<string>;
+//# sourceMappingURL=sensitive_headers.d.ts.map

package/dist/data/api/interceptors/sensitive_headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive_headers.d.ts","sourceRoot":"","sources":["../../../../src/data/api/interceptors/sensitive_headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,eAAO,MAAM,aAAa,EAAE,WAAW,CAAC,MAAM,CAU7C,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,uBAAuB,EAAE,WAAW,CAAC,MAAM,CAUvD,CAAC"}

package/dist/data/api/interceptors/sensitive_headers.js

@@ -0,0 +1,42 @@
+/**
+ * Canonical list of HTTP headers the SDK redacts unconditionally from
+ * any partner-visible log line, regardless of whether the partner
+ * remembered to populate `redactHeaders` themselves.
+ *
+ * These headers carry credentials, session tokens, or partner-id signals
+ * that would let a bystander reading the console output impersonate the
+ * partner's backend. The logging interceptor replaces the value with
+ * `██` while preserving the header name, so the audit trail still
+ * shows the header was present.
+ *
+ * Partners can extend this set via
+ * `n.logging((l) => { l.redactHeaders = ['x-partner-proxy-secret']; })` —
+ * the auto-applied + partner-supplied lists are unioned before logging.
+ *
+ * Names are stored lowercase; the logging interceptor matches
+ * case-insensitively.
+ */
+export const ALWAYS_REDACT = new Set([
+    "smileid-token",
+    "smileid-partner-id",
+    "smileid-api-key",
+    "smileid-device-nonce",
+    "authorization",
+    "cookie",
+    "set-cookie",
+].map((h) => h.toLowerCase()));
+/**
+ * JSON body fields redacted unconditionally from `LogLevel.body` log
+ * lines — credentials the server may echo back (token exchange,
+ * signed-response envelopes). Matched case-insensitively by full key.
+ */
+export const ALWAYS_REDACT_BODY_KEYS = new Set([
+    "token",
+    "api_key",
+    "apikey",
+    "signature",
+    "secret",
+    "authorization",
+    "session_id",
+].map((k) => k.toLowerCase()));
+//# sourceMappingURL=sensitive_headers.js.map

package/dist/data/api/interceptors/sensitive_headers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive_headers.js","sourceRoot":"","sources":["../../../../src/data/api/interceptors/sensitive_headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,aAAa,GAAwB,IAAI,GAAG,CACvD;IACE,eAAe;IACf,oBAAoB;IACpB,iBAAiB;IACjB,sBAAsB;IACtB,eAAe;IACf,QAAQ;IACR,YAAY;CACb,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAC9B,CAAC;AAEF;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CACjE;IACE,OAAO;IACP,SAAS;IACT,QAAQ;IACR,WAAW;IACX,QAAQ;IACR,eAAe;IACf,YAAY;CACb,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAC9B,CAAC"}

package/dist/data/api/interceptors/smile_auth_interceptor.d.ts

@@ -0,0 +1,22 @@
+import type { AxiosInstance } from "axios";
+import type { PartnerConfig } from "../../../core/models/network_config";
+import type { TokenHolder } from "../auth/token_holder";
+export type SmileAuthInterceptorOptions = {
+    readonly partnerConfig: PartnerConfig;
+    readonly tokenHolder: TokenHolder;
+};
+export declare class SmileAuthInterceptor {
+    private readonly _partnerConfig;
+    private readonly _tokenHolder;
+    constructor(options: SmileAuthInterceptorOptions);
+    /**
+     * Attach to an axios instance. Returns the interceptor ID so the
+     * caller can detach later if needed (typically just on instance
+     * disposal — the interceptor's lifetime tracks the instance).
+     */
+    attach(client: AxiosInstance): {
+        request: number;
+    };
+    private _onRequest;
+}
+//# sourceMappingURL=smile_auth_interceptor.d.ts.map

package/dist/data/api/interceptors/smile_auth_interceptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"smile_auth_interceptor.d.ts","sourceRoot":"","sources":["../../../../src/data/api/interceptors/smile_auth_interceptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAA8B,MAAM,OAAO,CAAC;AAGvE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAEzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AAwCxD,MAAM,MAAM,2BAA2B,GAAG;IACxC,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAC;IACtC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;CACnC,CAAC;AAEF,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAgB;IAC/C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAc;gBAE/B,OAAO,EAAE,2BAA2B;IAKhD;;;;OAIG;IACH,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE;YAOpC,UAAU;CAgBzB"}

package/dist/data/api/interceptors/smile_auth_interceptor.js

@@ -0,0 +1,71 @@
+import { Platform } from "react-native";
+import { currentRequestTimestamp } from "../../security/request_timestamp";
+/**
+ * Auth interceptor.
+ *
+ * Responsibilities:
+ *   1. Stamp the partner-supplied auth token onto every outbound
+ *      request as the `smileid-token` header.
+ *   2. Add the canonical SDK identification headers
+ *      (`smileid-source-sdk`, `smileid-source-sdk-version`,
+ *      `smileid-partner-id`, `callback-url`).
+ *   3. Stamp `smileid-request-timestamp` (epoch ms) before the request-MAC
+ *      interceptor runs, so it is part of the signed `smileid-*` set and the
+ *      MAC reuses it as the salt.
+ *
+ * Token exchange is the partner application's responsibility — it
+ * fetches a short-lived v3 token from its own backend and supplies the
+ * result via the network DSL's `config.token`. The interceptor reads
+ * the current value from the shared {@link TokenHolder} so a refreshed
+ * value written by `TokenRefreshInterceptor` is observed automatically
+ * by the next outgoing request.
+ */
+const SDK_VERSION = "12.0.0-beta01";
+/**
+ * Source-SDK identifier, suffixed with the runtime platform so the server can
+ * attribute the request and resolve the matching per-SDK signing secret.
+ */
+function sourceSdk() {
+    switch (Platform.OS) {
+        case "android":
+            return "react-native-expo (android)";
+        case "ios":
+            return "react-native-expo (iOS)";
+        default:
+            return "react-native-expo";
+    }
+}
+export class SmileAuthInterceptor {
+    _partnerConfig;
+    _tokenHolder;
+    constructor(options) {
+        this._partnerConfig = options.partnerConfig;
+        this._tokenHolder = options.tokenHolder;
+    }
+    /**
+     * Attach to an axios instance. Returns the interceptor ID so the
+     * caller can detach later if needed (typically just on instance
+     * disposal — the interceptor's lifetime tracks the instance).
+     */
+    attach(client) {
+        const requestId = client.interceptors.request.use(async (config) => {
+            return this._onRequest(config);
+        });
+        return { request: requestId };
+    }
+    async _onRequest(config) {
+        config.headers.set("smileid-token", this._tokenHolder.current);
+        config.headers.set("smileid-source-sdk", sourceSdk());
+        config.headers.set("smileid-source-sdk-version", SDK_VERSION);
+        config.headers.set("smileid-partner-id", this._partnerConfig.partnerId);
+        if (this._partnerConfig.callbackUrl) {
+            config.headers.set("callback-url", this._partnerConfig.callbackUrl);
+        }
+        // Generated at request time and stamped before the request-MAC interceptor
+        // runs, so it is part of the signed `smileid-*` header set and the MAC
+        // reuses the same value as its salt rather than reading the clock again.
+        config.headers.set("smileid-request-timestamp", currentRequestTimestamp());
+        return config;
+    }
+}
+//# sourceMappingURL=smile_auth_interceptor.js.map

package/dist/data/api/interceptors/smile_auth_interceptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"smile_auth_interceptor.js","sourceRoot":"","sources":["../../../../src/data/api/interceptors/smile_auth_interceptor.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAGxC,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAG3E;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,MAAM,WAAW,GAAG,eAAe,CAAC;AAEpC;;;GAGG;AACH,SAAS,SAAS;IAChB,QAAQ,QAAQ,CAAC,EAAE,EAAE,CAAC;QACpB,KAAK,SAAS;YACZ,OAAO,6BAA6B,CAAC;QACvC,KAAK,KAAK;YACR,OAAO,yBAAyB,CAAC;QACnC;YACE,OAAO,mBAAmB,CAAC;IAC/B,CAAC;AACH,CAAC;AAOD,MAAM,OAAO,oBAAoB;IACd,cAAc,CAAgB;IAC9B,YAAY,CAAc;IAE3C,YAAY,OAAoC;QAC9C,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;QAC5C,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;IAC1C,CAAC;IAED;;;;OAIG;IACH,MAAM,CAAC,MAAqB;QAC1B,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACjE,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,MAAkC;QAElC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAC/D,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,SAAS,EAAE,CAAC,CAAC;QACtD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,WAAW,CAAC,CAAC;QAC9D,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC;QACxE,IAAI,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,CAAC;YACpC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACtE,CAAC;QACD,2EAA2E;QAC3E,uEAAuE;QACvE,yEAAyE;QACzE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,uBAAuB,EAAE,CAAC,CAAC;QAC3E,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/data/api/interceptors/smile_integrity_interceptor.d.ts

@@ -0,0 +1,39 @@
+import type { AxiosInstance } from "axios";
+/**
+ * Stamps the `smileid-device-nonce` header on every outbound request
+ * whose axios config declares `_useSmileIDAttestation: true`. The
+ * header carries the base64-encoded envelope from
+ * `Attestation.requestToken`, bound to the `smileid-request-mac`
+ * value set upstream by `SmileRequestMacInterceptor`.
+ *
+ * Native side (Play Integrity on Android, App Attest on iOS) is
+ * already wired through `usesmileid_bridge`'s Expo module; this
+ * interceptor is a thin TS-side coordinator that:
+ *
+ *   1. Skips requests that don't opt in via `_useSmileIDAttestation`.
+ *   2. Reads the upstream `smileid-request-mac` header. If missing
+ *      (e.g. the endpoint opted into attestation but not MAC), ships
+ *      unattested — the integrity guarantee is the body binding, so
+ *      a stamped nonce without a MAC adds noise rather than security.
+ *   3. Calls `Attestation.requestToken(macHeader)`.
+ *   4. On success → stamp `smileid-device-nonce: <token>`.
+ *   5. On `AttestationException` → stamp
+ *      `smileid-device-nonce: ERR_<urlEncoded>`. **Fail-open by
+ *      design**: failing closed on the client means an outage at
+ *      Google / Apple takes the SDK offline; the server logs the
+ *      failure mode and decides policy.
+ *
+ * Warm-up lives outside the interceptor. Call `Attestation.warmUp()`
+ * once at flow mount so the per-request `requestToken` call doesn't
+ * pay the multi-second warm-up cost on every submission.
+ */
+export declare const DEVICE_NONCE_HEADER = "smileid-device-nonce";
+/** Axios config key that opts a request into attestation stamping. */
+export declare const ATTESTATION_OPT_IN_KEY = "_useSmileIDAttestation";
+export declare class SmileIntegrityInterceptor {
+    attach(client: AxiosInstance): {
+        request: number;
+    };
+    private _onRequest;
+}
+//# sourceMappingURL=smile_integrity_interceptor.d.ts.map

package/dist/data/api/interceptors/smile_integrity_interceptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"smile_integrity_interceptor.d.ts","sourceRoot":"","sources":["../../../../src/data/api/interceptors/smile_integrity_interceptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAA8B,MAAM,OAAO,CAAC;AAMvE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,eAAO,MAAM,mBAAmB,yBAAyB,CAAC;AAE1D,sEAAsE;AACtE,eAAO,MAAM,sBAAsB,2BAA2B,CAAC;AAE/D,qBAAa,yBAAyB;IACpC,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE;YAOpC,UAAU;CAwBzB"}

package/dist/data/api/interceptors/smile_integrity_interceptor.js

@@ -0,0 +1,66 @@
+import { Attestation, AttestationException } from "@smileid/usesmileid_bridge";
+import { REQUEST_MAC_HEADER } from "./smile_request_mac_interceptor";
+/**
+ * Stamps the `smileid-device-nonce` header on every outbound request
+ * whose axios config declares `_useSmileIDAttestation: true`. The
+ * header carries the base64-encoded envelope from
+ * `Attestation.requestToken`, bound to the `smileid-request-mac`
+ * value set upstream by `SmileRequestMacInterceptor`.
+ *
+ * Native side (Play Integrity on Android, App Attest on iOS) is
+ * already wired through `usesmileid_bridge`'s Expo module; this
+ * interceptor is a thin TS-side coordinator that:
+ *
+ *   1. Skips requests that don't opt in via `_useSmileIDAttestation`.
+ *   2. Reads the upstream `smileid-request-mac` header. If missing
+ *      (e.g. the endpoint opted into attestation but not MAC), ships
+ *      unattested — the integrity guarantee is the body binding, so
+ *      a stamped nonce without a MAC adds noise rather than security.
+ *   3. Calls `Attestation.requestToken(macHeader)`.
+ *   4. On success → stamp `smileid-device-nonce: <token>`.
+ *   5. On `AttestationException` → stamp
+ *      `smileid-device-nonce: ERR_<urlEncoded>`. **Fail-open by
+ *      design**: failing closed on the client means an outage at
+ *      Google / Apple takes the SDK offline; the server logs the
+ *      failure mode and decides policy.
+ *
+ * Warm-up lives outside the interceptor. Call `Attestation.warmUp()`
+ * once at flow mount so the per-request `requestToken` call doesn't
+ * pay the multi-second warm-up cost on every submission.
+ */
+export const DEVICE_NONCE_HEADER = "smileid-device-nonce";
+/** Axios config key that opts a request into attestation stamping. */
+export const ATTESTATION_OPT_IN_KEY = "_useSmileIDAttestation";
+export class SmileIntegrityInterceptor {
+    attach(client) {
+        const requestId = client.interceptors.request.use(async (config) => {
+            return this._onRequest(config);
+        });
+        return { request: requestId };
+    }
+    async _onRequest(config) {
+        const optedIn = config[ATTESTATION_OPT_IN_KEY] === true;
+        if (!optedIn)
+            return config;
+        const macHeader = config.headers.get(REQUEST_MAC_HEADER);
+        if (typeof macHeader !== "string")
+            return config;
+        try {
+            const token = await Attestation.requestToken(macHeader);
+            config.headers.set(DEVICE_NONCE_HEADER, token);
+        }
+        catch (error) {
+            const message = errorMessage(error);
+            config.headers.set(DEVICE_NONCE_HEADER, `ERR_${encodeURIComponent(message)}`);
+        }
+        return config;
+    }
+}
+function errorMessage(error) {
+    if (error instanceof AttestationException)
+        return error.message;
+    if (error instanceof Error)
+        return error.message;
+    return String(error);
+}
+//# sourceMappingURL=smile_integrity_interceptor.js.map

package/dist/data/api/interceptors/smile_integrity_interceptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"smile_integrity_interceptor.js","sourceRoot":"","sources":["../../../../src/data/api/interceptors/smile_integrity_interceptor.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAE/E,OAAO,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAErE;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAE1D,sEAAsE;AACtE,MAAM,CAAC,MAAM,sBAAsB,GAAG,wBAAwB,CAAC;AAE/D,MAAM,OAAO,yBAAyB;IACpC,MAAM,CAAC,MAAqB;QAC1B,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACjE,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,MAAkC;QAElC,MAAM,OAAO,GACV,MAA+D,CAC9D,sBAAsB,CACvB,KAAK,IAAI,CAAC;QACb,IAAI,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QAE5B,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QACzD,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YACxD,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,OAAO,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;YACpC,MAAM,CAAC,OAAO,CAAC,GAAG,CAChB,mBAAmB,EACnB,OAAO,kBAAkB,CAAC,OAAO,CAAC,EAAE,CACrC,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,IAAI,KAAK,YAAY,oBAAoB;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IAChE,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACjD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC"}

package/dist/data/api/interceptors/smile_request_mac_interceptor.d.ts

@@ -0,0 +1,34 @@
+import type { AxiosInstance } from "axios";
+import type { SmileIDCryptoManager } from "../../security/smile_id_crypto_manager";
+/**
+ * Stamps the `smileid-request-mac` header on every outbound request whose axios
+ * config declares `_useSmileIDRequestMac: true`. The value is computed by
+ * {@link SmileIDCryptoManager}: an HMAC-SHA256 over the canonicalised
+ * `smileid-*` headers and request body, keyed by a PBKDF2-derived key from the
+ * Arkana signing secret, Base64-encoded.
+ *
+ * The MAC is salted with the request timestamp, which is stamped upstream by
+ * `SmileAuthInterceptor` and carried as the signed `smileid-request-timestamp`
+ * header. This interceptor reuses that value as the single source of truth for
+ * the salt; if it is absent (a MAC endpoint that is not auth-annotated — a
+ * misconfiguration), the request is left unsigned for the server to reject
+ * rather than signed against an invented timestamp.
+ *
+ * Requests without the opt-in flag pass through unchanged.
+ */
+export declare const REQUEST_MAC_HEADER = "smileid-request-mac";
+export declare const REQUEST_TIMESTAMP_HEADER = "smileid-request-timestamp";
+/** Axios config key that opts a request into MAC stamping. */
+export declare const REQUEST_MAC_OPT_IN_KEY = "_useSmileIDRequestMac";
+export type SmileRequestMacInterceptorOptions = {
+    readonly cryptoManager: SmileIDCryptoManager;
+};
+export declare class SmileRequestMacInterceptor {
+    private readonly _cryptoManager;
+    constructor(options: SmileRequestMacInterceptorOptions);
+    attach(client: AxiosInstance): {
+        request: number;
+    };
+    private _onRequest;
+}
+//# sourceMappingURL=smile_request_mac_interceptor.d.ts.map

package/dist/data/api/interceptors/smile_request_mac_interceptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"smile_request_mac_interceptor.d.ts","sourceRoot":"","sources":["../../../../src/data/api/interceptors/smile_request_mac_interceptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAA8B,MAAM,OAAO,CAAC;AAGvE,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAEnF;;;;;;;;;;;;;;;GAeG;AAEH,eAAO,MAAM,kBAAkB,wBAAwB,CAAC;AACxD,eAAO,MAAM,wBAAwB,8BAA8B,CAAC;AAEpE,8DAA8D;AAC9D,eAAO,MAAM,sBAAsB,0BAA0B,CAAC;AAE9D,MAAM,MAAM,iCAAiC,GAAG;IAC9C,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAC;CAC9C,CAAC;AAEF,qBAAa,0BAA0B;IACrC,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAuB;gBAE1C,OAAO,EAAE,iCAAiC;IAItD,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE;YAOpC,UAAU;CA4BzB"}

package/dist/data/api/interceptors/smile_request_mac_interceptor.js

@@ -0,0 +1,66 @@
+import { SmileIDCryptoError } from "../../security/smile_id_crypto_error";
+/**
+ * Stamps the `smileid-request-mac` header on every outbound request whose axios
+ * config declares `_useSmileIDRequestMac: true`. The value is computed by
+ * {@link SmileIDCryptoManager}: an HMAC-SHA256 over the canonicalised
+ * `smileid-*` headers and request body, keyed by a PBKDF2-derived key from the
+ * Arkana signing secret, Base64-encoded.
+ *
+ * The MAC is salted with the request timestamp, which is stamped upstream by
+ * `SmileAuthInterceptor` and carried as the signed `smileid-request-timestamp`
+ * header. This interceptor reuses that value as the single source of truth for
+ * the salt; if it is absent (a MAC endpoint that is not auth-annotated — a
+ * misconfiguration), the request is left unsigned for the server to reject
+ * rather than signed against an invented timestamp.
+ *
+ * Requests without the opt-in flag pass through unchanged.
+ */
+export const REQUEST_MAC_HEADER = "smileid-request-mac";
+export const REQUEST_TIMESTAMP_HEADER = "smileid-request-timestamp";
+/** Axios config key that opts a request into MAC stamping. */
+export const REQUEST_MAC_OPT_IN_KEY = "_useSmileIDRequestMac";
+export class SmileRequestMacInterceptor {
+    _cryptoManager;
+    constructor(options) {
+        this._cryptoManager = options.cryptoManager;
+    }
+    attach(client) {
+        const requestId = client.interceptors.request.use(async (config) => {
+            return this._onRequest(config);
+        });
+        return { request: requestId };
+    }
+    async _onRequest(config) {
+        const optedIn = config[REQUEST_MAC_OPT_IN_KEY] === true;
+        if (!optedIn)
+            return config;
+        const timestamp = config.headers.get(REQUEST_TIMESTAMP_HEADER);
+        if (typeof timestamp !== "string")
+            return config;
+        try {
+            const mac = await this._cryptoManager.sign(timestamp, headersToRecord(config.headers), config.data);
+            config.headers.set(REQUEST_MAC_HEADER, mac);
+        }
+        catch (error) {
+            if (!(error instanceof SmileIDCryptoError))
+                throw error;
+            // Signing failed (e.g. the signing secret is unavailable). Proceed
+            // without the MAC header rather than breaking the request; the server
+            // rejects the unsigned request with a clear error.
+        }
+        return config;
+    }
+}
+/** Flattens axios `AxiosHeaders` (or a plain object) to a string record. */
+function headersToRecord(headers) {
+    const source = typeof headers.toJSON === "function"
+        ? headers.toJSON()
+        : headers;
+    const out = {};
+    for (const [key, value] of Object.entries(source)) {
+        if (value != null)
+            out[key] = String(value);
+    }
+    return out;
+}
+//# sourceMappingURL=smile_request_mac_interceptor.js.map

package/dist/data/api/interceptors/smile_request_mac_interceptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"smile_request_mac_interceptor.js","sourceRoot":"","sources":["../../../../src/data/api/interceptors/smile_request_mac_interceptor.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAG1E;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,CAAC,MAAM,kBAAkB,GAAG,qBAAqB,CAAC;AACxD,MAAM,CAAC,MAAM,wBAAwB,GAAG,2BAA2B,CAAC;AAEpE,8DAA8D;AAC9D,MAAM,CAAC,MAAM,sBAAsB,GAAG,uBAAuB,CAAC;AAM9D,MAAM,OAAO,0BAA0B;IACpB,cAAc,CAAuB;IAEtD,YAAY,OAA0C;QACpD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;IAC9C,CAAC;IAED,MAAM,CAAC,MAAqB;QAC1B,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACjE,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,UAAU,CACtB,MAAkC;QAElC,MAAM,OAAO,GACV,MAA+D,CAC9D,sBAAsB,CACvB,KAAK,IAAI,CAAC;QACb,IAAI,CAAC,OAAO;YAAE,OAAO,MAAM,CAAC;QAE5B,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAC/D,IAAI,OAAO,SAAS,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC;QAEjD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CACxC,SAAS,EACT,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,EAC/B,MAAM,CAAC,IAAI,CACZ,CAAC;YACF,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAC9C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,CAAC,KAAK,YAAY,kBAAkB,CAAC;gBAAE,MAAM,KAAK,CAAC;YACxD,mEAAmE;YACnE,sEAAsE;YACtE,mDAAmD;QACrD,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAED,4EAA4E;AAC5E,SAAS,eAAe,CACtB,OAA8C;IAE9C,MAAM,MAAM,GACV,OAAQ,OAAsC,CAAC,MAAM,KAAK,UAAU;QAClE,CAAC,CAAG,OAAqC,CAAC,MAAM,EAG5C;QACJ,CAAC,CAAE,OAA8C,CAAC;IACtD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAClD,IAAI,KAAK,IAAI,IAAI;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}