@stapel/auth-react 1.0.0

package/dist/headless/misc.js

@@ -0,0 +1,84 @@
+import { useMemo } from "react";
+import { createAnonymousFlow } from "../flows/anonymousFlow.js";
+import { createAuthenticatorChangeFlow } from "../flows/authenticatorChangeFlow.js";
+import { createMagicLinkFlow } from "../flows/magicLinkFlow.js";
+import { createSsoFlow } from "../flows/ssoFlow.js";
+import { useFlow } from "../flows/useFlow.js";
+import { useAuthAnalytics, useAuthApi, useAuthSession } from "../model/context.js";
+/** Headless magic-link request (auth-sa.md §15). */
+export function MagicLink(props) {
+    const api = useAuthApi();
+    const analytics = useAuthAnalytics();
+    const flow = useMemo(() => createMagicLinkFlow({ api, analytics }), [api, analytics]);
+    const state = useFlow(flow.machine);
+    return props.children({
+        state,
+        request: (email, redirectUrl) => {
+            void flow.request(email, redirectUrl);
+        },
+        reset: flow.reset,
+    });
+}
+/** Headless anonymous session (auth-sa.md §6). */
+export function AnonymousSession(props) {
+    const api = useAuthApi();
+    const analytics = useAuthAnalytics();
+    const session = useAuthSession();
+    const flow = useMemo(() => createAnonymousFlow({
+        api,
+        analytics,
+        onAuthenticated: (r) => session.adopt(r),
+    }), [api, analytics, session]);
+    const state = useFlow(flow.machine);
+    return props.children({
+        state,
+        create: (deviceId) => {
+            void flow.create(deviceId);
+        },
+        reset: flow.reset,
+    });
+}
+/** Headless SSO domain discovery + login redirect (auth-sa.md §18). */
+export function SsoDiscovery(props) {
+    const api = useAuthApi();
+    const analytics = useAuthAnalytics();
+    const flow = useMemo(() => createSsoFlow({ api, analytics }), [api, analytics]);
+    const state = useFlow(flow.machine);
+    return props.children({
+        state,
+        lookup: (domain) => {
+            void flow.lookup(domain);
+        },
+        beginLogin: flow.beginLogin,
+        reset: flow.reset,
+    });
+}
+/** Headless instant email/phone change (auth-sa.md §9). */
+export function AuthenticatorChange(props) {
+    const api = useAuthApi();
+    const analytics = useAuthAnalytics();
+    const session = useAuthSession();
+    const flow = useMemo(() => createAuthenticatorChangeFlow({
+        api,
+        analytics,
+        onAuthenticated: (r) => session.adopt(r),
+    }), [api, analytics, session]);
+    const state = useFlow(flow.machine);
+    return props.children({
+        state,
+        startInstant: (channel) => {
+            void flow.startInstant(channel);
+        },
+        submitOldCode: (code) => {
+            void flow.submitOldCode(code);
+        },
+        requestNew: (newValue) => {
+            void flow.requestNew(newValue);
+        },
+        submitNewCode: (code) => {
+            void flow.submitNewCode(code);
+        },
+        reset: flow.reset,
+    });
+}
+//# sourceMappingURL=misc.js.map

package/dist/headless/misc.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"misc.js","sourceRoot":"","sources":["../../src/headless/misc.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAGhC,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEhE,OAAO,EAAE,6BAA6B,EAAE,MAAM,qCAAqC,CAAC;AAEpF,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAEhE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAUnF,oDAAoD;AACpD,MAAM,UAAU,SAAS,CAAC,KAEzB;IACC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAClB,GAAG,EAAE,CAAC,mBAAmB,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAC7C,CAAC,GAAG,EAAE,SAAS,CAAC,CACjB,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC,QAAQ,CAAC;QACpB,KAAK;QACL,OAAO,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE;YAC9B,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QACxC,CAAC;QACD,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;AACL,CAAC;AAUD,kDAAkD;AAClD,MAAM,UAAU,gBAAgB,CAAC,KAEhC;IACC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,CAClB,GAAG,EAAE,CACH,mBAAmB,CAAC;QAClB,GAAG;QACH,SAAS;QACT,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;KACzC,CAAC,EACJ,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,CAC1B,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC,QAAQ,CAAC;QACpB,KAAK;QACL,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE;YACnB,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7B,CAAC;QACD,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;AACL,CAAC;AAWD,uEAAuE;AACvE,MAAM,UAAU,YAAY,CAAC,KAE5B;IACC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,CAClB,GAAG,EAAE,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EACvC,CAAC,GAAG,EAAE,SAAS,CAAC,CACjB,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC,QAAQ,CAAC;QACpB,KAAK;QACL,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE;YACjB,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;QACD,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;AACL,CAAC;AAaD,2DAA2D;AAC3D,MAAM,UAAU,mBAAmB,CAAC,KAEnC;IACC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,OAAO,CAClB,GAAG,EAAE,CACH,6BAA6B,CAAC;QAC5B,GAAG;QACH,SAAS;QACT,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;KACzC,CAAC,EACJ,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,CAC1B,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,KAAK,CAAC,QAAQ,CAAC;QACpB,KAAK;QACL,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE;YACxB,KAAK,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAClC,CAAC;QACD,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE;YACtB,KAAK,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,UAAU,EAAE,CAAC,QAAQ,EAAE,EAAE;YACvB,KAAK,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;QACjC,CAAC;QACD,aAAa,EAAE,CAAC,IAAI,EAAE,EAAE;YACtB,KAAK,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;AACL,CAAC"}

package/dist/i18n/keys.d.ts

@@ -0,0 +1,34 @@
+import type { I18nDictionary, I18nEngine } from "@stapel/core";
+/**
+ * auth-react's own translation KEYS (frontend-standard §4.2): headless
+ * components never render literal strings — hosts resolve these via core's
+ * i18n engine (`useT`). Backend error codes (auth-sa.md "Error reference")
+ * flow through the SAME contour: a `StapelApiError.code` like
+ * `error.400.code_expired` is already a key, so the default bundle below ships
+ * English fallbacks for both the backend error codes and auth-react's UI keys.
+ * Point core's `loadLocale` at stapel-translate to override per locale.
+ */
+export declare const AUTH_I18N_KEYS: {
+    readonly otpEnterCode: "auth.otp.enter_code";
+    readonly otpResend: "auth.otp.resend";
+    readonly otpSentTo: "auth.otp.sent_to";
+    readonly passwordLabel: "auth.password.label";
+    readonly totpEnterCode: "auth.totp.enter_code";
+    readonly totpUseBackup: "auth.totp.use_backup";
+    readonly verificationChoose: "auth.verification.choose_factor";
+    readonly verificationSuccess: "auth.verification.success";
+    readonly sessionThisDevice: "auth.session.this_device";
+    readonly sessionSuspicious: "auth.session.suspicious";
+    readonly passkeyNoCredentials: "auth.passkey.no_credentials";
+    readonly unknownError: "auth.error.unknown";
+};
+export type AuthI18nKey = (typeof AUTH_I18N_KEYS)[keyof typeof AUTH_I18N_KEYS];
+/** English fallback bundle for auth-react UI keys + backend auth error codes. */
+export declare const authI18nBundleEn: I18nDictionary;
+/**
+ * Register auth-react's key bundle into a core i18n engine (call once at
+ * startup). Registers under the given locale (default `"en"`); a later
+ * `loadLocale` from stapel-translate can layer localized overrides.
+ */
+export declare function registerAuthI18n(engine: I18nEngine, locale?: string): void;
+//# sourceMappingURL=keys.d.ts.map

package/dist/i18n/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/i18n/keys.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE/D;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;CAcjB,CAAC;AAEX,MAAM,MAAM,WAAW,GACrB,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,OAAO,cAAc,CAAC,CAAC;AAEvD,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,EAAE,cAqD9B,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,SAAO,GAAG,IAAI,CAExE"}

package/dist/i18n/keys.js

@@ -0,0 +1,83 @@
+/**
+ * auth-react's own translation KEYS (frontend-standard §4.2): headless
+ * components never render literal strings — hosts resolve these via core's
+ * i18n engine (`useT`). Backend error codes (auth-sa.md "Error reference")
+ * flow through the SAME contour: a `StapelApiError.code` like
+ * `error.400.code_expired` is already a key, so the default bundle below ships
+ * English fallbacks for both the backend error codes and auth-react's UI keys.
+ * Point core's `loadLocale` at stapel-translate to override per locale.
+ */
+export const AUTH_I18N_KEYS = {
+    // Flow UI keys (auth-react-owned)
+    otpEnterCode: "auth.otp.enter_code",
+    otpResend: "auth.otp.resend",
+    otpSentTo: "auth.otp.sent_to",
+    passwordLabel: "auth.password.label",
+    totpEnterCode: "auth.totp.enter_code",
+    totpUseBackup: "auth.totp.use_backup",
+    verificationChoose: "auth.verification.choose_factor",
+    verificationSuccess: "auth.verification.success",
+    sessionThisDevice: "auth.session.this_device",
+    sessionSuspicious: "auth.session.suspicious",
+    passkeyNoCredentials: "auth.passkey.no_credentials",
+    unknownError: "auth.error.unknown",
+};
+/** English fallback bundle for auth-react UI keys + backend auth error codes. */
+export const authI18nBundleEn = {
+    // auth-react UI
+    "auth.otp.enter_code": "Enter the code we sent you",
+    "auth.otp.resend": "Resend code",
+    "auth.otp.sent_to": "Code sent to {target}",
+    "auth.password.label": "Password",
+    "auth.totp.enter_code": "Enter your 6-digit code",
+    "auth.totp.use_backup": "Use a backup code",
+    "auth.verification.choose_factor": "Verify it's you",
+    "auth.verification.success": "Verified",
+    "auth.session.this_device": "This device",
+    "auth.session.suspicious": "Unrecognized sign-in",
+    "auth.passkey.no_credentials": "Couldn't sign in with a passkey on this device. Add one in Security settings after signing in another way, or pick a different sign-in method below.",
+    "auth.error.unknown": "Something went wrong. Please try again.",
+    // Backend error codes (auth-sa.md "Error reference")
+    "error.401.invalid_credentials": "Incorrect email or password.",
+    "error.401.account_disabled": "This account has been disabled.",
+    "error.401.refresh_revoked": "Your session ended. Please sign in again.",
+    "error.400.code_expired": "That code has expired. Request a new one.",
+    "error.400.invalid_code": "That code is incorrect.",
+    "error.400.invalid_code_attempts": "That code is incorrect. {attempts_remaining} attempts left.",
+    "error.422.blocked": "Too many attempts. Try again in {retry_after_minutes} min.",
+    "error.429.rate_limit": "Please wait before requesting another code.",
+    "error.400.no_verified_contact": "No verified contact for this method.",
+    "error.400.wrong_password": "Your current password is incorrect.",
+    "error.400.no_password": "This account has no password set.",
+    "error.404.user_for_reset": "No account found for that email or phone.",
+    "error.403.mock_otp_admin": "Admin accounts can't use codes in this environment.",
+    "error.400.code_required": "A code is required.",
+    "error.400.totp_not_pending": "Start two-factor setup first.",
+    "error.423.account_locked": "Account locked. Try again in {retry_after_minutes} min.",
+    "error.429.magic_link_rate": "Too many login-link requests. Try again later.",
+    "error.400.passkey_invalid": "Passkey verification failed.",
+    "error.400.passkey_challenge_expired": "Passkey request expired. Try again.",
+    "error.409.passkey_already_registered": "This passkey is already registered.",
+    "error.400.last_auth_method": "You can't remove your last sign-in method.",
+    "error.400.invalid_redirect_url": "Invalid redirect.",
+    "error.400.magic_link_invalid": "This login link is invalid or has expired.",
+    "error.400.captcha_required": "Please complete the captcha.",
+    "error.400.captcha_invalid": "Captcha verification failed.",
+    "error.403.verification_required": "Additional verification required.",
+    "error.404.verification_challenge_not_found": "This verification expired. Please retry the action.",
+    "error.400.verification_invalid_factor": "That verification option isn't available.",
+    "error.400.verification_failed": "Verification failed. Try again.",
+    "error.423.verification_locked": "Too many attempts. Retry the action later.",
+    "error.404.sso_org_not_found": "Organization not found.",
+    "error.400.sso_not_configured": "SSO isn't configured for this organization.",
+    "error.403.sso_required": "This account must sign in with SSO.",
+};
+/**
+ * Register auth-react's key bundle into a core i18n engine (call once at
+ * startup). Registers under the given locale (default `"en"`); a later
+ * `loadLocale` from stapel-translate can layer localized overrides.
+ */
+export function registerAuthI18n(engine, locale = "en") {
+    engine.registerBundle(locale, authI18nBundleEn);
+}
+//# sourceMappingURL=keys.js.map

package/dist/i18n/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../src/i18n/keys.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,kCAAkC;IAClC,YAAY,EAAE,qBAAqB;IACnC,SAAS,EAAE,iBAAiB;IAC5B,SAAS,EAAE,kBAAkB;IAC7B,aAAa,EAAE,qBAAqB;IACpC,aAAa,EAAE,sBAAsB;IACrC,aAAa,EAAE,sBAAsB;IACrC,kBAAkB,EAAE,iCAAiC;IACrD,mBAAmB,EAAE,2BAA2B;IAChD,iBAAiB,EAAE,0BAA0B;IAC7C,iBAAiB,EAAE,yBAAyB;IAC5C,oBAAoB,EAAE,6BAA6B;IACnD,YAAY,EAAE,oBAAoB;CAC1B,CAAC;AAKX,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAmB;IAC9C,gBAAgB;IAChB,qBAAqB,EAAE,4BAA4B;IACnD,iBAAiB,EAAE,aAAa;IAChC,kBAAkB,EAAE,uBAAuB;IAC3C,qBAAqB,EAAE,UAAU;IACjC,sBAAsB,EAAE,yBAAyB;IACjD,sBAAsB,EAAE,mBAAmB;IAC3C,iCAAiC,EAAE,iBAAiB;IACpD,2BAA2B,EAAE,UAAU;IACvC,0BAA0B,EAAE,aAAa;IACzC,yBAAyB,EAAE,sBAAsB;IACjD,6BAA6B,EAC3B,sJAAsJ;IACxJ,oBAAoB,EAAE,yCAAyC;IAE/D,qDAAqD;IACrD,+BAA+B,EAAE,8BAA8B;IAC/D,4BAA4B,EAAE,iCAAiC;IAC/D,2BAA2B,EAAE,2CAA2C;IACxE,wBAAwB,EAAE,2CAA2C;IACrE,wBAAwB,EAAE,yBAAyB;IACnD,iCAAiC,EAC/B,6DAA6D;IAC/D,mBAAmB,EAAE,4DAA4D;IACjF,sBAAsB,EAAE,6CAA6C;IACrE,+BAA+B,EAAE,sCAAsC;IACvE,0BAA0B,EAAE,qCAAqC;IACjE,uBAAuB,EAAE,mCAAmC;IAC5D,0BAA0B,EAAE,2CAA2C;IACvE,0BAA0B,EAAE,qDAAqD;IACjF,yBAAyB,EAAE,qBAAqB;IAChD,4BAA4B,EAAE,+BAA+B;IAC7D,0BAA0B,EACxB,yDAAyD;IAC3D,2BAA2B,EAAE,gDAAgD;IAC7E,2BAA2B,EAAE,8BAA8B;IAC3D,qCAAqC,EAAE,qCAAqC;IAC5E,sCAAsC,EAAE,qCAAqC;IAC7E,4BAA4B,EAAE,4CAA4C;IAC1E,gCAAgC,EAAE,mBAAmB;IACrD,8BAA8B,EAAE,4CAA4C;IAC5E,4BAA4B,EAAE,8BAA8B;IAC5D,2BAA2B,EAAE,8BAA8B;IAC3D,iCAAiC,EAAE,mCAAmC;IACtE,4CAA4C,EAC1C,qDAAqD;IACvD,uCAAuC,EAAE,2CAA2C;IACpF,+BAA+B,EAAE,iCAAiC;IAClE,+BAA+B,EAAE,4CAA4C;IAC7E,6BAA6B,EAAE,yBAAyB;IACxD,8BAA8B,EAAE,6CAA6C;IAC7E,wBAAwB,EAAE,qCAAqC;CAChE,CAAC;AAEF;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAkB,EAAE,MAAM,GAAG,IAAI;IAChE,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAClD,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,73 @@
+/**
+ * `@stapel/auth-react` — the headless React flow pair for stapel-auth
+ * (frontend-standard §2). Business + state only, zero visual opinion. Built on
+ * `@stapel/core`'s StapelClient (verification-403 interception, token refresh,
+ * i18n, analytics, query layer).
+ */
+export { createAuthApi } from "./api/authApi.js";
+export type { AuthApi } from "./api/authApi.js";
+export { authUrls, validRedirectUrl, safeNextPath, safeScanRedirect, } from "./api/urls.js";
+export type { AuthUrls } from "./api/urls.js";
+export { isTotpChallenge } from "./api/types.js";
+export type { AuthStatus, StapelUser, AuthTokens, AuthResponse, TOTPChallengeResponse, LoginResponse, OtpRequestResponse, StatusResponse, OtpChannel, OAuthProviderInfo, RegistrationCapabilities, LoginCapabilities, Capabilities, PasswordChangeMethod, PasswordMethodEntry, PasswordMethods, SecurityStatus, SessionDeviceType, AuthSession as AuthSessionRecord, TotpSetupResponse, TotpSetupConfirmResponse, TotpDisableRequest, VerificationFactorId, VerificationEnvelope, VerificationInitiateResponse, VerificationCompleteResponse, QrType, QrGenerateResponse, QrStatusValue, QrStatusResponse, Passkey, PasskeyRegisterBeginResponse, PasskeyAuthenticateBeginResponse, ChangeOldVerifiedResponse, DelayedChangeInitiatedResponse, DelayedChangeStatus, SsoLookupResponse, AuditEvent, AuditPage, RefreshResponse, } from "./api/types.js";
+export { createFlowMachine } from "./flows/createFlowMachine.js";
+export type { FlowMachine, FlowMachineOptions, FlowStateBase, } from "./flows/createFlowMachine.js";
+export { useFlow } from "./flows/useFlow.js";
+export { toFlowError, isErrorCode } from "./flows/errors.js";
+export type { FlowError } from "./flows/errors.js";
+export { createOtpFlow } from "./flows/otpFlow.js";
+export type { OtpFlow, OtpFlowDeps, OtpState } from "./flows/otpFlow.js";
+export { createPasswordLoginFlow } from "./flows/passwordLoginFlow.js";
+export type { PasswordLoginFlow, PasswordLoginFlowDeps, PasswordLoginState, TotpProof, } from "./flows/passwordLoginFlow.js";
+export { createPasswordChangeFlow } from "./flows/passwordChangeFlow.js";
+export type { PasswordChangeFlow, PasswordChangeFlowDeps, PasswordChangeState, } from "./flows/passwordChangeFlow.js";
+export { createPasswordResetFlow } from "./flows/passwordResetFlow.js";
+export type { PasswordResetFlow, PasswordResetFlowDeps, PasswordResetState, } from "./flows/passwordResetFlow.js";
+export { createVerificationController } from "./flows/verificationFlow.js";
+export type { VerificationController, VerificationControllerDeps, VerificationState, } from "./flows/verificationFlow.js";
+export { createTotpSetupFlow } from "./flows/totpSetupFlow.js";
+export type { TotpSetupFlow, TotpSetupFlowDeps, TotpSetupState, } from "./flows/totpSetupFlow.js";
+export { createOAuthFlow } from "./flows/oauthFlow.js";
+export type { OAuthFlow, OAuthFlowDeps, OAuthState } from "./flows/oauthFlow.js";
+export { createQrLoginFlow } from "./flows/qrLoginFlow.js";
+export type { QrLoginFlow, QrLoginFlowDeps, QrLoginState, } from "./flows/qrLoginFlow.js";
+export { createPasskeyRegistrationFlow, createPasskeyLoginFlow, } from "./flows/passkeyFlow.js";
+export type { PasskeyRegistrationFlow, PasskeyRegistrationFlowDeps, PasskeyRegisterState, PasskeyLoginFlow, PasskeyLoginFlowDeps, PasskeyLoginState, } from "./flows/passkeyFlow.js";
+export { createMagicLinkFlow } from "./flows/magicLinkFlow.js";
+export type { MagicLinkFlow, MagicLinkFlowDeps, MagicLinkState, } from "./flows/magicLinkFlow.js";
+export { createAnonymousFlow } from "./flows/anonymousFlow.js";
+export type { AnonymousFlow, AnonymousFlowDeps, AnonymousState, } from "./flows/anonymousFlow.js";
+export { createSsoFlow } from "./flows/ssoFlow.js";
+export type { SsoFlow, SsoFlowDeps, SsoState } from "./flows/ssoFlow.js";
+export { createAuthenticatorChangeFlow } from "./flows/authenticatorChangeFlow.js";
+export type { AuthenticatorChangeFlow, AuthenticatorChangeFlowDeps, AuthenticatorChangeState, } from "./flows/authenticatorChangeFlow.js";
+export { createAuthRuntime } from "./model/runtime.js";
+export type { AuthRuntime, CreateAuthRuntimeOptions } from "./model/runtime.js";
+export { createAuthSession } from "./model/session.js";
+export type { AuthSession, AuthSessionState, AuthSessionOptions, TeardownReason, } from "./model/session.js";
+export { AuthRuntimeContext, useAuthRuntime, useAuthApi, useAuthSession, useVerification, useAuthAnalytics, useAuthSessionState, } from "./model/context.js";
+export { authQueryKeys } from "./model/queryKeys.js";
+export { useCapabilities, useMe, useSecurityStatus, usePasswordMethods, useSessions, usePasskeys, useAuditLog, useDelayedChangeStatus, useSsoLookup, } from "./model/queries.js";
+export { useLogout, useRevokeSession, useRevokeOtherSessions, useConfirmSession, useRemovePasskey, useDisableTotp, useCancelDelayedChange, } from "./model/mutations.js";
+export { AuthProvider } from "./headless/AuthProvider.js";
+export { PasswordlessLogin } from "./headless/PasswordlessLogin.js";
+export type { PasswordlessLoginBag } from "./headless/PasswordlessLogin.js";
+export { PasswordLogin } from "./headless/PasswordLogin.js";
+export type { PasswordLoginBag } from "./headless/PasswordLogin.js";
+export { PasswordReset } from "./headless/PasswordReset.js";
+export type { PasswordResetBag } from "./headless/PasswordReset.js";
+export { PasswordChange } from "./headless/PasswordChange.js";
+export type { PasswordChangeBag } from "./headless/PasswordChange.js";
+export { VerificationChallenge } from "./headless/VerificationChallenge.js";
+export type { VerificationChallengeBag } from "./headless/VerificationChallenge.js";
+export { TotpSetup } from "./headless/TotpSetup.js";
+export type { TotpSetupBag } from "./headless/TotpSetup.js";
+export { QrLogin } from "./headless/QrLogin.js";
+export type { QrLoginBag } from "./headless/QrLogin.js";
+export { PasskeyRegistration, PasskeyLogin } from "./headless/Passkey.js";
+export type { WebauthnBinding, PasskeyRegistrationBag, PasskeyLoginBag, } from "./headless/Passkey.js";
+export { MagicLink, AnonymousSession, SsoDiscovery, AuthenticatorChange, } from "./headless/misc.js";
+export type { MagicLinkBag, AnonymousBag, SsoDiscoveryBag, AuthenticatorChangeBag, } from "./headless/misc.js";
+export { AUTH_I18N_KEYS, authI18nBundleEn, registerAuthI18n, } from "./i18n/keys.js";
+export type { AuthI18nKey } from "./i18n/keys.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,YAAY,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,EACL,QAAQ,EACR,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,YAAY,EACV,UAAU,EACV,UAAU,EACV,UAAU,EACV,YAAY,EACZ,qBAAqB,EACrB,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,UAAU,EACV,iBAAiB,EACjB,wBAAwB,EACxB,iBAAiB,EACjB,YAAY,EACZ,oBAAoB,EACpB,mBAAmB,EACnB,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,WAAW,IAAI,iBAAiB,EAChC,iBAAiB,EACjB,wBAAwB,EACxB,kBAAkB,EAClB,oBAAoB,EACpB,oBAAoB,EACpB,4BAA4B,EAC5B,4BAA4B,EAC5B,MAAM,EACN,kBAAkB,EAClB,aAAa,EACb,gBAAgB,EAChB,OAAO,EACP,4BAA4B,EAC5B,gCAAgC,EAChC,yBAAyB,EACzB,8BAA8B,EAC9B,mBAAmB,EACnB,iBAAiB,EACjB,UAAU,EACV,SAAS,EACT,eAAe,GAChB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,YAAY,EACV,WAAW,EACX,kBAAkB,EAClB,aAAa,GACd,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAC7D,YAAY,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAEnD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,YAAY,EACV,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,EAClB,SAAS,GACV,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,YAAY,EACV,kBAAkB,EAClB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,YAAY,EACV,iBAAiB,EACjB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAC3E,YAAY,EACV,sBAAsB,EACtB,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,cAAc,GACf,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3D,YAAY,EACV,WAAW,EACX,eAAe,EACf,YAAY,GACb,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAChC,YAAY,EACV,uBAAuB,EACvB,2BAA2B,EAC3B,oBAAoB,EACpB,gBAAgB,EAChB,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,cAAc,GACf,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,cAAc,GACf,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AACnF,YAAY,EACV,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,GACzB,MAAM,oCAAoC,CAAC;AAG5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,YAAY,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,YAAY,EACV,WAAW,EACX,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,UAAU,EACV,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EACL,eAAe,EACf,KAAK,EACL,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,EACX,WAAW,EACX,WAAW,EACX,sBAAsB,EACtB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,sBAAsB,EACtB,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AACpE,YAAY,EAAE,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,YAAY,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAC5D,YAAY,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,YAAY,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,YAAY,EAAE,wBAAwB,EAAE,MAAM,qCAAqC,CAAC;AACpF,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,YAAY,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAChD,YAAY,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAC1E,YAAY,EACV,eAAe,EACf,sBAAsB,EACtB,eAAe,GAChB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,YAAY,EACZ,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,YAAY,EACZ,YAAY,EACZ,eAAe,EACf,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAG5B,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/index.js

@@ -0,0 +1,48 @@
+/**
+ * `@stapel/auth-react` — the headless React flow pair for stapel-auth
+ * (frontend-standard §2). Business + state only, zero visual opinion. Built on
+ * `@stapel/core`'s StapelClient (verification-403 interception, token refresh,
+ * i18n, analytics, query layer).
+ */
+// ── api ──────────────────────────────────────────────────────────────────────
+export { createAuthApi } from "./api/authApi.js";
+export { authUrls, validRedirectUrl, safeNextPath, safeScanRedirect, } from "./api/urls.js";
+export { isTotpChallenge } from "./api/types.js";
+// ── flows (the reusable machine pattern — first instance) ────────────────────
+export { createFlowMachine } from "./flows/createFlowMachine.js";
+export { useFlow } from "./flows/useFlow.js";
+export { toFlowError, isErrorCode } from "./flows/errors.js";
+export { createOtpFlow } from "./flows/otpFlow.js";
+export { createPasswordLoginFlow } from "./flows/passwordLoginFlow.js";
+export { createPasswordChangeFlow } from "./flows/passwordChangeFlow.js";
+export { createPasswordResetFlow } from "./flows/passwordResetFlow.js";
+export { createVerificationController } from "./flows/verificationFlow.js";
+export { createTotpSetupFlow } from "./flows/totpSetupFlow.js";
+export { createOAuthFlow } from "./flows/oauthFlow.js";
+export { createQrLoginFlow } from "./flows/qrLoginFlow.js";
+export { createPasskeyRegistrationFlow, createPasskeyLoginFlow, } from "./flows/passkeyFlow.js";
+export { createMagicLinkFlow } from "./flows/magicLinkFlow.js";
+export { createAnonymousFlow } from "./flows/anonymousFlow.js";
+export { createSsoFlow } from "./flows/ssoFlow.js";
+export { createAuthenticatorChangeFlow } from "./flows/authenticatorChangeFlow.js";
+// ── model (runtime wiring, session, query hooks) ─────────────────────────────
+export { createAuthRuntime } from "./model/runtime.js";
+export { createAuthSession } from "./model/session.js";
+export { AuthRuntimeContext, useAuthRuntime, useAuthApi, useAuthSession, useVerification, useAuthAnalytics, useAuthSessionState, } from "./model/context.js";
+export { authQueryKeys } from "./model/queryKeys.js";
+export { useCapabilities, useMe, useSecurityStatus, usePasswordMethods, useSessions, usePasskeys, useAuditLog, useDelayedChangeStatus, useSsoLookup, } from "./model/queries.js";
+export { useLogout, useRevokeSession, useRevokeOtherSessions, useConfirmSession, useRemovePasskey, useDisableTotp, useCancelDelayedChange, } from "./model/mutations.js";
+// ── headless (renderless components) ─────────────────────────────────────────
+export { AuthProvider } from "./headless/AuthProvider.js";
+export { PasswordlessLogin } from "./headless/PasswordlessLogin.js";
+export { PasswordLogin } from "./headless/PasswordLogin.js";
+export { PasswordReset } from "./headless/PasswordReset.js";
+export { PasswordChange } from "./headless/PasswordChange.js";
+export { VerificationChallenge } from "./headless/VerificationChallenge.js";
+export { TotpSetup } from "./headless/TotpSetup.js";
+export { QrLogin } from "./headless/QrLogin.js";
+export { PasskeyRegistration, PasskeyLogin } from "./headless/Passkey.js";
+export { MagicLink, AnonymousSession, SsoDiscovery, AuthenticatorChange, } from "./headless/misc.js";
+// ── i18n ─────────────────────────────────────────────────────────────────────
+export { AUTH_I18N_KEYS, authI18nBundleEn, registerAuthI18n, } from "./i18n/keys.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,gFAAgF;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EACL,QAAQ,EACR,gBAAgB,EAChB,YAAY,EACZ,gBAAgB,GACjB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AA4CjD,gFAAgF;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AAMjE,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAG7D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAOvE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAMzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AAMvE,OAAO,EAAE,4BAA4B,EAAE,MAAM,6BAA6B,CAAC;AAM3E,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAM3D,OAAO,EACL,6BAA6B,EAC7B,sBAAsB,GACvB,MAAM,wBAAwB,CAAC;AAShC,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAM/D,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAEnD,OAAO,EAAE,6BAA6B,EAAE,MAAM,oCAAoC,CAAC;AAOnF,gFAAgF;AAChF,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAOvD,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,UAAU,EACV,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EACL,eAAe,EACf,KAAK,EACL,iBAAiB,EACjB,kBAAkB,EAClB,WAAW,EACX,WAAW,EACX,WAAW,EACX,sBAAsB,EACtB,YAAY,GACb,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,sBAAsB,EACtB,iBAAiB,EACjB,gBAAgB,EAChB,cAAc,EACd,sBAAsB,GACvB,MAAM,sBAAsB,CAAC;AAE9B,gFAAgF;AAChF,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAEpE,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5D,OAAO,EAAE,aAAa,EAAE,MAAM,6BAA6B,CAAC;AAE5D,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAE5E,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAEhD,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAM1E,OAAO,EACL,SAAS,EACT,gBAAgB,EAChB,YAAY,EACZ,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAQ5B,gFAAgF;AAChF,OAAO,EACL,cAAc,EACd,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,gBAAgB,CAAC"}

package/dist/model/context.d.ts

@@ -0,0 +1,22 @@
+import type { Context } from "react";
+import type { Analytics } from "@stapel/core";
+import type { AuthApi } from "../api/authApi.js";
+import type { VerificationController } from "../flows/verificationFlow.js";
+import type { AuthRuntime } from "./runtime.js";
+import type { AuthSession, AuthSessionState } from "./session.js";
+/**
+ * The auth runtime shared through React context by `<AuthProvider>`. Hooks in
+ * `model/` and `headless/` read the wired singletons from here; per-flow
+ * machines are created by the headless components using `useAuthApi()` +
+ * `useAuthAnalytics()`.
+ */
+export declare const AuthRuntimeContext: Context<AuthRuntime | null>;
+export declare function useAuthRuntime(): AuthRuntime;
+export declare function useAuthApi(): AuthApi;
+export declare function useAuthSession(): AuthSession;
+/** The singleton step-up verification controller (one modal per app). */
+export declare function useVerification(): VerificationController;
+export declare function useAuthAnalytics(): Analytics | null;
+/** Reactive session state (user / tokens / status). Re-renders on change. */
+export declare function useAuthSessionState(): AuthSessionState;
+//# sourceMappingURL=context.d.ts.map

package/dist/model/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/model/context.tsx"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AACrC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,KAAK,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAElE;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,EAAE,OAAO,CAAC,WAAW,GAAG,IAAI,CAClB,CAAC;AAE1C,wBAAgB,cAAc,IAAI,WAAW,CAM5C;AAED,wBAAgB,UAAU,IAAI,OAAO,CAEpC;AAED,wBAAgB,cAAc,IAAI,WAAW,CAE5C;AAED,yEAAyE;AACzE,wBAAgB,eAAe,IAAI,sBAAsB,CAExD;AAED,wBAAgB,gBAAgB,IAAI,SAAS,GAAG,IAAI,CAEnD;AAED,6EAA6E;AAC7E,wBAAgB,mBAAmB,IAAI,gBAAgB,CAOtD"}

package/dist/model/context.js

@@ -0,0 +1,34 @@
+import { createContext, useContext, useSyncExternalStore } from "react";
+/**
+ * The auth runtime shared through React context by `<AuthProvider>`. Hooks in
+ * `model/` and `headless/` read the wired singletons from here; per-flow
+ * machines are created by the headless components using `useAuthApi()` +
+ * `useAuthAnalytics()`.
+ */
+export const AuthRuntimeContext = createContext(null);
+export function useAuthRuntime() {
+    const runtime = useContext(AuthRuntimeContext);
+    if (runtime === null) {
+        throw new Error("Auth hooks must be used within an <AuthProvider>");
+    }
+    return runtime;
+}
+export function useAuthApi() {
+    return useAuthRuntime().api;
+}
+export function useAuthSession() {
+    return useAuthRuntime().session;
+}
+/** The singleton step-up verification controller (one modal per app). */
+export function useVerification() {
+    return useAuthRuntime().verification;
+}
+export function useAuthAnalytics() {
+    return useAuthRuntime().analytics;
+}
+/** Reactive session state (user / tokens / status). Re-renders on change. */
+export function useAuthSessionState() {
+    const session = useAuthSession();
+    return useSyncExternalStore(session.subscribe, session.getState, session.getState);
+}
+//# sourceMappingURL=context.js.map

package/dist/model/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/model/context.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,OAAO,CAAC;AAQxE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAC7B,aAAa,CAAqB,IAAI,CAAC,CAAC;AAE1C,MAAM,UAAU,cAAc;IAC5B,MAAM,OAAO,GAAG,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAC/C,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO,cAAc,EAAE,CAAC,GAAG,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,OAAO,cAAc,EAAE,CAAC,OAAO,CAAC;AAClC,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,eAAe;IAC7B,OAAO,cAAc,EAAE,CAAC,YAAY,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO,cAAc,EAAE,CAAC,SAAS,CAAC;AACpC,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,mBAAmB;IACjC,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,OAAO,oBAAoB,CACzB,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,QAAQ,CACjB,CAAC;AACJ,CAAC"}

package/dist/model/mutations.d.ts

@@ -0,0 +1,28 @@
+import type { UseMutationResult } from "@tanstack/react-query";
+import type { StapelApiError } from "@stapel/core";
+import type { OtpChannel, StatusResponse, TotpDisableRequest } from "../api/types.js";
+/**
+ * Write hooks with cache invalidation (frontend-standard §2 — "мутации с
+ * инвалидацией"). Each invalidates exactly the keys its effect touches so the
+ * security screen / session list stay consistent without a manual refetch.
+ *
+ * Note: options are built as typed `UseMutationOptions` objects rather than
+ * `useMutation<…>()` call-site generics — that keeps `void` (no data / no
+ * variables) in *type-reference* position, which `no-invalid-void-type`
+ * permits, while call-expression type arguments do not.
+ */
+/** Explicit logout: revoke server-side, tear down the session, drop auth caches. */
+export declare function useLogout(): UseMutationResult<void, StapelApiError, void>;
+/** Revoke one session (auth-sa.md §12). Immediate — token blacklisted. */
+export declare function useRevokeSession(): UseMutationResult<StatusResponse, StapelApiError, string>;
+/** Revoke all sessions except the current one (auth-sa.md §12). */
+export declare function useRevokeOtherSessions(): UseMutationResult<StatusResponse, StapelApiError, void>;
+/** Clear the `is_suspicious` flag ("This was me"). Idempotent (auth-sa.md §12). */
+export declare function useConfirmSession(): UseMutationResult<StatusResponse, StapelApiError, string>;
+/** Remove a passkey (auth-sa.md §17). Guard against `last_auth_method`. */
+export declare function useRemovePasskey(): UseMutationResult<void, StapelApiError, string>;
+/** Disable TOTP via authenticator/backup/SMS recovery (auth-sa.md §11). */
+export declare function useDisableTotp(): UseMutationResult<StatusResponse, StapelApiError, TotpDisableRequest>;
+/** Cancel a pending delayed authenticator change (auth-sa.md §9). */
+export declare function useCancelDelayedChange(channel: OtpChannel): UseMutationResult<StatusResponse, StapelApiError, string>;
+//# sourceMappingURL=mutations.d.ts.map

package/dist/model/mutations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mutations.d.ts","sourceRoot":"","sources":["../../src/model/mutations.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAEV,iBAAiB,EAClB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EACV,UAAU,EACV,cAAc,EACd,kBAAkB,EACnB,MAAM,iBAAiB,CAAC;AAIzB;;;;;;;;;GASG;AAEH,oFAAoF;AACpF,wBAAgB,SAAS,IAAI,iBAAiB,CAAC,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,CAUzE;AAED,0EAA0E;AAC1E,wBAAgB,gBAAgB,IAAI,iBAAiB,CACnD,cAAc,EACd,cAAc,EACd,MAAM,CACP,CAaA;AAED,mEAAmE;AACnE,wBAAgB,sBAAsB,IAAI,iBAAiB,CACzD,cAAc,EACd,cAAc,EACd,IAAI,CACL,CAUA;AAED,mFAAmF;AACnF,wBAAgB,iBAAiB,IAAI,iBAAiB,CACpD,cAAc,EACd,cAAc,EACd,MAAM,CACP,CAUA;AAED,2EAA2E;AAC3E,wBAAgB,gBAAgB,IAAI,iBAAiB,CACnD,IAAI,EACJ,cAAc,EACd,MAAM,CACP,CAaA;AAED,2EAA2E;AAC3E,wBAAgB,cAAc,IAAI,iBAAiB,CACjD,cAAc,EACd,cAAc,EACd,kBAAkB,CACnB,CAgBA;AAED,qEAAqE;AACrE,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,UAAU,GAClB,iBAAiB,CAAC,cAAc,EAAE,cAAc,EAAE,MAAM,CAAC,CAa3D"}

package/dist/model/mutations.js

@@ -0,0 +1,108 @@
+import { useMutation, useQueryClient } from "@tanstack/react-query";
+import { useAuthApi, useAuthSession } from "./context.js";
+import { authQueryKeys } from "./queryKeys.js";
+/**
+ * Write hooks with cache invalidation (frontend-standard §2 — "мутации с
+ * инвалидацией"). Each invalidates exactly the keys its effect touches so the
+ * security screen / session list stay consistent without a manual refetch.
+ *
+ * Note: options are built as typed `UseMutationOptions` objects rather than
+ * `useMutation<…>()` call-site generics — that keeps `void` (no data / no
+ * variables) in *type-reference* position, which `no-invalid-void-type`
+ * permits, while call-expression type arguments do not.
+ */
+/** Explicit logout: revoke server-side, tear down the session, drop auth caches. */
+export function useLogout() {
+    const session = useAuthSession();
+    const queryClient = useQueryClient();
+    const options = {
+        mutationFn: () => session.logout(),
+        onSuccess: () => {
+            queryClient.removeQueries({ queryKey: authQueryKeys.all });
+        },
+    };
+    return useMutation(options);
+}
+/** Revoke one session (auth-sa.md §12). Immediate — token blacklisted. */
+export function useRevokeSession() {
+    const api = useAuthApi();
+    const queryClient = useQueryClient();
+    const options = {
+        mutationFn: (id) => api.revokeSession(id),
+        onSuccess: () => {
+            void queryClient.invalidateQueries({ queryKey: authQueryKeys.sessions() });
+            void queryClient.invalidateQueries({
+                queryKey: authQueryKeys.securityStatus(),
+            });
+        },
+    };
+    return useMutation(options);
+}
+/** Revoke all sessions except the current one (auth-sa.md §12). */
+export function useRevokeOtherSessions() {
+    const api = useAuthApi();
+    const queryClient = useQueryClient();
+    const options = {
+        mutationFn: () => api.revokeOtherSessions(),
+        onSuccess: () => {
+            void queryClient.invalidateQueries({ queryKey: authQueryKeys.sessions() });
+        },
+    };
+    return useMutation(options);
+}
+/** Clear the `is_suspicious` flag ("This was me"). Idempotent (auth-sa.md §12). */
+export function useConfirmSession() {
+    const api = useAuthApi();
+    const queryClient = useQueryClient();
+    const options = {
+        mutationFn: (id) => api.confirmSession(id),
+        onSuccess: () => {
+            void queryClient.invalidateQueries({ queryKey: authQueryKeys.sessions() });
+        },
+    };
+    return useMutation(options);
+}
+/** Remove a passkey (auth-sa.md §17). Guard against `last_auth_method`. */
+export function useRemovePasskey() {
+    const api = useAuthApi();
+    const queryClient = useQueryClient();
+    const options = {
+        mutationFn: (id) => api.passkeyRemove(id),
+        onSuccess: () => {
+            void queryClient.invalidateQueries({ queryKey: authQueryKeys.passkeys() });
+            void queryClient.invalidateQueries({
+                queryKey: authQueryKeys.securityStatus(),
+            });
+        },
+    };
+    return useMutation(options);
+}
+/** Disable TOTP via authenticator/backup/SMS recovery (auth-sa.md §11). */
+export function useDisableTotp() {
+    const api = useAuthApi();
+    const queryClient = useQueryClient();
+    const options = {
+        mutationFn: (request) => api.totpDisable(request),
+        onSuccess: () => {
+            void queryClient.invalidateQueries({
+                queryKey: authQueryKeys.securityStatus(),
+            });
+        },
+    };
+    return useMutation(options);
+}
+/** Cancel a pending delayed authenticator change (auth-sa.md §9). */
+export function useCancelDelayedChange(channel) {
+    const api = useAuthApi();
+    const queryClient = useQueryClient();
+    const options = {
+        mutationFn: (changeRequestId) => api.changeDelayedCancel(channel, changeRequestId),
+        onSuccess: () => {
+            void queryClient.invalidateQueries({
+                queryKey: authQueryKeys.delayedChange(channel),
+            });
+        },
+    };
+    return useMutation(options);
+}
+//# sourceMappingURL=mutations.js.map

package/dist/model/mutations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mutations.js","sourceRoot":"","sources":["../../src/model/mutations.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAWpE,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C;;;;;;;;;GASG;AAEH,oFAAoF;AACpF,MAAM,UAAU,SAAS;IACvB,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,OAAO,GAAmD;QAC9D,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE;QAClC,SAAS,EAAE,GAAG,EAAE;YACd,WAAW,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7D,CAAC;KACF,CAAC;IACF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,gBAAgB;IAK9B,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,OAAO,GAA+D;QAC1E,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QACzC,SAAS,EAAE,GAAG,EAAE;YACd,KAAK,WAAW,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC3E,KAAK,WAAW,CAAC,iBAAiB,CAAC;gBACjC,QAAQ,EAAE,aAAa,CAAC,cAAc,EAAE;aACzC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IACF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,sBAAsB;IAKpC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,OAAO,GAA6D;QACxE,UAAU,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,mBAAmB,EAAE;QAC3C,SAAS,EAAE,GAAG,EAAE;YACd,KAAK,WAAW,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;KACF,CAAC;IACF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,iBAAiB;IAK/B,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,OAAO,GAA+D;QAC1E,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;QAC1C,SAAS,EAAE,GAAG,EAAE;YACd,KAAK,WAAW,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;KACF,CAAC;IACF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,gBAAgB;IAK9B,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,OAAO,GAAqD;QAChE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QACzC,SAAS,EAAE,GAAG,EAAE;YACd,KAAK,WAAW,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC3E,KAAK,WAAW,CAAC,iBAAiB,CAAC;gBACjC,QAAQ,EAAE,aAAa,CAAC,cAAc,EAAE;aACzC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IACF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,cAAc;IAK5B,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,OAAO,GAIT;QACF,UAAU,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC;QACjD,SAAS,EAAE,GAAG,EAAE;YACd,KAAK,WAAW,CAAC,iBAAiB,CAAC;gBACjC,QAAQ,EAAE,aAAa,CAAC,cAAc,EAAE;aACzC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IACF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,sBAAsB,CACpC,OAAmB;IAEnB,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IACzB,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,OAAO,GAA+D;QAC1E,UAAU,EAAE,CAAC,eAAe,EAAE,EAAE,CAC9B,GAAG,CAAC,mBAAmB,CAAC,OAAO,EAAE,eAAe,CAAC;QACnD,SAAS,EAAE,GAAG,EAAE;YACd,KAAK,WAAW,CAAC,iBAAiB,CAAC;gBACjC,QAAQ,EAAE,aAAa,CAAC,aAAa,CAAC,OAAO,CAAC;aAC/C,CAAC,CAAC;QACL,CAAC;KACF,CAAC;IACF,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC;AAC9B,CAAC"}

package/dist/model/queries.d.ts

@@ -0,0 +1,30 @@
+import type { UseQueryResult } from "@tanstack/react-query";
+import type { StapelApiError } from "@stapel/core";
+import type { AuditPage, AuthSession as AuthSessionRecord, Capabilities, DelayedChangeStatus, OtpChannel, Passkey, PasswordMethods, SecurityStatus, SsoLookupResponse, StapelUser } from "../api/types.js";
+/**
+ * Read hooks over the auth API. Staleness follows core's query defaults;
+ * override per call site via `options` where a page needs fresher data (e.g.
+ * `sessions` after a revoke). Keys are namespaced (see `authQueryKeys`).
+ */
+/** Login-method feature matrix — call on the sign-in page (auth-sa.md §"capabilities"). */
+export declare function useCapabilities(): UseQueryResult<Capabilities, StapelApiError>;
+/** Current user (auth-sa.md §14). Enabled only when a session exists. */
+export declare function useMe(enabled?: boolean): UseQueryResult<StapelUser, StapelApiError>;
+/** Security settings snapshot (auth-sa.md §10). */
+export declare function useSecurityStatus(): UseQueryResult<SecurityStatus, StapelApiError>;
+/** Password-change tabs (auth-sa.md §4). */
+export declare function usePasswordMethods(): UseQueryResult<PasswordMethods, StapelApiError>;
+/** Active sessions (auth-sa.md §12). */
+export declare function useSessions(): UseQueryResult<readonly AuthSessionRecord[], StapelApiError>;
+/** Registered passkeys (auth-sa.md §17). */
+export declare function usePasskeys(): UseQueryResult<readonly Passkey[], StapelApiError>;
+/** A page of the security audit log (auth-sa.md §16). */
+export declare function useAuditLog(page?: number): UseQueryResult<AuditPage, StapelApiError>;
+/** Pending delayed authenticator change (auth-sa.md §9). */
+export declare function useDelayedChangeStatus(channel: OtpChannel): UseQueryResult<DelayedChangeStatus, StapelApiError>;
+/**
+ * SSO domain lookup (auth-sa.md §18). Disabled until `domain` is a non-empty
+ * value — call after the user finishes typing their email.
+ */
+export declare function useSsoLookup(domain: string): UseQueryResult<SsoLookupResponse, StapelApiError>;
+//# sourceMappingURL=queries.d.ts.map

package/dist/model/queries.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"queries.d.ts","sourceRoot":"","sources":["../../src/model/queries.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EACV,SAAS,EACT,WAAW,IAAI,iBAAiB,EAChC,YAAY,EACZ,mBAAmB,EACnB,UAAU,EACV,OAAO,EACP,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,UAAU,EACX,MAAM,iBAAiB,CAAC;AAIzB;;;;GAIG;AAEH,2FAA2F;AAC3F,wBAAgB,eAAe,IAAI,cAAc,CAAC,YAAY,EAAE,cAAc,CAAC,CAO9E;AAED,yEAAyE;AACzE,wBAAgB,KAAK,CACnB,OAAO,UAAO,GACb,cAAc,CAAC,UAAU,EAAE,cAAc,CAAC,CAO5C;AAED,mDAAmD;AACnD,wBAAgB,iBAAiB,IAAI,cAAc,CACjD,cAAc,EACd,cAAc,CACf,CAMA;AAED,4CAA4C;AAC5C,wBAAgB,kBAAkB,IAAI,cAAc,CAClD,eAAe,EACf,cAAc,CACf,CAMA;AAED,wCAAwC;AACxC,wBAAgB,WAAW,IAAI,cAAc,CAC3C,SAAS,iBAAiB,EAAE,EAC5B,cAAc,CACf,CAMA;AAED,4CAA4C;AAC5C,wBAAgB,WAAW,IAAI,cAAc,CAC3C,SAAS,OAAO,EAAE,EAClB,cAAc,CACf,CAMA;AAED,yDAAyD;AACzD,wBAAgB,WAAW,CACzB,IAAI,SAAI,GACP,cAAc,CAAC,SAAS,EAAE,cAAc,CAAC,CAM3C;AAED,4DAA4D;AAC5D,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,UAAU,GAClB,cAAc,CAAC,mBAAmB,EAAE,cAAc,CAAC,CAMrD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,MAAM,GACb,cAAc,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAOnD"}