@velion-la/onboarding-sdk-react-native 1.0.0-beta.2

package/lib/module/transport/api.js

@@ -0,0 +1,173 @@
+"use strict";
+
+/**
+ * @fileoverview Secure, centralized API caller for the Velion Onboarding SDK.
+ *
+ * The SDK version comes from `utils/sdkVersion.ts` (a regular module constant)
+ * instead of bundler-injected globals so this code runs identically in Metro.
+ *
+ * Design decisions:
+ * - **Factory pattern** (`createApiCaller`): Returns a pre-configured caller
+ *   bound to a specific `baseUrl` and `sessionToken`. Modules receive this
+ *   caller and never have direct access to the token string.
+ * - **No API keys**: Only the short-lived `sessionToken` (Bearer) is used.
+ * - **AbortController integration**: All calls accept an optional signal,
+ *   enabling clean cancellation when `VelionOnboarding.destroy()` is called.
+ * - **Structured errors**: All failures are normalized into `SdkError` objects
+ *   with machine-readable codes, never raw exceptions.
+ */
+
+import { SdkErrorCode } from '../types';
+import { isSecureHttpUrl } from './secureUrl';
+import { log } from '../utils/log';
+import { SDK_VERSION } from '../utils/sdkVersion';
+
+/** Hours of clock skew tolerated before we warn the user about an inaccurate device clock. */
+const CLOCK_SKEW_WARN_HOURS = 24;
+const SESSION_EXPIRED_CODE = SdkErrorCode.SESSION_EXPIRED;
+function buildApiError(message, httpStatus, cause) {
+  let code;
+  if (httpStatus === 401) {
+    code = SdkErrorCode.SESSION_EXPIRED;
+  } else if (httpStatus === 403) {
+    code = SdkErrorCode.SESSION_INVALID;
+  } else if (httpStatus === undefined || httpStatus === 0) {
+    code = SdkErrorCode.NETWORK_ERROR;
+  } else {
+    code = SdkErrorCode.API_ERROR;
+  }
+  return {
+    code,
+    message,
+    cause,
+    ...(httpStatus !== undefined && {
+      httpStatus
+    })
+  };
+}
+/**
+ * Creates a pre-authorized API caller bound to a specific session.
+ * All requests include Authorization: Bearer <sessionToken>.
+ */
+export function createApiCaller(rawBaseUrl, sessionToken, expiresAt) {
+  if (!isSecureHttpUrl(rawBaseUrl)) {
+    throw {
+      code: SdkErrorCode.UNKNOWN,
+      message: `Insecure apiUrl: "${rawBaseUrl}". The SDK refuses to send the session token over a non-TLS channel. ` + 'Use https://; http:// is accepted only for loopback (localhost / 127.0.0.1 / ::1).'
+    };
+  }
+  // Strip a trailing slash so concatenation with endpoints (which always
+  // start with `/`) never produces a double slash. This is the same
+  // normalization `sse.ts` already does.
+  const baseUrl = rawBaseUrl.replace(/\/$/, '');
+  let currentToken = sessionToken;
+  let currentExpiresAt = expiresAt;
+  let clockSkewWarned = false;
+  function ensureTokenValid() {
+    if (!currentExpiresAt) return;
+    const expiry = new Date(currentExpiresAt).getTime();
+    if (Number.isNaN(expiry)) return;
+    const now = Date.now();
+    const skewMs = now - expiry;
+    if (!clockSkewWarned && Math.abs(skewMs) > CLOCK_SKEW_WARN_HOURS * 60 * 60 * 1000) {
+      clockSkewWarned = true;
+      log.warn('[api] device clock appears to be off by more than', CLOCK_SKEW_WARN_HOURS, 'h relative to the session expiresAt; falling back to server-side 401 detection.');
+      return;
+    }
+    if (now >= expiry) {
+      throw {
+        code: SESSION_EXPIRED_CODE,
+        message: 'Session token has expired. Obtain a new session from your backend.'
+      };
+    }
+  }
+  function buildAuthHeaders(extra) {
+    return {
+      ...extra,
+      Authorization: `Bearer ${currentToken}`,
+      'X-Velion-SDK-Version': SDK_VERSION
+    };
+  }
+  function setSessionToken(token, expiresAtIso) {
+    currentToken = token;
+    currentExpiresAt = expiresAtIso;
+    clockSkewWarned = false;
+  }
+  async function call(endpoint, init, options = {}) {
+    ensureTokenValid();
+    const url = `${baseUrl}${endpoint}`;
+    let response;
+    try {
+      const initWithSignal = options.signal !== undefined ? {
+        ...init,
+        signal: options.signal
+      } : init;
+      response = await fetch(url, initWithSignal);
+    } catch (networkErr) {
+      const name = networkErr?.name;
+      if (name === 'AbortError') {
+        throw networkErr;
+      }
+      throw buildApiError(`Network request failed for "${endpoint}". Check connectivity.`, undefined, networkErr);
+    }
+    if (!response.ok) {
+      let errorBody = {};
+      try {
+        errorBody = await response.json();
+      } catch {
+        // Body may not be JSON (e.g., a 502 from a proxy). That's fine.
+      }
+      throw buildApiError(errorBody.message ?? `Backend returned ${response.status} on ${endpoint}.`, response.status, errorBody);
+    }
+    if (response.status === 204 || response.headers.get('content-length') === '0') {
+      return {};
+    }
+    const contentType = response.headers.get('content-type') ?? '';
+    if (!contentType.includes('application/json')) {
+      return {};
+    }
+    try {
+      return await response.json();
+    } catch (parseErr) {
+      throw buildApiError(`Failed to parse JSON response from "${endpoint}".`, response.status, parseErr);
+    }
+  }
+  async function get(endpoint, options) {
+    return call(endpoint, {
+      method: 'GET',
+      headers: buildAuthHeaders(options?.extraHeaders)
+    }, options);
+  }
+  async function post(endpoint, body, options) {
+    return call(endpoint, {
+      method: 'POST',
+      headers: buildAuthHeaders({
+        'Content-Type': 'application/json',
+        ...options?.extraHeaders
+      }),
+      body: JSON.stringify(body)
+    }, options);
+  }
+
+  /**
+   * Authenticated POST with a `FormData` body. RN's `fetch` mirrors the
+   * standard contract: don't set `Content-Type` so the runtime injects the
+   * multipart boundary.
+   */
+  async function postFormData(endpoint, formData, options) {
+    return call(endpoint, {
+      method: 'POST',
+      headers: buildAuthHeaders(options?.extraHeaders),
+      body: formData
+    }, options);
+  }
+  return {
+    get,
+    post,
+    postFormData,
+    setSessionToken
+  };
+}
+
+/** The type of the object returned by `createApiCaller`. */
+//# sourceMappingURL=api.js.map

package/lib/module/transport/api.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["SdkErrorCode","isSecureHttpUrl","log","SDK_VERSION","CLOCK_SKEW_WARN_HOURS","SESSION_EXPIRED_CODE","SESSION_EXPIRED","buildApiError","message","httpStatus","cause","code","SESSION_INVALID","undefined","NETWORK_ERROR","API_ERROR","createApiCaller","rawBaseUrl","sessionToken","expiresAt","UNKNOWN","baseUrl","replace","currentToken","currentExpiresAt","clockSkewWarned","ensureTokenValid","expiry","Date","getTime","Number","isNaN","now","skewMs","Math","abs","warn","buildAuthHeaders","extra","Authorization","setSessionToken","token","expiresAtIso","call","endpoint","init","options","url","response","initWithSignal","signal","fetch","networkErr","name","ok","errorBody","json","status","headers","get","contentType","includes","parseErr","method","extraHeaders","post","body","JSON","stringify","postFormData","formData"],"sourceRoot":"../../../src","sources":["transport/api.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,YAAY,QAAuB,UAAU;AACtD,SAASC,eAAe,QAAQ,aAAa;AAC7C,SAASC,GAAG,QAAQ,cAAc;AAClC,SAASC,WAAW,QAAQ,qBAAqB;;AAEjD;AACA,MAAMC,qBAAqB,GAAG,EAAE;AAEhC,MAAMC,oBAAoB,GAAGL,YAAY,CAACM,eAAe;AAQzD,SAASC,aAAaA,CACpBC,OAAe,EACfC,UAAmB,EACnBC,KAAe,EACL;EACV,IAAIC,IAAkB;EAEtB,IAAIF,UAAU,KAAK,GAAG,EAAE;IACtBE,IAAI,GAAGX,YAAY,CAACM,eAAe;EACrC,CAAC,MAAM,IAAIG,UAAU,KAAK,GAAG,EAAE;IAC7BE,IAAI,GAAGX,YAAY,CAACY,eAAe;EACrC,CAAC,MAAM,IAAIH,UAAU,KAAKI,SAAS,IAAIJ,UAAU,KAAK,CAAC,EAAE;IACvDE,IAAI,GAAGX,YAAY,CAACc,aAAa;EACnC,CAAC,MAAM;IACLH,IAAI,GAAGX,YAAY,CAACe,SAAS;EAC/B;EAEA,OAAO;IACLJ,IAAI;IACJH,OAAO;IACPE,KAAK;IACL,IAAID,UAAU,KAAKI,SAAS,IAAI;MAAEJ;IAAW,CAAC;EAChD,CAAC;AACH;AASA;AACA;AACA;AACA;AACA,OAAO,SAASO,eAAeA,CAC7BC,UAAkB,EAClBC,YAAoB,EACpBC,SAAkB,EAClB;EACA,IAAI,CAAClB,eAAe,CAACgB,UAAU,CAAC,EAAE;IAChC,MAAM;MACJN,IAAI,EAAEX,YAAY,CAACoB,OAAO;MAC1BZ,OAAO,EACL,qBAAqBS,UAAU,uEAAuE,GACtG;IACJ,CAAC;EACH;EACA;EACA;EACA;EACA,MAAMI,OAAO,GAAGJ,UAAU,CAACK,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;EAE7C,IAAIC,YAAY,GAAGL,YAAY;EAC/B,IAAIM,gBAAgB,GAAGL,SAAS;EAChC,IAAIM,eAAe,GAAG,KAAK;EAE3B,SAASC,gBAAgBA,CAAA,EAAS;IAChC,IAAI,CAACF,gBAAgB,EAAE;IACvB,MAAMG,MAAM,GAAG,IAAIC,IAAI,CAACJ,gBAAgB,CAAC,CAACK,OAAO,CAAC,CAAC;IACnD,IAAIC,MAAM,CAACC,KAAK,CAACJ,MAAM,CAAC,EAAE;IAC1B,MAAMK,GAAG,GAAGJ,IAAI,CAACI,GAAG,CAAC,CAAC;IACtB,MAAMC,MAAM,GAAGD,GAAG,GAAGL,MAAM;IAC3B,IACE,CAACF,eAAe,IAChBS,IAAI,CAACC,GAAG,CAACF,MAAM,CAAC,GAAG7B,qBAAqB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,EACzD;MACAqB,eAAe,GAAG,IAAI;MACtBvB,GAAG,CAACkC,IAAI,CACN,mDAAmD,EACnDhC,qBAAqB,EACrB,iFACF,CAAC;MACD;IACF;IACA,IAAI4B,GAAG,IAAIL,MAAM,EAAE;MACjB,MAAM;QACJhB,IAAI,EAAEN,oBAAoB;QAC1BG,OAAO,EACL;MACJ,CAAC;IACH;EACF;EAEA,SAAS6B,gBAAgBA,CAACC,KAA8B,EAA0B;IAChF,OAAO;MACL,GAAGA,KAAK;MACRC,aAAa,EAAE,UAAUhB,YAAY,EAAE;MACvC,sBAAsB,EAAEpB;IAC1B,CAAC;EACH;EAEA,SAASqC,eAAeA,CAACC,KAAa,EAAEC,YAAqB,EAAQ;IACnEnB,YAAY,GAAGkB,KAAK;IACpBjB,gBAAgB,GAAGkB,YAAY;IAC/BjB,eAAe,GAAG,KAAK;EACzB;EAEA,eAAekB,IAAIA,CACjBC,QAAgB,EAChBC,IAAiB,EACjBC,OAAuB,GAAG,CAAC,CAAC,EACR;IACpBpB,gBAAgB,CAAC,CAAC;IAClB,MAAMqB,GAAG,GAAG,GAAG1B,OAAO,GAAGuB,QAAQ,EAAE;IAEnC,IAAII,QAAkB;IACtB,IAAI;MACF,MAAMC,cAAc,GAClBH,OAAO,CAACI,MAAM,KAAKrC,SAAS,GACxB;QAAE,GAAGgC,IAAI;QAAEK,MAAM,EAAEJ,OAAO,CAACI;MAAO,CAAC,GACnCL,IAAI;MACVG,QAAQ,GAAG,MAAMG,KAAK,CAACJ,GAAG,EAAEE,cAAc,CAAC;IAC7C,CAAC,CAAC,OAAOG,UAAU,EAAE;MACnB,MAAMC,IAAI,GAAID,UAAU,EAA+BC,IAAI;MAC3D,IAAIA,IAAI,KAAK,YAAY,EAAE;QACzB,MAAMD,UAAU;MAClB;MACA,MAAM7C,aAAa,CACjB,+BAA+BqC,QAAQ,wBAAwB,EAC/D/B,SAAS,EACTuC,UACF,CAAC;IACH;IAEA,IAAI,CAACJ,QAAQ,CAACM,EAAE,EAAE;MAChB,IAAIC,SAA2B,GAAG,CAAC,CAAC;MACpC,IAAI;QACFA,SAAS,GAAI,MAAMP,QAAQ,CAACQ,IAAI,CAAC,CAAsB;MACzD,CAAC,CAAC,MAAM;QACN;MAAA;MAGF,MAAMjD,aAAa,CACjBgD,SAAS,CAAC/C,OAAO,IACf,oBAAoBwC,QAAQ,CAACS,MAAM,OAAOb,QAAQ,GAAG,EACvDI,QAAQ,CAACS,MAAM,EACfF,SACF,CAAC;IACH;IAEA,IACEP,QAAQ,CAACS,MAAM,KAAK,GAAG,IACvBT,QAAQ,CAACU,OAAO,CAACC,GAAG,CAAC,gBAAgB,CAAC,KAAK,GAAG,EAC9C;MACA,OAAO,CAAC,CAAC;IACX;IAEA,MAAMC,WAAW,GAAGZ,QAAQ,CAACU,OAAO,CAACC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE;IAC9D,IAAI,CAACC,WAAW,CAACC,QAAQ,CAAC,kBAAkB,CAAC,EAAE;MAC7C,OAAO,CAAC,CAAC;IACX;IAEA,IAAI;MACF,OAAQ,MAAMb,QAAQ,CAACQ,IAAI,CAAC,CAAC;IAC/B,CAAC,CAAC,OAAOM,QAAQ,EAAE;MACjB,MAAMvD,aAAa,CACjB,uCAAuCqC,QAAQ,IAAI,EACnDI,QAAQ,CAACS,MAAM,EACfK,QACF,CAAC;IACH;EACF;EAEA,eAAeH,GAAGA,CAChBf,QAAgB,EAChBE,OAAwB,EACJ;IACpB,OAAOH,IAAI,CACTC,QAAQ,EACR;MACEmB,MAAM,EAAE,KAAK;MACbL,OAAO,EAAErB,gBAAgB,CAACS,OAAO,EAAEkB,YAAY;IACjD,CAAC,EACDlB,OACF,CAAC;EACH;EAEA,eAAemB,IAAIA,CACjBrB,QAAgB,EAChBsB,IAAa,EACbpB,OAAwB,EACJ;IACpB,OAAOH,IAAI,CACTC,QAAQ,EACR;MACEmB,MAAM,EAAE,MAAM;MACdL,OAAO,EAAErB,gBAAgB,CAAC;QACxB,cAAc,EAAE,kBAAkB;QAClC,GAAGS,OAAO,EAAEkB;MACd,CAAC,CAAC;MACFE,IAAI,EAAEC,IAAI,CAACC,SAAS,CAACF,IAAI;IAC3B,CAAC,EACDpB,OACF,CAAC;EACH;;EAEA;AACF;AACA;AACA;AACA;EACE,eAAeuB,YAAYA,CACzBzB,QAAgB,EAChB0B,QAAkB,EAClBxB,OAAwB,EACJ;IACpB,OAAOH,IAAI,CACTC,QAAQ,EACR;MACEmB,MAAM,EAAE,MAAM;MACdL,OAAO,EAAErB,gBAAgB,CAACS,OAAO,EAAEkB,YAAY,CAAC;MAChDE,IAAI,EAAEI;IACR,CAAC,EACDxB,OACF,CAAC;EACH;EAEA,OAAO;IAAEa,GAAG;IAAEM,IAAI;IAAEI,YAAY;IAAE7B;EAAgB,CAAC;AACrD;;AAEA","ignoreList":[]}

package/lib/module/transport/irisWebSocket.js

@@ -0,0 +1,115 @@
+"use strict";
+
+/**
+ * @fileoverview Typed wrapper around the WebSocket connection to the Iris
+ * orchestrator.
+ *
+ *   - Server messages are JSON (`{ type, ... }`). See `IrisServerMessage`.
+ *   - Client → server frames are either:
+ *       a) raw `ArrayBuffer` JPEGs (when no HMAC key was returned), or
+ *       b) JSON envelopes signed with HMAC-SHA256 (see `utils/hmac`).
+ *
+ * The WebSocket global on RN supports both string and binary payloads, so we
+ * don't need any extra polyfills. We do require the URL to be `wss://`
+ * (or `ws://localhost:*` for dev) — TLS is enforced.
+ */
+
+import { isSecureWebSocketUrl } from './secureUrl';
+import { log } from '../utils/log';
+const WS_OPEN = 1;
+
+/** Builds the final connect URL with `?token=...&lang=...` query params. */
+export function buildIrisUrl(websocketUrl, connectionToken, locale) {
+  let url = websocketUrl;
+  if (connectionToken) {
+    const sep = url.includes('?') ? '&' : '?';
+    url = `${url}${sep}token=${encodeURIComponent(connectionToken)}`;
+  }
+  const normalizedLang = locale.toLowerCase().startsWith('es') ? 'es' : 'en';
+  const langSep = url.includes('?') ? '&' : '?';
+  url = `${url}${langSep}lang=${normalizedLang}`;
+  return url;
+}
+
+/**
+ * Open a WebSocket against the Iris orchestrator. The URL must already include
+ * the customer's `connection_token` if Iris enforced auth.
+ *
+ * `onClose` fires for both clean (`code === 1000`) and unclean closures —
+ * callers decide how to react (terminal warning vs. unexpected drop).
+ */
+export function openIrisWebSocket(opts) {
+  if (!isSecureWebSocketUrl(opts.websocketUrl)) {
+    throw new Error(`Iris websocket_url must be wss:// (or ws://localhost in dev). Got: "${opts.websocketUrl}"`);
+  }
+  const url = buildIrisUrl(opts.websocketUrl, opts.connectionToken, opts.locale);
+  log.info('[IrisWS] opening', {
+    url: opts.websocketUrl
+  });
+  const ws = new WebSocket(url);
+  let closed = false;
+  ws.onopen = () => {
+    log.info('[IrisWS] open');
+    opts.onOpen?.();
+  };
+  ws.onmessage = event => {
+    if (typeof event.data !== 'string') return;
+    try {
+      const parsed = JSON.parse(event.data);
+      opts.onMessage(parsed);
+    } catch {
+      // Iris only sends JSON; ignore noise.
+    }
+  };
+  ws.onerror = event => {
+    log.warn('[IrisWS] error', event);
+    opts.onError?.(event);
+  };
+  ws.onclose = event => {
+    log.info('[IrisWS] close', {
+      code: event.code,
+      reason: event.reason
+    });
+    closed = true;
+    opts.onClose?.(event.code, event.reason ?? '');
+  };
+  return {
+    sendBinary: data => {
+      if (closed || ws.readyState !== WS_OPEN) return false;
+      try {
+        ws.send(data);
+        return true;
+      } catch (err) {
+        log.warn('[IrisWS] sendBinary failed', err);
+        return false;
+      }
+    },
+    sendJson: envelope => {
+      if (closed || ws.readyState !== WS_OPEN) return false;
+      try {
+        ws.send(envelope);
+        return true;
+      } catch (err) {
+        log.warn('[IrisWS] sendJson failed', err);
+        return false;
+      }
+    },
+    close: (code = 1000, reason = '') => {
+      if (closed) return;
+      closed = true;
+      try {
+        ws.close(code, reason);
+      } catch {
+        /* ignore */
+      }
+    },
+    isOpen: () => !closed && ws.readyState === WS_OPEN
+  };
+}
+
+/**
+ * Subset of WARNING `code`s that mean "Iris is about to close, escalate to
+ * the in-flow retry dialog instead of the generic close handler".
+ */
+export const TERMINAL_WARNING_CODES = new Set(['SPOOF_RISK_HIGH', 'SESSION_TERMINATED', 'BIOMETRIC_LOCK']);
+//# sourceMappingURL=irisWebSocket.js.map

package/lib/module/transport/irisWebSocket.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["isSecureWebSocketUrl","log","WS_OPEN","buildIrisUrl","websocketUrl","connectionToken","locale","url","sep","includes","encodeURIComponent","normalizedLang","toLowerCase","startsWith","langSep","openIrisWebSocket","opts","Error","info","ws","WebSocket","closed","onopen","onOpen","onmessage","event","data","parsed","JSON","parse","onMessage","onerror","warn","onError","onclose","code","reason","onClose","sendBinary","readyState","send","err","sendJson","envelope","close","isOpen","TERMINAL_WARNING_CODES","Set"],"sourceRoot":"../../../src","sources":["transport/irisWebSocket.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,oBAAoB,QAAQ,aAAa;AAClD,SAASC,GAAG,QAAQ,cAAc;AA+DlC,MAAMC,OAAO,GAAG,CAAC;;AAEjB;AACA,OAAO,SAASC,YAAYA,CAC1BC,YAAoB,EACpBC,eAAmC,EACnCC,MAAc,EACN;EACR,IAAIC,GAAG,GAAGH,YAAY;EACtB,IAAIC,eAAe,EAAE;IACnB,MAAMG,GAAG,GAAGD,GAAG,CAACE,QAAQ,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG;IACzCF,GAAG,GAAG,GAAGA,GAAG,GAAGC,GAAG,SAASE,kBAAkB,CAACL,eAAe,CAAC,EAAE;EAClE;EACA,MAAMM,cAAc,GAAGL,MAAM,CAACM,WAAW,CAAC,CAAC,CAACC,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI;EAC1E,MAAMC,OAAO,GAAGP,GAAG,CAACE,QAAQ,CAAC,GAAG,CAAC,GAAG,GAAG,GAAG,GAAG;EAC7CF,GAAG,GAAG,GAAGA,GAAG,GAAGO,OAAO,QAAQH,cAAc,EAAE;EAC9C,OAAOJ,GAAG;AACZ;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASQ,iBAAiBA,CAACC,IAAqB,EAAkB;EACvE,IAAI,CAAChB,oBAAoB,CAACgB,IAAI,CAACZ,YAAY,CAAC,EAAE;IAC5C,MAAM,IAAIa,KAAK,CACb,uEAAuED,IAAI,CAACZ,YAAY,GAC1F,CAAC;EACH;EACA,MAAMG,GAAG,GAAGJ,YAAY,CAACa,IAAI,CAACZ,YAAY,EAAEY,IAAI,CAACX,eAAe,EAAEW,IAAI,CAACV,MAAM,CAAC;EAE9EL,GAAG,CAACiB,IAAI,CAAC,kBAAkB,EAAE;IAAEX,GAAG,EAAES,IAAI,CAACZ;EAAa,CAAC,CAAC;EAExD,MAAMe,EAAE,GAAG,IAAIC,SAAS,CAACb,GAAG,CAAC;EAC7B,IAAIc,MAAM,GAAG,KAAK;EAElBF,EAAE,CAACG,MAAM,GAAG,MAAM;IAChBrB,GAAG,CAACiB,IAAI,CAAC,eAAe,CAAC;IACzBF,IAAI,CAACO,MAAM,GAAG,CAAC;EACjB,CAAC;EAEDJ,EAAE,CAACK,SAAS,GAAIC,KAA4B,IAAK;IAC/C,IAAI,OAAOA,KAAK,CAACC,IAAI,KAAK,QAAQ,EAAE;IACpC,IAAI;MACF,MAAMC,MAAM,GAAGC,IAAI,CAACC,KAAK,CAACJ,KAAK,CAACC,IAAI,CAAsB;MAC1DV,IAAI,CAACc,SAAS,CAACH,MAAM,CAAC;IACxB,CAAC,CAAC,MAAM;MACN;IAAA;EAEJ,CAAC;EAEDR,EAAE,CAACY,OAAO,GAAIN,KAAK,IAAK;IACtBxB,GAAG,CAAC+B,IAAI,CAAC,gBAAgB,EAAEP,KAAK,CAAC;IACjCT,IAAI,CAACiB,OAAO,GAAGR,KAAc,CAAC;EAChC,CAAC;EAEDN,EAAE,CAACe,OAAO,GAAIT,KAAK,IAAK;IACtBxB,GAAG,CAACiB,IAAI,CAAC,gBAAgB,EAAE;MAAEiB,IAAI,EAAEV,KAAK,CAACU,IAAI;MAAEC,MAAM,EAAEX,KAAK,CAACW;IAAO,CAAC,CAAC;IACtEf,MAAM,GAAG,IAAI;IACbL,IAAI,CAACqB,OAAO,GAAGZ,KAAK,CAACU,IAAI,EAAEV,KAAK,CAACW,MAAM,IAAI,EAAE,CAAC;EAChD,CAAC;EAED,OAAO;IACLE,UAAU,EAAGZ,IAAI,IAAK;MACpB,IAAIL,MAAM,IAAIF,EAAE,CAACoB,UAAU,KAAKrC,OAAO,EAAE,OAAO,KAAK;MACrD,IAAI;QACFiB,EAAE,CAACqB,IAAI,CAACd,IAAmB,CAAC;QAC5B,OAAO,IAAI;MACb,CAAC,CAAC,OAAOe,GAAG,EAAE;QACZxC,GAAG,CAAC+B,IAAI,CAAC,4BAA4B,EAAES,GAAG,CAAC;QAC3C,OAAO,KAAK;MACd;IACF,CAAC;IACDC,QAAQ,EAAGC,QAAQ,IAAK;MACtB,IAAItB,MAAM,IAAIF,EAAE,CAACoB,UAAU,KAAKrC,OAAO,EAAE,OAAO,KAAK;MACrD,IAAI;QACFiB,EAAE,CAACqB,IAAI,CAACG,QAAQ,CAAC;QACjB,OAAO,IAAI;MACb,CAAC,CAAC,OAAOF,GAAG,EAAE;QACZxC,GAAG,CAAC+B,IAAI,CAAC,0BAA0B,EAAES,GAAG,CAAC;QACzC,OAAO,KAAK;MACd;IACF,CAAC;IACDG,KAAK,EAAEA,CAACT,IAAI,GAAG,IAAI,EAAEC,MAAM,GAAG,EAAE,KAAK;MACnC,IAAIf,MAAM,EAAE;MACZA,MAAM,GAAG,IAAI;MACb,IAAI;QACFF,EAAE,CAACyB,KAAK,CAACT,IAAI,EAAEC,MAAM,CAAC;MACxB,CAAC,CAAC,MAAM;QACN;MAAA;IAEJ,CAAC;IACDS,MAAM,EAAEA,CAAA,KAAM,CAACxB,MAAM,IAAIF,EAAE,CAACoB,UAAU,KAAKrC;EAC7C,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACA,OAAO,MAAM4C,sBAAsB,GAAG,IAAIC,GAAG,CAAS,CACpD,iBAAiB,EACjB,oBAAoB,EACpB,gBAAgB,CACjB,CAAC","ignoreList":[]}

package/lib/module/transport/secureUrl.js

@@ -0,0 +1,45 @@
+"use strict";
+
+/**
+ * @fileoverview Transport-security guards for runtime URLs.
+ *
+ * The SDK exchanges bearer tokens, KYC documents and selfies. A misconfigured
+ * `apiUrl`, a tampered `liveness-init` response, or a backend that returns a
+ * `ws://` URL would all leak that data in cleartext. These helpers force every
+ * runtime endpoint to use TLS, with a single carve-out for loopback hosts so
+ * developers can still run the SDK against a local backend.
+ */
+
+function isLocalhostHost(host) {
+  // `URL.hostname` returns `[::1]` (with brackets) for IPv6 loopback in some
+  // engines and `::1` in others — accept both. Strict loopback only: arbitrary
+  // `*.local` (Bonjour) or `*.svc.cluster.local` hostnames are NOT exempted —
+  // the SDK refuses to send the session token over plain HTTP outside of
+  // loopback even if the host is reachable on the local network.
+  return host === 'localhost' || host === '127.0.0.1' || host === '::1' || host === '[::1]';
+}
+
+/** True when the URL is `https://`, or `http://localhost`-style for dev. */
+export function isSecureHttpUrl(url) {
+  try {
+    const u = new URL(url);
+    if (u.protocol === 'https:') return true;
+    if (u.protocol === 'http:') return isLocalhostHost(u.hostname);
+    return false;
+  } catch {
+    return false;
+  }
+}
+
+/** True when the URL is `wss://`, or `ws://localhost`-style for dev. */
+export function isSecureWebSocketUrl(url) {
+  try {
+    const u = new URL(url);
+    if (u.protocol === 'wss:') return true;
+    if (u.protocol === 'ws:') return isLocalhostHost(u.hostname);
+    return false;
+  } catch {
+    return false;
+  }
+}
+//# sourceMappingURL=secureUrl.js.map

package/lib/module/transport/secureUrl.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["isLocalhostHost","host","isSecureHttpUrl","url","u","URL","protocol","hostname","isSecureWebSocketUrl"],"sourceRoot":"../../../src","sources":["transport/secureUrl.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,SAASA,eAAeA,CAACC,IAAY,EAAW;EAC9C;EACA;EACA;EACA;EACA;EACA,OACEA,IAAI,KAAK,WAAW,IACpBA,IAAI,KAAK,WAAW,IACpBA,IAAI,KAAK,KAAK,IACdA,IAAI,KAAK,OAAO;AAEpB;;AAEA;AACA,OAAO,SAASC,eAAeA,CAACC,GAAW,EAAW;EACpD,IAAI;IACF,MAAMC,CAAC,GAAG,IAAIC,GAAG,CAACF,GAAG,CAAC;IACtB,IAAIC,CAAC,CAACE,QAAQ,KAAK,QAAQ,EAAE,OAAO,IAAI;IACxC,IAAIF,CAAC,CAACE,QAAQ,KAAK,OAAO,EAAE,OAAON,eAAe,CAACI,CAAC,CAACG,QAAQ,CAAC;IAC9D,OAAO,KAAK;EACd,CAAC,CAAC,MAAM;IACN,OAAO,KAAK;EACd;AACF;;AAEA;AACA,OAAO,SAASC,oBAAoBA,CAACL,GAAW,EAAW;EACzD,IAAI;IACF,MAAMC,CAAC,GAAG,IAAIC,GAAG,CAACF,GAAG,CAAC;IACtB,IAAIC,CAAC,CAACE,QAAQ,KAAK,MAAM,EAAE,OAAO,IAAI;IACtC,IAAIF,CAAC,CAACE,QAAQ,KAAK,KAAK,EAAE,OAAON,eAAe,CAACI,CAAC,CAACG,QAAQ,CAAC;IAC5D,OAAO,KAAK;EACd,CAAC,CAAC,MAAM;IACN,OAAO,KAAK;EACd;AACF","ignoreList":[]}

package/lib/module/transport/sse.js

@@ -0,0 +1,242 @@
+"use strict";
+
+/**
+ * @fileoverview SSE client for React Native, with auto-reconnect.
+ *
+ * React Native's `fetch` does not expose `body.getReader()`, so we lean on
+ * `react-native-sse` — which follows the `EventSource` model and dispatches
+ * by `event:` name. If the backend publishes named events
+ * (e.g. `event: NextStepRequestedEvent`), the default `'message'` listener
+ * never fires.
+ *
+ * To cover both cases we register the same handler on `'message'` AND on
+ * every named event the orchestrator may emit. New event types are
+ * discovered automatically the first time the wrapper sees them
+ * (`addEventListener` is added on demand) — see the dynamic registration
+ * below.
+ *
+ * ## Reconnection
+ *
+ * Production deployments behind GCP / k8s ingress (and most load balancers)
+ * close idle TCP streams at ~30 s. When that happens `react-native-sse`
+ * fires `error` with `{ type: 'error', message: 'cannot parse response',
+ * xhrStatus: 200, xhrState: 4 }` — a clean upstream close, not a real
+ * transport failure. The native EventSource spec would auto-reconnect
+ * here, but `react-native-sse` does not in this scenario, so we wrap it.
+ *
+ * Strategy:
+ *   - On `error` or `close`, schedule a reconnect with exponential backoff
+ *     (capped at 30 s). On `open` of the new connection, reset the attempt
+ *     counter so a brief blip doesn't punish us forever.
+ *   - Track `lastEventId` across reconnects — the backend supports
+ *     `Last-Event-ID` replay via Redis, so we never lose an event that
+ *     fired during the gap.
+ *   - Don't escalate transient drops to `onError`: the orchestrator uses
+ *     that callback to switch to GET polling, which is a much worse UX
+ *     than a 1 s blip + replay. We still log the underlying error for
+ *     debugging.
+ *
+ * Path: `${baseUrl}/sessions/:sessionId/events` (baseUrl already includes `/public/sdk`).
+ * Backend: `OnboardingSseController GET /public/sdk/sessions/{sessionId}/events`.
+ */
+
+import EventSource from 'react-native-sse';
+import { log } from '../utils/log';
+export const SSE_EVENTS_PATH = '/sessions';
+
+/**
+ * Named events the backend is known to dispatch. The list intentionally
+ * covers both the legacy domain-event names (e.g. `NextStepRequestedEvent`)
+ * and the public wire types (`ROUTING_COMMAND`, `STEP_UPDATED`, …) so we
+ * stay compatible with whichever shape the orchestrator chooses.
+ */
+const KNOWN_EVENT_TYPES = [
+// Public/wire types (preferred — what the SDK code branches on).
+'ROUTING_COMMAND', 'STEP_UPDATED', 'SESSION_APPROVED', 'SESSION_MANUAL_REVIEW', 'SESSION_DECLINED', 'SESSION_TERMINATED',
+// Legacy/domain-event names emitted by `SseDomainEventConsumer` in the
+// Spring orchestrator. Listening to both lets the same SDK build talk to
+// older and newer backends without a config flag.
+'NextStepRequestedEvent', 'StepUpdatedEvent', 'SessionApprovedEvent', 'SessionManualReviewEvent', 'SessionDeclinedEvent', 'SessionTerminatedEvent', 'OnboardingCreatedEvent'];
+
+/** Backoff schedule (ms). Last entry repeats indefinitely. */
+const RECONNECT_BACKOFF_MS = [1_000, 2_000, 4_000, 8_000, 15_000, 30_000];
+export function createSessionEventSource(options) {
+  const {
+    baseUrl,
+    sessionId,
+    sessionToken,
+    lastEventId: initialLastEventId = '0',
+    signal,
+    onEvent,
+    onError
+  } = options;
+  const base = baseUrl.replace(/\/$/, '');
+  const url = `${base}${SSE_EVENTS_PATH}/${sessionId}/events`;
+
+  /** Updated on every event we receive — replayed via Last-Event-ID. */
+  let lastEventId = initialLastEventId;
+  let attempt = 0;
+  let closed = false;
+  let current = null;
+  let reconnectTimer = null;
+  /**
+   * Monotonic id of the active EventSource. Listeners capture their own id
+   * and only act if it still matches — events from a previous instance that
+   * fire after we've moved on (e.g. `close` fired *because* we called
+   * `es.close()` ourselves) are ignored. Without this guard the listeners
+   * cascade into runaway reconnect loops.
+   */
+  let generation = 0;
+
+  // Cast to a relaxed type — `react-native-sse` typings are over-strict on
+  // the constructor signature when passing a custom-events tuple.
+  const EventSourceCtor = EventSource;
+  const buildHeaders = () => {
+    const headers = {
+      Accept: 'text/event-stream',
+      Authorization: `Bearer ${sessionToken}`,
+      // Hint to any intermediate proxy not to buffer the stream.
+      'Cache-Control': 'no-cache'
+    };
+    if (lastEventId !== '0') {
+      headers['Last-Event-ID'] = lastEventId;
+    }
+    return headers;
+  };
+  const scheduleReconnect = reason => {
+    if (closed) return;
+    if (reconnectTimer != null) return; // already scheduled
+    const delay = RECONNECT_BACKOFF_MS[Math.min(attempt, RECONNECT_BACKOFF_MS.length - 1)] ?? 30_000;
+    attempt += 1;
+    log.info('[SSE] Reconnecting', {
+      reason,
+      attempt,
+      delayMs: delay,
+      lastEventId
+    });
+    reconnectTimer = setTimeout(() => {
+      reconnectTimer = null;
+      if (closed) return;
+      tearDown(current);
+      current = connect();
+    }, delay);
+  };
+
+  /**
+   * Detach listeners and close an EventSource that we're about to replace.
+   * The listener detach is what stops the cascade: without it, `es.close()`
+   * itself dispatches a `close` event, which our handler would catch and
+   * schedule another reconnect — even though we already started a new one.
+   */
+  const tearDown = es => {
+    if (!es) return;
+    try {
+      es.removeAllEventListeners?.();
+    } catch (detachErr) {
+      log.warn('[SSE] Error detaching listeners from previous stream', detachErr);
+    }
+    try {
+      es.close();
+    } catch (closeErr) {
+      log.warn('[SSE] Error closing previous stream', closeErr);
+    }
+  };
+  const connect = () => {
+    const myGen = ++generation;
+    const isStale = () => closed || myGen !== generation;
+    const headers = buildHeaders();
+    log.info('[SSE] Opening stream', {
+      url,
+      sessionId,
+      hasLastEventId: lastEventId !== '0',
+      lastEventId,
+      attempt,
+      generation: myGen
+    });
+    const es = new EventSourceCtor(url, {
+      headers,
+      method: 'GET',
+      pollingInterval: 0,
+      customEvents: KNOWN_EVENT_TYPES
+    });
+    es.addEventListener('open', () => {
+      if (isStale()) return;
+      log.info('[SSE] Stream connected', {
+        generation: myGen
+      });
+      // Reset backoff once the upstream has accepted us — a healthy
+      // connection wipes any prior penalty.
+      attempt = 0;
+    });
+    const handleMessage = evt => {
+      if (isStale()) return;
+      const data = evt.data;
+      // Track lastEventId even when we receive a heartbeat / non-JSON
+      // chunk: the server still advanced its replay cursor.
+      if (typeof evt.lastEventId === 'string' && evt.lastEventId.length > 0) {
+        lastEventId = evt.lastEventId;
+      }
+      if (typeof data !== 'string' || data.length === 0) return;
+      try {
+        const payload = JSON.parse(data);
+        log.info('[SSE] Event received', {
+          wireType: evt.type,
+          eventType: payload.event_type,
+          action: payload.action,
+          stepCode: payload.step_code,
+          eventId: payload.event_id
+        });
+        onEvent?.(payload);
+      } catch (parseErr) {
+        log.warn('[SSE] Failed to parse event payload', {
+          wireType: evt.type,
+          rawData: data,
+          error: parseErr
+        });
+      }
+    };
+    es.addEventListener('message', handleMessage);
+    for (const type of KNOWN_EVENT_TYPES) {
+      es.addEventListener(type, handleMessage);
+    }
+    es.addEventListener('error', evt => {
+      if (isStale()) return;
+      // Most errors here are upstream idle-timeouts from the ingress.
+      // Log at info level (not error) to avoid noisy reports, and don't
+      // escalate to onError — we'll just reconnect.
+      log.info('[SSE] Stream interrupted, will reconnect', evt);
+      scheduleReconnect('error');
+    });
+    es.addEventListener('close', () => {
+      if (isStale()) return;
+      log.info('[SSE] Stream closed by server, will reconnect');
+      scheduleReconnect('close');
+    });
+    return es;
+  };
+  current = connect();
+  const closeAll = () => {
+    if (closed) return;
+    closed = true;
+    if (reconnectTimer != null) {
+      clearTimeout(reconnectTimer);
+      reconnectTimer = null;
+    }
+    tearDown(current);
+    current = null;
+  };
+  if (signal) {
+    if (signal.aborted) {
+      closeAll();
+    } else {
+      signal.addEventListener('abort', closeAll);
+    }
+  }
+
+  // We still expose onError so the orchestrator can react to *unrecoverable*
+  // failures — but with auto-reconnect, the only realistic trigger is the
+  // outer signal aborting. Keep the parameter wired up for future use.
+  void onError;
+  return closeAll;
+}
+//# sourceMappingURL=sse.js.map

package/lib/module/transport/sse.js.map

@@ -0,0 +1 @@
+{"version":3,"names":["EventSource","log","SSE_EVENTS_PATH","KNOWN_EVENT_TYPES","RECONNECT_BACKOFF_MS","createSessionEventSource","options","baseUrl","sessionId","sessionToken","lastEventId","initialLastEventId","signal","onEvent","onError","base","replace","url","attempt","closed","current","reconnectTimer","generation","EventSourceCtor","buildHeaders","headers","Accept","Authorization","scheduleReconnect","reason","delay","Math","min","length","info","delayMs","setTimeout","tearDown","connect","es","removeAllEventListeners","detachErr","warn","close","closeErr","myGen","isStale","hasLastEventId","method","pollingInterval","customEvents","addEventListener","handleMessage","evt","data","payload","JSON","parse","wireType","type","eventType","event_type","action","stepCode","step_code","eventId","event_id","parseErr","rawData","error","closeAll","clearTimeout","aborted"],"sourceRoot":"../../../src","sources":["transport/sse.ts"],"mappings":";;AAAA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAEA,OAAOA,WAAW,MAAM,kBAAkB;AAE1C,SAASC,GAAG,QAAQ,cAAc;AAElC,OAAO,MAAMC,eAAe,GAAG,WAAW;;AAE1C;AACA;AACA;AACA;AACA;AACA;AACA,MAAMC,iBAAiB,GAAG;AACxB;AACA,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,uBAAuB,EACvB,kBAAkB,EAClB,oBAAoB;AACpB;AACA;AACA;AACA,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC1B,sBAAsB,EACtB,wBAAwB,EACxB,wBAAwB,CAChB;;AAEV;AACA,MAAMC,oBAAoB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAU;AA6BlF,OAAO,SAASC,wBAAwBA,CACtCC,OAAkC,EACtB;EACZ,MAAM;IACJC,OAAO;IACPC,SAAS;IACTC,YAAY;IACZC,WAAW,EAAEC,kBAAkB,GAAG,GAAG;IACrCC,MAAM;IACNC,OAAO;IACPC;EACF,CAAC,GAAGR,OAAO;EAEX,MAAMS,IAAI,GAAGR,OAAO,CAACS,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;EACvC,MAAMC,GAAG,GAAG,GAAGF,IAAI,GAAGb,eAAe,IAAIM,SAAS,SAAS;;EAE3D;EACA,IAAIE,WAAW,GAAGC,kBAAkB;EACpC,IAAIO,OAAO,GAAG,CAAC;EACf,IAAIC,MAAM,GAAG,KAAK;EAClB,IAAIC,OAA6B,GAAG,IAAI;EACxC,IAAIC,cAAoD,GAAG,IAAI;EAC/D;AACF;AACA;AACA;AACA;AACA;AACA;EACE,IAAIC,UAAU,GAAG,CAAC;;EAElB;EACA;EACA,MAAMC,eAAe,GAAGvB,WAWN;EAElB,MAAMwB,YAAY,GAAGA,CAAA,KAA8B;IACjD,MAAMC,OAA+B,GAAG;MACtCC,MAAM,EAAE,mBAAmB;MAC3BC,aAAa,EAAE,UAAUlB,YAAY,EAAE;MACvC;MACA,eAAe,EAAE;IACnB,CAAC;IACD,IAAIC,WAAW,KAAK,GAAG,EAAE;MACvBe,OAAO,CAAC,eAAe,CAAC,GAAGf,WAAW;IACxC;IACA,OAAOe,OAAO;EAChB,CAAC;EAED,MAAMG,iBAAiB,GAAIC,MAAc,IAAW;IAClD,IAAIV,MAAM,EAAE;IACZ,IAAIE,cAAc,IAAI,IAAI,EAAE,OAAO,CAAC;IACpC,MAAMS,KAAK,GACT1B,oBAAoB,CAAC2B,IAAI,CAACC,GAAG,CAACd,OAAO,EAAEd,oBAAoB,CAAC6B,MAAM,GAAG,CAAC,CAAC,CAAC,IACxE,MAAM;IACRf,OAAO,IAAI,CAAC;IACZjB,GAAG,CAACiC,IAAI,CAAC,oBAAoB,EAAE;MAC7BL,MAAM;MACNX,OAAO;MACPiB,OAAO,EAAEL,KAAK;MACdpB;IACF,CAAC,CAAC;IACFW,cAAc,GAAGe,UAAU,CAAC,MAAM;MAChCf,cAAc,GAAG,IAAI;MACrB,IAAIF,MAAM,EAAE;MACZkB,QAAQ,CAACjB,OAAO,CAAC;MACjBA,OAAO,GAAGkB,OAAO,CAAC,CAAC;IACrB,CAAC,EAAER,KAAK,CAAC;EACX,CAAC;;EAED;AACF;AACA;AACA;AACA;AACA;EACE,MAAMO,QAAQ,GAAIE,EAAwB,IAAW;IACnD,IAAI,CAACA,EAAE,EAAE;IACT,IAAI;MACFA,EAAE,CAACC,uBAAuB,GAAG,CAAC;IAChC,CAAC,CAAC,OAAOC,SAAS,EAAE;MAClBxC,GAAG,CAACyC,IAAI,CAAC,sDAAsD,EAAED,SAAS,CAAC;IAC7E;IACA,IAAI;MACFF,EAAE,CAACI,KAAK,CAAC,CAAC;IACZ,CAAC,CAAC,OAAOC,QAAQ,EAAE;MACjB3C,GAAG,CAACyC,IAAI,CAAC,qCAAqC,EAAEE,QAAQ,CAAC;IAC3D;EACF,CAAC;EAED,MAAMN,OAAO,GAAGA,CAAA,KAAqB;IACnC,MAAMO,KAAK,GAAG,EAAEvB,UAAU;IAC1B,MAAMwB,OAAO,GAAGA,CAAA,KAAe3B,MAAM,IAAI0B,KAAK,KAAKvB,UAAU;IAE7D,MAAMG,OAAO,GAAGD,YAAY,CAAC,CAAC;IAC9BvB,GAAG,CAACiC,IAAI,CAAC,sBAAsB,EAAE;MAC/BjB,GAAG;MACHT,SAAS;MACTuC,cAAc,EAAErC,WAAW,KAAK,GAAG;MACnCA,WAAW;MACXQ,OAAO;MACPI,UAAU,EAAEuB;IACd,CAAC,CAAC;IAEF,MAAMN,EAAE,GAAG,IAAIhB,eAAe,CAACN,GAAG,EAAE;MAClCQ,OAAO;MACPuB,MAAM,EAAE,KAAK;MACbC,eAAe,EAAE,CAAC;MAClBC,YAAY,EAAE/C;IAChB,CAAC,CAAC;IAEFoC,EAAE,CAACY,gBAAgB,CAAC,MAAM,EAAE,MAAM;MAChC,IAAIL,OAAO,CAAC,CAAC,EAAE;MACf7C,GAAG,CAACiC,IAAI,CAAC,wBAAwB,EAAE;QAAEZ,UAAU,EAAEuB;MAAM,CAAC,CAAC;MACzD;MACA;MACA3B,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;IAEF,MAAMkC,aAAa,GAAIC,GAAqB,IAAW;MACrD,IAAIP,OAAO,CAAC,CAAC,EAAE;MACf,MAAMQ,IAAI,GAAGD,GAAG,CAACC,IAAI;MACrB;MACA;MACA,IAAI,OAAOD,GAAG,CAAC3C,WAAW,KAAK,QAAQ,IAAI2C,GAAG,CAAC3C,WAAW,CAACuB,MAAM,GAAG,CAAC,EAAE;QACrEvB,WAAW,GAAG2C,GAAG,CAAC3C,WAAW;MAC/B;MACA,IAAI,OAAO4C,IAAI,KAAK,QAAQ,IAAIA,IAAI,CAACrB,MAAM,KAAK,CAAC,EAAE;MACnD,IAAI;QACF,MAAMsB,OAAO,GAAGC,IAAI,CAACC,KAAK,CAACH,IAAI,CAA2B;QAC1DrD,GAAG,CAACiC,IAAI,CAAC,sBAAsB,EAAE;UAC/BwB,QAAQ,EAAEL,GAAG,CAACM,IAAI;UAClBC,SAAS,EAAEL,OAAO,CAACM,UAAU;UAC7BC,MAAM,EAAEP,OAAO,CAACO,MAAM;UACtBC,QAAQ,EAAER,OAAO,CAACS,SAAS;UAC3BC,OAAO,EAAEV,OAAO,CAACW;QACnB,CAAC,CAAC;QACFrD,OAAO,GAAG0C,OAAO,CAAC;MACpB,CAAC,CAAC,OAAOY,QAAQ,EAAE;QACjBlE,GAAG,CAACyC,IAAI,CAAC,qCAAqC,EAAE;UAC9CgB,QAAQ,EAAEL,GAAG,CAACM,IAAI;UAClBS,OAAO,EAAEd,IAAI;UACbe,KAAK,EAAEF;QACT,CAAC,CAAC;MACJ;IACF,CAAC;IAED5B,EAAE,CAACY,gBAAgB,CAAC,SAAS,EAAEC,aAAa,CAAC;IAC7C,KAAK,MAAMO,IAAI,IAAIxD,iBAAiB,EAAE;MACpCoC,EAAE,CAACY,gBAAgB,CAACQ,IAAI,EAAEP,aAAa,CAAC;IAC1C;IAEAb,EAAE,CAACY,gBAAgB,CAAC,OAAO,EAAGE,GAAG,IAAK;MACpC,IAAIP,OAAO,CAAC,CAAC,EAAE;MACf;MACA;MACA;MACA7C,GAAG,CAACiC,IAAI,CAAC,0CAA0C,EAAEmB,GAAG,CAAC;MACzDzB,iBAAiB,CAAC,OAAO,CAAC;IAC5B,CAAC,CAAC;IAEFW,EAAE,CAACY,gBAAgB,CAAC,OAAO,EAAE,MAAM;MACjC,IAAIL,OAAO,CAAC,CAAC,EAAE;MACf7C,GAAG,CAACiC,IAAI,CAAC,+CAA+C,CAAC;MACzDN,iBAAiB,CAAC,OAAO,CAAC;IAC5B,CAAC,CAAC;IAEF,OAAOW,EAAE;EACX,CAAC;EAEDnB,OAAO,GAAGkB,OAAO,CAAC,CAAC;EAEnB,MAAMgC,QAAQ,GAAGA,CAAA,KAAY;IAC3B,IAAInD,MAAM,EAAE;IACZA,MAAM,GAAG,IAAI;IACb,IAAIE,cAAc,IAAI,IAAI,EAAE;MAC1BkD,YAAY,CAAClD,cAAc,CAAC;MAC5BA,cAAc,GAAG,IAAI;IACvB;IACAgB,QAAQ,CAACjB,OAAO,CAAC;IACjBA,OAAO,GAAG,IAAI;EAChB,CAAC;EAED,IAAIR,MAAM,EAAE;IACV,IAAIA,MAAM,CAAC4D,OAAO,EAAE;MAClBF,QAAQ,CAAC,CAAC;IACZ,CAAC,MAAM;MACL1D,MAAM,CAACuC,gBAAgB,CAAC,OAAO,EAAEmB,QAAQ,CAAC;IAC5C;EACF;;EAEA;EACA;EACA;EACA,KAAKxD,OAAO;EAEZ,OAAOwD,QAAQ;AACjB","ignoreList":[]}