@vertesia/ui 1.6.0-dev.20260918.090710Z → 1.6.0-dev.20260923.085325Z

package/lib/session/auth/oauth.js

@@ -1,12 +1,35 @@
 import { Env } from '@vertesia/ui/env';
 import { jwtDecode } from 'jwt-decode';
+import { markCentralAuthRoundTripStarted } from './authRoundTrip';
+import { verifyAuthState } from './authState';
 import { usesGatewaySession } from './gateway';
+import { isStsTokenIssuer } from './tokenIssuer';
 const TRANSACTION_KEY = 'vertesia.oauth.transaction';
 const TOKEN_KEY = 'vertesia.oauth.access';
 const MAX_TRANSACTION_AGE = 10 * 60_000;
 let pending;
+// Long-lived credentials never enter browser storage. A reload resumes via the broker when access expires.
+let refreshSession;
+export class OAuthLoginError extends Error {
+}
+function hasVertesiaFragmentToken() {
+    try {
+        const fragment = new URLSearchParams(window.location.hash.slice(1));
+        const token = fragment.get('token');
+        if (!token || verifyAuthState(fragment.get('state')))
+            return false;
+        return isStsTokenIssuer(jwtDecode(token).iss, Env.endpoints.sts);
+    }
+    catch {
+        return false;
+    }
+}
 export function usesAppOAuth() {
-    return Boolean(Env.oauth && window.parent === window && window.AUTH_MODE !== 'firebase' && !usesGatewaySession());
+    return Boolean(Env.oauth &&
+        window.parent === window &&
+        window.AUTH_MODE !== 'firebase' &&
+        !usesGatewaySession() &&
+        !hasVertesiaFragmentToken());
 }
 function base64url(bytes) {
     return btoa(String.fromCharCode(...bytes))
@@ -24,11 +47,12 @@ function httpsUrl(value) {
     return url;
 }
 export function clearAppOAuth() {
+    refreshSession = undefined;
     sessionStorage.removeItem(TOKEN_KEY);
     sessionStorage.removeItem(TRANSACTION_KEY);
 }
 /** Public-client PKCE for independently hosted apps. No Firebase identity token or client secret. */
-async function acquireToken() {
+async function acquireToken(forceRefresh = false) {
     const config = Env.oauth;
     if (!config)
         throw new Error('Application OAuth is not configured');
@@ -52,6 +76,7 @@ async function acquireToken() {
     const state = callback ? current.searchParams.get('state') : null;
     const code = callback ? current.searchParams.get('code') : null;
     const error = callback ? current.searchParams.get('error') : null;
+    let refreshCredential;
     let transaction;
     if (state || code || error) {
         const raw = sessionStorage.getItem(TRANSACTION_KEY);
@@ -74,9 +99,22 @@ async function acquireToken() {
         if (raw) {
             const cached = JSON.parse(raw);
             const claims = jwtDecode(cached.token);
+            if (config.offlineAccess &&
+                cached.clientId === clientId &&
+                cached.issuer === issuer &&
+                (!current.searchParams.get('p') || claims.project?.id === current.searchParams.get('p')) &&
+                (!current.searchParams.get('a') || claims.account?.id === current.searchParams.get('a')))
+                refreshCredential =
+                    refreshSession?.clientId === clientId && refreshSession.issuer === issuer
+                        ? refreshSession.token
+                        : undefined;
+            // Discard credentials persisted by older SDK versions rather than loading them into the new session.
+            if (cached.refreshToken)
+                sessionStorage.removeItem(TOKEN_KEY);
             if (cached.clientId === clientId &&
                 cached.issuer === issuer &&
-                claims.exp > Date.now() / 1000 + 30 &&
+                !forceRefresh &&
+                claims.exp > Date.now() / 1000 + (config.offlineAccess ? 300 : 30) &&
                 (!current.searchParams.get('p') || claims.project?.id === current.searchParams.get('p')) &&
                 (!current.searchParams.get('a') || claims.account?.id === current.searchParams.get('a'))) {
                 return cached.token;
@@ -91,12 +129,59 @@ async function acquireToken() {
         throw new Error('OAuth issuer mismatch');
     const authorize = httpsUrl(metadata.authorization_endpoint);
     const tokenEndpoint = httpsUrl(metadata.token_endpoint);
+    const revocationEndpoint = metadata.revocation_endpoint === undefined ? undefined : httpsUrl(metadata.revocation_endpoint).toString();
+    const resource = new URL(metadata.issuer).toString();
+    if (refreshCredential) {
+        try {
+            const response = await fetch(tokenEndpoint, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                body: new URLSearchParams({
+                    grant_type: 'refresh_token',
+                    client_id: clientId,
+                    refresh_token: refreshCredential,
+                    resource,
+                }),
+            });
+            if (response.ok) {
+                const grant = (await response.json());
+                if (!grant.access_token || grant.token_type?.toLowerCase() !== 'bearer')
+                    throw new OAuthLoginError('Invalid OAuth refresh grant');
+                const claims = jwtDecode(grant.access_token);
+                if (claims.iss.replace(/\/+$/, '') !== issuer ||
+                    claims.client_id !== clientId ||
+                    claims.exp <= Date.now() / 1000 ||
+                    (!!current.searchParams.get('a') && claims.account?.id !== current.searchParams.get('a')) ||
+                    (!!current.searchParams.get('p') && claims.project?.id !== current.searchParams.get('p')))
+                    throw new OAuthLoginError('Invalid OAuth refresh identity');
+                sessionStorage.setItem(TOKEN_KEY, JSON.stringify({
+                    token: grant.access_token,
+                    clientId,
+                    issuer,
+                }));
+                refreshSession = {
+                    token: grant.refresh_token ?? refreshCredential,
+                    clientId,
+                    issuer,
+                    tokenEndpoint: tokenEndpoint.toString(),
+                    revocationEndpoint,
+                };
+                return grant.access_token;
+            }
+        }
+        catch {
+            // A failed or invalid refresh starts a fresh authorization transaction.
+        }
+        refreshSession = undefined;
+        sessionStorage.removeItem(TOKEN_KEY);
+    }
     if (transaction && code) {
         const response = await fetch(tokenEndpoint, {
             method: 'POST',
             headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
             body: new URLSearchParams({
                 grant_type: 'authorization_code',
+                resource,
                 code,
                 client_id: clientId,
                 redirect_uri: redirectUri,
@@ -114,10 +199,34 @@ async function acquireToken() {
             claims.exp <= Date.now() / 1000) {
             throw new Error('OAuth grant does not match this application');
         }
-        sessionStorage.setItem(TOKEN_KEY, JSON.stringify({ token: grant.access_token, clientId, issuer }));
+        sessionStorage.setItem(TOKEN_KEY, JSON.stringify({
+            token: grant.access_token,
+            clientId,
+            issuer,
+        }));
+        refreshSession =
+            config.offlineAccess && grant.refresh_token
+                ? {
+                    token: grant.refresh_token,
+                    clientId,
+                    issuer,
+                    tokenEndpoint: tokenEndpoint.toString(),
+                    revocationEndpoint,
+                }
+                : undefined;
         const target = new URL(transaction.target);
         if (target.origin !== window.location.origin)
             throw new Error('Invalid OAuth return target');
+        if (claims.account?.id)
+            target.searchParams.set('a', claims.account.id);
+        else
+            target.searchParams.delete('a');
+        if (claims.project?.id)
+            target.searchParams.set('p', claims.project.id);
+        else
+            target.searchParams.delete('p');
+        if (target.pathname === '/auth/callback')
+            target.pathname = '/';
         window.history.replaceState(window.history.state, '', target);
         return grant.access_token;
     }
@@ -146,22 +255,50 @@ async function acquireToken() {
     authorize.searchParams.set('client_id', clientId);
     authorize.searchParams.set('redirect_uri', redirectUri);
     authorize.searchParams.set('response_type', 'code');
+    authorize.searchParams.set('resource', resource);
     authorize.searchParams.set('state', next.state);
     authorize.searchParams.set('code_challenge_method', 'S256');
     authorize.searchParams.set('code_challenge', base64url(new Uint8Array(digest)));
-    // This browser client intentionally requests no refresh token.
-    authorize.searchParams.set('scope', scopes.filter((s) => s !== 'offline_access').join(' '));
+    authorize.searchParams.set('scope', (config.offlineAccess
+        ? [...new Set([...scopes, 'offline_access'])]
+        : scopes.filter((s) => s !== 'offline_access')).join(' '));
+    const account = current.searchParams.get('a');
+    if (account)
+        authorize.searchParams.set('account_id', account);
     const project = current.searchParams.get('p');
     if (project)
         authorize.searchParams.set('project_id', project);
     sessionStorage.setItem(TRANSACTION_KEY, JSON.stringify(next));
+    markCentralAuthRoundTripStarted();
     window.location.replace(authorize.toString());
     return new Promise(() => { });
 }
-export function getAppOAuthToken() {
-    pending ??= acquireToken().finally(() => {
+export function getAppOAuthToken(forceRefresh = false) {
+    pending ??= acquireToken(forceRefresh).finally(() => {
         pending = undefined;
     });
     return pending;
 }
+export function isAppOAuthLoginPending() {
+    return usesAppOAuth();
+}
+export const startAppOAuthLogin = getAppOAuthToken;
+export async function revokeAppOAuthSession() {
+    const cached = refreshSession;
+    clearAppOAuth();
+    if (!cached)
+        return;
+    const revoke = httpsUrl(cached.revocationEndpoint ?? cached.tokenEndpoint);
+    if (cached.revocationEndpoint === undefined)
+        revoke.pathname = revoke.pathname.replace(/\/token$/, '/revoke');
+    await fetch(revoke, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            client_id: cached.clientId,
+            token: cached.token,
+            token_type_hint: 'refresh_token',
+        }),
+    });
+}
 //# sourceMappingURL=oauth.js.map

package/lib/session/auth/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/session/auth/oauth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAE/C,MAAM,eAAe,GAAG,4BAA4B,CAAC;AACrD,MAAM,SAAS,GAAG,uBAAuB,CAAC;AAC1C,MAAM,mBAAmB,GAAG,EAAE,GAAG,MAAM,CAAC;AACxC,IAAI,OAAoC,CAAC;AAEzC,MAAM,UAAU,YAAY;IACxB,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,UAAU,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC;AACtH,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAChC,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC;SACrC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5B,CAAC;AACD,SAAS,WAAW;IAChB,OAAO,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AACD,SAAS,QAAQ,CAAC,KAAa;IAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAChH,OAAO,GAAG,CAAC;AACf,CAAC;AAYD,MAAM,UAAU,aAAa;IACzB,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACrC,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;AAC/C,CAAC;AAED,qGAAqG;AACrG,KAAK,UAAU,YAAY;IACvB,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC;IACzB,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,QAAQ,GACV,QAAQ,CAAC,QAAQ,KAAK,WAAW;QACjC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QACxC,QAAQ,CAAC,QAAQ,KAAK,OAAO;QAC7B,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAClH,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,QAAQ,KAAK,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;IACnH,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,IAAI,WAAoC,CAAC;IACzC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACpD,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;QAC3C,WAAW,GAAG,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,IACI,CAAC,WAAW;YACZ,WAAW,CAAC,KAAK,KAAK,KAAK;YAC3B,WAAW,CAAC,QAAQ,KAAK,QAAQ;YACjC,WAAW,CAAC,WAAW,KAAK,WAAW;YACvC,WAAW,CAAC,MAAM,KAAK,MAAM;YAC7B,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO,GAAG,mBAAmB;YACtD,WAAW,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,EAClC,CAAC;YACC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,KAAK,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,KAAK,IAAI,cAAc,GAAG,CAAC,CAAC;IAC9G,CAAC;SAAM,CAAC;QACJ,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,GAAG,EAAE,CAAC;YACN,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAwD,CAAC;YACtF,MAAM,MAAM,GAAG,SAAS,CAAmB,MAAM,CAAC,KAAK,CAAC,CAAC;YACzD,IACI,MAAM,CAAC,QAAQ,KAAK,QAAQ;gBAC5B,MAAM,CAAC,MAAM,KAAK,MAAM;gBACxB,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,EAAE;gBACnC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACxF,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAC1F,CAAC;gBACC,OAAO,MAAM,CAAC,KAAK,CAAC;YACxB,CAAC;QACL,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,yCAAyC,CAAC,CAAC;IAClF,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;IACnF,MAAM,QAAQ,GAA+E,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;IACpH,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IACxD,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;YACxC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACtB,UAAU,EAAE,oBAAoB;gBAChC,IAAI;gBACJ,SAAS,EAAE,QAAQ;gBACnB,YAAY,EAAE,WAAW;gBACzB,aAAa,EAAE,WAAW,CAAC,QAAQ;aACtC,CAAC;SACL,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QACrF,MAAM,KAAK,GAAmD,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACpF,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAChH,MAAM,MAAM,GAAG,SAAS,CAA4C,KAAK,CAAC,YAAY,CAAC,CAAC;QACxF,IACI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM;YACzC,MAAM,CAAC,SAAS,KAAK,QAAQ;YAC7B,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EACjC,CAAC;YACC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACnE,CAAC;QACD,cAAc,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QACnG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC7F,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC,YAAY,CAAC;IAC9B,CAAC;IACD,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACpD,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAClC,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,gBAAgB,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;QACvG,MAAM,QAAQ,GAAiD,MAAM,gBAAgB,CAAC,IAAI,EAAE,CAAC;QAC7F,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,WAAW,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK;YAAE,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAgB;QACtB,KAAK,EAAE,WAAW,EAAE;QACpB,QAAQ;QACR,QAAQ;QACR,WAAW;QACX,MAAM;QACN,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE;QAC1B,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzF,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAClD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACxD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACpD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAChD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAC5D,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChF,+DAA+D;IAC/D,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,gBAAgB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5F,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,OAAO;QAAE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC/D,cAAc,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9C,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC5B,OAAO,KAAK,YAAY,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;QACpC,OAAO,GAAG,SAAS,CAAC;IACxB,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACnB,CAAC"}
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../../../src/session/auth/oauth.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,GAAG,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,+BAA+B,EAAE,MAAM,iBAAiB,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD,MAAM,eAAe,GAAG,4BAA4B,CAAC;AACrD,MAAM,SAAS,GAAG,uBAAuB,CAAC;AAC1C,MAAM,mBAAmB,GAAG,EAAE,GAAG,MAAM,CAAC;AACxC,IAAI,OAAoC,CAAC;AACzC,2GAA2G;AAC3G,IAAI,cAEW,CAAC;AAEhB,MAAM,OAAO,eAAgB,SAAQ,KAAK;CAAG;AAE7C,SAAS,wBAAwB;IAC7B,IAAI,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,IAAI,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACnE,OAAO,gBAAgB,CAAC,SAAS,CAAmB,KAAK,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACvF,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED,MAAM,UAAU,YAAY;IACxB,OAAO,OAAO,CACV,GAAG,CAAC,KAAK;QACL,MAAM,CAAC,MAAM,KAAK,MAAM;QACxB,MAAM,CAAC,SAAS,KAAK,UAAU;QAC/B,CAAC,kBAAkB,EAAE;QACrB,CAAC,wBAAwB,EAAE,CAClC,CAAC;AACN,CAAC;AAED,SAAS,SAAS,CAAC,KAAiB;IAChC,OAAO,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,CAAC;SACrC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;SACnB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5B,CAAC;AACD,SAAS,WAAW;IAChB,OAAO,SAAS,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AACD,SAAS,QAAQ,CAAC,KAAa;IAC3B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IAC3B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAChH,OAAO,GAAG,CAAC;AACf,CAAC;AAYD,MAAM,UAAU,aAAa;IACzB,cAAc,GAAG,SAAS,CAAC;IAC3B,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACrC,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;AAC/C,CAAC;AAED,qGAAqG;AACrG,KAAK,UAAU,YAAY,CAAC,YAAY,GAAG,KAAK;IAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC;IACzB,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,QAAQ,GACV,QAAQ,CAAC,QAAQ,KAAK,WAAW;QACjC,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QACxC,QAAQ,CAAC,QAAQ,KAAK,OAAO;QAC7B,sBAAsB,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,QAAQ,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IAClH,MAAM,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,QAAQ,KAAK,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;IACnH,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,MAAM,IAAI,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClE,IAAI,iBAAqC,CAAC;IAC1C,IAAI,WAAoC,CAAC;IACzC,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACpD,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;QAC3C,WAAW,GAAG,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;QACjE,IACI,CAAC,WAAW;YACZ,WAAW,CAAC,KAAK,KAAK,KAAK;YAC3B,WAAW,CAAC,QAAQ,KAAK,QAAQ;YACjC,WAAW,CAAC,WAAW,KAAK,WAAW;YACvC,WAAW,CAAC,MAAM,KAAK,MAAM;YAC7B,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO,GAAG,mBAAmB;YACtD,WAAW,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,EAClC,CAAC;YACC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;QAC5D,CAAC;QACD,IAAI,KAAK,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,KAAK,IAAI,cAAc,GAAG,CAAC,CAAC;IAC9G,CAAC;SAAM,CAAC;QACJ,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,GAAG,EAAE,CAAC;YACN,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAK5B,CAAC;YACF,MAAM,MAAM,GAAG,SAAS,CAAmB,MAAM,CAAC,KAAK,CAAC,CAAC;YACzD,IACI,MAAM,CAAC,aAAa;gBACpB,MAAM,CAAC,QAAQ,KAAK,QAAQ;gBAC5B,MAAM,CAAC,MAAM,KAAK,MAAM;gBACxB,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACxF,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAExF,iBAAiB;oBACb,cAAc,EAAE,QAAQ,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,KAAK,MAAM;wBACrE,CAAC,CAAC,cAAc,CAAC,KAAK;wBACtB,CAAC,CAAC,SAAS,CAAC;YACxB,qGAAqG;YACrG,IAAI,MAAM,CAAC,YAAY;gBAAE,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;YAC9D,IACI,MAAM,CAAC,QAAQ,KAAK,QAAQ;gBAC5B,MAAM,CAAC,MAAM,KAAK,MAAM;gBACxB,CAAC,YAAY;gBACb,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACxF,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAC1F,CAAC;gBACC,OAAO,MAAM,CAAC,KAAK,CAAC;YACxB,CAAC;QACL,CAAC;IACL,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,yCAAyC,CAAC,CAAC;IAClF,IAAI,CAAC,SAAS,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;IACnF,MAAM,QAAQ,GAKV,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;IAC7F,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IAC5D,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IACxD,MAAM,kBAAkB,GACpB,QAAQ,CAAC,mBAAmB,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/G,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IACrD,IAAI,iBAAiB,EAAE,CAAC;QACpB,IAAI,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;gBACxC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,IAAI,EAAE,IAAI,eAAe,CAAC;oBACtB,UAAU,EAAE,eAAe;oBAC3B,SAAS,EAAE,QAAQ;oBACnB,aAAa,EAAE,iBAAiB;oBAChC,QAAQ;iBACX,CAAC;aACL,CAAC,CAAC;YACH,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACd,MAAM,KAAK,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAInC,CAAC;gBACF,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,QAAQ;oBACnE,MAAM,IAAI,eAAe,CAAC,6BAA6B,CAAC,CAAC;gBAC7D,MAAM,MAAM,GAAG,SAAS,CAA4C,KAAK,CAAC,YAAY,CAAC,CAAC;gBACxF,IACI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM;oBACzC,MAAM,CAAC,SAAS,KAAK,QAAQ;oBAC7B,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI;oBAC/B,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBACzF,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,KAAK,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBAEzF,MAAM,IAAI,eAAe,CAAC,gCAAgC,CAAC,CAAC;gBAChE,cAAc,CAAC,OAAO,CAClB,SAAS,EACT,IAAI,CAAC,SAAS,CAAC;oBACX,KAAK,EAAE,KAAK,CAAC,YAAY;oBACzB,QAAQ;oBACR,MAAM;iBACT,CAAC,CACL,CAAC;gBACF,cAAc,GAAG;oBACb,KAAK,EAAE,KAAK,CAAC,aAAa,IAAI,iBAAiB;oBAC/C,QAAQ;oBACR,MAAM;oBACN,aAAa,EAAE,aAAa,CAAC,QAAQ,EAAE;oBACvC,kBAAkB;iBACrB,CAAC;gBACF,OAAO,KAAK,CAAC,YAAY,CAAC;YAC9B,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACL,wEAAwE;QAC5E,CAAC;QACD,cAAc,GAAG,SAAS,CAAC;QAC3B,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACzC,CAAC;IACD,IAAI,WAAW,IAAI,IAAI,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,aAAa,EAAE;YACxC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;YAChE,IAAI,EAAE,IAAI,eAAe,CAAC;gBACtB,UAAU,EAAE,oBAAoB;gBAChC,QAAQ;gBACR,IAAI;gBACJ,SAAS,EAAE,QAAQ;gBACnB,YAAY,EAAE,WAAW;gBACzB,aAAa,EAAE,WAAW,CAAC,QAAQ;aACtC,CAAC;SACL,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QACrF,MAAM,KAAK,GAA2E,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC5G,IAAI,CAAC,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAChH,MAAM,MAAM,GAAG,SAAS,CAA4C,KAAK,CAAC,YAAY,CAAC,CAAC;QACxF,IACI,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,MAAM;YACzC,MAAM,CAAC,SAAS,KAAK,QAAQ;YAC7B,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EACjC,CAAC;YACC,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACnE,CAAC;QACD,cAAc,CAAC,OAAO,CAClB,SAAS,EACT,IAAI,CAAC,SAAS,CAAC;YACX,KAAK,EAAE,KAAK,CAAC,YAAY;YACzB,QAAQ;YACR,MAAM;SACT,CAAC,CACL,CAAC;QACF,cAAc;YACV,MAAM,CAAC,aAAa,IAAI,KAAK,CAAC,aAAa;gBACvC,CAAC,CAAC;oBACI,KAAK,EAAE,KAAK,CAAC,aAAa;oBAC1B,QAAQ;oBACR,MAAM;oBACN,aAAa,EAAE,aAAa,CAAC,QAAQ,EAAE;oBACvC,kBAAkB;iBACrB;gBACH,CAAC,CAAC,SAAS,CAAC;QACpB,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;QAC7F,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE;YAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;;YACnE,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE;YAAE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;;YACnE,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,QAAQ,KAAK,gBAAgB;YAAE,MAAM,CAAC,QAAQ,GAAG,GAAG,CAAC;QAChE,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;QAC9D,OAAO,KAAK,CAAC,YAAY,CAAC;IAC9B,CAAC;IACD,IAAI,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACpD,IAAI,QAAQ,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAClC,MAAM,gBAAgB,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;QAChF,IAAI,CAAC,gBAAgB,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC;QACvG,MAAM,QAAQ,GAAiD,MAAM,gBAAgB,CAAC,IAAI,EAAE,CAAC;QAC7F,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,WAAW,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK;YAAE,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/E,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAgB;QACtB,KAAK,EAAE,WAAW,EAAE;QACpB,QAAQ;QACR,QAAQ;QACR,WAAW;QACX,MAAM;QACN,MAAM,EAAE,OAAO,CAAC,QAAQ,EAAE;QAC1B,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE;KACtB,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzF,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAClD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;IACxD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACpD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACjD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAChD,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;IAC5D,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAChF,SAAS,CAAC,YAAY,CAAC,GAAG,CACtB,OAAO,EACP,CAAC,MAAM,CAAC,aAAa;QACjB,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAC7C,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,gBAAgB,CAAC,CACjD,CAAC,IAAI,CAAC,GAAG,CAAC,CACd,CAAC;IACF,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,OAAO;QAAE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,OAAO;QAAE,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC/D,cAAc,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,+BAA+B,EAAE,CAAC;IAClC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC9C,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,YAAY,GAAG,KAAK;IACjD,OAAO,KAAK,YAAY,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;QAChD,OAAO,GAAG,SAAS,CAAC;IACxB,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,sBAAsB;IAClC,OAAO,YAAY,EAAE,CAAC;AAC1B,CAAC;AACD,MAAM,CAAC,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAEnD,MAAM,CAAC,KAAK,UAAU,qBAAqB;IACvC,MAAM,MAAM,GAAG,cAAc,CAAC;IAC9B,aAAa,EAAE,CAAC;IAChB,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,aAAa,CAAC,CAAC;IAC3E,IAAI,MAAM,CAAC,kBAAkB,KAAK,SAAS;QAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC9G,MAAM,KAAK,CAAC,MAAM,EAAE;QAChB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACtB,SAAS,EAAE,MAAM,CAAC,QAAQ;YAC1B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,eAAe,EAAE,eAAe;SACnC,CAAC;KACL,CAAC,CAAC;AACP,CAAC"}

package/lib/session/auth/tokenIssuer.d.ts

@@ -0,0 +1,3 @@
+/** Classify legacy STS credentials for routing; API servers still verify their signatures and grants. */
+export declare function isStsTokenIssuer(issuer: string | undefined, stsEndpoint: string): boolean;
+//# sourceMappingURL=tokenIssuer.d.ts.map

package/lib/session/auth/tokenIssuer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenIssuer.d.ts","sourceRoot":"","sources":["../../../src/session/auth/tokenIssuer.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAuBzF"}

package/lib/session/auth/tokenIssuer.js

@@ -0,0 +1,27 @@
+/** Classify legacy STS credentials for routing; API servers still verify their signatures and grants. */
+export function isStsTokenIssuer(issuer, stsEndpoint) {
+    if (!issuer)
+        return false;
+    const normalized = issuer.replace(/\/+$/, '');
+    if (normalized === stsEndpoint.replace(/\/+$/, ''))
+        return true;
+    try {
+        const endpoint = new URL(stsEndpoint);
+        // Branch STS uses a separate OAuth issuer but retains the regional issuer for legacy
+        // /token/issue and /token/sign credentials (including workload identity consumers).
+        const branch = /^token-server-dev-[a-z0-9-]+\.api\.(dev1|dev2)\.vertesia\.io$/.exec(endpoint.hostname);
+        return Boolean(branch &&
+            endpoint.protocol === 'https:' &&
+            !endpoint.port &&
+            !endpoint.username &&
+            !endpoint.password &&
+            endpoint.pathname === '/' &&
+            !endpoint.search &&
+            !endpoint.hash &&
+            normalized === `https://sts.${branch[1]}.vertesia.io`);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=tokenIssuer.js.map

package/lib/session/auth/tokenIssuer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenIssuer.js","sourceRoot":"","sources":["../../../src/session/auth/tokenIssuer.ts"],"names":[],"mappings":"AAAA,yGAAyG;AACzG,MAAM,UAAU,gBAAgB,CAAC,MAA0B,EAAE,WAAmB;IAC5E,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC9C,IAAI,UAAU,KAAK,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IAChE,IAAI,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;QACtC,qFAAqF;QACrF,oFAAoF;QACpF,MAAM,MAAM,GAAG,+DAA+D,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACvG,OAAO,OAAO,CACV,MAAM;YACF,QAAQ,CAAC,QAAQ,KAAK,QAAQ;YAC9B,CAAC,QAAQ,CAAC,IAAI;YACd,CAAC,QAAQ,CAAC,QAAQ;YAClB,CAAC,QAAQ,CAAC,QAAQ;YAClB,QAAQ,CAAC,QAAQ,KAAK,GAAG;YACzB,CAAC,QAAQ,CAAC,MAAM;YAChB,CAAC,QAAQ,CAAC,IAAI;YACd,UAAU,KAAK,eAAe,MAAM,CAAC,CAAC,CAAC,cAAc,CAC5D,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC"}

package/lib/session/auth/vertesiaHosts.d.ts

@@ -0,0 +1,47 @@
+/** A single DNS label: alphanumeric, inner hyphens allowed. */
+export declare const LABEL = "[a-z0-9](?:[a-z0-9-]*[a-z0-9])?";
+/** The region label is optional throughout, because each regional host has a global US alias. */
+export declare const REGION = "(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\\.)?";
+/**
+ * Hostnames served by the UI backend — Vertesia's own code, not merely a Vertesia-owned name:
+ *   `cloud.vertesia.io`, `cloud.us1.vertesia.io`                     — the Cloud UI
+ *   `preprod.cloud.vertesia.io`, `preview.cloud.us1.vertesia.io`     — its preview/preprod tiers
+ *   `acme.cloud.us1.vertesia.io`                                     — per-IdP-tenant branded hosts
+ *   `dev-feat-x.ui.dev1.vertesia.io`                                 — dynamic per-branch dev envs
+ *
+ * Mirrors the load-balancer host rules (region-lb/main.tf: `cloud.${var.domain}`,
+ * `*.cloud.${var.domain}`, `*.ui.${var.domain}`) rather than the DNS zone, so a name we merely own
+ * is not trusted for what serves it.
+ */
+export declare const FIRST_PARTY_HOST_PATTERNS: readonly RegExp[];
+/**
+ * Public app-gateway origins. Stable tiers use the `apps*` browser-facing host, while development
+ * environments reach the gateway through its `*.api.*` Cloud Run route:
+ *   `apps.us1.vertesia.io`, `apps-preview.us1.vertesia.io`
+ *   `app-gateway-dev1.api.dev1.vertesia.io`, `app-gateway-us3.api.us3.vertesia.io`
+ *
+ * The second label is deliberately unconstrained. Branch environments do NOT each get a gateway —
+ * they share their region's (`detectGatewayUrl` in packages/server-common/src/env/ServerEnv.ts:444
+ * and `getAppgenServerBaseUrl` in packages/workflows/.../app_workspace/workspace-utils.ts), so the
+ * host published to browsers is region-scoped, while the per-branch `app-gateway-dev-<branch>`
+ * shape in the infrastructure README also exists. Matching `app-gateway-<anything>` covers both,
+ * and every Cloud Run service named that way *is* a gateway (region-compute/main.tf:373).
+ *
+ * These serve every tenant's published application from one shared origin, and published assets
+ * need no authentication — so this is generated, low-trust code sitting on a Vertesia-owned
+ * hostname. Owning the domain is not the test; which backend serves the origin is.
+ *
+ * Two load-balancer variables can map further hostnames onto the same backend —
+ * `appgen_host_aliases` and `appgen_preview_host_aliases` in
+ * infrastructure/terraform/modules/region-lb/variables.tf. Both are empty in every region today; if
+ * one is ever set, add the alias here too, or it silently falls through to the permissive branch of
+ * Policy L and becomes an origin that may receive a token at any path.
+ */
+export declare const GATEWAY_HOST_PATTERNS: readonly RegExp[];
+export declare function isLoopbackHostname(hostname: string): boolean;
+export declare function normalizeHostname(hostname: string): string;
+export declare const AUTH_BROKER_HOST_PATTERNS: readonly RegExp[];
+export declare function isTrustedAuthBrokerUrl(value: string, options?: {
+    allowLoopback?: boolean;
+}): boolean;
+//# sourceMappingURL=vertesiaHosts.d.ts.map

package/lib/session/auth/vertesiaHosts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vertesiaHosts.d.ts","sourceRoot":"","sources":["../../../src/session/auth/vertesiaHosts.ts"],"names":[],"mappings":"AACA,+DAA+D;AAC/D,eAAO,MAAM,KAAK,oCAAoC,CAAC;AAEvD,iGAAiG;AACjG,eAAO,MAAM,MAAM,4CAAqB,CAAC;AAEzC;;;;;;;;;;GAUG;AACH,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAItD,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAGlD,CAAC;AAEF,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAQ5D;AAED,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,eAAO,MAAM,yBAAyB,EAAE,SAAS,MAAM,EAAoD,CAAC;AAE5G,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE;IAAE,aAAa,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAgBxG"}

package/lib/session/auth/vertesiaHosts.js

@@ -0,0 +1,79 @@
+const LOOPBACK_IPV4 = /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/;
+/** A single DNS label: alphanumeric, inner hyphens allowed. */
+export const LABEL = '[a-z0-9](?:[a-z0-9-]*[a-z0-9])?';
+/** The region label is optional throughout, because each regional host has a global US alias. */
+export const REGION = `(?:${LABEL}\\.)?`;
+/**
+ * Hostnames served by the UI backend — Vertesia's own code, not merely a Vertesia-owned name:
+ *   `cloud.vertesia.io`, `cloud.us1.vertesia.io`                     — the Cloud UI
+ *   `preprod.cloud.vertesia.io`, `preview.cloud.us1.vertesia.io`     — its preview/preprod tiers
+ *   `acme.cloud.us1.vertesia.io`                                     — per-IdP-tenant branded hosts
+ *   `dev-feat-x.ui.dev1.vertesia.io`                                 — dynamic per-branch dev envs
+ *
+ * Mirrors the load-balancer host rules (region-lb/main.tf: `cloud.${var.domain}`,
+ * `*.cloud.${var.domain}`, `*.ui.${var.domain}`) rather than the DNS zone, so a name we merely own
+ * is not trusted for what serves it.
+ */
+export const FIRST_PARTY_HOST_PATTERNS = [
+    new RegExp(`^cloud\\.${REGION}vertesia\\.io$`),
+    new RegExp(`^${LABEL}\\.cloud\\.${REGION}vertesia\\.io$`),
+    new RegExp(`^${LABEL}\\.ui\\.${LABEL}\\.vertesia\\.io$`),
+];
+/**
+ * Public app-gateway origins. Stable tiers use the `apps*` browser-facing host, while development
+ * environments reach the gateway through its `*.api.*` Cloud Run route:
+ *   `apps.us1.vertesia.io`, `apps-preview.us1.vertesia.io`
+ *   `app-gateway-dev1.api.dev1.vertesia.io`, `app-gateway-us3.api.us3.vertesia.io`
+ *
+ * The second label is deliberately unconstrained. Branch environments do NOT each get a gateway —
+ * they share their region's (`detectGatewayUrl` in packages/server-common/src/env/ServerEnv.ts:444
+ * and `getAppgenServerBaseUrl` in packages/workflows/.../app_workspace/workspace-utils.ts), so the
+ * host published to browsers is region-scoped, while the per-branch `app-gateway-dev-<branch>`
+ * shape in the infrastructure README also exists. Matching `app-gateway-<anything>` covers both,
+ * and every Cloud Run service named that way *is* a gateway (region-compute/main.tf:373).
+ *
+ * These serve every tenant's published application from one shared origin, and published assets
+ * need no authentication — so this is generated, low-trust code sitting on a Vertesia-owned
+ * hostname. Owning the domain is not the test; which backend serves the origin is.
+ *
+ * Two load-balancer variables can map further hostnames onto the same backend —
+ * `appgen_host_aliases` and `appgen_preview_host_aliases` in
+ * infrastructure/terraform/modules/region-lb/variables.tf. Both are empty in every region today; if
+ * one is ever set, add the alias here too, or it silently falls through to the permissive branch of
+ * Policy L and becomes an origin that may receive a token at any path.
+ */
+export const GATEWAY_HOST_PATTERNS = [
+    new RegExp(`^apps(?:-preview|-preprod)?\\.${REGION}vertesia\\.io$`),
+    new RegExp(`^app-gateway-${LABEL}\\.api\\.${LABEL}\\.vertesia\\.io$`),
+];
+export function isLoopbackHostname(hostname) {
+    if (hostname === 'localhost' || hostname.endsWith('.localhost')) {
+        return true;
+    }
+    if (hostname === '::1' || hostname === '[::1]') {
+        return true;
+    }
+    return LOOPBACK_IPV4.test(hostname);
+}
+export function normalizeHostname(hostname) {
+    return hostname.toLowerCase().replace(/\.$/, '');
+}
+export const AUTH_BROKER_HOST_PATTERNS = [new RegExp(`^auth\\.${REGION}vertesia\\.io$`)];
+export function isTrustedAuthBrokerUrl(value, options = {}) {
+    try {
+        const url = new URL(value);
+        const hostname = normalizeHostname(url.hostname);
+        if (url.username || url.password || url.search || url.hash || url.pathname !== '/')
+            return false;
+        if (options.allowLoopback && isLoopbackHostname(hostname)) {
+            return url.protocol === 'http:' || url.protocol === 'https:';
+        }
+        return (url.protocol === 'https:' &&
+            !url.port &&
+            AUTH_BROKER_HOST_PATTERNS.some((pattern) => pattern.test(hostname)));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=vertesiaHosts.js.map

package/lib/session/auth/vertesiaHosts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vertesiaHosts.js","sourceRoot":"","sources":["../../../src/session/auth/vertesiaHosts.ts"],"names":[],"mappings":"AAAA,MAAM,aAAa,GAAG,kCAAkC,CAAC;AACzD,+DAA+D;AAC/D,MAAM,CAAC,MAAM,KAAK,GAAG,iCAAiC,CAAC;AAEvD,iGAAiG;AACjG,MAAM,CAAC,MAAM,MAAM,GAAG,MAAM,KAAK,OAAO,CAAC;AAEzC;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAsB;IACxD,IAAI,MAAM,CAAC,YAAY,MAAM,gBAAgB,CAAC;IAC9C,IAAI,MAAM,CAAC,IAAI,KAAK,cAAc,MAAM,gBAAgB,CAAC;IACzD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,KAAK,mBAAmB,CAAC;CAC3D,CAAC;AAEF;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACpD,IAAI,MAAM,CAAC,iCAAiC,MAAM,gBAAgB,CAAC;IACnE,IAAI,MAAM,CAAC,gBAAgB,KAAK,YAAY,KAAK,mBAAmB,CAAC;CACxE,CAAC;AAEF,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IAC/C,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAC9C,OAAO,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAsB,CAAC,IAAI,MAAM,CAAC,WAAW,MAAM,gBAAgB,CAAC,CAAC,CAAC;AAE5G,MAAM,UAAU,sBAAsB,CAAC,KAAa,EAAE,OAAO,GAAgC,EAAE;IAC3F,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG;YAAE,OAAO,KAAK,CAAC;QACjG,IAAI,OAAO,CAAC,aAAa,IAAI,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxD,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;QACjE,CAAC;QACD,OAAO,CACH,GAAG,CAAC,QAAQ,KAAK,QAAQ;YACzB,CAAC,GAAG,CAAC,IAAI;YACT,yBAAyB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CACtE,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC"}

package/lib/session/index.d.ts

@@ -1,6 +1,7 @@
 export * from './auth/composable';
 export { clearCentralAuthRoundTripMarker, isCentralAuthRedirectPending, redirectToCentralAuth, } from './auth/domainRouting';
 export * from './auth/firebase';
+export { isAppOAuthLoginPending, startAppOAuthLogin } from './auth/oauth';
 export * from './auth/useAuthState';
 export * from './auth/useCurrentTenant';
 export * from './DevSessionProvider';

package/lib/session/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/session/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAIlC,OAAO,EACH,+BAA+B,EAC/B,4BAA4B,EAC5B,qBAAqB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/session/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAIlC,OAAO,EACH,+BAA+B,EAC/B,4BAA4B,EAC5B,qBAAqB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC1E,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC"}

package/lib/session/index.js

@@ -4,6 +4,7 @@ export * from './auth/composable';
 // nothing. Only the boot-time entry points an app needs are published here.
 export { clearCentralAuthRoundTripMarker, isCentralAuthRedirectPending, redirectToCentralAuth, } from './auth/domainRouting';
 export * from './auth/firebase';
+export { isAppOAuthLoginPending, startAppOAuthLogin } from './auth/oauth';
 export * from './auth/useAuthState';
 export * from './auth/useCurrentTenant';
 export * from './DevSessionProvider';

package/lib/session/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/session/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,wFAAwF;AACxF,4FAA4F;AAC5F,4EAA4E;AAC5E,OAAO,EACH,+BAA+B,EAC/B,4BAA4B,EAC5B,qBAAqB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/session/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,wFAAwF;AACxF,4FAA4F;AAC5F,4EAA4E;AAC5E,OAAO,EACH,+BAA+B,EAC/B,4BAA4B,EAC5B,qBAAqB,GACxB,MAAM,sBAAsB,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAC1E,cAAc,qBAAqB,CAAC;AACpC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,eAAe,CAAC;AAC9B,cAAc,uBAAuB,CAAC;AACtC,cAAc,iBAAiB,CAAC"}

package/lib/shell/AuthScreenPreview.d.ts

@@ -1,4 +1,4 @@
-import type { AppBranding } from '../boot/branding.js';
+import { type AppBranding } from '../boot/branding.js';
 import type { AuthScreens } from './VertesiaShell';
 export declare const AUTH_PREVIEW_SCREENS: readonly ['email', 'providers', 'tenant', 'returning', 'pending', 'blocked', 'signup', 'restricted', 'scope-project', 'scope-account', 'no-account', 'credentials', 'service', 'auth-error', 'loading', 'permissions', 'permission-retry', 'permission-error', 'permission-denied', 'permission-session-expired', 'boot'];
 export type AuthPreviewScreen = (typeof AUTH_PREVIEW_SCREENS)[number];

package/lib/shell/AuthScreenPreview.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthScreenPreview.d.ts","sourceRoot":"","sources":["../../src/shell/AuthScreenPreview.tsx"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAavD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD,eAAO,MAAM,oBAAoB,YAC7B,OAAO,EACP,WAAW,EACX,QAAQ,EACR,WAAW,EACX,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,eAAe,EACf,YAAY,EACZ,aAAa,EACb,SAAS,EACT,YAAY,EACZ,SAAS,EACT,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,4BAA4B,EAC5B,MAAM,CACA,CAAC;AACX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAatE,wBAAgB,iBAAiB,CAAC,EAC9B,MAAM,EACN,QAAQ,EACR,OAAY,GACf,EAAE;IACC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,WAAW,CAAC;IACtB,OAAO,CAAC,EAAE,WAAW,CAAC;CACzB,+BAqJA;AAED,0GAA0G;AAC1G,wBAAsB,sBAAsB,CACxC,SAAS,EAAE,WAAW,EACtB,MAAM,EAAE,MAAM,EACd,QAAQ,GAAE,WAIT,EACD,OAAO,GAAE,WAAgB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAIf"}
+{"version":3,"file":"AuthScreenPreview.d.ts","sourceRoot":"","sources":["../../src/shell/AuthScreenPreview.tsx"],"names":[],"mappings":"AAGA,OAAO,EAAE,KAAK,WAAW,EAAoB,MAAM,qBAAqB,CAAC;AAazE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD,eAAO,MAAM,oBAAoB,YAC7B,OAAO,EACP,WAAW,EACX,QAAQ,EACR,WAAW,EACX,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,eAAe,EACf,eAAe,EACf,YAAY,EACZ,aAAa,EACb,SAAS,EACT,YAAY,EACZ,SAAS,EACT,aAAa,EACb,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,EACnB,4BAA4B,EAC5B,MAAM,CACA,CAAC;AACX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AAatE,wBAAgB,iBAAiB,CAAC,EAC9B,MAAM,EACN,QAAQ,EACR,OAAY,GACf,EAAE;IACC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,WAAW,CAAC;IACtB,OAAO,CAAC,EAAE,WAAW,CAAC;CACzB,+BAqJA;AAED,0GAA0G;AAC1G,wBAAsB,sBAAsB,CACxC,SAAS,EAAE,WAAW,EACtB,MAAM,EAAE,MAAM,EACd,QAAQ,GAAE,WAA8B,EACxC,OAAO,GAAE,WAAgB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAIf"}

package/lib/shell/AuthScreenPreview.js

@@ -1,6 +1,7 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 /** Developer-only visual fixtures. Mount outside the authenticated application tree. */
 import { I18nProvider, useUITranslation } from '@vertesia/ui/i18n';
+import { vertesiaBranding } from '../boot/branding.js';
 import { AppBrandingProvider, BrandedAuthLoadingScreen, BrandedPermissionLoadingScreen, BrandedSignInScreen, } from './BrandedAuthScreens';
 import { SignInFlowSteps } from './login/SignInFlow';
 import SignInRecoveryStep from './login/SignInRecoveryStep';
@@ -127,11 +128,7 @@ export function AuthScreenPreview({ screen, branding, screens = {}, }) {
                                 }), _jsx("a", { href: window.location.pathname, children: "Exit preview" })] })] })] }) }));
 }
 /** Hosts call this only from their import.meta.env.DEV branch, before mounting auth/session providers. */
-export async function mountAuthScreenPreview(container, screen, branding = {
-    name: 'Vertesia',
-    logo: { light: '/logo-light.png', dark: '/logo-dark.png' },
-    loadingIcon: { light: '/icon.svg' },
-}, screens = {}) {
+export async function mountAuthScreenPreview(container, screen, branding = vertesiaBranding, screens = {}) {
     if (screen === 'boot')
         return;
     const { createRoot } = await import('react-dom/client');

package/lib/shell/AuthScreenPreview.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthScreenPreview.js","sourceRoot":"","sources":["../../src/shell/AuthScreenPreview.tsx"],"names":[],"mappings":";AAAA,wFAAwF;AACxF,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAGnE,OAAO,EACH,mBAAmB,EACnB,wBAAwB,EACxB,8BAA8B,EAC9B,mBAAmB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAA6B,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,kBAA+C,MAAM,4BAA4B,CAAC;AACzF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,uBAAuB,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAA2B,MAAM,sBAAsB,CAAC;AAClF,OAAO,UAAU,MAAM,oBAAoB,CAAC;AAG5C,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAChC,OAAO;IACP,WAAW;IACX,QAAQ;IACR,WAAW;IACX,SAAS;IACT,SAAS;IACT,QAAQ;IACR,YAAY;IACZ,eAAe;IACf,eAAe;IACf,YAAY;IACZ,aAAa;IACb,SAAS;IACT,YAAY;IACZ,SAAS;IACT,aAAa;IACb,kBAAkB;IAClB,kBAAkB;IAClB,mBAAmB;IACnB,4BAA4B;IAC5B,MAAM;CACA,CAAC;AAGX,MAAM,IAAI,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;AACtB,MAAM,QAAQ,GAAG,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;AACrE,MAAM,cAAc,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;AAC7E,MAAM,aAAa,GAA2D;IAC1E,eAAe,EAAE,cAAc;IAC/B,eAAe,EAAE,cAAc;IAC/B,YAAY,EAAE,qBAAqB;IACnC,WAAW,EAAE,YAAY;IACzB,OAAO,EAAE,SAAS;CACrB,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,EAC9B,MAAM,EACN,QAAQ,EACR,OAAO,GAAG,EAAE,GAKf;IACG,MAAM,EAAE,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC;IACnF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,mBAAmB,CAAC;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,wBAAwB,CAAC;IAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,8BAA8B,CAAC;IAC1E,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAA6C;QACnD,IAAI,EACA,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,QAAQ;YACrB,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,SAAS;YACtB,QAAQ,KAAK,SAAS;YACtB,QAAQ,KAAK,QAAQ;YACrB,QAAQ,KAAK,YAAY;YACrB,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,QAAQ,KAAK,eAAe,IAAI,QAAQ,KAAK,eAAe;gBAC5D,CAAC,CAAC,kBAAkB;gBACpB,CAAC,CAAC,QAAQ,KAAK,YAAY;oBACzB,CAAC,CAAC,qBAAqB;oBACvB,CAAC,CAAC,QAAQ,KAAK,aAAa;wBAC1B,CAAC,CAAC,mBAAmB;wBACrB,CAAC,CAAC,QAAQ,KAAK,SAAS;4BACtB,CAAC,CAAC,gBAAgB;4BAClB,CAAC,CAAC,OAAO;QACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,MAAM,EAAE,EAAE,gBAAgB,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE;QAC9E,aAAa,EAAE,EAAE,GAAG,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE;QAC/E,eAAe,EAAE,MAAM;QACvB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,IAAI;QACf,gBAAgB,EAAE,IAAI;QACtB,kBAAkB,EAAE,IAAI;QACxB,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,IAAI;QACd,iBAAiB,EAAE,IAAI;QACvB,SAAS,EAAE,IAAI;KAClB,CAAC;IACF,IAAI,OAAO,GAAc,KAAC,eAAe,IAAC,IAAI,EAAE,IAAI,GAAI,CAAC;IACzD,IAAI,QAAQ,KAAK,SAAS;QACtB,OAAO,GAAG,KAAC,uBAAuB,IAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAI,CAAC;IAC1G,IAAI,QAAQ,KAAK,YAAY;QAAE,OAAO,GAAG,KAAC,uBAAuB,IAAC,mBAAmB,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,GAAI,CAAC;IAClH,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,GAAG,KAAC,UAAU,IAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAI,CAAC;IAC5G,IAAI,QAAQ;QACR,OAAO,GAAG,CACN,KAAC,kBAAkB,IACf,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,EAAE,GAAG,EAAE,EAC1D,UAAU,EACN,QAAQ,KAAK,cAAc,IAAI,QAAQ,KAAK,cAAc,IAAI,QAAQ,KAAK,SAAS;gBAChF,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,SAAS,EAEnB,qBAAqB,EAAE,IAAI,GAC7B,CACL,CAAC;IACN,IAAI,IAAI,GAAc,CAClB,KAAC,MAAM,IACH,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,KAAK,EACf,MAAM,EAAE,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,KAAC,iBAAiB,KAAG,CAAC,CAAC,CAAC,IAAI,EAChE,qBAAqB,EAAE,IAAI,EAC3B,4BAA4B,EAAE,IAAI,EAClC,OAAO,EAAE,IAAI,EACb,QAAQ,EAAE,IAAI,YAEb,OAAO,GACH,CACZ,CAAC;IACF,IAAI,QAAQ,KAAK,SAAS;QAAE,IAAI,GAAG,KAAC,OAAO,KAAG,CAAC;IAC/C,IACI,QAAQ,KAAK,aAAa;QAC1B,QAAQ,KAAK,kBAAkB;QAC/B,QAAQ,KAAK,kBAAkB;QAC/B,QAAQ,KAAK,mBAAmB;QAChC,QAAQ,KAAK,4BAA4B,EAC3C,CAAC;QACC,MAAM,MAAM,GAAG,QAAQ,KAAK,mBAAmB,CAAC;QAChD,MAAM,OAAO,GAAG,QAAQ,KAAK,4BAA4B,CAAC;QAC1D,MAAM,MAAM,GAAG,QAAQ,KAAK,kBAAkB,IAAI,MAAM,IAAI,OAAO,CAAC;QACpE,IAAI,GAAG,CACH,KAAC,WAAW,IACR,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,KAAK,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,EACnF,KAAK,EACD,OAAO;gBACH,CAAC,CAAC,CAAC,CAAC,gCAAgC,CAAC;gBACrC,CAAC,CAAC,MAAM;oBACN,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC;oBACzB,CAAC,CAAC,MAAM;wBACN,CAAC,CAAC,CAAC,CAAC,8BAA8B,CAAC;wBACnC,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAEzC,WAAW,EACP,OAAO;gBACH,CAAC,CAAC,CAAC,CAAC,+BAA+B,CAAC;gBACpC,CAAC,CAAC,MAAM;oBACN,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC;oBAC/B,CAAC,CAAC,MAAM;wBACN,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC;wBAChC,CAAC,CAAC,QAAQ,KAAK,kBAAkB;4BAC/B,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC;4BAC3B,CAAC,CAAC,CAAC,CAAC,gCAAgC,CAAC,EAEnD,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,SAAS,EACjE,WAAW,EAAE,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAClG,QAAQ,EAAE,IAAI,GAChB,CACL,CAAC;IACN,CAAC;IACD,OAAO,CACH,KAAC,YAAY,cACT,MAAC,mBAAmB,IAAC,QAAQ,EAAE,QAAQ,aAEnC,cAAK,KAAK,QAAC,KAAK,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,YACpC,IAAI,GACH,EACN,mBACI,SAAS,EAAC,qGAAqG,EAC/G,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,aAE7B,gDAAwB,QAAQ,IAAW,EAC3C,6BAAgB,sBAAsB,EAAC,SAAS,EAAC,0BAA0B,aACtE,oBAAoB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;oCAChC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oCAC3D,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;oCACjC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;oCACjC,MAAM,CAAC,GAAG,CACN,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,EACxD,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CACpC,CAAC;oCACF,OAAO,CACH,YAEI,IAAI,EAAE,IAAI,MAAM,EAAE,kBACJ,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,YAEpD,KAAK,IAJD,KAAK,CAKV,CACP,CAAC;gCACN,CAAC,CAAC,EACF,YAAG,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,6BAAkB,IACjD,IACA,IACQ,GACX,CAClB,CAAC;AACN,CAAC;AAED,0GAA0G;AAC1G,MAAM,CAAC,KAAK,UAAU,sBAAsB,CACxC,SAAsB,EACtB,MAAc,EACd,QAAQ,GAAgB;IACpB,IAAI,EAAE,UAAU;IAChB,IAAI,EAAE,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,EAAE,gBAAgB,EAAE;IAC1D,WAAW,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE;CACtC,EACD,OAAO,GAAgB,EAAE;IAEzB,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO;IAC9B,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACxD,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAC,iBAAiB,IAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAI,CAAC,CAAC;AAC9G,CAAC"}
+{"version":3,"file":"AuthScreenPreview.js","sourceRoot":"","sources":["../../src/shell/AuthScreenPreview.tsx"],"names":[],"mappings":";AAAA,wFAAwF;AACxF,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAEnE,OAAO,EAAoB,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EACH,mBAAmB,EACnB,wBAAwB,EACxB,8BAA8B,EAC9B,mBAAmB,GACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAA6B,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,kBAA+C,MAAM,4BAA4B,CAAC;AACzF,OAAO,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAC1E,OAAO,uBAAuB,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,iBAAiB,EAA2B,MAAM,sBAAsB,CAAC;AAClF,OAAO,UAAU,MAAM,oBAAoB,CAAC;AAG5C,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAChC,OAAO;IACP,WAAW;IACX,QAAQ;IACR,WAAW;IACX,SAAS;IACT,SAAS;IACT,QAAQ;IACR,YAAY;IACZ,eAAe;IACf,eAAe;IACf,YAAY;IACZ,aAAa;IACb,SAAS;IACT,YAAY;IACZ,SAAS;IACT,aAAa;IACb,kBAAkB;IAClB,kBAAkB;IAClB,mBAAmB;IACnB,4BAA4B;IAC5B,MAAM;CACA,CAAC;AAGX,MAAM,IAAI,GAAG,GAAG,EAAE,GAAE,CAAC,CAAC;AACtB,MAAM,QAAQ,GAAG,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;AACrE,MAAM,cAAc,GAAG,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC;AAC7E,MAAM,aAAa,GAA2D;IAC1E,eAAe,EAAE,cAAc;IAC/B,eAAe,EAAE,cAAc;IAC/B,YAAY,EAAE,qBAAqB;IACnC,WAAW,EAAE,YAAY;IACzB,OAAO,EAAE,SAAS;CACrB,CAAC;AAEF,MAAM,UAAU,iBAAiB,CAAC,EAC9B,MAAM,EACN,QAAQ,EACR,OAAO,GAAG,EAAE,GAKf;IACG,MAAM,EAAE,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC;IACnF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,mBAAmB,CAAC;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,wBAAwB,CAAC;IAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,8BAA8B,CAAC;IAC1E,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,IAAI,GAA6C;QACnD,IAAI,EACA,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,QAAQ;YACrB,QAAQ,KAAK,WAAW;YACxB,QAAQ,KAAK,SAAS;YACtB,QAAQ,KAAK,SAAS;YACtB,QAAQ,KAAK,QAAQ;YACrB,QAAQ,KAAK,YAAY;YACrB,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,QAAQ,KAAK,eAAe,IAAI,QAAQ,KAAK,eAAe;gBAC5D,CAAC,CAAC,kBAAkB;gBACpB,CAAC,CAAC,QAAQ,KAAK,YAAY;oBACzB,CAAC,CAAC,qBAAqB;oBACvB,CAAC,CAAC,QAAQ,KAAK,aAAa;wBAC1B,CAAC,CAAC,mBAAmB;wBACrB,CAAC,CAAC,QAAQ,KAAK,SAAS;4BACtB,CAAC,CAAC,gBAAgB;4BAClB,CAAC,CAAC,OAAO;QACzB,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,MAAM,EAAE,EAAE,gBAAgB,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE;QAC9E,aAAa,EAAE,EAAE,GAAG,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE;QAC/E,eAAe,EAAE,MAAM;QACvB,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,IAAI;QACd,SAAS,EAAE,IAAI;QACf,gBAAgB,EAAE,IAAI;QACtB,kBAAkB,EAAE,IAAI;QACxB,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,IAAI;QACd,iBAAiB,EAAE,IAAI;QACvB,SAAS,EAAE,IAAI;KAClB,CAAC;IACF,IAAI,OAAO,GAAc,KAAC,eAAe,IAAC,IAAI,EAAE,IAAI,GAAI,CAAC;IACzD,IAAI,QAAQ,KAAK,SAAS;QACtB,OAAO,GAAG,KAAC,uBAAuB,IAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAI,CAAC;IAC1G,IAAI,QAAQ,KAAK,YAAY;QAAE,OAAO,GAAG,KAAC,uBAAuB,IAAC,mBAAmB,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,GAAI,CAAC;IAClH,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,GAAG,KAAC,UAAU,IAAC,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,GAAI,CAAC;IAC5G,IAAI,QAAQ;QACR,OAAO,GAAG,CACN,KAAC,kBAAkB,IACf,IAAI,EAAE,QAAQ,EACd,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,MAAM,EAAE,GAAG,EAAE,EAC1D,UAAU,EACN,QAAQ,KAAK,cAAc,IAAI,QAAQ,KAAK,cAAc,IAAI,QAAQ,KAAK,SAAS;gBAChF,CAAC,CAAC,IAAI;gBACN,CAAC,CAAC,SAAS,EAEnB,qBAAqB,EAAE,IAAI,GAC7B,CACL,CAAC;IACN,IAAI,IAAI,GAAc,CAClB,KAAC,MAAM,IACH,IAAI,EAAE,IAAI,EACV,QAAQ,EAAE,KAAK,EACf,MAAM,EAAE,QAAQ,KAAK,YAAY,CAAC,CAAC,CAAC,KAAC,iBAAiB,KAAG,CAAC,CAAC,CAAC,IAAI,EAChE,qBAAqB,EAAE,IAAI,EAC3B,4BAA4B,EAAE,IAAI,EAClC,OAAO,EAAE,IAAI,EACb,QAAQ,EAAE,IAAI,YAEb,OAAO,GACH,CACZ,CAAC;IACF,IAAI,QAAQ,KAAK,SAAS;QAAE,IAAI,GAAG,KAAC,OAAO,KAAG,CAAC;IAC/C,IACI,QAAQ,KAAK,aAAa;QAC1B,QAAQ,KAAK,kBAAkB;QAC/B,QAAQ,KAAK,kBAAkB;QAC/B,QAAQ,KAAK,mBAAmB;QAChC,QAAQ,KAAK,4BAA4B,EAC3C,CAAC;QACC,MAAM,MAAM,GAAG,QAAQ,KAAK,mBAAmB,CAAC;QAChD,MAAM,OAAO,GAAG,QAAQ,KAAK,4BAA4B,CAAC;QAC1D,MAAM,MAAM,GAAG,QAAQ,KAAK,kBAAkB,IAAI,MAAM,IAAI,OAAO,CAAC;QACpE,IAAI,GAAG,CACH,KAAC,WAAW,IACR,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,KAAK,kBAAkB,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,EACnF,KAAK,EACD,OAAO;gBACH,CAAC,CAAC,CAAC,CAAC,gCAAgC,CAAC;gBACrC,CAAC,CAAC,MAAM;oBACN,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC;oBACzB,CAAC,CAAC,MAAM;wBACN,CAAC,CAAC,CAAC,CAAC,8BAA8B,CAAC;wBACnC,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAEzC,WAAW,EACP,OAAO;gBACH,CAAC,CAAC,CAAC,CAAC,+BAA+B,CAAC;gBACpC,CAAC,CAAC,MAAM;oBACN,CAAC,CAAC,CAAC,CAAC,0BAA0B,CAAC;oBAC/B,CAAC,CAAC,MAAM;wBACN,CAAC,CAAC,CAAC,CAAC,2BAA2B,CAAC;wBAChC,CAAC,CAAC,QAAQ,KAAK,kBAAkB;4BAC/B,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC;4BAC3B,CAAC,CAAC,CAAC,CAAC,gCAAgC,CAAC,EAEnD,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC,SAAS,EACjE,WAAW,EAAE,CAAC,CAAC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,wBAAwB,CAAC,EAClG,QAAQ,EAAE,IAAI,GAChB,CACL,CAAC;IACN,CAAC;IACD,OAAO,CACH,KAAC,YAAY,cACT,MAAC,mBAAmB,IAAC,QAAQ,EAAE,QAAQ,aAEnC,cAAK,KAAK,QAAC,KAAK,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,YACpC,IAAI,GACH,EACN,mBACI,SAAS,EAAC,qGAAqG,EAC/G,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,aAE7B,gDAAwB,QAAQ,IAAW,EAC3C,6BAAgB,sBAAsB,EAAC,SAAS,EAAC,0BAA0B,aACtE,oBAAoB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;oCAChC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;oCAC3D,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;oCACjC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;oCACjC,MAAM,CAAC,GAAG,CACN,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,EACxD,KAAK,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CACpC,CAAC;oCACF,OAAO,CACH,YAEI,IAAI,EAAE,IAAI,MAAM,EAAE,kBACJ,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,YAEpD,KAAK,IAJD,KAAK,CAKV,CACP,CAAC;gCACN,CAAC,CAAC,EACF,YAAG,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,6BAAkB,IACjD,IACA,IACQ,GACX,CAClB,CAAC;AACN,CAAC;AAED,0GAA0G;AAC1G,MAAM,CAAC,KAAK,UAAU,sBAAsB,CACxC,SAAsB,EACtB,MAAc,EACd,QAAQ,GAAgB,gBAAgB,EACxC,OAAO,GAAgB,EAAE;IAEzB,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO;IAC9B,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACxD,UAAU,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAC,iBAAiB,IAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAI,CAAC,CAAC;AAC9G,CAAC"}

package/lib/shell/BrandedAuthScreens.d.ts

@@ -4,6 +4,7 @@ import { type AppBranding } from '../boot/branding.js';
 import { type SignInScreenViewProps } from './login/SigninScreen';
 import { type AuthLoadingScreenProps } from './SplashScreen';
 import type { AuthScreens } from './VertesiaShell';
+export { BrandedLoadingIndicator } from './BrandedLoadingIndicator';
 export declare function AppBrandingProvider({ branding, children }: {
     branding: AppBranding;
     children: ReactNode;
@@ -12,8 +13,4 @@ export declare function BrandedAuthLoadingScreen({ loadingIcon }: AuthLoadingScr
 export declare function BrandedSignInScreen({ children, notice, isNested, lightLogo, darkLogo }: SignInScreenViewProps): import("react").JSX.Element;
 export declare function BrandedPermissionLoadingScreen(props: PermissionLoadingScreenProps): import("react").JSX.Element;
 export declare const brandedAuthScreens: AuthScreens;
-/** Brand-aware loading indicator that stays inside its container instead of covering the app shell. */
-export declare function BrandedLoadingIndicator({ loadingIcon, delayMs }: AuthLoadingScreenProps & {
-    delayMs?: number;
-}): import("react").JSX.Element | null;
 //# sourceMappingURL=BrandedAuthScreens.d.ts.map

package/lib/shell/BrandedAuthScreens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BrandedAuthScreens.d.ts","sourceRoot":"","sources":["../../src/shell/BrandedAuthScreens.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAkC,KAAK,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AAE1G,OAAO,EAAiB,KAAK,SAAS,EAAmD,MAAM,OAAO,CAAC;AACvG,OAAO,EAAE,KAAK,WAAW,EAAqB,MAAM,qBAAqB,CAAC;AAC1E,OAAO,EAAuB,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AACvF,OAAO,EAAE,KAAK,sBAAsB,EAA8C,MAAM,gBAAgB,CAAC;AACzG,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAInD,wBAAgB,mBAAmB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE;IAAE,QAAQ,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,SAAS,CAAA;CAAE,+BAoBzG;AAgBD,wBAAgB,wBAAwB,CAAC,EAAE,WAAW,EAAE,EAAE,sBAAsB,+BAQ/E;AAED,wBAAgB,mBAAmB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,qBAAqB,+BAc7G;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,4BAA4B,+BAejF;AAED,eAAO,MAAM,kBAAkB,EAAE,WAIhC,CAAC;AAEF,uGAAuG;AACvG,wBAAgB,uBAAuB,CAAC,EAAE,WAAW,EAAE,OAAW,EAAE,EAAE,sBAAsB,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,sCAoBlH"}
+{"version":3,"file":"BrandedAuthScreens.d.ts","sourceRoot":"","sources":["../../src/shell/BrandedAuthScreens.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAkC,KAAK,4BAA4B,EAAE,MAAM,uBAAuB,CAAC;AAE1G,OAAO,EAAE,KAAK,SAAS,EAA8B,MAAM,OAAO,CAAC;AACnE,OAAO,EAAE,KAAK,WAAW,EAAqB,MAAM,qBAAqB,CAAC;AAE1E,OAAO,EAAuB,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AACvF,OAAO,EAAE,KAAK,sBAAsB,EAA4B,MAAM,gBAAgB,CAAC;AACvF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAEpE,wBAAgB,mBAAmB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE;IAAE,QAAQ,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,SAAS,CAAA;CAAE,+BAoBzG;AAED,wBAAgB,wBAAwB,CAAC,EAAE,WAAW,EAAE,EAAE,sBAAsB,+BAQ/E;AAED,wBAAgB,mBAAmB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,qBAAqB,+BAc7G;AAED,wBAAgB,8BAA8B,CAAC,KAAK,EAAE,4BAA4B,+BAejF;AAED,eAAO,MAAM,kBAAkB,EAAE,WAIhC,CAAC"}