@wildo-ai/saas-frontend-lib 1.1.2 → 1.1.4

package/dist/esm/core/security/jwt.frontend.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/jwt.frontend.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,GAAG,CAAC,CAO1F"}
+{"version":3,"file":"jwt.frontend.utils.d.ts","sourceRoot":"","sources":["../../../../src/core/security/jwt.frontend.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAYH;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,GAAG,CAAC,CAO1F"}

package/dist/esm/core/security/jwt.frontend.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.frontend.utils.js","sourceRoot":"","sources":["../../../../../src/core/security/jwt.frontend.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,SAAS,qBAAqB,CAAC,OAAe;IAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjE,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,GAAG,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5E,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAoC,WAAmB;IACrF,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAM,CAAC;AAC/D,CAAC","sourcesContent":["/**\n * Frontend JWT utilities.\n *\n * JWT payload segments use base64url, not plain base64. Consumers that decode\n * payload claims must normalize `-` / `_` and padding before parsing.\n */\n\nfunction decodeBase64UrlToUtf8(segment: string): string {\n  const normalized = segment.replace(/-/g, '+').replace(/_/g, '/');\n  const paddingLength = (4 - (normalized.length % 4)) % 4;\n  const padded = `${normalized}${'='.repeat(paddingLength)}`;\n  const binary = atob(padded);\n  const bytes = Uint8Array.from(binary, character => character.charCodeAt(0));\n\n  return new TextDecoder().decode(bytes);\n}\n\n/**\n * Decode and parse the payload segment of a JWT access token.\n *\n * Throws when the token is malformed or when the payload is not valid JSON so\n * callers can apply context-specific logging/error handling policy.\n */\nexport function decodeJwtPayload<T extends Record<string, unknown>>(accessToken: string): T {\n  const tokenParts = accessToken.split('.');\n  if (tokenParts.length !== 3) {\n    throw new Error('JWT must contain exactly three segments');\n  }\n\n  return JSON.parse(decodeBase64UrlToUtf8(tokenParts[1])) as T;\n}\n"]}
+{"version":3,"file":"jwt.frontend.utils.js","sourceRoot":"","sources":["../../../../src/core/security/jwt.frontend.utils.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,SAAS,qBAAqB,CAAC,OAAe;IAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjE,MAAM,aAAa,GAAG,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,GAAG,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;IAC3D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAE5E,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAoC,WAAmB;IACrF,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO,IAAI,CAAC,KAAK,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAM,CAAC;AAC/D,CAAC","sourcesContent":["/**\n * Frontend JWT utilities.\n *\n * JWT payload segments use base64url, not plain base64. Consumers that decode\n * payload claims must normalize `-` / `_` and padding before parsing.\n */\n\nfunction decodeBase64UrlToUtf8(segment: string): string {\n  const normalized = segment.replace(/-/g, '+').replace(/_/g, '/');\n  const paddingLength = (4 - (normalized.length % 4)) % 4;\n  const padded = `${normalized}${'='.repeat(paddingLength)}`;\n  const binary = atob(padded);\n  const bytes = Uint8Array.from(binary, character => character.charCodeAt(0));\n\n  return new TextDecoder().decode(bytes);\n}\n\n/**\n * Decode and parse the payload segment of a JWT access token.\n *\n * Throws when the token is malformed or when the payload is not valid JSON so\n * callers can apply context-specific logging/error handling policy.\n */\nexport function decodeJwtPayload<T extends Record<string, unknown>>(accessToken: string): T {\n  const tokenParts = accessToken.split('.');\n  if (tokenParts.length !== 3) {\n    throw new Error('JWT must contain exactly three segments');\n  }\n\n  return JSON.parse(decodeBase64UrlToUtf8(tokenParts[1])) as T;\n}\n"]}

package/dist/esm/core/security/security.frontend.schemas.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.frontend.schemas.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/security.frontend.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,0BAA0B,EAC1B,WAAW,EACX,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,0BAA0B,GAAG,IAAI,CAAC;IAClD,YAAY,EAAE,GAAG,GAAG,IAAI,CAAC;IACzB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mBAAmB,EAAE,eAAe,EAAE,CAAC;IACvC,0BAA0B,EAAE,UAAU,EAAE,CAAC;IACzC,2BAA2B,EAAE,MAAM,EAAE,CAAC;IACtC,yBAAyB,EAAE,MAAM,EAAE,CAAC;IACpC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACnC,oEAAoE;IACpE,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,wGAAwG;IACxG,aAAa,CAAC,EAAE;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5C,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,2BAA2B,CAAC,EAAE;QAC5B;;;;;WAKG;QACH,UAAU,EAAE,MAAM,CAAC;QACnB;;;;;;;;;WASG;QACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;QACnC,mGAAmG;QACnG,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACzC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAmB9B,CAAC;AAIF,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjE,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;AAEpE,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,QAAQ,CAAC"}
+{"version":3,"file":"security.frontend.schemas.d.ts","sourceRoot":"","sources":["../../../../src/core/security/security.frontend.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,0BAA0B,EAC1B,WAAW,EACX,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,kBAAkB,EACxB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;;;;;;GAaG;AACH,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,OAAO,CAAC;IACnB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,0BAA0B,GAAG,IAAI,CAAC;IAClD,YAAY,EAAE,GAAG,GAAG,IAAI,CAAC;IACzB,kBAAkB,EAAE,OAAO,CAAC;IAC5B,eAAe,EAAE,OAAO,CAAC;IACzB,WAAW,EAAE,OAAO,CAAC;IACrB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mBAAmB,EAAE,eAAe,EAAE,CAAC;IACvC,0BAA0B,EAAE,UAAU,EAAE,CAAC;IACzC,2BAA2B,EAAE,MAAM,EAAE,CAAC;IACtC,yBAAyB,EAAE,MAAM,EAAE,CAAC;IACpC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACnC,oEAAoE;IACpE,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;IAChC,wGAAwG;IACxG,aAAa,CAAC,EAAE;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5C,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC;IACF;;;;;;;;;;;;;;;;;;;;OAoBG;IACH,2BAA2B,CAAC,EAAE;QAC5B;;;;;WAKG;QACH,UAAU,EAAE,MAAM,CAAC;QACnB;;;;;;;;;WASG;QACH,yBAAyB,CAAC,EAAE,MAAM,CAAC;QACnC,mGAAmG;QACnG,gBAAgB,CAAC,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAED;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG;IACjC,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;CACzC,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,gBAAgB,EAAE,SAmB9B,CAAC;AAIF,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;AAEjE,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;AAEpE,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,QAAQ,CAAC"}

package/dist/esm/core/security/security.frontend.schemas.js.map

@@ -1 +1 @@
-{"version":3,"file":"security.frontend.schemas.js","sourceRoot":"","sources":["../../../../../src/core/security/security.frontend.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA0GH;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAc;IACzC,SAAS,EAAE,KAAK;IAChB,KAAK,EAAE,IAAI;IACX,SAAS,EAAE,IAAI;IACf,WAAW,EAAE,IAAI;IACjB,cAAc,EAAE,IAAI;IACpB,YAAY,EAAE,IAAI;IAClB,kBAAkB,EAAE,KAAK;IACzB,eAAe,EAAE,KAAK;IACtB,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,IAAI;IAClB,mBAAmB,EAAE,EAAE;IACvB,0BAA0B,EAAE,EAAE;IAC9B,2BAA2B,EAAE,EAAE;IAC/B,yBAAyB,EAAE,EAAE;IAC7B,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,IAAI;IACjB,aAAa,EAAE,SAAS;IACxB,2BAA2B,EAAE,SAAS;CACvC,CAAC","sourcesContent":["/**\n * Security Frontend Schemas\n * \n * Core authentication and authorization types for the frontend security layer.\n */\n\nimport { z } from 'zod';\nimport { \n  AuthIdentificationResponse,\n  SessionType,\n  type AuthMethod,\n  type AvailableMethod,\n  type AuthSessionPurpose,\n} from '@wildo-ai/saas-models';\n\n/**\n * Authentication state — contains only authentication-related fields.\n *\n * **No `refreshToken` field** (Auth-hardening Slice A Step 6,\n * 2026-04-13). Pre-Slice-A this carried `refreshToken: string | null`\n * mirroring the legacy body-channel rotation contract. A-Step 2\n * (cookie migration) made the cookie the sole owner of the refresh\n * token, A-Step 3 stopped this state from being read by any consumer,\n * and A-Step 6 dropped the field entirely. The refresh token now lives\n * EXCLUSIVELY in the `__wildo_refresh` `HttpOnly` cookie — JS-invisible\n * by design (XSS exfiltration surface closed). Consumers that want to\n * \"check if the user has a valid session\" should look at `accessToken`\n * (or `sessionRestored`) — never at the cookie, which is opaque to JS.\n */\nexport interface AuthState {\n  isLoading: boolean;\n  error: string | null;\n  sessionId: string | null;\n  accessToken: string | null;\n  identification: AuthIdentificationResponse | null;\n  sessionState: any | null;\n  isRestoringSession: boolean;\n  sessionRestored: boolean;\n  mfaRequired: boolean;\n  mfaSessionId: string | null;\n  availableMfaMethods: AvailableMethod[];\n  availableEnrollmentMethods: AuthMethod[];\n  enrolledSecondFactorMethods: string[];\n  usableSecondFactorMethods: string[];\n  purpose: AuthSessionPurpose | null;\n  /** W7.3b: Session type — null before authentication is resolved. */\n  sessionType: SessionType | null;\n  /** W7.3b: Context data for one-off sessions (only present when sessionType === SessionType.ONE_OFF). */\n  oneOffContext?: {\n    originTokenId: string;\n    tokenType: string;\n    consumableTokenValue?: string;\n    tokenExpiresAt?: string;\n    scopedInitiatorIds?: Record<string, string>;\n    applicationId?: string;\n  };\n  /**\n   * cross-app-jwt-propagation.md Step 5: Context data populated when an\n   * AUTH_CODE_EXCHANGE token was minted by the cross-frontend-handoff issuer.\n   * `AuthSessionContext.handleAuthCodeExchange()` populates this field only\n   * when the token-exchange response carries a top-level `returnPath`; OAuth2\n   * callback codes omit that field and therefore leave this context undefined.\n   *\n   * Distinct from `oneOffContext` on purpose (semantic distinction over\n   * convenience — see `design-philosophy.mdc`):\n   *   - `oneOffContext` describes a W7.3b ephemeral one-off session\n   *     (resource-scoped targeting, applicationId, consumable replay).\n   *   - `crossFrontendHandoffContext` describes a session-transfer landing\n   *     (returnPath, source/target frontend telemetry). The session itself\n   *     is a regular persistent session driven by the receiver's storage\n   *     adapter (cross-app-jwt-propagation.md K-7).\n   *\n   * Consumed by `Auth_OneOffSession` in cross-frontend-handoff mode to drive\n   * post-exchange navigation (`returnPath`); also available to app-level\n   * telemetry hooks that want to know \"this user just landed via a handoff\n   * from $sourceFrontendServiceName\".\n   */\n  crossFrontendHandoffContext?: {\n    /**\n     * Path to navigate to after the exchange completes. Already passed\n     * `CrossFrontendHandoff_ReturnPathSchema` refines at issuance, but\n     * receivers MUST sanitize defense-in-depth (a malicious caller could\n     * hand-craft an exchange URL bypassing the issuer).\n     */\n    returnPath: string;\n    /**\n     * The frontend that initiated the handoff (e.g., `'admin-console'`).\n     * Optional because the source frontend identifies itself only via the\n     * `X-Frontend-Service-Name` request header (set by the shared HTTP\n     * client interceptor). Non-browser callers — server-to-server\n     * invocations, hand-crafted curl sessions — may legitimately omit\n     * the header (the issuer falls back to \"unknown\" source for audit\n     * purposes), in which case the receiver simply has no source\n     * identity to display in telemetry / breadcrumbs.\n     */\n    sourceFrontendServiceName?: string;\n    /** The target frontend the handoff was minted for. Useful for telemetry / breadcrumb rendering. */\n    targetServiceKey?: string;\n  };\n}\n\n/**\n * Effective permissions for the current user\n * Contains app-level permissions and per-organization permissions\n */\nexport type EffectivePermissions = {\n  appLevel: string[];\n  organizations: Record<string, string[]>;\n};\n\n/**\n * Empty/initial authentication state\n */\nexport const EMPTY_AUTH_STATE: AuthState = {\n  isLoading: false,\n  error: null,\n  sessionId: null,\n  accessToken: null,\n  identification: null,\n  sessionState: null,\n  isRestoringSession: false,\n  sessionRestored: false,\n  mfaRequired: false,\n  mfaSessionId: null,\n  availableMfaMethods: [],\n  availableEnrollmentMethods: [],\n  enrolledSecondFactorMethods: [],\n  usableSecondFactorMethods: [],\n  purpose: null,\n  sessionType: null,\n  oneOffContext: undefined,\n  crossFrontendHandoffContext: undefined,\n};\n\n// ─── Auth UI State Types ─────────────────────────────────────────────\n\nexport type ResendStatus = 'idle' | 'sending' | 'sent' | 'error';\n\nexport type MfaPageErrorType = 'expired' | 'no_methods' | 'generic';\n\nexport type UIFactorLevel = 'first' | 'second';\n\n\n\n"]}
+{"version":3,"file":"security.frontend.schemas.js","sourceRoot":"","sources":["../../../../src/core/security/security.frontend.schemas.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AA0GH;;GAEG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAc;IACzC,SAAS,EAAE,KAAK;IAChB,KAAK,EAAE,IAAI;IACX,SAAS,EAAE,IAAI;IACf,WAAW,EAAE,IAAI;IACjB,cAAc,EAAE,IAAI;IACpB,YAAY,EAAE,IAAI;IAClB,kBAAkB,EAAE,KAAK;IACzB,eAAe,EAAE,KAAK;IACtB,WAAW,EAAE,KAAK;IAClB,YAAY,EAAE,IAAI;IAClB,mBAAmB,EAAE,EAAE;IACvB,0BAA0B,EAAE,EAAE;IAC9B,2BAA2B,EAAE,EAAE;IAC/B,yBAAyB,EAAE,EAAE;IAC7B,OAAO,EAAE,IAAI;IACb,WAAW,EAAE,IAAI;IACjB,aAAa,EAAE,SAAS;IACxB,2BAA2B,EAAE,SAAS;CACvC,CAAC","sourcesContent":["/**\n * Security Frontend Schemas\n * \n * Core authentication and authorization types for the frontend security layer.\n */\n\nimport { z } from 'zod';\nimport { \n  AuthIdentificationResponse,\n  SessionType,\n  type AuthMethod,\n  type AvailableMethod,\n  type AuthSessionPurpose,\n} from '@wildo-ai/saas-models';\n\n/**\n * Authentication state — contains only authentication-related fields.\n *\n * **No `refreshToken` field** (Auth-hardening Slice A Step 6,\n * 2026-04-13). Pre-Slice-A this carried `refreshToken: string | null`\n * mirroring the legacy body-channel rotation contract. A-Step 2\n * (cookie migration) made the cookie the sole owner of the refresh\n * token, A-Step 3 stopped this state from being read by any consumer,\n * and A-Step 6 dropped the field entirely. The refresh token now lives\n * EXCLUSIVELY in the `__wildo_refresh` `HttpOnly` cookie — JS-invisible\n * by design (XSS exfiltration surface closed). Consumers that want to\n * \"check if the user has a valid session\" should look at `accessToken`\n * (or `sessionRestored`) — never at the cookie, which is opaque to JS.\n */\nexport interface AuthState {\n  isLoading: boolean;\n  error: string | null;\n  sessionId: string | null;\n  accessToken: string | null;\n  identification: AuthIdentificationResponse | null;\n  sessionState: any | null;\n  isRestoringSession: boolean;\n  sessionRestored: boolean;\n  mfaRequired: boolean;\n  mfaSessionId: string | null;\n  availableMfaMethods: AvailableMethod[];\n  availableEnrollmentMethods: AuthMethod[];\n  enrolledSecondFactorMethods: string[];\n  usableSecondFactorMethods: string[];\n  purpose: AuthSessionPurpose | null;\n  /** W7.3b: Session type — null before authentication is resolved. */\n  sessionType: SessionType | null;\n  /** W7.3b: Context data for one-off sessions (only present when sessionType === SessionType.ONE_OFF). */\n  oneOffContext?: {\n    originTokenId: string;\n    tokenType: string;\n    consumableTokenValue?: string;\n    tokenExpiresAt?: string;\n    scopedInitiatorIds?: Record<string, string>;\n    applicationId?: string;\n  };\n  /**\n   * cross-app-jwt-propagation.md Step 5: Context data populated when an\n   * AUTH_CODE_EXCHANGE token was minted by the cross-frontend-handoff issuer.\n   * `AuthSessionContext.handleAuthCodeExchange()` populates this field only\n   * when the token-exchange response carries a top-level `returnPath`; OAuth2\n   * callback codes omit that field and therefore leave this context undefined.\n   *\n   * Distinct from `oneOffContext` on purpose (semantic distinction over\n   * convenience — see `design-philosophy.mdc`):\n   *   - `oneOffContext` describes a W7.3b ephemeral one-off session\n   *     (resource-scoped targeting, applicationId, consumable replay).\n   *   - `crossFrontendHandoffContext` describes a session-transfer landing\n   *     (returnPath, source/target frontend telemetry). The session itself\n   *     is a regular persistent session driven by the receiver's storage\n   *     adapter (cross-app-jwt-propagation.md K-7).\n   *\n   * Consumed by `Auth_OneOffSession` in cross-frontend-handoff mode to drive\n   * post-exchange navigation (`returnPath`); also available to app-level\n   * telemetry hooks that want to know \"this user just landed via a handoff\n   * from $sourceFrontendServiceName\".\n   */\n  crossFrontendHandoffContext?: {\n    /**\n     * Path to navigate to after the exchange completes. Already passed\n     * `CrossFrontendHandoff_ReturnPathSchema` refines at issuance, but\n     * receivers MUST sanitize defense-in-depth (a malicious caller could\n     * hand-craft an exchange URL bypassing the issuer).\n     */\n    returnPath: string;\n    /**\n     * The frontend that initiated the handoff (e.g., `'admin-console'`).\n     * Optional because the source frontend identifies itself only via the\n     * `X-Frontend-Service-Name` request header (set by the shared HTTP\n     * client interceptor). Non-browser callers — server-to-server\n     * invocations, hand-crafted curl sessions — may legitimately omit\n     * the header (the issuer falls back to \"unknown\" source for audit\n     * purposes), in which case the receiver simply has no source\n     * identity to display in telemetry / breadcrumbs.\n     */\n    sourceFrontendServiceName?: string;\n    /** The target frontend the handoff was minted for. Useful for telemetry / breadcrumb rendering. */\n    targetServiceKey?: string;\n  };\n}\n\n/**\n * Effective permissions for the current user\n * Contains app-level permissions and per-organization permissions\n */\nexport type EffectivePermissions = {\n  appLevel: string[];\n  organizations: Record<string, string[]>;\n};\n\n/**\n * Empty/initial authentication state\n */\nexport const EMPTY_AUTH_STATE: AuthState = {\n  isLoading: false,\n  error: null,\n  sessionId: null,\n  accessToken: null,\n  identification: null,\n  sessionState: null,\n  isRestoringSession: false,\n  sessionRestored: false,\n  mfaRequired: false,\n  mfaSessionId: null,\n  availableMfaMethods: [],\n  availableEnrollmentMethods: [],\n  enrolledSecondFactorMethods: [],\n  usableSecondFactorMethods: [],\n  purpose: null,\n  sessionType: null,\n  oneOffContext: undefined,\n  crossFrontendHandoffContext: undefined,\n};\n\n// ─── Auth UI State Types ─────────────────────────────────────────────\n\nexport type ResendStatus = 'idle' | 'sending' | 'sent' | 'error';\n\nexport type MfaPageErrorType = 'expired' | 'no_methods' | 'generic';\n\nexport type UIFactorLevel = 'first' | 'second';\n\n\n\n"]}

package/dist/esm/core/security/session-token-storage.frontend.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session-token-storage.frontend.service.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/session-token-storage.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AASH,MAAM,WAAW,mBAAmB;IAClC,cAAc,IAAI,MAAM,GAAG,IAAI,CAAC;IAChC,eAAe,IAAI,MAAM,GAAG,IAAI,CAAC;IACjC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAE3E,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAAC;IACnC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAE9C,KAAK,IAAI,IAAI,CAAC;CACf;AAQD,qBAAa,6BAA8B,YAAW,mBAAmB;IACvE,cAAc,IAAI,MAAM,GAAG,IAAI;IAG/B;;;;;;OAMG;IACH,eAAe,IAAI,MAAM,GAAG,IAAI;IAGhC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAY1E,iBAAiB,IAAI,MAAM,GAAG,IAAI;IAGlC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAK7C,KAAK,IAAI,IAAI;CAKd;AAED,qBAAa,4BAA6B,YAAW,mBAAmB;IACtE,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,eAAe,CAAuB;IAE9C,cAAc,IAAI,MAAM,GAAG,IAAI;IAC/B,eAAe,IAAI,MAAM,GAAG,IAAI;IAChC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAI1E,iBAAiB,IAAI,MAAM,GAAG,IAAI;IAClC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAC7C,KAAK,IAAI,IAAI;CAKd"}
+{"version":3,"file":"session-token-storage.frontend.service.d.ts","sourceRoot":"","sources":["../../../../src/core/security/session-token-storage.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AASH,MAAM,WAAW,mBAAmB;IAClC,cAAc,IAAI,MAAM,GAAG,IAAI,CAAC;IAChC,eAAe,IAAI,MAAM,GAAG,IAAI,CAAC;IACjC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAE3E,iBAAiB,IAAI,MAAM,GAAG,IAAI,CAAC;IACnC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IAE9C,KAAK,IAAI,IAAI,CAAC;CACf;AAQD,qBAAa,6BAA8B,YAAW,mBAAmB;IACvE,cAAc,IAAI,MAAM,GAAG,IAAI;IAG/B;;;;;;OAMG;IACH,eAAe,IAAI,MAAM,GAAG,IAAI;IAGhC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAY1E,iBAAiB,IAAI,MAAM,GAAG,IAAI;IAGlC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAK7C,KAAK,IAAI,IAAI;CAKd;AAED,qBAAa,4BAA6B,YAAW,mBAAmB;IACtE,OAAO,CAAC,YAAY,CAAuB;IAC3C,OAAO,CAAC,aAAa,CAAuB;IAC5C,OAAO,CAAC,eAAe,CAAuB;IAE9C,cAAc,IAAI,MAAM,GAAG,IAAI;IAC/B,eAAe,IAAI,MAAM,GAAG,IAAI;IAChC,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAI1E,iBAAiB,IAAI,MAAM,GAAG,IAAI;IAClC,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI;IAC7C,KAAK,IAAI,IAAI;CAKd"}

package/dist/esm/core/security/session-token-storage.frontend.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"session-token-storage.frontend.service.js","sourceRoot":"","sources":["../../../../../src/core/security/session-token-storage.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,iEAAiE,CAAC;AAazE;;;GAGG;AACH,IAAI,8BAA8B,GAAG,KAAK,CAAC;AAE3C,MAAM,OAAO,6BAA6B;IACxC,cAAc;QACZ,OAAO,mBAAmB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC;IACD;;;;;;OAMG;IACH,eAAe;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,WAAW,CAAC,WAA0B,EAAE,YAA2B;QACjE,WAAW;YACT,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC;YAChE,CAAC,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,8BAA8B,EAAE,CAAC;YAC7D,8BAA8B,GAAG,IAAI,CAAC;YACtC,OAAO,CAAC,IAAI,CACV,gNAAgN,CACjN,CAAC;QACJ,CAAC;QACD,sBAAsB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAC3D,CAAC;IACD,iBAAiB;QACf,OAAO,mBAAmB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACzE,CAAC;IACD,iBAAiB,CAAC,KAAoB;QACpC,KAAK;YACH,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,uBAAuB,EAAE,KAAK,CAAC;YACxE,CAAC,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACzE,CAAC;IACD,KAAK;QACH,sBAAsB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACrD,sBAAsB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QACzD,sBAAsB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACrE,CAAC;CACF;AAED,MAAM,OAAO,4BAA4B;IAC/B,YAAY,GAAkB,IAAI,CAAC;IACnC,aAAa,GAAkB,IAAI,CAAC;IACpC,eAAe,GAAkB,IAAI,CAAC;IAE9C,cAAc,KAAoB,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7D,eAAe,KAAoB,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IAC/D,WAAW,CAAC,WAA0B,EAAE,YAA2B;QACjE,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QAChC,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;IACpC,CAAC;IACD,iBAAiB,KAAoB,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;IACnE,iBAAiB,CAAC,KAAoB,IAAU,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,CAAC,CAAC;IAC/E,KAAK;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;IAC9B,CAAC;CACF","sourcesContent":["/**\n * W7.3b: Session Token Storage — Strategy pattern for token persistence.\n *\n * PersistentSessionTokenStorage: Delegates to localStorage (survives tab close).\n * EphemeralSessionTokenStorage: In-memory only (dies with the tab/component instance).\n *\n * Auth-hardening Slice A Step 3 (2026-04-13) — `PersistentSessionTokenStorage`\n * NO LONGER persists the refresh token in localStorage. The refresh token now\n * travels via the `__wildo_refresh` `HttpOnly` cookie (see\n * `auth-controller.utils.ts` and `authentication-controller.backend.service.ts`).\n * The cookie is invisible to JS, which closes the XSS exfiltration surface\n * that ANY localStorage-backed refresh token inherently has.\n *\n * The `storeTokens()` signature still accepts a `refreshToken` parameter for\n * source-compat with `EphemeralSessionTokenStorage` (which keeps the in-memory\n * field for one-off / test contexts), but `PersistentSessionTokenStorage`\n * silently ignores the argument and emits a one-line `console.warn` if a\n * non-null value is passed during the transition window. The existing\n * `removeLocalStorageItem(REFRESH_TOKEN)` is kept on every `storeTokens()`\n * AND `clear()` invocation so any leftover localStorage value from a\n * pre-migration session is wiped on the user's next interaction.\n */\n\nimport {\n  LOCAL_STORAGE_KEYS,\n  getLocalStorageItem,\n  setLocalStorageItem,\n  removeLocalStorageItem,\n} from '~wildo-frontend-lib/core/commons/local-storage.frontend.schemas';\n\nexport interface SessionTokenStorage {\n  getAccessToken(): string | null;\n  getRefreshToken(): string | null;\n  storeTokens(accessToken: string | null, refreshToken: string | null): void;\n\n  getOrganizationId(): string | null;\n  setOrganizationId(orgId: string | null): void;\n\n  clear(): void;\n}\n\n/**\n * Module-scoped flag — emit the deprecation warning ONCE per page load even if\n * `storeTokens()` is called many times during a session. Avoids log spam.\n */\nlet _refreshTokenArgWarningEmitted = false;\n\nexport class PersistentSessionTokenStorage implements SessionTokenStorage {\n  getAccessToken(): string | null {\n    return getLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);\n  }\n  /**\n   * Always returns `null` — refresh tokens no longer live in localStorage\n   * (Auth-hardening Slice A Step 3). The `__wildo_refresh` `HttpOnly` cookie\n   * carries the refresh token; JS can never read it. Method kept for\n   * `SessionTokenStorage` interface conformance — `EphemeralSessionTokenStorage`\n   * still uses it for in-memory contexts.\n   */\n  getRefreshToken(): string | null {\n    return null;\n  }\n  storeTokens(accessToken: string | null, refreshToken: string | null): void {\n    accessToken\n      ? setLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN, accessToken)\n      : removeLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);\n    if (refreshToken !== null && !_refreshTokenArgWarningEmitted) {\n      _refreshTokenArgWarningEmitted = true;\n      console.warn(\n        '[wildo-auth] PersistentSessionTokenStorage.storeTokens() received a non-null refreshToken — argument is ignored. Refresh tokens now travel via the `__wildo_refresh` HttpOnly cookie (Auth-hardening Slice A).',\n      );\n    }\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.REFRESH_TOKEN);\n  }\n  getOrganizationId(): string | null {\n    return getLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);\n  }\n  setOrganizationId(orgId: string | null): void {\n    orgId\n      ? setLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID, orgId)\n      : removeLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);\n  }\n  clear(): void {\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.REFRESH_TOKEN);\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);\n  }\n}\n\nexport class EphemeralSessionTokenStorage implements SessionTokenStorage {\n  private _accessToken: string | null = null;\n  private _refreshToken: string | null = null;\n  private _organizationId: string | null = null;\n\n  getAccessToken(): string | null { return this._accessToken; }\n  getRefreshToken(): string | null { return this._refreshToken; }\n  storeTokens(accessToken: string | null, refreshToken: string | null): void {\n    this._accessToken = accessToken;\n    this._refreshToken = refreshToken;\n  }\n  getOrganizationId(): string | null { return this._organizationId; }\n  setOrganizationId(orgId: string | null): void { this._organizationId = orgId; }\n  clear(): void {\n    this._accessToken = null;\n    this._refreshToken = null;\n    this._organizationId = null;\n  }\n}\n"]}
+{"version":3,"file":"session-token-storage.frontend.service.js","sourceRoot":"","sources":["../../../../src/core/security/session-token-storage.frontend.service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,iEAAiE,CAAC;AAazE;;;GAGG;AACH,IAAI,8BAA8B,GAAG,KAAK,CAAC;AAE3C,MAAM,OAAO,6BAA6B;IACxC,cAAc;QACZ,OAAO,mBAAmB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAC3D,CAAC;IACD;;;;;;OAMG;IACH,eAAe;QACb,OAAO,IAAI,CAAC;IACd,CAAC;IACD,WAAW,CAAC,WAA0B,EAAE,YAA2B;QACjE,WAAW;YACT,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,SAAS,EAAE,WAAW,CAAC;YAChE,CAAC,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,YAAY,KAAK,IAAI,IAAI,CAAC,8BAA8B,EAAE,CAAC;YAC7D,8BAA8B,GAAG,IAAI,CAAC;YACtC,OAAO,CAAC,IAAI,CACV,gNAAgN,CACjN,CAAC;QACJ,CAAC;QACD,sBAAsB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IAC3D,CAAC;IACD,iBAAiB;QACf,OAAO,mBAAmB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACzE,CAAC;IACD,iBAAiB,CAAC,KAAoB;QACpC,KAAK;YACH,CAAC,CAAC,mBAAmB,CAAC,kBAAkB,CAAC,uBAAuB,EAAE,KAAK,CAAC;YACxE,CAAC,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACzE,CAAC;IACD,KAAK;QACH,sBAAsB,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;QACrD,sBAAsB,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;QACzD,sBAAsB,CAAC,kBAAkB,CAAC,uBAAuB,CAAC,CAAC;IACrE,CAAC;CACF;AAED,MAAM,OAAO,4BAA4B;IAC/B,YAAY,GAAkB,IAAI,CAAC;IACnC,aAAa,GAAkB,IAAI,CAAC;IACpC,eAAe,GAAkB,IAAI,CAAC;IAE9C,cAAc,KAAoB,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7D,eAAe,KAAoB,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IAC/D,WAAW,CAAC,WAA0B,EAAE,YAA2B;QACjE,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;QAChC,IAAI,CAAC,aAAa,GAAG,YAAY,CAAC;IACpC,CAAC;IACD,iBAAiB,KAAoB,OAAO,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC;IACnE,iBAAiB,CAAC,KAAoB,IAAU,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC,CAAC,CAAC;IAC/E,KAAK;QACH,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;IAC9B,CAAC;CACF","sourcesContent":["/**\n * W7.3b: Session Token Storage — Strategy pattern for token persistence.\n *\n * PersistentSessionTokenStorage: Delegates to localStorage (survives tab close).\n * EphemeralSessionTokenStorage: In-memory only (dies with the tab/component instance).\n *\n * Auth-hardening Slice A Step 3 (2026-04-13) — `PersistentSessionTokenStorage`\n * NO LONGER persists the refresh token in localStorage. The refresh token now\n * travels via the `__wildo_refresh` `HttpOnly` cookie (see\n * `auth-controller.utils.ts` and `authentication-controller.backend.service.ts`).\n * The cookie is invisible to JS, which closes the XSS exfiltration surface\n * that ANY localStorage-backed refresh token inherently has.\n *\n * The `storeTokens()` signature still accepts a `refreshToken` parameter for\n * source-compat with `EphemeralSessionTokenStorage` (which keeps the in-memory\n * field for one-off / test contexts), but `PersistentSessionTokenStorage`\n * silently ignores the argument and emits a one-line `console.warn` if a\n * non-null value is passed during the transition window. The existing\n * `removeLocalStorageItem(REFRESH_TOKEN)` is kept on every `storeTokens()`\n * AND `clear()` invocation so any leftover localStorage value from a\n * pre-migration session is wiped on the user's next interaction.\n */\n\nimport {\n  LOCAL_STORAGE_KEYS,\n  getLocalStorageItem,\n  setLocalStorageItem,\n  removeLocalStorageItem,\n} from '~wildo-frontend-lib/core/commons/local-storage.frontend.schemas';\n\nexport interface SessionTokenStorage {\n  getAccessToken(): string | null;\n  getRefreshToken(): string | null;\n  storeTokens(accessToken: string | null, refreshToken: string | null): void;\n\n  getOrganizationId(): string | null;\n  setOrganizationId(orgId: string | null): void;\n\n  clear(): void;\n}\n\n/**\n * Module-scoped flag — emit the deprecation warning ONCE per page load even if\n * `storeTokens()` is called many times during a session. Avoids log spam.\n */\nlet _refreshTokenArgWarningEmitted = false;\n\nexport class PersistentSessionTokenStorage implements SessionTokenStorage {\n  getAccessToken(): string | null {\n    return getLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);\n  }\n  /**\n   * Always returns `null` — refresh tokens no longer live in localStorage\n   * (Auth-hardening Slice A Step 3). The `__wildo_refresh` `HttpOnly` cookie\n   * carries the refresh token; JS can never read it. Method kept for\n   * `SessionTokenStorage` interface conformance — `EphemeralSessionTokenStorage`\n   * still uses it for in-memory contexts.\n   */\n  getRefreshToken(): string | null {\n    return null;\n  }\n  storeTokens(accessToken: string | null, refreshToken: string | null): void {\n    accessToken\n      ? setLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN, accessToken)\n      : removeLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);\n    if (refreshToken !== null && !_refreshTokenArgWarningEmitted) {\n      _refreshTokenArgWarningEmitted = true;\n      console.warn(\n        '[wildo-auth] PersistentSessionTokenStorage.storeTokens() received a non-null refreshToken — argument is ignored. Refresh tokens now travel via the `__wildo_refresh` HttpOnly cookie (Auth-hardening Slice A).',\n      );\n    }\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.REFRESH_TOKEN);\n  }\n  getOrganizationId(): string | null {\n    return getLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);\n  }\n  setOrganizationId(orgId: string | null): void {\n    orgId\n      ? setLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID, orgId)\n      : removeLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);\n  }\n  clear(): void {\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.JWT_TOKEN);\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.REFRESH_TOKEN);\n    removeLocalStorageItem(LOCAL_STORAGE_KEYS.CURRENT_ORGANIZATION_ID);\n  }\n}\n\nexport class EphemeralSessionTokenStorage implements SessionTokenStorage {\n  private _accessToken: string | null = null;\n  private _refreshToken: string | null = null;\n  private _organizationId: string | null = null;\n\n  getAccessToken(): string | null { return this._accessToken; }\n  getRefreshToken(): string | null { return this._refreshToken; }\n  storeTokens(accessToken: string | null, refreshToken: string | null): void {\n    this._accessToken = accessToken;\n    this._refreshToken = refreshToken;\n  }\n  getOrganizationId(): string | null { return this._organizationId; }\n  setOrganizationId(orgId: string | null): void { this._organizationId = orgId; }\n  clear(): void {\n    this._accessToken = null;\n    this._refreshToken = null;\n    this._organizationId = null;\n  }\n}\n"]}

package/dist/esm/core/security/useAuthSession.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useAuthSession.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/useAuthSession.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAsB,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACvF;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAAO,sBAMjC,CAAC"}
+{"version":3,"file":"useAuthSession.d.ts","sourceRoot":"","sources":["../../../../src/core/security/useAuthSession.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAsB,KAAK,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACvF;;;;GAIG;AACH,eAAO,MAAM,cAAc,QAAO,sBAMjC,CAAC"}

package/dist/esm/core/security/useAuthSession.js.map

@@ -1 +1 @@
-{"version":3,"file":"useAuthSession.js","sourceRoot":"","sources":["../../../../../src/core/security/useAuthSession.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAA+B,MAAM,sBAAsB,CAAC;AACvF;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAA2B,EAAE;IACzD,MAAM,OAAO,GAAG,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC","sourcesContent":["/**\n * useAuthSession Hook\n * \n * Separated from AuthSessionContext.tsx for React Fast Refresh compatibility.\n */\n\nimport { useContext } from 'react';\nimport { AuthSessionContext, type AuthSessionContextType } from './AuthSessionContext';\n/**\n * Hook to access the Auth Session context\n * @returns AuthSessionContextType with auth state and authentication functions\n * @throws Error if used outside of AuthSessionProvider\n */\nexport const useAuthSession = (): AuthSessionContextType => {\n  const context = useContext(AuthSessionContext);\n  if (!context) {\n    throw new Error('useAuthSession must be used within an AuthSessionProvider');\n  }\n  return context;\n};\n"]}
+{"version":3,"file":"useAuthSession.js","sourceRoot":"","sources":["../../../../src/core/security/useAuthSession.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAA+B,MAAM,sBAAsB,CAAC;AACvF;;;;GAIG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,GAA2B,EAAE;IACzD,MAAM,OAAO,GAAG,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAC/C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC","sourcesContent":["/**\n * useAuthSession Hook\n * \n * Separated from AuthSessionContext.tsx for React Fast Refresh compatibility.\n */\n\nimport { useContext } from 'react';\nimport { AuthSessionContext, type AuthSessionContextType } from './AuthSessionContext';\n/**\n * Hook to access the Auth Session context\n * @returns AuthSessionContextType with auth state and authentication functions\n * @throws Error if used outside of AuthSessionProvider\n */\nexport const useAuthSession = (): AuthSessionContextType => {\n  const context = useContext(AuthSessionContext);\n  if (!context) {\n    throw new Error('useAuthSession must be used within an AuthSessionProvider');\n  }\n  return context;\n};\n"]}

package/dist/esm/core/security/useResolvedAuthConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useResolvedAuthConfig.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/useResolvedAuthConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,OAAO,KAAK,EACV,4BAA4B,EAC5B,kBAAkB,EAElB,mBAAmB,EAEpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,UAAU,EAGV,gBAAgB,EAEjB,MAAM,uBAAuB,CAAC;AAqD/B,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,gBAAgB,CAAC;IACvB,cAAc,EAAE,UAAU,EAAE,CAAC;IAC7B,iCAAiC,EAAE,OAAO,CAAC;IAC3C,2BAA2B,EAAE,OAAO,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACxC,UAAU,EAAE,4BAA4B,CAAC;IACzC,cAAc,EAAE,mBAAmB,CAAC;IACpC,kBAAkB,EAAE,0BAA0B,CAAC;CAChD;AAED,wBAAgB,qBAAqB,IAAI,kBAAkB,CAuD1D"}
+{"version":3,"file":"useResolvedAuthConfig.d.ts","sourceRoot":"","sources":["../../../../src/core/security/useResolvedAuthConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,OAAO,KAAK,EACV,4BAA4B,EAC5B,kBAAkB,EAElB,mBAAmB,EAEpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EACL,UAAU,EAGV,gBAAgB,EAEjB,MAAM,uBAAuB,CAAC;AAqD/B,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,gBAAgB,CAAC;IACvB,cAAc,EAAE,UAAU,EAAE,CAAC;IAC7B,iCAAiC,EAAE,OAAO,CAAC;IAC3C,2BAA2B,EAAE,OAAO,CAAC;CACtC;AAED,MAAM,WAAW,kBAAkB;IACjC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACxC,UAAU,EAAE,4BAA4B,CAAC;IACzC,cAAc,EAAE,mBAAmB,CAAC;IACpC,kBAAkB,EAAE,0BAA0B,CAAC;CAChD;AAED,wBAAgB,qBAAqB,IAAI,kBAAkB,CAuD1D"}

package/dist/esm/core/security/useResolvedAuthConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"useResolvedAuthConfig.js","sourceRoot":"","sources":["../../../../../src/core/security/useResolvedAuthConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,uEAAuE,CAAC;AAClG,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAQpD,OAAO,EAEL,8BAA8B,EAC9B,wBAAwB,EACxB,gBAAgB,EAChB,gCAAgC,GACjC,MAAM,uBAAuB,CAAC;AAE/B;;;;GAIG;AACH,SAAS,sCAAsC,CAC7C,mBAA2B,EAC3B,gBAAoD;IAEpD,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;IACpE,IAAI,CAAC,qBAAqB,EAAE,eAAe;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAO,CAAC,YAAY,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACnD,CAAC;AAED,SAAS,8CAA8C,CACrD,mBAA2B,EAC3B,sBAAqD,EACrD,gBAAoD;IAEpD,IAAI,CAAC,sBAAsB,EAAE,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,eAAe,CAAC;IACrF,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,sBAAsB,EAAE,CAAC;QAC9C,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,uBAAuB,GAAwB;IACnD,SAAS,EAAE,CAAC;IACZ,SAAS,EAAE,GAAG;IACd,gBAAgB,EAAE,IAAI;IACtB,gBAAgB,EAAE,IAAI;IACtB,cAAc,EAAE,IAAI;IACpB,mBAAmB,EAAE,KAAK;IAC1B,UAAU,EAAE,CAAC;CACd,CAAC;AAiBF,MAAM,UAAU,qBAAqB;IACnC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,mBAAmB,GAAG,SAAS,CAAC,qBAAqB,EAAE,CAAC,mBAAmB,CAAC;IAElF,OAAO,OAAO,CAAC,GAAG,EAAE;QAClB,MAAM,uBAAuB,GAAG,sCAAsC,CAAC,mBAAmB,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACxH,MAAM,qBAAqB,GAAG,8CAA8C,CAC1E,mBAAmB,EACnB,QAAQ,EAAE,IAAI,EAAE,SAAS,EACzB,SAAS,CAAC,gBAAgB,CAC3B,CAAC;QACF,MAAM,gBAAgB,GAAG,qBAAqB,IAAI,uBAAuB,CAAC;QAC1E,MAAM,WAAW,GAAG,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtF,MAAM,YAAY,GAA8B,WAAW,EAAE,IAAI,IAAI,IAAI,CAAC;QAE1E,MAAM,cAAc,GAAwB,YAAY,EAAE,cAAc,IAAI,uBAAuB,CAAC;QAEpG,MAAM,KAAK,GAAmC,YAAY,EAAE,YAAY,CAAC;QACzE,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACrE,MAAM,iCAAiC,GAAG,OAAO,CAC/C,gBAAgB;eACb,SAAS,CAAC,gBAAgB,EAAE,CAAC,mBAAmB,CAAC;gBAClD,EAAE,eAAe,EAAE,CAAC,gBAAgB,CAAC,EAAE,QAAQ,KAAK,IAAI,CAC3D,CAAC;QAEF,MAAM,kBAAkB,GAA+B,kBAAkB,CAAC,OAAO;YAC/E,CAAC,CAAC;gBACE,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,IAAI;gBAClC,cAAc,EAAE,kBAAkB,CAAC,IAAI,CAAC,cAAc;gBACtD,iCAAiC;gBACjC,2BAA2B,EACzB,iCAAiC;uBAC9B,gCAAgC,CACjC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAC5B,8BAA8B,CAAC,mBAAmB,CACnD;aACJ;YACH,CAAC,CAAC;gBACE,qFAAqF;gBACrF,qFAAqF;gBACrF,IAAI,EAAE,gBAAgB,CAAC,QAAQ;gBAC/B,cAAc,EAAE,EAAE;gBAClB,iCAAiC,EAAE,KAAK;gBACxC,2BAA2B,EAAE,KAAK;aACnC,CAAC;QAEN,OAAO;YACL,gBAAgB;YAChB,YAAY;YACZ,UAAU;YACV,cAAc;YACd,kBAAkB;SACnB,CAAC;IACJ,CAAC,EAAE,CAAC,mBAAmB,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;AAC9E,CAAC","sourcesContent":["/**\n * W6.5: Resolves the effective auth config for the current frontend service.\n *\n * Resolution chain:\n * 1. If the user is authenticated, prefer their actual user type that is allowed on the\n *    current frontend service\n * 2. Otherwise use envLoader.frontendServiceName → frontendServices[frontendServiceName].usersManagement → default user type key\n * 3. userTypes[resolvedType].auth → per-user-type auth policy (UserTypeAuthPolicy)\n * 4. Falls back to hardcoded restrictive defaults when user type cannot be resolved\n *\n * Public social OAuth2 provider enumeration and passkeyConfig are global auth\n * concerns — always resolved from the shared auth payload.\n * Auth methods, MFA, registration, password policy come from the resolved user type.\n */\n\nimport { useContext, useMemo } from 'react';\nimport { useApplication } from '~wildo-frontend-lib/core/runtime/useApplication';\nimport { envLoader } from '~wildo-frontend-lib/core/runtime/env-variable-loader.frontend.service';\nimport { UserOrgsContext } from './UserOrgsContext';\nimport type {\n  AppConfiguration_Shared_Auth,\n  UserTypeAuthPolicy,\n  FrontendServicesConfig,\n  PasswordPolicyRules,\n  RegistrationConfig,\n} from '@wildo-ai/saas-models';\nimport {\n  AuthMethod,\n  RegistrationAcquisitionChannel,\n  RegistrationConfigSchema,\n  RegistrationMode,\n  isRegistrationAcquisitionAllowed,\n} from '@wildo-ai/saas-models';\n\n/**\n * Resolves the default user type key from frontendServices config.\n * Mirrors backend AppConfigurationBackendService.resolveUserTypeFromFrontendServiceName():\n * isDefault entry first, then first entry.\n */\nfunction resolveUserTypeFromFrontendServiceName(\n  frontendServiceName: string,\n  frontendServices: FrontendServicesConfig | undefined,\n): string | null {\n  if (!frontendServices) return null;\n  const frontendServiceConfig = frontendServices[frontendServiceName];\n  if (!frontendServiceConfig?.usersManagement) return null;\n  const entries = Object.entries(frontendServiceConfig.usersManagement);\n  const defaultEntry = entries.find(([, v]) => v.isDefault);\n  const firstEntry = entries[0];\n  return (defaultEntry ?? firstEntry)?.[0] ?? null;\n}\n\nfunction resolveAuthenticatedUserTypeForFrontendService(\n  frontendServiceName: string,\n  authenticatedUserTypes: readonly string[] | undefined,\n  frontendServices: FrontendServicesConfig | undefined,\n): string | null {\n  if (!authenticatedUserTypes?.length || !frontendServices) {\n    return null;\n  }\n\n  const allowedUserManagement = frontendServices[frontendServiceName]?.usersManagement;\n  if (!allowedUserManagement) {\n    return null;\n  }\n\n  for (const userType of authenticatedUserTypes) {\n    if (allowedUserManagement[userType]) {\n      return userType;\n    }\n  }\n\n  return null;\n}\n\nconst DEFAULT_PASSWORD_POLICY: PasswordPolicyRules = {\n  minLength: 8,\n  maxLength: 128,\n  requireUppercase: true,\n  requireLowercase: true,\n  requireNumbers: true,\n  requireSpecialChars: false,\n  expiryDays: 0,\n};\n\nexport interface ResolvedRegistrationConfig {\n  mode: RegistrationMode;\n  allowedMethods: AuthMethod[];\n  frontendServiceAllowsRegistration: boolean;\n  publicRegistrationAvailable: boolean;\n}\n\nexport interface ResolvedAuthConfig {\n  resolvedUserType: string | null;\n  userTypeAuth: UserTypeAuthPolicy | null;\n  globalAuth: AppConfiguration_Shared_Auth;\n  passwordPolicy: PasswordPolicyRules;\n  registrationConfig: ResolvedRegistrationConfig;\n}\n\nexport function useResolvedAuthConfig(): ResolvedAuthConfig {\n  const { auth: globalAuth, appConfig } = useApplication();\n  const userOrgs = useContext(UserOrgsContext);\n  const frontendServiceName = envLoader.loadEnvironmentConfig().frontendServiceName;\n\n  return useMemo(() => {\n    const defaultFrontendUserType = resolveUserTypeFromFrontendServiceName(frontendServiceName, appConfig.frontendServices);\n    const authenticatedUserType = resolveAuthenticatedUserTypeForFrontendService(\n      frontendServiceName,\n      userOrgs?.user?.userTypes,\n      appConfig.frontendServices,\n    );\n    const resolvedUserType = authenticatedUserType ?? defaultFrontendUserType;\n    const userTypeDef = resolvedUserType ? appConfig.userTypes?.[resolvedUserType] : null;\n    const userTypeAuth: UserTypeAuthPolicy | null = userTypeDef?.auth ?? null;\n\n    const passwordPolicy: PasswordPolicyRules = userTypeAuth?.passwordPolicy ?? DEFAULT_PASSWORD_POLICY;\n\n    const utReg: RegistrationConfig | undefined = userTypeAuth?.registration;\n    const parsedRegistration = RegistrationConfigSchema.safeParse(utReg);\n    const frontendServiceAllowsRegistration = Boolean(\n      resolvedUserType\n      && appConfig.frontendServices?.[frontendServiceName]\n        ?.usersManagement?.[resolvedUserType]?.register === true,\n    );\n\n    const registrationConfig: ResolvedRegistrationConfig = parsedRegistration.success\n      ? {\n          mode: parsedRegistration.data.mode,\n          allowedMethods: parsedRegistration.data.allowedMethods,\n          frontendServiceAllowsRegistration,\n          publicRegistrationAvailable:\n            frontendServiceAllowsRegistration\n            && isRegistrationAcquisitionAllowed(\n              parsedRegistration.data.mode,\n              RegistrationAcquisitionChannel.PUBLIC_SELF_SERVICE,\n            ),\n        }\n      : {\n          // No resolved or parseable leaf means the backend cannot authorize the same request.\n          // Mocked/stale/unparsed client boundaries fail closed without legacy interpretation.\n          mode: RegistrationMode.DISABLED,\n          allowedMethods: [],\n          frontendServiceAllowsRegistration: false,\n          publicRegistrationAvailable: false,\n        };\n\n    return {\n      resolvedUserType,\n      userTypeAuth,\n      globalAuth,\n      passwordPolicy,\n      registrationConfig,\n    };\n  }, [frontendServiceName, appConfig, globalAuth, userOrgs?.user?.userTypes]);\n}\n"]}
+{"version":3,"file":"useResolvedAuthConfig.js","sourceRoot":"","sources":["../../../../src/core/security/useResolvedAuthConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,uEAAuE,CAAC;AAClG,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAQpD,OAAO,EAEL,8BAA8B,EAC9B,wBAAwB,EACxB,gBAAgB,EAChB,gCAAgC,GACjC,MAAM,uBAAuB,CAAC;AAE/B;;;;GAIG;AACH,SAAS,sCAAsC,CAC7C,mBAA2B,EAC3B,gBAAoD;IAEpD,IAAI,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;IACpE,IAAI,CAAC,qBAAqB,EAAE,eAAe;QAAE,OAAO,IAAI,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,CAAC,eAAe,CAAC,CAAC;IACtE,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9B,OAAO,CAAC,YAAY,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACnD,CAAC;AAED,SAAS,8CAA8C,CACrD,mBAA2B,EAC3B,sBAAqD,EACrD,gBAAoD;IAEpD,IAAI,CAAC,sBAAsB,EAAE,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,qBAAqB,GAAG,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,eAAe,CAAC;IACrF,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,MAAM,QAAQ,IAAI,sBAAsB,EAAE,CAAC;QAC9C,IAAI,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpC,OAAO,QAAQ,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,uBAAuB,GAAwB;IACnD,SAAS,EAAE,CAAC;IACZ,SAAS,EAAE,GAAG;IACd,gBAAgB,EAAE,IAAI;IACtB,gBAAgB,EAAE,IAAI;IACtB,cAAc,EAAE,IAAI;IACpB,mBAAmB,EAAE,KAAK;IAC1B,UAAU,EAAE,CAAC;CACd,CAAC;AAiBF,MAAM,UAAU,qBAAqB;IACnC,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC7C,MAAM,mBAAmB,GAAG,SAAS,CAAC,qBAAqB,EAAE,CAAC,mBAAmB,CAAC;IAElF,OAAO,OAAO,CAAC,GAAG,EAAE;QAClB,MAAM,uBAAuB,GAAG,sCAAsC,CAAC,mBAAmB,EAAE,SAAS,CAAC,gBAAgB,CAAC,CAAC;QACxH,MAAM,qBAAqB,GAAG,8CAA8C,CAC1E,mBAAmB,EACnB,QAAQ,EAAE,IAAI,EAAE,SAAS,EACzB,SAAS,CAAC,gBAAgB,CAC3B,CAAC;QACF,MAAM,gBAAgB,GAAG,qBAAqB,IAAI,uBAAuB,CAAC;QAC1E,MAAM,WAAW,GAAG,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACtF,MAAM,YAAY,GAA8B,WAAW,EAAE,IAAI,IAAI,IAAI,CAAC;QAE1E,MAAM,cAAc,GAAwB,YAAY,EAAE,cAAc,IAAI,uBAAuB,CAAC;QAEpG,MAAM,KAAK,GAAmC,YAAY,EAAE,YAAY,CAAC;QACzE,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACrE,MAAM,iCAAiC,GAAG,OAAO,CAC/C,gBAAgB;eACb,SAAS,CAAC,gBAAgB,EAAE,CAAC,mBAAmB,CAAC;gBAClD,EAAE,eAAe,EAAE,CAAC,gBAAgB,CAAC,EAAE,QAAQ,KAAK,IAAI,CAC3D,CAAC;QAEF,MAAM,kBAAkB,GAA+B,kBAAkB,CAAC,OAAO;YAC/E,CAAC,CAAC;gBACE,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,IAAI;gBAClC,cAAc,EAAE,kBAAkB,CAAC,IAAI,CAAC,cAAc;gBACtD,iCAAiC;gBACjC,2BAA2B,EACzB,iCAAiC;uBAC9B,gCAAgC,CACjC,kBAAkB,CAAC,IAAI,CAAC,IAAI,EAC5B,8BAA8B,CAAC,mBAAmB,CACnD;aACJ;YACH,CAAC,CAAC;gBACE,qFAAqF;gBACrF,qFAAqF;gBACrF,IAAI,EAAE,gBAAgB,CAAC,QAAQ;gBAC/B,cAAc,EAAE,EAAE;gBAClB,iCAAiC,EAAE,KAAK;gBACxC,2BAA2B,EAAE,KAAK;aACnC,CAAC;QAEN,OAAO;YACL,gBAAgB;YAChB,YAAY;YACZ,UAAU;YACV,cAAc;YACd,kBAAkB;SACnB,CAAC;IACJ,CAAC,EAAE,CAAC,mBAAmB,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC,CAAC;AAC9E,CAAC","sourcesContent":["/**\n * W6.5: Resolves the effective auth config for the current frontend service.\n *\n * Resolution chain:\n * 1. If the user is authenticated, prefer their actual user type that is allowed on the\n *    current frontend service\n * 2. Otherwise use envLoader.frontendServiceName → frontendServices[frontendServiceName].usersManagement → default user type key\n * 3. userTypes[resolvedType].auth → per-user-type auth policy (UserTypeAuthPolicy)\n * 4. Falls back to hardcoded restrictive defaults when user type cannot be resolved\n *\n * Public social OAuth2 provider enumeration and passkeyConfig are global auth\n * concerns — always resolved from the shared auth payload.\n * Auth methods, MFA, registration, password policy come from the resolved user type.\n */\n\nimport { useContext, useMemo } from 'react';\nimport { useApplication } from '~wildo-frontend-lib/core/runtime/useApplication';\nimport { envLoader } from '~wildo-frontend-lib/core/runtime/env-variable-loader.frontend.service';\nimport { UserOrgsContext } from './UserOrgsContext';\nimport type {\n  AppConfiguration_Shared_Auth,\n  UserTypeAuthPolicy,\n  FrontendServicesConfig,\n  PasswordPolicyRules,\n  RegistrationConfig,\n} from '@wildo-ai/saas-models';\nimport {\n  AuthMethod,\n  RegistrationAcquisitionChannel,\n  RegistrationConfigSchema,\n  RegistrationMode,\n  isRegistrationAcquisitionAllowed,\n} from '@wildo-ai/saas-models';\n\n/**\n * Resolves the default user type key from frontendServices config.\n * Mirrors backend AppConfigurationBackendService.resolveUserTypeFromFrontendServiceName():\n * isDefault entry first, then first entry.\n */\nfunction resolveUserTypeFromFrontendServiceName(\n  frontendServiceName: string,\n  frontendServices: FrontendServicesConfig | undefined,\n): string | null {\n  if (!frontendServices) return null;\n  const frontendServiceConfig = frontendServices[frontendServiceName];\n  if (!frontendServiceConfig?.usersManagement) return null;\n  const entries = Object.entries(frontendServiceConfig.usersManagement);\n  const defaultEntry = entries.find(([, v]) => v.isDefault);\n  const firstEntry = entries[0];\n  return (defaultEntry ?? firstEntry)?.[0] ?? null;\n}\n\nfunction resolveAuthenticatedUserTypeForFrontendService(\n  frontendServiceName: string,\n  authenticatedUserTypes: readonly string[] | undefined,\n  frontendServices: FrontendServicesConfig | undefined,\n): string | null {\n  if (!authenticatedUserTypes?.length || !frontendServices) {\n    return null;\n  }\n\n  const allowedUserManagement = frontendServices[frontendServiceName]?.usersManagement;\n  if (!allowedUserManagement) {\n    return null;\n  }\n\n  for (const userType of authenticatedUserTypes) {\n    if (allowedUserManagement[userType]) {\n      return userType;\n    }\n  }\n\n  return null;\n}\n\nconst DEFAULT_PASSWORD_POLICY: PasswordPolicyRules = {\n  minLength: 8,\n  maxLength: 128,\n  requireUppercase: true,\n  requireLowercase: true,\n  requireNumbers: true,\n  requireSpecialChars: false,\n  expiryDays: 0,\n};\n\nexport interface ResolvedRegistrationConfig {\n  mode: RegistrationMode;\n  allowedMethods: AuthMethod[];\n  frontendServiceAllowsRegistration: boolean;\n  publicRegistrationAvailable: boolean;\n}\n\nexport interface ResolvedAuthConfig {\n  resolvedUserType: string | null;\n  userTypeAuth: UserTypeAuthPolicy | null;\n  globalAuth: AppConfiguration_Shared_Auth;\n  passwordPolicy: PasswordPolicyRules;\n  registrationConfig: ResolvedRegistrationConfig;\n}\n\nexport function useResolvedAuthConfig(): ResolvedAuthConfig {\n  const { auth: globalAuth, appConfig } = useApplication();\n  const userOrgs = useContext(UserOrgsContext);\n  const frontendServiceName = envLoader.loadEnvironmentConfig().frontendServiceName;\n\n  return useMemo(() => {\n    const defaultFrontendUserType = resolveUserTypeFromFrontendServiceName(frontendServiceName, appConfig.frontendServices);\n    const authenticatedUserType = resolveAuthenticatedUserTypeForFrontendService(\n      frontendServiceName,\n      userOrgs?.user?.userTypes,\n      appConfig.frontendServices,\n    );\n    const resolvedUserType = authenticatedUserType ?? defaultFrontendUserType;\n    const userTypeDef = resolvedUserType ? appConfig.userTypes?.[resolvedUserType] : null;\n    const userTypeAuth: UserTypeAuthPolicy | null = userTypeDef?.auth ?? null;\n\n    const passwordPolicy: PasswordPolicyRules = userTypeAuth?.passwordPolicy ?? DEFAULT_PASSWORD_POLICY;\n\n    const utReg: RegistrationConfig | undefined = userTypeAuth?.registration;\n    const parsedRegistration = RegistrationConfigSchema.safeParse(utReg);\n    const frontendServiceAllowsRegistration = Boolean(\n      resolvedUserType\n      && appConfig.frontendServices?.[frontendServiceName]\n        ?.usersManagement?.[resolvedUserType]?.register === true,\n    );\n\n    const registrationConfig: ResolvedRegistrationConfig = parsedRegistration.success\n      ? {\n          mode: parsedRegistration.data.mode,\n          allowedMethods: parsedRegistration.data.allowedMethods,\n          frontendServiceAllowsRegistration,\n          publicRegistrationAvailable:\n            frontendServiceAllowsRegistration\n            && isRegistrationAcquisitionAllowed(\n              parsedRegistration.data.mode,\n              RegistrationAcquisitionChannel.PUBLIC_SELF_SERVICE,\n            ),\n        }\n      : {\n          // No resolved or parseable leaf means the backend cannot authorize the same request.\n          // Mocked/stale/unparsed client boundaries fail closed without legacy interpretation.\n          mode: RegistrationMode.DISABLED,\n          allowedMethods: [],\n          frontendServiceAllowsRegistration: false,\n          publicRegistrationAvailable: false,\n        };\n\n    return {\n      resolvedUserType,\n      userTypeAuth,\n      globalAuth,\n      passwordPolicy,\n      registrationConfig,\n    };\n  }, [frontendServiceName, appConfig, globalAuth, userOrgs?.user?.userTypes]);\n}\n"]}

package/dist/esm/core/security/useStepUpAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useStepUpAuth.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/useStepUpAuth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAqB,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEpF,eAAO,MAAM,aAAa,QAAO,qBAMhC,CAAC"}
+{"version":3,"file":"useStepUpAuth.d.ts","sourceRoot":"","sources":["../../../../src/core/security/useStepUpAuth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAqB,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAEpF,eAAO,MAAM,aAAa,QAAO,qBAMhC,CAAC"}

package/dist/esm/core/security/useStepUpAuth.js.map

@@ -1 +1 @@
-{"version":3,"file":"useStepUpAuth.js","sourceRoot":"","sources":["../../../../../src/core/security/useStepUpAuth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAA8B,MAAM,qBAAqB,CAAC;AAEpF,MAAM,CAAC,MAAM,aAAa,GAAG,GAA0B,EAAE;IACvD,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC","sourcesContent":["/**\n * useStepUpAuth Hook\n * \n * Separated from StepUpAuthContext.tsx for React Fast Refresh compatibility.\n */\n\nimport { useContext } from 'react';\nimport { StepUpAuthContext, type StepUpAuthContextType } from './StepUpAuthContext';\n\nexport const useStepUpAuth = (): StepUpAuthContextType => {\n  const context = useContext(StepUpAuthContext);\n  if (!context) {\n    throw new Error('useStepUpAuth must be used within a StepUpAuthProvider');\n  }\n  return context;\n};\n"]}
+{"version":3,"file":"useStepUpAuth.js","sourceRoot":"","sources":["../../../../src/core/security/useStepUpAuth.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,iBAAiB,EAA8B,MAAM,qBAAqB,CAAC;AAEpF,MAAM,CAAC,MAAM,aAAa,GAAG,GAA0B,EAAE;IACvD,MAAM,OAAO,GAAG,UAAU,CAAC,iBAAiB,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC","sourcesContent":["/**\n * useStepUpAuth Hook\n * \n * Separated from StepUpAuthContext.tsx for React Fast Refresh compatibility.\n */\n\nimport { useContext } from 'react';\nimport { StepUpAuthContext, type StepUpAuthContextType } from './StepUpAuthContext';\n\nexport const useStepUpAuth = (): StepUpAuthContextType => {\n  const context = useContext(StepUpAuthContext);\n  if (!context) {\n    throw new Error('useStepUpAuth must be used within a StepUpAuthProvider');\n  }\n  return context;\n};\n"]}

package/dist/esm/core/security/useUserOrgs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"useUserOrgs.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/useUserOrgs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAmB,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,WAAW,QAAO,mBAM9B,CAAC"}
+{"version":3,"file":"useUserOrgs.d.ts","sourceRoot":"","sources":["../../../../src/core/security/useUserOrgs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAmB,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,WAAW,QAAO,mBAM9B,CAAC"}

package/dist/esm/core/security/useUserOrgs.js.map

@@ -1 +1 @@
-{"version":3,"file":"useUserOrgs.js","sourceRoot":"","sources":["../../../../../src/core/security/useUserOrgs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,eAAe,EAA4B,MAAM,mBAAmB,CAAC;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,GAAwB,EAAE;IACnD,MAAM,OAAO,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC","sourcesContent":["/**\n * useUserOrgs Hook\n * \n * Separated from UserOrgsContext.tsx for React Fast Refresh compatibility.\n */\n\nimport { useContext } from 'react';\nimport { UserOrgsContext, type UserOrgsContextType } from './UserOrgsContext';\n\n/**\n * Hook to access the User Organizations context\n * @returns UserOrgsContextType with auth state and authentication functions\n * @throws Error if used outside of UserOrgsProvider\n */\nexport const useUserOrgs = (): UserOrgsContextType => {\n  const context = useContext(UserOrgsContext);\n  if (!context) {\n    throw new Error('useUserOrgs must be used within a UserOrgsProvider');\n  }\n  return context;\n};\n\n\n\n"]}
+{"version":3,"file":"useUserOrgs.js","sourceRoot":"","sources":["../../../../src/core/security/useUserOrgs.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AACnC,OAAO,EAAE,eAAe,EAA4B,MAAM,mBAAmB,CAAC;AAE9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,GAAwB,EAAE;IACnD,MAAM,OAAO,GAAG,UAAU,CAAC,eAAe,CAAC,CAAC;IAC5C,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC,CAAC","sourcesContent":["/**\n * useUserOrgs Hook\n * \n * Separated from UserOrgsContext.tsx for React Fast Refresh compatibility.\n */\n\nimport { useContext } from 'react';\nimport { UserOrgsContext, type UserOrgsContextType } from './UserOrgsContext';\n\n/**\n * Hook to access the User Organizations context\n * @returns UserOrgsContextType with auth state and authentication functions\n * @throws Error if used outside of UserOrgsProvider\n */\nexport const useUserOrgs = (): UserOrgsContextType => {\n  const context = useContext(UserOrgsContext);\n  if (!context) {\n    throw new Error('useUserOrgs must be used within a UserOrgsProvider');\n  }\n  return context;\n};\n\n\n\n"]}

package/dist/esm/core/ui/SurfaceErrorBoundary.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SurfaceErrorBoundary.d.ts","sourceRoot":"","sources":["../../../../../src/core/ui/SurfaceErrorBoundary.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAM1B,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B;AAED,UAAU,yBAAyB;IACjC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,qBAAa,oBAAqB,SAAQ,KAAK,CAAC,SAAS,CAAC,yBAAyB,EAAE,yBAAyB,CAAC;IAC7G,KAAK,EAAE,yBAAyB,CAG9B;IAEF,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAIjF,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,GAAG,IAAI;IAKjE,OAAO,CAAC,UAAU,CAEhB;IAEF,MAAM,IAAI,KAAK,CAAC,SAAS;CA6B1B"}
+{"version":3,"file":"SurfaceErrorBoundary.d.ts","sourceRoot":"","sources":["../../../../src/core/ui/SurfaceErrorBoundary.tsx"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAM1B,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC;CAC3B;AAED,UAAU,yBAAyB;IACjC,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,qBAAa,oBAAqB,SAAQ,KAAK,CAAC,SAAS,CAAC,yBAAyB,EAAE,yBAAyB,CAAC;IAC7G,KAAK,EAAE,yBAAyB,CAG9B;IAEF,MAAM,CAAC,wBAAwB,CAAC,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAIjF,iBAAiB,CAAC,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,GAAG,IAAI;IAKjE,OAAO,CAAC,UAAU,CAEhB;IAEF,MAAM,IAAI,KAAK,CAAC,SAAS;CA6B1B"}

package/dist/esm/core/ui/SurfaceErrorBoundary.js.map

@@ -1 +1 @@
-{"version":3,"file":"SurfaceErrorBoundary.js","sourceRoot":"","sources":["../../../../../src/core/ui/SurfaceErrorBoundary.tsx"],"names":[],"mappings":";AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,uDAAuD,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,6DAA6D,CAAC;AAEpG,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,CAAC;AAWjD;;;;;;;GAOG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK,CAAC,SAA+D;IAC7G,KAAK,GAA8B;QACjC,KAAK,EAAE,IAAI;QACX,SAAS,EAAE,IAAI;KAChB,CAAC;IAEF,MAAM,CAAC,wBAAwB,CAAC,KAAY;QAC1C,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,iBAAiB,CAAC,KAAY,EAAE,SAA0B;QACxD,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACtC,CAAC;IAEO,UAAU,GAAG,GAAS,EAAE;QAC9B,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC;IAEF,MAAM;QACJ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC7B,CAAC;QAED,OAAO,CACL,KAAC,YAAY,IACX,OAAO,EAAC,OAAO,EACf,KAAK,EAAC,qBAAqB,EAC3B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,6BAA6B,EAClE,OAAO,EAAE;gBACP;oBACE,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,IAAI,CAAC,UAAU;oBACxB,OAAO,EAAE,SAAS;iBACnB;aACF,EACD,WAAW,QACX,YAAY,EAAC,eAAe,EAC5B,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;gBACtC;oBACE,KAAK,EAAE,iBAAiB;oBACxB,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,cAAc,IAAI,EAAE;oBAClD,OAAO,EAAE,OAAO;iBACjB;aACF,CAAC,CAAC,CAAC,SAAS,GACb,CACH,CAAC;IACJ,CAAC;CACF","sourcesContent":["import React from 'react';\nimport { ErrorDisplay } from '~wildo-frontend-lib/components/feedback/error-display';\nimport { LoggerFrontendService } from '~wildo-frontend-lib/core/monitoring/logger.frontend.service';\n\nconst logger = LoggerFrontendService.getLogger();\n\nexport interface SurfaceErrorBoundaryProps {\n  children: React.ReactNode;\n}\n\ninterface SurfaceErrorBoundaryState {\n  error: Error | null;\n  errorInfo: React.ErrorInfo | null;\n}\n\n/**\n * Surface-scoped crash isolation for `policy.interactiveState.errorBoundary`.\n *\n * This boundary intentionally avoids router/navigation recovery assumptions:\n * a surface can be rendered inside dialogs, menus, sidebars, or tests where\n * route-level recovery is not available. Route/app boundaries remain\n * responsible for full-page recovery.\n */\nexport class SurfaceErrorBoundary extends React.Component<SurfaceErrorBoundaryProps, SurfaceErrorBoundaryState> {\n  state: SurfaceErrorBoundaryState = {\n    error: null,\n    errorInfo: null,\n  };\n\n  static getDerivedStateFromError(error: Error): Partial<SurfaceErrorBoundaryState> {\n    return { error };\n  }\n\n  componentDidCatch(error: Error, errorInfo: React.ErrorInfo): void {\n    logger.error('[SurfaceErrorBoundary] Surface child crashed', { error, errorInfo });\n    this.setState({ error, errorInfo });\n  }\n\n  private resetError = (): void => {\n    this.setState({ error: null, errorInfo: null });\n  };\n\n  render(): React.ReactNode {\n    if (!this.state.error) {\n      return this.props.children;\n    }\n\n    return (\n      <ErrorDisplay\n        variant=\"error\"\n        title=\"Surface unavailable\"\n        message={this.state.error.message || 'A surface failed to render.'}\n        actions={[\n          {\n            label: 'Try again',\n            onClick: this.resetError,\n            variant: 'primary',\n          },\n        ]}\n        showDevInfo\n        devInfoTitle=\"Surface error\"\n        devInfoSections={this.state.errorInfo ? [\n          {\n            label: 'Component stack',\n            content: this.state.errorInfo.componentStack ?? '',\n            variant: 'error',\n          },\n        ] : undefined}\n      />\n    );\n  }\n}\n"]}
+{"version":3,"file":"SurfaceErrorBoundary.js","sourceRoot":"","sources":["../../../../src/core/ui/SurfaceErrorBoundary.tsx"],"names":[],"mappings":";AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,YAAY,EAAE,MAAM,uDAAuD,CAAC;AACrF,OAAO,EAAE,qBAAqB,EAAE,MAAM,6DAA6D,CAAC;AAEpG,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,EAAE,CAAC;AAWjD;;;;;;;GAOG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK,CAAC,SAA+D;IAC7G,KAAK,GAA8B;QACjC,KAAK,EAAE,IAAI;QACX,SAAS,EAAE,IAAI;KAChB,CAAC;IAEF,MAAM,CAAC,wBAAwB,CAAC,KAAY;QAC1C,OAAO,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,iBAAiB,CAAC,KAAY,EAAE,SAA0B;QACxD,MAAM,CAAC,KAAK,CAAC,8CAA8C,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACtC,CAAC;IAEO,UAAU,GAAG,GAAS,EAAE;QAC9B,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC;IAEF,MAAM;QACJ,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC7B,CAAC;QAED,OAAO,CACL,KAAC,YAAY,IACX,OAAO,EAAC,OAAO,EACf,KAAK,EAAC,qBAAqB,EAC3B,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,IAAI,6BAA6B,EAClE,OAAO,EAAE;gBACP;oBACE,KAAK,EAAE,WAAW;oBAClB,OAAO,EAAE,IAAI,CAAC,UAAU;oBACxB,OAAO,EAAE,SAAS;iBACnB;aACF,EACD,WAAW,QACX,YAAY,EAAC,eAAe,EAC5B,eAAe,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;gBACtC;oBACE,KAAK,EAAE,iBAAiB;oBACxB,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,cAAc,IAAI,EAAE;oBAClD,OAAO,EAAE,OAAO;iBACjB;aACF,CAAC,CAAC,CAAC,SAAS,GACb,CACH,CAAC;IACJ,CAAC;CACF","sourcesContent":["import React from 'react';\nimport { ErrorDisplay } from '~wildo-frontend-lib/components/feedback/error-display';\nimport { LoggerFrontendService } from '~wildo-frontend-lib/core/monitoring/logger.frontend.service';\n\nconst logger = LoggerFrontendService.getLogger();\n\nexport interface SurfaceErrorBoundaryProps {\n  children: React.ReactNode;\n}\n\ninterface SurfaceErrorBoundaryState {\n  error: Error | null;\n  errorInfo: React.ErrorInfo | null;\n}\n\n/**\n * Surface-scoped crash isolation for `policy.interactiveState.errorBoundary`.\n *\n * This boundary intentionally avoids router/navigation recovery assumptions:\n * a surface can be rendered inside dialogs, menus, sidebars, or tests where\n * route-level recovery is not available. Route/app boundaries remain\n * responsible for full-page recovery.\n */\nexport class SurfaceErrorBoundary extends React.Component<SurfaceErrorBoundaryProps, SurfaceErrorBoundaryState> {\n  state: SurfaceErrorBoundaryState = {\n    error: null,\n    errorInfo: null,\n  };\n\n  static getDerivedStateFromError(error: Error): Partial<SurfaceErrorBoundaryState> {\n    return { error };\n  }\n\n  componentDidCatch(error: Error, errorInfo: React.ErrorInfo): void {\n    logger.error('[SurfaceErrorBoundary] Surface child crashed', { error, errorInfo });\n    this.setState({ error, errorInfo });\n  }\n\n  private resetError = (): void => {\n    this.setState({ error: null, errorInfo: null });\n  };\n\n  render(): React.ReactNode {\n    if (!this.state.error) {\n      return this.props.children;\n    }\n\n    return (\n      <ErrorDisplay\n        variant=\"error\"\n        title=\"Surface unavailable\"\n        message={this.state.error.message || 'A surface failed to render.'}\n        actions={[\n          {\n            label: 'Try again',\n            onClick: this.resetError,\n            variant: 'primary',\n          },\n        ]}\n        showDevInfo\n        devInfoTitle=\"Surface error\"\n        devInfoSections={this.state.errorInfo ? [\n          {\n            label: 'Component stack',\n            content: this.state.errorInfo.componentStack ?? '',\n            variant: 'error',\n          },\n        ] : undefined}\n      />\n    );\n  }\n}\n"]}

package/dist/esm/core/ui/SurfacePolicyContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SurfacePolicyContext.d.ts","sourceRoot":"","sources":["../../../../../src/core/ui/SurfacePolicyContext.tsx"],"names":[],"mappings":"AACA,OAAO,EAEL,cAAc,EACd,KAAK,wBAAwB,EAC7B,KAAK,aAAa,EACnB,MAAM,qCAAqC,CAAC;AAK7C,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,aAAa,CAAC;IACtB;;;;;;OAMG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAC5B,+EAA+E;IAC/E,eAAe,EAAE,OAAO,CAAC;IACzB,4BAA4B,EAAE,cAAc,GAAG,IAAI,CAAC;IACpD,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IACrD,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CACxD;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACnE,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACrE;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,cAAc,CAAC;IACxB,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B;AAED,eAAO,MAAM,oBAAoB,oDAAwD,CAAC;AAmO1F;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,gBAAgB,EAAE,aAAa,EAC/B,YAAY,EAAE,wBAAwB,GAAG,SAAS,EAClD,iBAAiB,EAAE,wBAAwB,GAAG,SAAS,EACvD,gBAAgB,EAAE,wBAAwB,GAAG,SAAS,EACtD,OAAO,EAAE,yBAAyB,GACjC,aAAa,CAwBf;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,aAAa,EACrB,aAAa,EAAE,yBAAyB,GAAG,IAAI,EAC/C,kBAAkB,CAAC,EAAE,IAAI,CAAC,yBAAyB,EAAE,UAAU,GAAG,kBAAkB,GAAG,oBAAoB,CAAC,GAC3G,yBAAyB,CAiB3B;AAED,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,cAAoC,GAAG,aAAa,CAE1F;AAED,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,IAAI,CAEzD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C"}
+{"version":3,"file":"SurfacePolicyContext.d.ts","sourceRoot":"","sources":["../../../../src/core/ui/SurfacePolicyContext.tsx"],"names":[],"mappings":"AACA,OAAO,EAEL,cAAc,EACd,KAAK,wBAAwB,EAC7B,KAAK,aAAa,EACnB,MAAM,qCAAqC,CAAC;AAK7C,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,cAAc,CAAC;IACxB,MAAM,EAAE,aAAa,CAAC;IACtB;;;;;;OAMG;IACH,kBAAkB,EAAE,OAAO,CAAC;IAC5B,+EAA+E;IAC/E,eAAe,EAAE,OAAO,CAAC;IACzB,4BAA4B,EAAE,cAAc,GAAG,IAAI,CAAC;IACpD,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;IACrD,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC,GAAG,SAAS,CAAC;CACxD;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACnE,KAAK,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;CACrE;AAED,MAAM,WAAW,yBAAyB;IACxC,OAAO,EAAE,cAAc,CAAC;IACxB,YAAY,CAAC,EAAE,aAAa,CAAC;IAC7B,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B;AAED,eAAO,MAAM,oBAAoB,oDAAwD,CAAC;AAmO1F;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAChC,gBAAgB,EAAE,aAAa,EAC/B,YAAY,EAAE,wBAAwB,GAAG,SAAS,EAClD,iBAAiB,EAAE,wBAAwB,GAAG,SAAS,EACvD,gBAAgB,EAAE,wBAAwB,GAAG,SAAS,EACtD,OAAO,EAAE,yBAAyB,GACjC,aAAa,CAwBf;AAED,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,aAAa,EACrB,aAAa,EAAE,yBAAyB,GAAG,IAAI,EAC/C,kBAAkB,CAAC,EAAE,IAAI,CAAC,yBAAyB,EAAE,UAAU,GAAG,kBAAkB,GAAG,oBAAoB,CAAC,GAC3G,yBAAyB,CAiB3B;AAED,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,cAAoC,GAAG,aAAa,CAE1F;AAED,wBAAgB,iBAAiB,IAAI,cAAc,GAAG,IAAI,CAEzD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C"}

package/dist/esm/core/ui/SurfacePolicyContext.js.map

@@ -1 +1 @@
-{"version":3,"file":"SurfacePolicyContext.js","sourceRoot":"","sources":["../../../../../src/core/ui/SurfacePolicyContext.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAClD,OAAO,EACL,kCAAkC,EAClC,cAAc,GAGf,MAAM,qCAAqC,CAAC;AAmC7C,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,CAAmC,IAAI,CAAC,CAAC;AAE1F,MAAM,uBAAuB,GAAmC;IAC9D,aAAa;IACb,SAAS;IACT,SAAS;IACT,YAAY;IACZ,kBAAkB;IAClB,MAAM;IACN,UAAU;IACV,UAAU;IACV,UAAU;IACV,aAAa;CACd,CAAC;AAEF,MAAM,0BAA0B,GAAwB,IAAI,GAAG,CAAC;IAC9D,wBAAwB;IACxB,sBAAsB;IACtB,0BAA0B;IAC1B,+BAA+B;IAC/B,4BAA4B;IAC5B,6BAA6B;IAC7B,+BAA+B;IAC/B,iCAAiC;IACjC,gCAAgC;IAChC,0BAA0B;IAC1B,2BAA2B;IAC3B,0BAA0B;IAC1B,kCAAkC;CACnC,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAG,IAAI,GAAG,EAAU,CAAC;AACrD,MAAM,4BAA4B,GAAG,IAAI,GAAG,EAAU,CAAC;AACvD,MAAM,SAAS,GAAG,IAAI,OAAO,EAAkB,CAAC;AAChD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAC;AACpD,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC,IAAI,YAAY,GAAG,CAAC,CAAC;AAErB,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,EAAE,GAAG,YAAY,CAAC;QAClB,YAAY,IAAI,CAAC,CAAC;QAClB,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,OAAO,IAAI,EAAE,EAAE,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CACvB,OAAuB,EACvB,gBAA+B,EAC/B,YAAkD,EAClD,iBAAuD,EACvD,gBAAsD,EACtD,YAAuC;IAEvC,OAAO;QACL,OAAO;QACP,UAAU,CAAC,gBAAgB,CAAC;QAC5B,UAAU,CAAC,YAAY,CAAC;QACxB,UAAU,CAAC,iBAAiB,CAAC;QAC7B,UAAU,CAAC,gBAAgB,CAAC;QAC5B,UAAU,CAAC,YAAY,CAAC;KACzB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CACvB,IAAmB,EACnB,QAA8C;IAE9C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAkB,EAAE,GAAG,IAAI,EAAE,CAAC;IAE1C,KAAK,MAAM,MAAM,IAAI,uBAAuB,EAAE,CAAC;QAC7C,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,CAAC,MAAM,CAAC,GAAG;gBACf,GAAG,IAAI,CAAC,MAAM,CAAC;gBACf,GAAG,cAAc;gBACjB,GAAG,CAAC,MAAM,KAAK,aAAa,IAAI,SAAS,IAAI,cAAc;oBACzD,CAAC,CAAC,uBAAuB,CAAC,IAAI,EAAE,cAAc,CAAC;oBAC/C,CAAC,CAAC,EAAE,CAAC;aACwB,CAAC;QACpC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,uBAAuB,CAC9B,IAAmB,EACnB,cAAoE;IAEpE,IAAI,cAAc,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,OAAO;QACL,OAAO,EAAE;YACP,GAAG,IAAI,CAAC,WAAW,EAAE,OAAO;YAC5B,GAAG,cAAc,CAAC,OAAO;SAC1B;KACF,CAAC;AACJ,CAAC;AAED,SAAS,+BAA+B,CAAC,MAA2B,EAAE,IAAuB;IAC3F,OAAO,0BAA0B,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,4BAA4B,CACnC,MAAqB,EACrB,gBAA+B,EAC/B,OAAkC;IAElC,MAAM,QAAQ,GAAkB,EAAE,GAAG,MAAM,EAAE,CAAC;IAE9C,KAAK,MAAM,MAAM,IAAI,uBAAuB,EAAE,CAAC;QAC7C,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,SAAS;QACX,CAAC;QAED,MAAM,cAAc,GAAG,EAAE,GAAG,YAAY,EAA6B,CAAC;QACtE,MAAM,eAAe,GAAG,gBAAgB,CAAC,MAAM,CAAwC,CAAC;QACxF,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,MAAM,CAAwC,CAAC;QAE3F,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAuC,CAAC,EAAE,CAAC;YACpF,IAAI,MAAM,KAAK,aAAa,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACzF,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC;gBAC/D,MAAM,eAAe,GAAG,EAAE,GAAI,KAAiC,EAAE,CAAC;gBAElE,KAAK,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;oBACpE,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;wBAC1B,SAAS;oBACX,CAAC;oBAED,MAAM,UAAU,GAAG,QAAmF,CAAC;oBACvG,MAAM,cAAc,GAAG,gBAAgB,EAAE,CAAC,UAAU,CAAC,CAAC;oBACtD,eAAe,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC;oBAE3C,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;wBACjC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;wBAC/D,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;4BAC3C,4BAA4B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;4BACtC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,kEAAkE,EAAE;gCACxF,OAAO,EAAE,OAAO,CAAC,OAAO;gCACxB,MAAM;gCACN,IAAI,EAAE,GAAG,IAAI,IAAI,QAAQ,EAAE;6BAC5B,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,cAAc,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC;gBACvC,SAAS;YACX,CAAC;YAED,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;gBACtB,MAAM,cAAc,GAAG,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC;gBAC/C,cAAc,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC;gBAEtC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;oBACjC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;oBACnD,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC3C,4BAA4B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;wBACtC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,kEAAkE,EAAE;4BACxF,OAAO,EAAE,OAAO,CAAC,OAAO;4BACxB,MAAM;4BACN,IAAI;yBACL,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,KAAK,KAAK,SAAS,IAAI,+BAA+B,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;gBACzE,MAAM,WAAW,GAAG,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC;gBACzC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;oBAC9B,cAAc,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC;oBACnC,SAAS;gBACX,CAAC;gBAED,MAAM,kBAAkB,GAAG,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC;gBACnD,cAAc,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC;gBAE1C,mEAAmE;gBACnE,wEAAwE;gBACxE,iEAAiE;gBACjE,uEAAuE;gBACvE,sEAAsE;gBACtE,mEAAmE;gBACnE,uEAAuE;gBACvE,sEAAsE;gBACtE,8DAA8D;gBAC9D,EAAE;gBACF,mEAAmE;gBACnE,sEAAsE;gBACtE,iEAAiE;gBACjE,gBAAgB;gBAChB,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;oBACrC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;oBACnD,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;wBACzC,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;wBACpC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,sFAAsF,EAAE;4BAC3G,OAAO,EAAE,OAAO,CAAC,OAAO;4BACxB,MAAM;4BACN,IAAI;yBACL,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,QAAQ,CAAC,MAAM,CAAC,GAAG,cAA8C,CAAC;IACpE,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,gBAA+B,EAC/B,YAAkD,EAClD,iBAAuD,EACvD,gBAAsD,EACtD,OAAkC;IAElC,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,OAAO,CAAC,OAAO,EACf,gBAAgB,EAChB,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,OAAO,CAAC,YAAY,CACrB,CAAC;IACF,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,WAAW,GAAG,gBAAgB,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,gBAAgB,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IACnE,MAAM,cAAc,GAAG,gBAAgB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,4BAA4B,CAAC,cAAc,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAEzF,IAAI,UAAU,CAAC,IAAI,IAAI,uBAAuB,EAAE,CAAC;QAC/C,UAAU,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IACD,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACnC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,OAAuB,EACvB,MAAqB,EACrB,aAA+C,EAC/C,kBAA4G;IAE5G,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,EAAE,WAAW,IAAI,QAAQ,CAAC;IAC5D,MAAM,eAAe,GAAG,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,KAAK,aAAa,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;IAC1H,MAAM,4BAA4B,GAAG,eAAe;QAClD,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,aAAa,EAAE,4BAA4B,IAAI,IAAI,CAAC;IAExD,OAAO;QACL,OAAO;QACP,MAAM;QACN,kBAAkB,EAAE,OAAO,CAAC,aAAa,EAAE,kBAAkB,IAAI,eAAe,CAAC;QACjF,eAAe;QACf,4BAA4B;QAC5B,QAAQ,EAAE,kBAAkB,EAAE,QAAQ;QACtC,gBAAgB,EAAE,kBAAkB,EAAE,gBAAgB;QACtD,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB;KAC3D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAuB,cAAc,CAAC,IAAI;IACzE,OAAO,UAAU,CAAC,oBAAoB,CAAC,EAAE,MAAM,IAAI,kCAAkC,CAAC,IAAI,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,UAAU,CAAC,oBAAoB,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,UAAU,CAAC,oBAAoB,CAAC,EAAE,kBAAkB,IAAI,KAAK,CAAC;AACvE,CAAC","sourcesContent":["import { createContext, useContext } from 'react';\nimport {\n  FRAMEWORK_DEFAULT_SURFACE_POLICIES,\n  SurfaceVariant,\n  type DeepPartialSurfacePolicy,\n  type SurfacePolicy,\n} from '@wildo-ai/presets-components-models';\n\ntype SurfacePolicyFamily = keyof SurfacePolicy;\ntype SurfacePolicySlot = string;\n\nexport interface SurfacePolicyContextValue {\n  variant: SurfaceVariant;\n  policy: SurfacePolicy;\n  /**\n   * True when the current context chain already contains a rendered frame.\n   *\n   * The value is intentionally precomputed by each `<Surface>` provider so a\n   * nested surface can decide `framingMode: 'when-orphan'` in O(1), without\n   * walking the whole React ancestor chain on every render.\n   */\n  isInFramedAncestor: boolean;\n  /** True when this exact surface resolves to rendering its own visual frame. */\n  rendersOwnFrame: boolean;\n  nearestFramedAncestorVariant: SurfaceVariant | null;\n  headerId: string | undefined;\n  registerHeaderId: ((id: string) => void) | undefined;\n  unregisterHeaderId: ((id: string) => void) | undefined;\n}\n\nexport interface SurfacePolicyLogger {\n  warn: (message: string, context?: Record<string, unknown>) => void;\n  error: (message: string, context?: Record<string, unknown>) => void;\n}\n\nexport interface MergeSurfacePolicyOptions {\n  variant: SurfaceVariant;\n  parentPolicy?: SurfacePolicy;\n  logger?: SurfacePolicyLogger;\n}\n\nexport const SurfacePolicyContext = createContext<SurfacePolicyContextValue | null>(null);\n\nconst SURFACE_POLICY_FAMILIES: readonly SurfacePolicyFamily[] = [\n  'containment',\n  'nesting',\n  'content',\n  'autoRender',\n  'interactiveState',\n  'a11y',\n  'geometry',\n  'stacking',\n  'skeleton',\n  'composition',\n];\n\nconst POLICY_VALUE_INHERIT_SLOTS: ReadonlySet<string> = new Set([\n  'content.textTruncation',\n  'content.wrapStrategy',\n  'content.numericAlignment',\n  'content.overlongTokenStrategy',\n  'autoRender.autoFieldChrome',\n  'autoRender.autoFieldDensity',\n  'autoRender.autoErrorPlacement',\n  'interactiveState.loadingDisplay',\n  'interactiveState.errorBoundary',\n  'geometry.actionAlignment',\n  'skeleton.skeletonTemplate',\n  'skeleton.skeletonDensity',\n  'composition.selectionColumnAware',\n]);\n\nconst warnedMissingParentInherit = new Set<string>();\nconst erroredMissingFrameworkReset = new Set<string>();\nconst objectIds = new WeakMap<object, number>();\nconst mergeCache = new Map<string, SurfacePolicy>();\nconst MAX_MERGE_CACHE_ENTRIES = 500;\nlet nextObjectId = 1;\n\nfunction getInputId(value: object | undefined): string {\n  if (!value) {\n    return 'u';\n  }\n\n  let id = objectIds.get(value);\n  if (!id) {\n    id = nextObjectId;\n    nextObjectId += 1;\n    objectIds.set(value, id);\n  }\n\n  return `o${id}`;\n}\n\nfunction getMergeCacheKey(\n  variant: SurfaceVariant,\n  frameworkDefault: SurfacePolicy,\n  themeDefault: DeepPartialSurfacePolicy | undefined,\n  appConfigOverride: DeepPartialSurfacePolicy | undefined,\n  callSiteOverride: DeepPartialSurfacePolicy | undefined,\n  parentPolicy: SurfacePolicy | undefined,\n): string {\n  return [\n    variant,\n    getInputId(frameworkDefault),\n    getInputId(themeDefault),\n    getInputId(appConfigOverride),\n    getInputId(callSiteOverride),\n    getInputId(parentPolicy),\n  ].join('|');\n}\n\nfunction mergePolicyLayer(\n  base: SurfacePolicy,\n  override: DeepPartialSurfacePolicy | undefined,\n): SurfacePolicy {\n  if (!override) {\n    return base;\n  }\n\n  const merged: SurfacePolicy = { ...base };\n\n  for (const family of SURFACE_POLICY_FAMILIES) {\n    const familyOverride = override[family];\n    if (familyOverride) {\n      merged[family] = {\n        ...base[family],\n        ...familyOverride,\n        ...(family === 'containment' && 'slotGap' in familyOverride\n          ? mergeContainmentSlotGap(base, familyOverride)\n          : {}),\n      } as SurfacePolicy[typeof family];\n    }\n  }\n\n  return merged;\n}\n\nfunction mergeContainmentSlotGap(\n  base: SurfacePolicy,\n  familyOverride: NonNullable<DeepPartialSurfacePolicy['containment']>,\n): Pick<NonNullable<SurfacePolicy['containment']>, 'slotGap'> {\n  if (familyOverride.slotGap === undefined) {\n    return { slotGap: undefined };\n  }\n\n  return {\n    slotGap: {\n      ...base.containment?.slotGap,\n      ...familyOverride.slotGap,\n    },\n  };\n}\n\nfunction shouldResolvePolicyValueInherit(family: SurfacePolicyFamily, slot: SurfacePolicySlot): boolean {\n  return POLICY_VALUE_INHERIT_SLOTS.has(`${family}.${slot}`);\n}\n\nfunction resolveResetAndInheritValues(\n  policy: SurfacePolicy,\n  frameworkDefault: SurfacePolicy,\n  options: MergeSurfacePolicyOptions,\n): SurfacePolicy {\n  const resolved: SurfacePolicy = { ...policy };\n\n  for (const family of SURFACE_POLICY_FAMILIES) {\n    const familyPolicy = policy[family];\n    if (!familyPolicy) {\n      continue;\n    }\n\n    const familyResolved = { ...familyPolicy } as Record<string, unknown>;\n    const frameworkFamily = frameworkDefault[family] as Record<string, unknown> | undefined;\n    const parentFamily = options.parentPolicy?.[family] as Record<string, unknown> | undefined;\n\n    for (const [slot, value] of Object.entries(familyPolicy as Record<string, unknown>)) {\n      if (family === 'containment' && slot === 'slotGap' && value && typeof value === 'object') {\n        const frameworkSlotGap = frameworkDefault.containment?.slotGap;\n        const resolvedSlotGap = { ...(value as Record<string, unknown>) };\n\n        for (const [slotName, slotValue] of Object.entries(resolvedSlotGap)) {\n          if (slotValue !== 'reset') {\n            continue;\n          }\n\n          const slotGapKey = slotName as keyof NonNullable<NonNullable<SurfacePolicy['containment']>['slotGap']>;\n          const frameworkValue = frameworkSlotGap?.[slotGapKey];\n          resolvedSlotGap[slotName] = frameworkValue;\n\n          if (frameworkValue === undefined) {\n            const key = `${options.variant}.${family}.${slot}.${slotName}`;\n            if (!erroredMissingFrameworkReset.has(key)) {\n              erroredMissingFrameworkReset.add(key);\n              options.logger?.error('[SurfacePolicy] reset resolved to an undefined framework default', {\n                variant: options.variant,\n                family,\n                slot: `${slot}.${slotName}`,\n              });\n            }\n          }\n        }\n\n        familyResolved[slot] = resolvedSlotGap;\n        continue;\n      }\n\n      if (value === 'reset') {\n        const frameworkValue = frameworkFamily?.[slot];\n        familyResolved[slot] = frameworkValue;\n\n        if (frameworkValue === undefined) {\n          const key = `${options.variant}.${family}.${slot}`;\n          if (!erroredMissingFrameworkReset.has(key)) {\n            erroredMissingFrameworkReset.add(key);\n            options.logger?.error('[SurfacePolicy] reset resolved to an undefined framework default', {\n              variant: options.variant,\n              family,\n              slot,\n            });\n          }\n        }\n        continue;\n      }\n\n      if (value === 'inherit' && shouldResolvePolicyValueInherit(family, slot)) {\n        const parentValue = parentFamily?.[slot];\n        if (parentValue !== undefined) {\n          familyResolved[slot] = parentValue;\n          continue;\n        }\n\n        const frameworkSlotValue = frameworkFamily?.[slot];\n        familyResolved[slot] = frameworkSlotValue;\n\n        // Only warn when the framework default would actually substitute a\n        // DIFFERENT concrete value than the `'inherit'` the call-site provided.\n        // If the variant's own framework default for this slot is ITSELF\n        // `'inherit'` (as is the case for root variants like SHELL and OVERLAY\n        // on `content.numericAlignment`), then the resolver's fallback simply\n        // re-emits the same `'inherit'` keyword the author asked for — CSS\n        // then handles DOM-level inheritance natively. That is the framework's\n        // intentional design for root-level variants which by definition have\n        // no parent Surface, and is NOT an authoring mistake to flag.\n        //\n        // The warning is reserved for the case where the framework default\n        // would substitute a concrete value — that's the case worth surfacing\n        // because the resolved policy then quietly differs from what the\n        // author wrote.\n        if (frameworkSlotValue !== 'inherit') {\n          const key = `${options.variant}.${family}.${slot}`;\n          if (!warnedMissingParentInherit.has(key)) {\n            warnedMissingParentInherit.add(key);\n            options.logger?.warn('[SurfacePolicy] inherit had no parent surface; falling back to the framework default', {\n              variant: options.variant,\n              family,\n              slot,\n            });\n          }\n        }\n      }\n    }\n\n    resolved[family] = familyResolved as SurfacePolicy[typeof family];\n  }\n\n  return resolved;\n}\n\n/**\n * Merge the four Surface Policy layers into a concrete `SurfacePolicy`.\n *\n * Order is fixed by KD-4: framework fallback → theme recipe policy → app\n * configuration override → call-site override. The function is memoized by\n * shallow identity of those inputs so repeated renders with stable config\n * objects reuse the same policy reference.\n */\nexport function mergeSurfacePolicy(\n  frameworkDefault: SurfacePolicy,\n  themeDefault: DeepPartialSurfacePolicy | undefined,\n  appConfigOverride: DeepPartialSurfacePolicy | undefined,\n  callSiteOverride: DeepPartialSurfacePolicy | undefined,\n  options: MergeSurfacePolicyOptions,\n): SurfacePolicy {\n  const cacheKey = getMergeCacheKey(\n    options.variant,\n    frameworkDefault,\n    themeDefault,\n    appConfigOverride,\n    callSiteOverride,\n    options.parentPolicy,\n  );\n  const cached = mergeCache.get(cacheKey);\n  if (cached) {\n    return cached;\n  }\n\n  const mergedTheme = mergePolicyLayer(frameworkDefault, themeDefault);\n  const mergedApp = mergePolicyLayer(mergedTheme, appConfigOverride);\n  const mergedCallSite = mergePolicyLayer(mergedApp, callSiteOverride);\n  const resolved = resolveResetAndInheritValues(mergedCallSite, frameworkDefault, options);\n\n  if (mergeCache.size >= MAX_MERGE_CACHE_ENTRIES) {\n    mergeCache.clear();\n  }\n  mergeCache.set(cacheKey, resolved);\n  return resolved;\n}\n\nexport function computeSurfacePolicyContextValue(\n  variant: SurfaceVariant,\n  policy: SurfacePolicy,\n  parentContext: SurfacePolicyContextValue | null,\n  headerRegistration?: Pick<SurfacePolicyContextValue, 'headerId' | 'registerHeaderId' | 'unregisterHeaderId'>,\n): SurfacePolicyContextValue {\n  const framingMode = policy.nesting?.framingMode ?? 'always';\n  const rendersOwnFrame = framingMode === 'always' || (framingMode === 'when-orphan' && !parentContext?.isInFramedAncestor);\n  const nearestFramedAncestorVariant = rendersOwnFrame\n    ? variant\n    : parentContext?.nearestFramedAncestorVariant ?? null;\n\n  return {\n    variant,\n    policy,\n    isInFramedAncestor: Boolean(parentContext?.isInFramedAncestor || rendersOwnFrame),\n    rendersOwnFrame,\n    nearestFramedAncestorVariant,\n    headerId: headerRegistration?.headerId,\n    registerHeaderId: headerRegistration?.registerHeaderId,\n    unregisterHeaderId: headerRegistration?.unregisterHeaderId,\n  };\n}\n\nexport function useSurfacePolicy(hint: SurfaceVariant = SurfaceVariant.BASE): SurfacePolicy {\n  return useContext(SurfacePolicyContext)?.policy ?? FRAMEWORK_DEFAULT_SURFACE_POLICIES[hint];\n}\n\nexport function useSurfaceVariant(): SurfaceVariant | null {\n  return useContext(SurfacePolicyContext)?.variant ?? null;\n}\n\n/**\n * `true` when the current React subtree is already inside a surface that paints\n * its own visual frame (border + shadow). Section/card chrome reads this to\n * activate the `when-orphan` framing semantic: a framed section nested inside an\n * already-framed ancestor (card-in-card, card-in-dialog, card-in-composite)\n * suppresses its OWN frame to avoid \"border soup\", because the outer frame\n * already delineates the region.\n *\n * Returns `false` at the top of the tree (no surface ancestor). The value is\n * precomputed by each `<Surface>` provider (see\n * {@link computeSurfacePolicyContextValue}), so this read is O(1) and never\n * walks the ancestor chain.\n *\n * IMPORTANT: this signal is only reliable when every surface's\n * `nesting.framingMode` truthfully reflects whether it paints a frame. A surface\n * that renders FLAT but declares `framingMode: 'always'` would falsely report\n * `true` to its descendants — so flat chrome must declare `framingMode: 'never'`\n * and `when-orphan` chrome must paint its frame iff this hook returns `false`.\n */\nexport function useIsInFramedAncestor(): boolean {\n  return useContext(SurfacePolicyContext)?.isInFramedAncestor ?? false;\n}\n"]}
+{"version":3,"file":"SurfacePolicyContext.js","sourceRoot":"","sources":["../../../../src/core/ui/SurfacePolicyContext.tsx"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAClD,OAAO,EACL,kCAAkC,EAClC,cAAc,GAGf,MAAM,qCAAqC,CAAC;AAmC7C,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,CAAmC,IAAI,CAAC,CAAC;AAE1F,MAAM,uBAAuB,GAAmC;IAC9D,aAAa;IACb,SAAS;IACT,SAAS;IACT,YAAY;IACZ,kBAAkB;IAClB,MAAM;IACN,UAAU;IACV,UAAU;IACV,UAAU;IACV,aAAa;CACd,CAAC;AAEF,MAAM,0BAA0B,GAAwB,IAAI,GAAG,CAAC;IAC9D,wBAAwB;IACxB,sBAAsB;IACtB,0BAA0B;IAC1B,+BAA+B;IAC/B,4BAA4B;IAC5B,6BAA6B;IAC7B,+BAA+B;IAC/B,iCAAiC;IACjC,gCAAgC;IAChC,0BAA0B;IAC1B,2BAA2B;IAC3B,0BAA0B;IAC1B,kCAAkC;CACnC,CAAC,CAAC;AAEH,MAAM,0BAA0B,GAAG,IAAI,GAAG,EAAU,CAAC;AACrD,MAAM,4BAA4B,GAAG,IAAI,GAAG,EAAU,CAAC;AACvD,MAAM,SAAS,GAAG,IAAI,OAAO,EAAkB,CAAC;AAChD,MAAM,UAAU,GAAG,IAAI,GAAG,EAAyB,CAAC;AACpD,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC,IAAI,YAAY,GAAG,CAAC,CAAC;AAErB,SAAS,UAAU,CAAC,KAAyB;IAC3C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,GAAG,CAAC;IACb,CAAC;IAED,IAAI,EAAE,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,EAAE,GAAG,YAAY,CAAC;QAClB,YAAY,IAAI,CAAC,CAAC;QAClB,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3B,CAAC;IAED,OAAO,IAAI,EAAE,EAAE,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CACvB,OAAuB,EACvB,gBAA+B,EAC/B,YAAkD,EAClD,iBAAuD,EACvD,gBAAsD,EACtD,YAAuC;IAEvC,OAAO;QACL,OAAO;QACP,UAAU,CAAC,gBAAgB,CAAC;QAC5B,UAAU,CAAC,YAAY,CAAC;QACxB,UAAU,CAAC,iBAAiB,CAAC;QAC7B,UAAU,CAAC,gBAAgB,CAAC;QAC5B,UAAU,CAAC,YAAY,CAAC;KACzB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CACvB,IAAmB,EACnB,QAA8C;IAE9C,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,MAAM,GAAkB,EAAE,GAAG,IAAI,EAAE,CAAC;IAE1C,KAAK,MAAM,MAAM,IAAI,uBAAuB,EAAE,CAAC;QAC7C,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,cAAc,EAAE,CAAC;YACnB,MAAM,CAAC,MAAM,CAAC,GAAG;gBACf,GAAG,IAAI,CAAC,MAAM,CAAC;gBACf,GAAG,cAAc;gBACjB,GAAG,CAAC,MAAM,KAAK,aAAa,IAAI,SAAS,IAAI,cAAc;oBACzD,CAAC,CAAC,uBAAuB,CAAC,IAAI,EAAE,cAAc,CAAC;oBAC/C,CAAC,CAAC,EAAE,CAAC;aACwB,CAAC;QACpC,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,uBAAuB,CAC9B,IAAmB,EACnB,cAAoE;IAEpE,IAAI,cAAc,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACzC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;IAChC,CAAC;IAED,OAAO;QACL,OAAO,EAAE;YACP,GAAG,IAAI,CAAC,WAAW,EAAE,OAAO;YAC5B,GAAG,cAAc,CAAC,OAAO;SAC1B;KACF,CAAC;AACJ,CAAC;AAED,SAAS,+BAA+B,CAAC,MAA2B,EAAE,IAAuB;IAC3F,OAAO,0BAA0B,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,4BAA4B,CACnC,MAAqB,EACrB,gBAA+B,EAC/B,OAAkC;IAElC,MAAM,QAAQ,GAAkB,EAAE,GAAG,MAAM,EAAE,CAAC;IAE9C,KAAK,MAAM,MAAM,IAAI,uBAAuB,EAAE,CAAC;QAC7C,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,SAAS;QACX,CAAC;QAED,MAAM,cAAc,GAAG,EAAE,GAAG,YAAY,EAA6B,CAAC;QACtE,MAAM,eAAe,GAAG,gBAAgB,CAAC,MAAM,CAAwC,CAAC;QACxF,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,MAAM,CAAwC,CAAC;QAE3F,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,YAAuC,CAAC,EAAE,CAAC;YACpF,IAAI,MAAM,KAAK,aAAa,IAAI,IAAI,KAAK,SAAS,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACzF,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC;gBAC/D,MAAM,eAAe,GAAG,EAAE,GAAI,KAAiC,EAAE,CAAC;gBAElE,KAAK,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;oBACpE,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;wBAC1B,SAAS;oBACX,CAAC;oBAED,MAAM,UAAU,GAAG,QAAmF,CAAC;oBACvG,MAAM,cAAc,GAAG,gBAAgB,EAAE,CAAC,UAAU,CAAC,CAAC;oBACtD,eAAe,CAAC,QAAQ,CAAC,GAAG,cAAc,CAAC;oBAE3C,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;wBACjC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;wBAC/D,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;4BAC3C,4BAA4B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;4BACtC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,kEAAkE,EAAE;gCACxF,OAAO,EAAE,OAAO,CAAC,OAAO;gCACxB,MAAM;gCACN,IAAI,EAAE,GAAG,IAAI,IAAI,QAAQ,EAAE;6BAC5B,CAAC,CAAC;wBACL,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,cAAc,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC;gBACvC,SAAS;YACX,CAAC;YAED,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;gBACtB,MAAM,cAAc,GAAG,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC;gBAC/C,cAAc,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC;gBAEtC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;oBACjC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;oBACnD,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;wBAC3C,4BAA4B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;wBACtC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,kEAAkE,EAAE;4BACxF,OAAO,EAAE,OAAO,CAAC,OAAO;4BACxB,MAAM;4BACN,IAAI;yBACL,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;gBACD,SAAS;YACX,CAAC;YAED,IAAI,KAAK,KAAK,SAAS,IAAI,+BAA+B,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;gBACzE,MAAM,WAAW,GAAG,YAAY,EAAE,CAAC,IAAI,CAAC,CAAC;gBACzC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;oBAC9B,cAAc,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC;oBACnC,SAAS;gBACX,CAAC;gBAED,MAAM,kBAAkB,GAAG,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC;gBACnD,cAAc,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC;gBAE1C,mEAAmE;gBACnE,wEAAwE;gBACxE,iEAAiE;gBACjE,uEAAuE;gBACvE,sEAAsE;gBACtE,mEAAmE;gBACnE,uEAAuE;gBACvE,sEAAsE;gBACtE,8DAA8D;gBAC9D,EAAE;gBACF,mEAAmE;gBACnE,sEAAsE;gBACtE,iEAAiE;gBACjE,gBAAgB;gBAChB,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;oBACrC,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;oBACnD,IAAI,CAAC,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;wBACzC,0BAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;wBACpC,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,sFAAsF,EAAE;4BAC3G,OAAO,EAAE,OAAO,CAAC,OAAO;4BACxB,MAAM;4BACN,IAAI;yBACL,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,QAAQ,CAAC,MAAM,CAAC,GAAG,cAA8C,CAAC;IACpE,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAChC,gBAA+B,EAC/B,YAAkD,EAClD,iBAAuD,EACvD,gBAAsD,EACtD,OAAkC;IAElC,MAAM,QAAQ,GAAG,gBAAgB,CAC/B,OAAO,CAAC,OAAO,EACf,gBAAgB,EAChB,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,OAAO,CAAC,YAAY,CACrB,CAAC;IACF,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,WAAW,GAAG,gBAAgB,CAAC,gBAAgB,EAAE,YAAY,CAAC,CAAC;IACrE,MAAM,SAAS,GAAG,gBAAgB,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC;IACnE,MAAM,cAAc,GAAG,gBAAgB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,4BAA4B,CAAC,cAAc,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAEzF,IAAI,UAAU,CAAC,IAAI,IAAI,uBAAuB,EAAE,CAAC;QAC/C,UAAU,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IACD,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACnC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,OAAuB,EACvB,MAAqB,EACrB,aAA+C,EAC/C,kBAA4G;IAE5G,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,EAAE,WAAW,IAAI,QAAQ,CAAC;IAC5D,MAAM,eAAe,GAAG,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,KAAK,aAAa,IAAI,CAAC,aAAa,EAAE,kBAAkB,CAAC,CAAC;IAC1H,MAAM,4BAA4B,GAAG,eAAe;QAClD,CAAC,CAAC,OAAO;QACT,CAAC,CAAC,aAAa,EAAE,4BAA4B,IAAI,IAAI,CAAC;IAExD,OAAO;QACL,OAAO;QACP,MAAM;QACN,kBAAkB,EAAE,OAAO,CAAC,aAAa,EAAE,kBAAkB,IAAI,eAAe,CAAC;QACjF,eAAe;QACf,4BAA4B;QAC5B,QAAQ,EAAE,kBAAkB,EAAE,QAAQ;QACtC,gBAAgB,EAAE,kBAAkB,EAAE,gBAAgB;QACtD,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB;KAC3D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAuB,cAAc,CAAC,IAAI;IACzE,OAAO,UAAU,CAAC,oBAAoB,CAAC,EAAE,MAAM,IAAI,kCAAkC,CAAC,IAAI,CAAC,CAAC;AAC9F,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,OAAO,UAAU,CAAC,oBAAoB,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO,UAAU,CAAC,oBAAoB,CAAC,EAAE,kBAAkB,IAAI,KAAK,CAAC;AACvE,CAAC","sourcesContent":["import { createContext, useContext } from 'react';\nimport {\n  FRAMEWORK_DEFAULT_SURFACE_POLICIES,\n  SurfaceVariant,\n  type DeepPartialSurfacePolicy,\n  type SurfacePolicy,\n} from '@wildo-ai/presets-components-models';\n\ntype SurfacePolicyFamily = keyof SurfacePolicy;\ntype SurfacePolicySlot = string;\n\nexport interface SurfacePolicyContextValue {\n  variant: SurfaceVariant;\n  policy: SurfacePolicy;\n  /**\n   * True when the current context chain already contains a rendered frame.\n   *\n   * The value is intentionally precomputed by each `<Surface>` provider so a\n   * nested surface can decide `framingMode: 'when-orphan'` in O(1), without\n   * walking the whole React ancestor chain on every render.\n   */\n  isInFramedAncestor: boolean;\n  /** True when this exact surface resolves to rendering its own visual frame. */\n  rendersOwnFrame: boolean;\n  nearestFramedAncestorVariant: SurfaceVariant | null;\n  headerId: string | undefined;\n  registerHeaderId: ((id: string) => void) | undefined;\n  unregisterHeaderId: ((id: string) => void) | undefined;\n}\n\nexport interface SurfacePolicyLogger {\n  warn: (message: string, context?: Record<string, unknown>) => void;\n  error: (message: string, context?: Record<string, unknown>) => void;\n}\n\nexport interface MergeSurfacePolicyOptions {\n  variant: SurfaceVariant;\n  parentPolicy?: SurfacePolicy;\n  logger?: SurfacePolicyLogger;\n}\n\nexport const SurfacePolicyContext = createContext<SurfacePolicyContextValue | null>(null);\n\nconst SURFACE_POLICY_FAMILIES: readonly SurfacePolicyFamily[] = [\n  'containment',\n  'nesting',\n  'content',\n  'autoRender',\n  'interactiveState',\n  'a11y',\n  'geometry',\n  'stacking',\n  'skeleton',\n  'composition',\n];\n\nconst POLICY_VALUE_INHERIT_SLOTS: ReadonlySet<string> = new Set([\n  'content.textTruncation',\n  'content.wrapStrategy',\n  'content.numericAlignment',\n  'content.overlongTokenStrategy',\n  'autoRender.autoFieldChrome',\n  'autoRender.autoFieldDensity',\n  'autoRender.autoErrorPlacement',\n  'interactiveState.loadingDisplay',\n  'interactiveState.errorBoundary',\n  'geometry.actionAlignment',\n  'skeleton.skeletonTemplate',\n  'skeleton.skeletonDensity',\n  'composition.selectionColumnAware',\n]);\n\nconst warnedMissingParentInherit = new Set<string>();\nconst erroredMissingFrameworkReset = new Set<string>();\nconst objectIds = new WeakMap<object, number>();\nconst mergeCache = new Map<string, SurfacePolicy>();\nconst MAX_MERGE_CACHE_ENTRIES = 500;\nlet nextObjectId = 1;\n\nfunction getInputId(value: object | undefined): string {\n  if (!value) {\n    return 'u';\n  }\n\n  let id = objectIds.get(value);\n  if (!id) {\n    id = nextObjectId;\n    nextObjectId += 1;\n    objectIds.set(value, id);\n  }\n\n  return `o${id}`;\n}\n\nfunction getMergeCacheKey(\n  variant: SurfaceVariant,\n  frameworkDefault: SurfacePolicy,\n  themeDefault: DeepPartialSurfacePolicy | undefined,\n  appConfigOverride: DeepPartialSurfacePolicy | undefined,\n  callSiteOverride: DeepPartialSurfacePolicy | undefined,\n  parentPolicy: SurfacePolicy | undefined,\n): string {\n  return [\n    variant,\n    getInputId(frameworkDefault),\n    getInputId(themeDefault),\n    getInputId(appConfigOverride),\n    getInputId(callSiteOverride),\n    getInputId(parentPolicy),\n  ].join('|');\n}\n\nfunction mergePolicyLayer(\n  base: SurfacePolicy,\n  override: DeepPartialSurfacePolicy | undefined,\n): SurfacePolicy {\n  if (!override) {\n    return base;\n  }\n\n  const merged: SurfacePolicy = { ...base };\n\n  for (const family of SURFACE_POLICY_FAMILIES) {\n    const familyOverride = override[family];\n    if (familyOverride) {\n      merged[family] = {\n        ...base[family],\n        ...familyOverride,\n        ...(family === 'containment' && 'slotGap' in familyOverride\n          ? mergeContainmentSlotGap(base, familyOverride)\n          : {}),\n      } as SurfacePolicy[typeof family];\n    }\n  }\n\n  return merged;\n}\n\nfunction mergeContainmentSlotGap(\n  base: SurfacePolicy,\n  familyOverride: NonNullable<DeepPartialSurfacePolicy['containment']>,\n): Pick<NonNullable<SurfacePolicy['containment']>, 'slotGap'> {\n  if (familyOverride.slotGap === undefined) {\n    return { slotGap: undefined };\n  }\n\n  return {\n    slotGap: {\n      ...base.containment?.slotGap,\n      ...familyOverride.slotGap,\n    },\n  };\n}\n\nfunction shouldResolvePolicyValueInherit(family: SurfacePolicyFamily, slot: SurfacePolicySlot): boolean {\n  return POLICY_VALUE_INHERIT_SLOTS.has(`${family}.${slot}`);\n}\n\nfunction resolveResetAndInheritValues(\n  policy: SurfacePolicy,\n  frameworkDefault: SurfacePolicy,\n  options: MergeSurfacePolicyOptions,\n): SurfacePolicy {\n  const resolved: SurfacePolicy = { ...policy };\n\n  for (const family of SURFACE_POLICY_FAMILIES) {\n    const familyPolicy = policy[family];\n    if (!familyPolicy) {\n      continue;\n    }\n\n    const familyResolved = { ...familyPolicy } as Record<string, unknown>;\n    const frameworkFamily = frameworkDefault[family] as Record<string, unknown> | undefined;\n    const parentFamily = options.parentPolicy?.[family] as Record<string, unknown> | undefined;\n\n    for (const [slot, value] of Object.entries(familyPolicy as Record<string, unknown>)) {\n      if (family === 'containment' && slot === 'slotGap' && value && typeof value === 'object') {\n        const frameworkSlotGap = frameworkDefault.containment?.slotGap;\n        const resolvedSlotGap = { ...(value as Record<string, unknown>) };\n\n        for (const [slotName, slotValue] of Object.entries(resolvedSlotGap)) {\n          if (slotValue !== 'reset') {\n            continue;\n          }\n\n          const slotGapKey = slotName as keyof NonNullable<NonNullable<SurfacePolicy['containment']>['slotGap']>;\n          const frameworkValue = frameworkSlotGap?.[slotGapKey];\n          resolvedSlotGap[slotName] = frameworkValue;\n\n          if (frameworkValue === undefined) {\n            const key = `${options.variant}.${family}.${slot}.${slotName}`;\n            if (!erroredMissingFrameworkReset.has(key)) {\n              erroredMissingFrameworkReset.add(key);\n              options.logger?.error('[SurfacePolicy] reset resolved to an undefined framework default', {\n                variant: options.variant,\n                family,\n                slot: `${slot}.${slotName}`,\n              });\n            }\n          }\n        }\n\n        familyResolved[slot] = resolvedSlotGap;\n        continue;\n      }\n\n      if (value === 'reset') {\n        const frameworkValue = frameworkFamily?.[slot];\n        familyResolved[slot] = frameworkValue;\n\n        if (frameworkValue === undefined) {\n          const key = `${options.variant}.${family}.${slot}`;\n          if (!erroredMissingFrameworkReset.has(key)) {\n            erroredMissingFrameworkReset.add(key);\n            options.logger?.error('[SurfacePolicy] reset resolved to an undefined framework default', {\n              variant: options.variant,\n              family,\n              slot,\n            });\n          }\n        }\n        continue;\n      }\n\n      if (value === 'inherit' && shouldResolvePolicyValueInherit(family, slot)) {\n        const parentValue = parentFamily?.[slot];\n        if (parentValue !== undefined) {\n          familyResolved[slot] = parentValue;\n          continue;\n        }\n\n        const frameworkSlotValue = frameworkFamily?.[slot];\n        familyResolved[slot] = frameworkSlotValue;\n\n        // Only warn when the framework default would actually substitute a\n        // DIFFERENT concrete value than the `'inherit'` the call-site provided.\n        // If the variant's own framework default for this slot is ITSELF\n        // `'inherit'` (as is the case for root variants like SHELL and OVERLAY\n        // on `content.numericAlignment`), then the resolver's fallback simply\n        // re-emits the same `'inherit'` keyword the author asked for — CSS\n        // then handles DOM-level inheritance natively. That is the framework's\n        // intentional design for root-level variants which by definition have\n        // no parent Surface, and is NOT an authoring mistake to flag.\n        //\n        // The warning is reserved for the case where the framework default\n        // would substitute a concrete value — that's the case worth surfacing\n        // because the resolved policy then quietly differs from what the\n        // author wrote.\n        if (frameworkSlotValue !== 'inherit') {\n          const key = `${options.variant}.${family}.${slot}`;\n          if (!warnedMissingParentInherit.has(key)) {\n            warnedMissingParentInherit.add(key);\n            options.logger?.warn('[SurfacePolicy] inherit had no parent surface; falling back to the framework default', {\n              variant: options.variant,\n              family,\n              slot,\n            });\n          }\n        }\n      }\n    }\n\n    resolved[family] = familyResolved as SurfacePolicy[typeof family];\n  }\n\n  return resolved;\n}\n\n/**\n * Merge the four Surface Policy layers into a concrete `SurfacePolicy`.\n *\n * Order is fixed by KD-4: framework fallback → theme recipe policy → app\n * configuration override → call-site override. The function is memoized by\n * shallow identity of those inputs so repeated renders with stable config\n * objects reuse the same policy reference.\n */\nexport function mergeSurfacePolicy(\n  frameworkDefault: SurfacePolicy,\n  themeDefault: DeepPartialSurfacePolicy | undefined,\n  appConfigOverride: DeepPartialSurfacePolicy | undefined,\n  callSiteOverride: DeepPartialSurfacePolicy | undefined,\n  options: MergeSurfacePolicyOptions,\n): SurfacePolicy {\n  const cacheKey = getMergeCacheKey(\n    options.variant,\n    frameworkDefault,\n    themeDefault,\n    appConfigOverride,\n    callSiteOverride,\n    options.parentPolicy,\n  );\n  const cached = mergeCache.get(cacheKey);\n  if (cached) {\n    return cached;\n  }\n\n  const mergedTheme = mergePolicyLayer(frameworkDefault, themeDefault);\n  const mergedApp = mergePolicyLayer(mergedTheme, appConfigOverride);\n  const mergedCallSite = mergePolicyLayer(mergedApp, callSiteOverride);\n  const resolved = resolveResetAndInheritValues(mergedCallSite, frameworkDefault, options);\n\n  if (mergeCache.size >= MAX_MERGE_CACHE_ENTRIES) {\n    mergeCache.clear();\n  }\n  mergeCache.set(cacheKey, resolved);\n  return resolved;\n}\n\nexport function computeSurfacePolicyContextValue(\n  variant: SurfaceVariant,\n  policy: SurfacePolicy,\n  parentContext: SurfacePolicyContextValue | null,\n  headerRegistration?: Pick<SurfacePolicyContextValue, 'headerId' | 'registerHeaderId' | 'unregisterHeaderId'>,\n): SurfacePolicyContextValue {\n  const framingMode = policy.nesting?.framingMode ?? 'always';\n  const rendersOwnFrame = framingMode === 'always' || (framingMode === 'when-orphan' && !parentContext?.isInFramedAncestor);\n  const nearestFramedAncestorVariant = rendersOwnFrame\n    ? variant\n    : parentContext?.nearestFramedAncestorVariant ?? null;\n\n  return {\n    variant,\n    policy,\n    isInFramedAncestor: Boolean(parentContext?.isInFramedAncestor || rendersOwnFrame),\n    rendersOwnFrame,\n    nearestFramedAncestorVariant,\n    headerId: headerRegistration?.headerId,\n    registerHeaderId: headerRegistration?.registerHeaderId,\n    unregisterHeaderId: headerRegistration?.unregisterHeaderId,\n  };\n}\n\nexport function useSurfacePolicy(hint: SurfaceVariant = SurfaceVariant.BASE): SurfacePolicy {\n  return useContext(SurfacePolicyContext)?.policy ?? FRAMEWORK_DEFAULT_SURFACE_POLICIES[hint];\n}\n\nexport function useSurfaceVariant(): SurfaceVariant | null {\n  return useContext(SurfacePolicyContext)?.variant ?? null;\n}\n\n/**\n * `true` when the current React subtree is already inside a surface that paints\n * its own visual frame (border + shadow). Section/card chrome reads this to\n * activate the `when-orphan` framing semantic: a framed section nested inside an\n * already-framed ancestor (card-in-card, card-in-dialog, card-in-composite)\n * suppresses its OWN frame to avoid \"border soup\", because the outer frame\n * already delineates the region.\n *\n * Returns `false` at the top of the tree (no surface ancestor). The value is\n * precomputed by each `<Surface>` provider (see\n * {@link computeSurfacePolicyContextValue}), so this read is O(1) and never\n * walks the ancestor chain.\n *\n * IMPORTANT: this signal is only reliable when every surface's\n * `nesting.framingMode` truthfully reflects whether it paints a frame. A surface\n * that renders FLAT but declares `framingMode: 'always'` would falsely report\n * `true` to its descendants — so flat chrome must declare `framingMode: 'never'`\n * and `when-orphan` chrome must paint its frame iff this hook returns `false`.\n */\nexport function useIsInFramedAncestor(): boolean {\n  return useContext(SurfacePolicyContext)?.isInFramedAncestor ?? false;\n}\n"]}

package/dist/esm/core/ui/TypographyScopeContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TypographyScopeContext.d.ts","sourceRoot":"","sources":["../../../../../src/core/ui/TypographyScopeContext.tsx"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAK1B,MAAM,WAAW,oBAAoB;IACnC,+EAA+E;IAC/E,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CAC5B;AAED,wBAAgB,eAAe,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAEhG;AAED,8FAA8F;AAC9F,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAEvD"}
+{"version":3,"file":"TypographyScopeContext.d.ts","sourceRoot":"","sources":["../../../../src/core/ui/TypographyScopeContext.tsx"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAK1B,MAAM,WAAW,oBAAoB;IACnC,+EAA+E;IAC/E,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CAC5B;AAED,wBAAgB,eAAe,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,oBAAoB,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAEhG;AAED,8FAA8F;AAC9F,wBAAgB,kBAAkB,IAAI,MAAM,GAAG,SAAS,CAEvD"}

package/dist/esm/core/ui/TypographyScopeContext.js.map

@@ -1 +1 @@
-{"version":3,"file":"TypographyScopeContext.js","sourceRoot":"","sources":["../../../../../src/core/ui/TypographyScopeContext.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,yFAAyF;AACzF,MAAM,sBAAsB,GAAG,KAAK,CAAC,aAAa,CAAqB,SAAS,CAAC,CAAC;AAQlF,MAAM,UAAU,eAAe,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAwB;IAC3E,OAAO,KAAC,sBAAsB,CAAC,QAAQ,IAAC,KAAK,EAAE,SAAS,YAAG,QAAQ,GAAmC,CAAC;AACzG,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,kBAAkB;IAChC,OAAO,KAAK,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;AAClD,CAAC","sourcesContent":["'use client';\n\n/**\n * A TYPOGRAPHY SCOPE — the type treatment a subtree's text renders at, when the text itself is\n * rendered by machinery the caller does not control.\n *\n * ## The problem it exists for\n *\n * A display field's value is not written by whoever places the field. `<DisplayField name=\"title\" />`\n * reaches a formatter preset, which constructs its own `<Text>`, which resolves its own typography\n * recipe — and `Text` sets an explicit `text-sm`. So a caller wanting that value to read as a\n * HEADLINE has nothing to say: a class on any wrapper loses to the size the inner element sets on\n * itself.\n *\n * What the repository did instead, at 22 sites and counting, was reach through the field:\n *\n *     <div className=\"text-xl font-semibold [&_p]:text-xl [&_p]:font-semibold\">\n *       <DisplayField name=\"idea.oneLiner\" hideLabel />\n *     </div>\n *\n * That is worse than it looks. It hard-codes a step of a ladder eight themes each define\n * differently; it hits EVERY paragraph in the subtree rather than the value; and the size cannot come\n * from a theme at all, because a Tailwind variant composed at runtime is never generated — the\n * scanner only sees what is written literally in source, so `[&_p]:${themeClass}` produces no CSS.\n * That last fact is what rules out fixing this with a smarter wrapper.\n *\n * ## Why a context rather than a prop\n *\n * The alternative is to thread a typography intent from `DisplayField` through the resolved props,\n * the dispatcher, and into each formatter's `<Text>`: **24 formatter presets, 75 call sites**, every\n * one of which could be forgotten — and the one forgotten is invisible, because the text still\n * renders, just at the wrong size.\n *\n * A scope inverts it. `Text` is the ONE component that renders display text, and its wrapper here\n * merges the scope into what it forwards, so every formatter is covered without being edited and a\n * new formatter is covered on the day it is written.\n *\n * ## Precedence, and why this direction\n *\n * The scope is merged BEFORE the element's own `className`, so an explicit class on a specific\n * `<Text>` still wins — a formatter that deliberately renders something small (a machine ref, a\n * secret's monospace) keeps its choice. The scope is a default for text that expressed no opinion,\n * never an override of one.\n *\n * The value is a resolved class string rather than a semantic name on purpose: whoever provides the\n * scope has the theme's recipe in hand and resolves it there, so this context stays a transport and\n * never becomes a second place where type scale is decided.\n */\n\nimport React from 'react';\n\n/** The class string every `Text` in the subtree renders with, unless it sets its own. */\nconst TypographyScopeContext = React.createContext<string | undefined>(undefined);\n\nexport interface TypographyScopeProps {\n  /** Resolved typography classes — from a theme recipe, never a literal step. */\n  className: string | undefined;\n  children?: React.ReactNode;\n}\n\nexport function TypographyScope({ className, children }: TypographyScopeProps): React.JSX.Element {\n  return <TypographyScopeContext.Provider value={className}>{children}</TypographyScopeContext.Provider>;\n}\n\n/** The active scope, or `undefined` outside one — which is the overwhelmingly common case. */\nexport function useTypographyScope(): string | undefined {\n  return React.useContext(TypographyScopeContext);\n}\n"]}
+{"version":3,"file":"TypographyScopeContext.js","sourceRoot":"","sources":["../../../../src/core/ui/TypographyScopeContext.tsx"],"names":[],"mappings":"AAAA,YAAY,CAAC;;AAEb;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAE1B,yFAAyF;AACzF,MAAM,sBAAsB,GAAG,KAAK,CAAC,aAAa,CAAqB,SAAS,CAAC,CAAC;AAQlF,MAAM,UAAU,eAAe,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAwB;IAC3E,OAAO,KAAC,sBAAsB,CAAC,QAAQ,IAAC,KAAK,EAAE,SAAS,YAAG,QAAQ,GAAmC,CAAC;AACzG,CAAC;AAED,8FAA8F;AAC9F,MAAM,UAAU,kBAAkB;IAChC,OAAO,KAAK,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;AAClD,CAAC","sourcesContent":["'use client';\n\n/**\n * A TYPOGRAPHY SCOPE — the type treatment a subtree's text renders at, when the text itself is\n * rendered by machinery the caller does not control.\n *\n * ## The problem it exists for\n *\n * A display field's value is not written by whoever places the field. `<DisplayField name=\"title\" />`\n * reaches a formatter preset, which constructs its own `<Text>`, which resolves its own typography\n * recipe — and `Text` sets an explicit `text-sm`. So a caller wanting that value to read as a\n * HEADLINE has nothing to say: a class on any wrapper loses to the size the inner element sets on\n * itself.\n *\n * What the repository did instead, at 22 sites and counting, was reach through the field:\n *\n *     <div className=\"text-xl font-semibold [&_p]:text-xl [&_p]:font-semibold\">\n *       <DisplayField name=\"idea.oneLiner\" hideLabel />\n *     </div>\n *\n * That is worse than it looks. It hard-codes a step of a ladder eight themes each define\n * differently; it hits EVERY paragraph in the subtree rather than the value; and the size cannot come\n * from a theme at all, because a Tailwind variant composed at runtime is never generated — the\n * scanner only sees what is written literally in source, so `[&_p]:${themeClass}` produces no CSS.\n * That last fact is what rules out fixing this with a smarter wrapper.\n *\n * ## Why a context rather than a prop\n *\n * The alternative is to thread a typography intent from `DisplayField` through the resolved props,\n * the dispatcher, and into each formatter's `<Text>`: **24 formatter presets, 75 call sites**, every\n * one of which could be forgotten — and the one forgotten is invisible, because the text still\n * renders, just at the wrong size.\n *\n * A scope inverts it. `Text` is the ONE component that renders display text, and its wrapper here\n * merges the scope into what it forwards, so every formatter is covered without being edited and a\n * new formatter is covered on the day it is written.\n *\n * ## Precedence, and why this direction\n *\n * The scope is merged BEFORE the element's own `className`, so an explicit class on a specific\n * `<Text>` still wins — a formatter that deliberately renders something small (a machine ref, a\n * secret's monospace) keeps its choice. The scope is a default for text that expressed no opinion,\n * never an override of one.\n *\n * The value is a resolved class string rather than a semantic name on purpose: whoever provides the\n * scope has the theme's recipe in hand and resolves it there, so this context stays a transport and\n * never becomes a second place where type scale is decided.\n */\n\nimport React from 'react';\n\n/** The class string every `Text` in the subtree renders with, unless it sets its own. */\nconst TypographyScopeContext = React.createContext<string | undefined>(undefined);\n\nexport interface TypographyScopeProps {\n  /** Resolved typography classes — from a theme recipe, never a literal step. */\n  className: string | undefined;\n  children?: React.ReactNode;\n}\n\nexport function TypographyScope({ className, children }: TypographyScopeProps): React.JSX.Element {\n  return <TypographyScopeContext.Provider value={className}>{children}</TypographyScopeContext.Provider>;\n}\n\n/** The active scope, or `undefined` outside one — which is the overwhelmingly common case. */\nexport function useTypographyScope(): string | undefined {\n  return React.useContext(TypographyScopeContext);\n}\n"]}

package/dist/esm/core/ui/UIContext.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UIContext.d.ts","sourceRoot":"","sources":["../../../../../src/core/ui/UIContext.tsx"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,EAAiB,SAAS,EAAqD,MAAM,OAAO,CAAC;AAG3G,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oEAAoE,CAAC;AACpH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oEAAoE,CAAC;AACxG,OAAO,EAAE,kBAAkB,EAAyB,MAAM,0BAA0B,CAAC;AACrF,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACtG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kEAAkE,CAAC;AAGjH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0DAA0D,CAAC;AACzG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AAC3G,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oEAAoE,CAAC;AACzG,OAAO,EACL,iBAAiB,EAEjB,UAAU,EAIV,cAAc,EAMd,eAAe,EACf,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAEV,gBAAgB,EAGhB,wBAAwB,EACxB,aAAa,EACb,gBAAgB,EAChB,eAAe,EAChB,MAAM,qCAAqC,CAAC;AAa7C,OAAO,EAAE,eAAe,EAAE,MAAM,iDAAiD,CAAC;AA2HlF,MAAM,WAAW,6BAA6B;IAC5C,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,EAAE,SAAS,CAAC;IACpB,iBAAiB,CAAC,EAAE,kBAAkB,CAAC;IACvC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AA6DD,eAAO,MAAM,0BAA0B,EAAE,KAAK,CAAC,EAAE,CAAC,+BAA+B,CAsFhF,CAAC;AAMF;;;GAGG;AACH,MAAM,WAAW,aAAa;IAE5B,QAAQ,EAAG,eAAe,GAAG,SAAS,CAAC;IAGvC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,0BAA0B,CAAC,EAAE,eAAe,CAAC,4BAA4B,CAAC,CAAC;IAC3E,yBAAyB,CAAC,EAAE,eAAe,CAAC,2BAA2B,CAAC,CAAC;IAGzE,cAAc,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAC3C,eAAe,CAAC,EAAE,wBAAwB,EAAE,CAAC;IAC7C,eAAe,CAAC,EAAE,wBAAwB,EAAE,CAAC;IAC7C,gBAAgB,CAAC,EAAE,yBAAyB,EAAE,CAAC;IAC/C,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAG9B,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IACpC,UAAU,EAAE,MAAM,IAAI,CAAC;IACvB;;;;OAIG;IACH,eAAe,EAAE,SAAS,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;IAGrC,aAAa,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAG5C,gBAAgB,EAAE,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAGrD,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,KAAK,EAAE,OAAO,CAAC;IAGf,SAAS,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,gBAAgB,CAAC;IACxE,kBAAkB,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACtF,wEAAwE;IACxE,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,GAAG,SAAS,KAAK,eAAe,GAAG,SAAS,CAAC;IAC5F,gBAAgB,CAAC,EAAE,CACjB,OAAO,EAAE,cAAc,EACvB,gBAAgB,CAAC,EAAE,wBAAwB,EAC3C,YAAY,CAAC,EAAE,aAAa,KACzB,aAAa,CAAC;IACnB,aAAa,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,MAAM,CAAC;IACpD,cAAc,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,MAAM,CAAC;IACrD,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;IAC5C,WAAW,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C;;;;;OAKG;IACH,eAAe,EAAE,eAAe,CAAC;IACjC;;;;OAIG;IACH,uBAAuB,EAAE,uBAAuB,CAAC;IACjD;;;;;OAKG;IACH,sBAAsB,EAAE,sBAAsB,CAAC;CAChD;AAED;;;;GAIG;AACH,eAAO,MAAM,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa,GAAG,SAAS,CAAuD,CAAC;AAKvH;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,SAAS,CAAC;IACpB,yDAAyD;IACzD,qBAAqB,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAC7D,oEAAoE;IACpE,0BAA0B,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,IAAI,KAAK,MAAM,IAAI,CAAC;IAC1G,6DAA6D;IAC7D,eAAe,EAAE,MAAM,IAAI,CAAC;CAC7B;AAED,wBAAgB,UAAU,CAAC,EACzB,QAAQ,EACR,qBAAqB,EACrB,0BAA0B,EAC1B,eAAe,GAChB,EAAE,eAAe,GAAG,KAAK,CAAC,YAAY,CAiftC"}
+{"version":3,"file":"UIContext.d.ts","sourceRoot":"","sources":["../../../../src/core/ui/UIContext.tsx"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,EAAiB,SAAS,EAAqD,MAAM,OAAO,CAAC;AAG3G,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,oEAAoE,CAAC;AACpH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+DAA+D,CAAC;AACvG,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oEAAoE,CAAC;AACxG,OAAO,EAAE,kBAAkB,EAAyB,MAAM,0BAA0B,CAAC;AACrF,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACnE,OAAO,EAAE,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,wDAAwD,CAAC;AACtG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,kEAAkE,CAAC;AAGjH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,0DAA0D,CAAC;AACzG,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AAC3G,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oEAAoE,CAAC;AACzG,OAAO,EACL,iBAAiB,EAEjB,UAAU,EAIV,cAAc,EAMd,eAAe,EACf,uBAAuB,EACvB,sBAAsB,EACtB,mBAAmB,EACpB,MAAM,qCAAqC,CAAC;AAC7C,OAAO,KAAK,EAEV,gBAAgB,EAGhB,wBAAwB,EACxB,aAAa,EACb,gBAAgB,EAChB,eAAe,EAChB,MAAM,qCAAqC,CAAC;AAa7C,OAAO,EAAE,eAAe,EAAE,MAAM,iDAAiD,CAAC;AA2HlF,MAAM,WAAW,6BAA6B;IAC5C,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,EAAE,SAAS,CAAC;IACpB,iBAAiB,CAAC,EAAE,kBAAkB,CAAC;IACvC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AA6DD,eAAO,MAAM,0BAA0B,EAAE,KAAK,CAAC,EAAE,CAAC,+BAA+B,CAsFhF,CAAC;AAMF;;;GAGG;AACH,MAAM,WAAW,aAAa;IAE5B,QAAQ,EAAG,eAAe,GAAG,SAAS,CAAC;IAGvC,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,0BAA0B,CAAC,EAAE,eAAe,CAAC,4BAA4B,CAAC,CAAC;IAC3E,yBAAyB,CAAC,EAAE,eAAe,CAAC,2BAA2B,CAAC,CAAC;IAGzE,cAAc,CAAC,EAAE,uBAAuB,EAAE,CAAC;IAC3C,eAAe,CAAC,EAAE,wBAAwB,EAAE,CAAC;IAC7C,eAAe,CAAC,EAAE,wBAAwB,EAAE,CAAC;IAC7C,gBAAgB,CAAC,EAAE,yBAAyB,EAAE,CAAC;IAC/C,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC;;;;OAIG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,aAAa,CAAC,EAAE,aAAa,CAAC;IAG9B,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,IAAI,CAAC;IACpC,UAAU,EAAE,MAAM,IAAI,CAAC;IACvB;;;;OAIG;IACH,eAAe,EAAE,SAAS,CAAC;IAC3B;;;;OAIG;IACH,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;IAGrC,aAAa,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAG5C,gBAAgB,EAAE,MAAM,eAAe,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAGrD,iBAAiB,EAAE,kBAAkB,CAAC;IACtC,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,oBAAoB,EAAE,OAAO,CAAC;IAC9B,KAAK,EAAE,OAAO,CAAC;IAGf,SAAS,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,gBAAgB,CAAC;IACxE,kBAAkB,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;IACtF,wEAAwE;IACxE,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,mBAAmB,GAAG,SAAS,KAAK,eAAe,GAAG,SAAS,CAAC;IAC5F,gBAAgB,CAAC,EAAE,CACjB,OAAO,EAAE,cAAc,EACvB,gBAAgB,CAAC,EAAE,wBAAwB,EAC3C,YAAY,CAAC,EAAE,aAAa,KACzB,aAAa,CAAC;IACnB,aAAa,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,MAAM,CAAC;IACpD,cAAc,EAAE,CAAC,KAAK,EAAE,iBAAiB,KAAK,MAAM,CAAC;IACrD,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;IAC5C,WAAW,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1C;;;;;OAKG;IACH,eAAe,EAAE,eAAe,CAAC;IACjC;;;;OAIG;IACH,uBAAuB,EAAE,uBAAuB,CAAC;IACjD;;;;;OAKG;IACH,sBAAsB,EAAE,sBAAsB,CAAC;CAChD;AAED;;;;GAIG;AACH,eAAO,MAAM,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,aAAa,GAAG,SAAS,CAAuD,CAAC;AAKvH;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,SAAS,CAAC;IACpB,yDAAyD;IACzD,qBAAqB,EAAE,yBAAyB,GAAG,SAAS,CAAC;IAC7D,oEAAoE;IACpE,0BAA0B,EAAE,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,IAAI,KAAK,MAAM,IAAI,CAAC;IAC1G,6DAA6D;IAC7D,eAAe,EAAE,MAAM,IAAI,CAAC;CAC7B;AAED,wBAAgB,UAAU,CAAC,EACzB,QAAQ,EACR,qBAAqB,EACrB,0BAA0B,EAC1B,eAAe,GAChB,EAAE,eAAe,GAAG,KAAK,CAAC,YAAY,CAiftC"}