capacitor-oidc 0.1.0 → 0.1.2

package/README.md

@@ -104,7 +104,7 @@ callback route, call `signinCallback()`; on the web logout callback route, call
 `web` or `native`, then the matching `ios` or `android` override.
 
 A runnable Keycloak-backed iOS application and its UI test live in
-[`example`](example).
+[`example`](example/).
 
 ## Documentation
 
@@ -127,7 +127,7 @@ npm run verify:android
 
 Architecture decisions and contributor constraints are documented in
 [ARCHITECTURE.md](ARCHITECTURE.md), [REQUIREMENTS.md](REQUIREMENTS.md), and
-[docs/adr](docs/adr).
+[docs/adr](docs/adr/).
 
 ## License
 

package/SECURITY.md

@@ -12,33 +12,6 @@ with PKCE and cannot contain a client secret. Native authorization and provider
 logout run in system authentication UI, never an embedded WebView; web uses
 normal browser redirect or popup navigation.
 
-## ID-token validation in `oidc-client-ts` 3.5.0
-
-The pinned `oidc-client-ts` 3.5.0 decodes ID-token claims and validates `sub`,
-`nonce`, and selected refresh-token continuity claims. It does not independently
-compare the decoded `iss`, `aud`, and `exp` claims with the configured client and
-current time. This behavior is visible in the
-[v3.5.0 ResponseValidator](https://github.com/authts/oidc-client-ts/blob/v3.5.0/src/ResponseValidator.ts)
-and is the subject of the open upstream report
-[authts/oidc-client-ts#2475](https://github.com/authts/oidc-client-ts/issues/2475).
-
-The practical exposure is narrower than an implicit-flow token parser: this
-package uses Authorization Code Flow only, and the token response comes from the
-configured token endpoint over TLS after state, nonce, and PKCE processing. The
-upstream project has not yet classified or resolved the report.
-
-This is a standards-conformance and threat-model consideration, not a categorical
-claim that every application using `oidc-client-ts` is unsafe. Consumers should
-evaluate it against their provider, reliance on ID-token claims, and assurance
-requirements. Resource servers must always validate access tokens independently;
-an application must not use unverified client-side profile claims as its API
-authorization boundary.
-
-The package will follow the upstream resolution and cover the expected behavior
-in provider integration tests before a stable v1 decision. It will not add a
-package-local JWT or cryptographic-validation layer, because duplicating protocol
-security code would expand the attack surface and create a second OIDC engine.
-
 ## Secure-storage boundary
 
 OIDC transactions and sessions are stored through iOS Keychain or an Android
@@ -59,3 +32,26 @@ absent. Their behavior must be verified in packaged applications on supported
 physical devices.
 
 See [Testing](docs/TESTING.md) for current platform and provider coverage.
+
+## Known issues
+
+### ID-token claim validation in `oidc-client-ts` 3.5.0
+
+The pinned `oidc-client-ts` 3.5.0 decodes ID-token claims and validates `sub`,
+`nonce`, and selected refresh-token continuity claims. It does not independently
+compare the decoded `iss`, `aud`, and `exp` claims with the configured client and
+current time. This behavior is visible in the
+[v3.5.0 ResponseValidator](https://github.com/authts/oidc-client-ts/blob/v3.5.0/src/ResponseValidator.ts)
+and is the subject of the unresolved upstream report
+[authts/oidc-client-ts#2475](https://github.com/authts/oidc-client-ts/issues/2475).
+
+This package uses Authorization Code Flow, so the token response comes from the
+configured token endpoint over TLS after state, nonce, and PKCE processing.
+Applications that rely on `iss`, `aud`, or `exp` claims should still evaluate
+the upstream gap against their assurance requirements. Resource servers must
+validate access tokens independently, and client-side ID-token claims must not
+be an API authorization boundary.
+
+The package will follow the upstream resolution and cover the expected behavior
+in provider integration tests before a stable v1 decision. It will not add a
+package-local JWT validation layer that would duplicate protocol security code.

package/dist/esm/configuration.js

@@ -1,4 +1,5 @@
 import { CapacitorOidcError } from './errors.js';
+import { WEB_ONLY_SETTINGS } from './user-manager-settings-policy.js';
 export function resolveConfiguration(configuration, platform) {
     if (platform === 'web')
         return resolveWebConfiguration(configuration);
@@ -61,7 +62,7 @@ function assertPublicClient(settings) {
     }
 }
 function assertNativeSettings(settings) {
-    const unsupported = ['dpop', 'monitorSession', 'silent_redirect_uri', 'stateStore', 'userStore'].find((key) => key in settings);
+    const unsupported = WEB_ONLY_SETTINGS.find((key) => key in settings);
     if (unsupported) {
         throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', `Native configuration does not support ${unsupported}`);
     }

package/dist/esm/configuration.js.map

@@ -1 +1 @@
-{"version":3,"file":"configuration.js","sourceRoot":"","sources":["../../src/configuration.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAcjD,MAAM,UAAU,oBAAoB,CAClC,aAAgD,EAChD,QAAyB;IAEzB,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO,uBAAuB,CAAC,aAAa,CAAC,CAAC;IACtE,OAAO,0BAA0B,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,QAAsC,EACtC,aAAyC,EACzC,QAAyB;IAEzB,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,kBAAkB,CAC1B,qBAAqB,EACrB,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IAED,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC7B,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;QACvB,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,4CAA4C,CAAC,CAAC;IACpG,CAAC;IAED,OAAO,2BAA2B,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,uBAAuB,CAAC,aAAgD;IAC/E,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAE1C,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,UAAU,CAAC;IAClD,MAAM,QAAQ,GAAwB,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IACnF,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC7B,IAAI,WAAW,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,8BAA8B,IAAI,CAAC,QAAQ,CAAC,wBAAwB,EAAE,CAAC;QAC9G,MAAM,IAAI,kBAAkB,CAC1B,qBAAqB,EACrB,uFAAuF,CACxF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,QAAQ;QACR,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,UAAU;QACxC,WAAW;QACX,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE;QAChC,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;KACnC,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,aAAgD,EAChD,QAA2B;IAE3B,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;IACpC,IAAI,CAAC,MAAM;QAAE,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IAEhD,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACxF,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC7B,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAE/B,OAAO,2BAA2B,CAChC,QAAQ,EACR,QAAQ,EACR,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,EAC3C,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,EACjD,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,CACpD,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAClC,QAA2B,EAC3B,QAA6B,EAC7B,aAAyC,EACzC,aAAkC,EAAE,EACpC,cAAoC,EAAE;IAEtC,OAAO;QACL,QAAQ;QACR,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE;QAC3F,aAAa;QACb,UAAU,EAAE,OAAO;QACnB,WAAW,EAAE,OAAO;QACpB,UAAU;QACV,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,WAAW,GAAG,CAAC,uBAAuB,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC,IAAI,CACjG,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,QAAQ,CACzB,CAAC;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,gDAAgD,WAAW,EAAE,CAAC,CAAC;IACrH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,IAAI,CACnG,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,QAAQ,CACzB,CAAC;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,yCAAyC,WAAW,EAAE,CAAC,CAAC;IAC9G,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAyB;IACzD,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,MAAM,QAAQ,6BAA6B,CAAC,CAAC;AACnG,CAAC","sourcesContent":["import type { UserManagerSettings } from 'oidc-client-ts';\n\nimport type {\n  CapacitorOidcNativeOptions,\n  CapacitorSigninArgs,\n  CapacitorSignoutArgs,\n  CapacitorUserManagerConfiguration,\n  CapacitorUserManagerSettings,\n} from './definitions.js';\nimport { CapacitorOidcError } from './errors.js';\n\nexport type RuntimePlatform = 'android' | 'ios' | 'web';\n\nexport interface ResolvedUserManagerConfiguration {\n  platform: RuntimePlatform;\n  settings: UserManagerSettings;\n  nativeOptions?: CapacitorOidcNativeOptions;\n  signinMode: 'popup' | 'redirect';\n  signoutMode: 'popup' | 'redirect';\n  signinArgs: CapacitorSigninArgs;\n  signoutArgs: CapacitorSignoutArgs;\n}\n\nexport function resolveConfiguration(\n  configuration: CapacitorUserManagerConfiguration,\n  platform: RuntimePlatform,\n): ResolvedUserManagerConfiguration {\n  if (platform === 'web') return resolveWebConfiguration(configuration);\n  return resolveNativeConfiguration(configuration, platform);\n}\n\nexport function resolveLegacyNativeConfiguration(\n  settings: CapacitorUserManagerSettings,\n  nativeOptions: CapacitorOidcNativeOptions,\n  platform: RuntimePlatform,\n): ResolvedUserManagerConfiguration {\n  if (platform === 'web') {\n    throw new CapacitorOidcError(\n      'UNSUPPORTED_RUNTIME',\n      'Legacy CapacitorUserManager settings are only supported on iOS and Android',\n    );\n  }\n\n  assertPublicClient(settings);\n  if ('dpop' in settings) {\n    throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', 'Native configuration does not support dpop');\n  }\n\n  return resolvedNativeConfiguration(platform, settings, nativeOptions);\n}\n\nfunction resolveWebConfiguration(configuration: CapacitorUserManagerConfiguration): ResolvedUserManagerConfiguration {\n  const web = configuration.web;\n  if (!web) unsupportedConfiguration('web');\n\n  const signoutMode = web.signoutMode ?? 'redirect';\n  const settings: UserManagerSettings = { ...configuration.common, ...web.settings };\n  assertPublicClient(settings);\n  if (signoutMode === 'popup' && !settings.popup_post_logout_redirect_uri && !settings.post_logout_redirect_uri) {\n    throw new CapacitorOidcError(\n      'UNSUPPORTED_RUNTIME',\n      'Web popup signout requires post_logout_redirect_uri or popup_post_logout_redirect_uri',\n    );\n  }\n\n  return {\n    platform: 'web',\n    settings,\n    signinMode: web.signinMode ?? 'redirect',\n    signoutMode,\n    signinArgs: web.signinArgs ?? {},\n    signoutArgs: web.signoutArgs ?? {},\n  };\n}\n\nfunction resolveNativeConfiguration(\n  configuration: CapacitorUserManagerConfiguration,\n  platform: 'android' | 'ios',\n): ResolvedUserManagerConfiguration {\n  const native = configuration.native;\n  if (!native) unsupportedConfiguration(platform);\n\n  const override = configuration[platform];\n  const settings = { ...configuration.common, ...native.settings, ...override?.settings };\n  assertPublicClient(settings);\n  assertNativeSettings(settings);\n\n  return resolvedNativeConfiguration(\n    platform,\n    settings,\n    { ...native.options, ...override?.options },\n    { ...native.signinArgs, ...override?.signinArgs },\n    { ...native.signoutArgs, ...override?.signoutArgs },\n  );\n}\n\nfunction resolvedNativeConfiguration(\n  platform: 'android' | 'ios',\n  settings: UserManagerSettings,\n  nativeOptions: CapacitorOidcNativeOptions,\n  signinArgs: CapacitorSigninArgs = {},\n  signoutArgs: CapacitorSignoutArgs = {},\n): ResolvedUserManagerConfiguration {\n  return {\n    platform,\n    settings: { ...settings, response_type: 'code', disablePKCE: false, monitorSession: false },\n    nativeOptions,\n    signinMode: 'popup',\n    signoutMode: 'popup',\n    signinArgs,\n    signoutArgs,\n  };\n}\n\nfunction assertPublicClient(settings: object): void {\n  const unsupported = ['client_authentication', 'client_secret', 'disablePKCE', 'response_type'].find(\n    (key) => key in settings,\n  );\n  if (unsupported) {\n    throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', `Public-client configuration does not support ${unsupported}`);\n  }\n}\n\nfunction assertNativeSettings(settings: object): void {\n  const unsupported = ['dpop', 'monitorSession', 'silent_redirect_uri', 'stateStore', 'userStore'].find(\n    (key) => key in settings,\n  );\n  if (unsupported) {\n    throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', `Native configuration does not support ${unsupported}`);\n  }\n}\n\nfunction unsupportedConfiguration(platform: RuntimePlatform): never {\n  throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', `No ${platform} configuration was provided`);\n}\n"]}
+{"version":3,"file":"configuration.js","sourceRoot":"","sources":["../../src/configuration.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AActE,MAAM,UAAU,oBAAoB,CAClC,aAAgD,EAChD,QAAyB;IAEzB,IAAI,QAAQ,KAAK,KAAK;QAAE,OAAO,uBAAuB,CAAC,aAAa,CAAC,CAAC;IACtE,OAAO,0BAA0B,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC9C,QAAsC,EACtC,aAAyC,EACzC,QAAyB;IAEzB,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,kBAAkB,CAC1B,qBAAqB,EACrB,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IAED,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC7B,IAAI,MAAM,IAAI,QAAQ,EAAE,CAAC;QACvB,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,4CAA4C,CAAC,CAAC;IACpG,CAAC;IAED,OAAO,2BAA2B,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,uBAAuB,CAAC,aAAgD;IAC/E,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG,CAAC;IAC9B,IAAI,CAAC,GAAG;QAAE,wBAAwB,CAAC,KAAK,CAAC,CAAC;IAE1C,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,UAAU,CAAC;IAClD,MAAM,QAAQ,GAAwB,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;IACnF,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC7B,IAAI,WAAW,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,8BAA8B,IAAI,CAAC,QAAQ,CAAC,wBAAwB,EAAE,CAAC;QAC9G,MAAM,IAAI,kBAAkB,CAC1B,qBAAqB,EACrB,uFAAuF,CACxF,CAAC;IACJ,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,KAAK;QACf,QAAQ;QACR,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,UAAU;QACxC,WAAW;QACX,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE;QAChC,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;KACnC,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,aAAgD,EAChD,QAA2B;IAE3B,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC;IACpC,IAAI,CAAC,MAAM;QAAE,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IAEhD,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACxF,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAC7B,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IAE/B,OAAO,2BAA2B,CAChC,QAAQ,EACR,QAAQ,EACR,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,EAC3C,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,EACjD,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,CACpD,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAClC,QAA2B,EAC3B,QAA6B,EAC7B,aAAyC,EACzC,aAAkC,EAAE,EACpC,cAAoC,EAAE;IAEtC,OAAO;QACL,QAAQ;QACR,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE;QAC3F,aAAa;QACb,UAAU,EAAE,OAAO;QACnB,WAAW,EAAE,OAAO;QACpB,UAAU;QACV,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,MAAM,WAAW,GAAG,CAAC,uBAAuB,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC,IAAI,CACjG,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,QAAQ,CACzB,CAAC;IACF,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,gDAAgD,WAAW,EAAE,CAAC,CAAC;IACrH,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,QAAgB;IAC5C,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,QAAQ,CAAC,CAAC;IACrE,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,yCAAyC,WAAW,EAAE,CAAC,CAAC;IAC9G,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAyB;IACzD,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,MAAM,QAAQ,6BAA6B,CAAC,CAAC;AACnG,CAAC","sourcesContent":["import type { UserManagerSettings } from 'oidc-client-ts';\n\nimport type {\n  CapacitorOidcNativeOptions,\n  CapacitorSigninArgs,\n  CapacitorSignoutArgs,\n  CapacitorUserManagerConfiguration,\n  CapacitorUserManagerSettings,\n} from './definitions.js';\nimport { CapacitorOidcError } from './errors.js';\nimport { WEB_ONLY_SETTINGS } from './user-manager-settings-policy.js';\n\nexport type RuntimePlatform = 'android' | 'ios' | 'web';\n\nexport interface ResolvedUserManagerConfiguration {\n  platform: RuntimePlatform;\n  settings: UserManagerSettings;\n  nativeOptions?: CapacitorOidcNativeOptions;\n  signinMode: 'popup' | 'redirect';\n  signoutMode: 'popup' | 'redirect';\n  signinArgs: CapacitorSigninArgs;\n  signoutArgs: CapacitorSignoutArgs;\n}\n\nexport function resolveConfiguration(\n  configuration: CapacitorUserManagerConfiguration,\n  platform: RuntimePlatform,\n): ResolvedUserManagerConfiguration {\n  if (platform === 'web') return resolveWebConfiguration(configuration);\n  return resolveNativeConfiguration(configuration, platform);\n}\n\nexport function resolveLegacyNativeConfiguration(\n  settings: CapacitorUserManagerSettings,\n  nativeOptions: CapacitorOidcNativeOptions,\n  platform: RuntimePlatform,\n): ResolvedUserManagerConfiguration {\n  if (platform === 'web') {\n    throw new CapacitorOidcError(\n      'UNSUPPORTED_RUNTIME',\n      'Legacy CapacitorUserManager settings are only supported on iOS and Android',\n    );\n  }\n\n  assertPublicClient(settings);\n  if ('dpop' in settings) {\n    throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', 'Native configuration does not support dpop');\n  }\n\n  return resolvedNativeConfiguration(platform, settings, nativeOptions);\n}\n\nfunction resolveWebConfiguration(configuration: CapacitorUserManagerConfiguration): ResolvedUserManagerConfiguration {\n  const web = configuration.web;\n  if (!web) unsupportedConfiguration('web');\n\n  const signoutMode = web.signoutMode ?? 'redirect';\n  const settings: UserManagerSettings = { ...configuration.common, ...web.settings };\n  assertPublicClient(settings);\n  if (signoutMode === 'popup' && !settings.popup_post_logout_redirect_uri && !settings.post_logout_redirect_uri) {\n    throw new CapacitorOidcError(\n      'UNSUPPORTED_RUNTIME',\n      'Web popup signout requires post_logout_redirect_uri or popup_post_logout_redirect_uri',\n    );\n  }\n\n  return {\n    platform: 'web',\n    settings,\n    signinMode: web.signinMode ?? 'redirect',\n    signoutMode,\n    signinArgs: web.signinArgs ?? {},\n    signoutArgs: web.signoutArgs ?? {},\n  };\n}\n\nfunction resolveNativeConfiguration(\n  configuration: CapacitorUserManagerConfiguration,\n  platform: 'android' | 'ios',\n): ResolvedUserManagerConfiguration {\n  const native = configuration.native;\n  if (!native) unsupportedConfiguration(platform);\n\n  const override = configuration[platform];\n  const settings = { ...configuration.common, ...native.settings, ...override?.settings };\n  assertPublicClient(settings);\n  assertNativeSettings(settings);\n\n  return resolvedNativeConfiguration(\n    platform,\n    settings,\n    { ...native.options, ...override?.options },\n    { ...native.signinArgs, ...override?.signinArgs },\n    { ...native.signoutArgs, ...override?.signoutArgs },\n  );\n}\n\nfunction resolvedNativeConfiguration(\n  platform: 'android' | 'ios',\n  settings: UserManagerSettings,\n  nativeOptions: CapacitorOidcNativeOptions,\n  signinArgs: CapacitorSigninArgs = {},\n  signoutArgs: CapacitorSignoutArgs = {},\n): ResolvedUserManagerConfiguration {\n  return {\n    platform,\n    settings: { ...settings, response_type: 'code', disablePKCE: false, monitorSession: false },\n    nativeOptions,\n    signinMode: 'popup',\n    signoutMode: 'popup',\n    signinArgs,\n    signoutArgs,\n  };\n}\n\nfunction assertPublicClient(settings: object): void {\n  const unsupported = ['client_authentication', 'client_secret', 'disablePKCE', 'response_type'].find(\n    (key) => key in settings,\n  );\n  if (unsupported) {\n    throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', `Public-client configuration does not support ${unsupported}`);\n  }\n}\n\nfunction assertNativeSettings(settings: object): void {\n  const unsupported = WEB_ONLY_SETTINGS.find((key) => key in settings);\n  if (unsupported) {\n    throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', `Native configuration does not support ${unsupported}`);\n  }\n}\n\nfunction unsupportedConfiguration(platform: RuntimePlatform): never {\n  throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', `No ${platform} configuration was provided`);\n}\n"]}

package/dist/esm/definitions.d.ts

@@ -1,4 +1,5 @@
 import type { SigninPopupArgs, SigninRedirectArgs, SignoutPopupArgs, SignoutRedirectArgs, UserManagerSettings } from 'oidc-client-ts';
+import type { WebOnlySetting } from './user-manager-settings-policy.js';
 export type CapacitorOidcErrorCode = 'AUTH_SESSION_IN_PROGRESS' | 'USER_CANCELLED' | 'BROWSER_UNAVAILABLE' | 'INVALID_CALLBACK' | 'SECURE_STORAGE_ERROR' | 'UNSUPPORTED_RUNTIME';
 export interface IOSNativeOptions {
     keychainAccessGroup?: string;
@@ -11,12 +12,11 @@ export interface CapacitorOidcNativeOptions {
 }
 type UnsafePublicClientSettings = 'client_secret' | 'client_authentication' | 'disablePKCE' | 'response_type';
 type LegacyUnsupportedSettings = UnsafePublicClientSettings | 'dpop' | 'monitorSession' | 'silent_redirect_uri' | 'stateStore' | 'userStore';
-type WebOnlySettings = 'checkSessionIntervalInSeconds' | 'dpop' | 'iframeNotifyParentOrigin' | 'iframeScriptOrigin' | 'includeIdTokenInSilentSignout' | 'monitorAnonymousSession' | 'monitorSession' | 'popup_post_logout_redirect_uri' | 'popup_redirect_uri' | 'popupWindowFeatures' | 'popupWindowTarget' | 'query_status_response_type' | 'redirectMethod' | 'redirectTarget' | 'silent_redirect_uri' | 'silentRequestTimeoutInSeconds' | 'stateStore' | 'stopCheckSessionOnError' | 'userStore';
 type PublicClientUserManagerSettings = Omit<UserManagerSettings, UnsafePublicClientSettings>;
-type NativeUserManagerSettings = Omit<PublicClientUserManagerSettings, WebOnlySettings>;
+type NativeUserManagerSettings = Omit<PublicClientUserManagerSettings, WebOnlySetting>;
 /** @deprecated Use CapacitorUserManagerConfiguration. */
 export type CapacitorUserManagerSettings = Omit<UserManagerSettings, LegacyUnsupportedSettings>;
-export type CapacitorUserManagerCommonSettings = Omit<PublicClientUserManagerSettings, WebOnlySettings | 'post_logout_redirect_uri' | 'redirect_uri'>;
+export type CapacitorUserManagerCommonSettings = Omit<PublicClientUserManagerSettings, WebOnlySetting | 'post_logout_redirect_uri' | 'redirect_uri'>;
 export type CapacitorWebUserManagerSettings = Partial<Omit<PublicClientUserManagerSettings, 'redirect_uri'>> & {
     redirect_uri: string;
 };

package/dist/esm/definitions.js.map

@@ -1 +1 @@
-{"version":3,"file":"definitions.js","sourceRoot":"","sources":["../../src/definitions.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  SigninPopupArgs,\n  SigninRedirectArgs,\n  SignoutPopupArgs,\n  SignoutRedirectArgs,\n  UserManagerSettings,\n} from 'oidc-client-ts';\n\nexport type CapacitorOidcErrorCode =\n  | 'AUTH_SESSION_IN_PROGRESS'\n  | 'USER_CANCELLED'\n  | 'BROWSER_UNAVAILABLE'\n  | 'INVALID_CALLBACK'\n  | 'SECURE_STORAGE_ERROR'\n  | 'UNSUPPORTED_RUNTIME';\n\nexport interface IOSNativeOptions {\n  keychainAccessGroup?: string;\n  keychainAccessibility?: 'afterFirstUnlockThisDeviceOnly' | 'whenUnlockedThisDeviceOnly';\n}\n\nexport interface CapacitorOidcNativeOptions {\n  ios?: IOSNativeOptions;\n  prefersEphemeralWebBrowserSession?: boolean;\n  storageNamespace?: string;\n}\n\ntype UnsafePublicClientSettings = 'client_secret' | 'client_authentication' | 'disablePKCE' | 'response_type';\n\ntype LegacyUnsupportedSettings =\n  | UnsafePublicClientSettings\n  | 'dpop'\n  | 'monitorSession'\n  | 'silent_redirect_uri'\n  | 'stateStore'\n  | 'userStore';\n\ntype WebOnlySettings =\n  | 'checkSessionIntervalInSeconds'\n  | 'dpop'\n  | 'iframeNotifyParentOrigin'\n  | 'iframeScriptOrigin'\n  | 'includeIdTokenInSilentSignout'\n  | 'monitorAnonymousSession'\n  | 'monitorSession'\n  | 'popup_post_logout_redirect_uri'\n  | 'popup_redirect_uri'\n  | 'popupWindowFeatures'\n  | 'popupWindowTarget'\n  | 'query_status_response_type'\n  | 'redirectMethod'\n  | 'redirectTarget'\n  | 'silent_redirect_uri'\n  | 'silentRequestTimeoutInSeconds'\n  | 'stateStore'\n  | 'stopCheckSessionOnError'\n  | 'userStore';\n\ntype PublicClientUserManagerSettings = Omit<UserManagerSettings, UnsafePublicClientSettings>;\ntype NativeUserManagerSettings = Omit<PublicClientUserManagerSettings, WebOnlySettings>;\n\n/** @deprecated Use CapacitorUserManagerConfiguration. */\nexport type CapacitorUserManagerSettings = Omit<UserManagerSettings, LegacyUnsupportedSettings>;\n\nexport type CapacitorUserManagerCommonSettings = Omit<\n  PublicClientUserManagerSettings,\n  WebOnlySettings | 'post_logout_redirect_uri' | 'redirect_uri'\n>;\n\nexport type CapacitorWebUserManagerSettings = Partial<Omit<PublicClientUserManagerSettings, 'redirect_uri'>> & {\n  redirect_uri: string;\n};\n\nexport type CapacitorNativeUserManagerSettings = Partial<Omit<NativeUserManagerSettings, 'redirect_uri'>> & {\n  redirect_uri: string;\n};\n\nexport type CapacitorSigninArgs = SigninPopupArgs & SigninRedirectArgs;\nexport type CapacitorSignoutArgs = SignoutPopupArgs & SignoutRedirectArgs;\n\ninterface CapacitorWebUserManagerConfigurationBase {\n  settings: CapacitorWebUserManagerSettings;\n  signinMode?: 'popup' | 'redirect';\n  signinArgs?: CapacitorSigninArgs;\n  signoutArgs?: CapacitorSignoutArgs;\n}\n\ntype PopupSignoutSettings = CapacitorWebUserManagerSettings &\n  ({ popup_post_logout_redirect_uri: string } | { post_logout_redirect_uri: string });\n\nexport type CapacitorWebUserManagerConfiguration =\n  | (CapacitorWebUserManagerConfigurationBase & {\n      signoutMode: 'popup';\n      settings: PopupSignoutSettings;\n    })\n  | (CapacitorWebUserManagerConfigurationBase & {\n      signoutMode?: 'redirect';\n    });\n\nexport interface CapacitorNativeUserManagerConfiguration {\n  settings: CapacitorNativeUserManagerSettings;\n  options?: CapacitorOidcNativeOptions;\n  signinArgs?: CapacitorSigninArgs;\n  signoutArgs?: CapacitorSignoutArgs;\n}\n\nexport interface CapacitorNativeUserManagerOverride {\n  settings?: Partial<CapacitorNativeUserManagerSettings>;\n  options?: CapacitorOidcNativeOptions;\n  signinArgs?: CapacitorSigninArgs;\n  signoutArgs?: CapacitorSignoutArgs;\n}\n\nexport interface CapacitorUserManagerConfiguration {\n  common: CapacitorUserManagerCommonSettings;\n  web?: CapacitorWebUserManagerConfiguration;\n  native?: CapacitorNativeUserManagerConfiguration;\n  ios?: CapacitorNativeUserManagerOverride;\n  android?: CapacitorNativeUserManagerOverride;\n}\n\nexport interface StoredSessionV1 {\n  version: 1;\n  issuer: string;\n  clientId: string;\n  accessToken: string;\n  refreshToken?: string;\n  idToken?: string;\n  tokenType: string;\n  scope?: string;\n  expiresAt?: number;\n}\n\nexport interface NativeOpenOptions {\n  url: string;\n  callbackUrl: string;\n  prefersEphemeralWebBrowserSession: boolean;\n}\n\nexport interface NativeStorageOptions {\n  namespace: string;\n  key: string;\n}\n\nexport interface CapacitorOidcPlugin {\n  configure(options: IOSNativeOptions): Promise<void>;\n  open(options: NativeOpenOptions): Promise<{ url: string }>;\n  cancel(): Promise<void>;\n  storageSet(options: NativeStorageOptions & { value: string }): Promise<void>;\n  storageGet(options: NativeStorageOptions): Promise<{ value: string | null }>;\n  storageRemove(options: NativeStorageOptions): Promise<{ value: string | null }>;\n  storageGetAllKeys(options: { namespace: string }): Promise<{ keys: string[] }>;\n  setSessionSnapshot(options: { namespace: string; value: string | null }): Promise<void>;\n}\n"]}
+{"version":3,"file":"definitions.js","sourceRoot":"","sources":["../../src/definitions.ts"],"names":[],"mappings":"","sourcesContent":["import type {\n  SigninPopupArgs,\n  SigninRedirectArgs,\n  SignoutPopupArgs,\n  SignoutRedirectArgs,\n  UserManagerSettings,\n} from 'oidc-client-ts';\n\nimport type { WebOnlySetting } from './user-manager-settings-policy.js';\n\nexport type CapacitorOidcErrorCode =\n  | 'AUTH_SESSION_IN_PROGRESS'\n  | 'USER_CANCELLED'\n  | 'BROWSER_UNAVAILABLE'\n  | 'INVALID_CALLBACK'\n  | 'SECURE_STORAGE_ERROR'\n  | 'UNSUPPORTED_RUNTIME';\n\nexport interface IOSNativeOptions {\n  keychainAccessGroup?: string;\n  keychainAccessibility?: 'afterFirstUnlockThisDeviceOnly' | 'whenUnlockedThisDeviceOnly';\n}\n\nexport interface CapacitorOidcNativeOptions {\n  ios?: IOSNativeOptions;\n  prefersEphemeralWebBrowserSession?: boolean;\n  storageNamespace?: string;\n}\n\ntype UnsafePublicClientSettings = 'client_secret' | 'client_authentication' | 'disablePKCE' | 'response_type';\n\ntype LegacyUnsupportedSettings =\n  | UnsafePublicClientSettings\n  | 'dpop'\n  | 'monitorSession'\n  | 'silent_redirect_uri'\n  | 'stateStore'\n  | 'userStore';\n\ntype PublicClientUserManagerSettings = Omit<UserManagerSettings, UnsafePublicClientSettings>;\ntype NativeUserManagerSettings = Omit<PublicClientUserManagerSettings, WebOnlySetting>;\n\n/** @deprecated Use CapacitorUserManagerConfiguration. */\nexport type CapacitorUserManagerSettings = Omit<UserManagerSettings, LegacyUnsupportedSettings>;\n\nexport type CapacitorUserManagerCommonSettings = Omit<\n  PublicClientUserManagerSettings,\n  WebOnlySetting | 'post_logout_redirect_uri' | 'redirect_uri'\n>;\n\nexport type CapacitorWebUserManagerSettings = Partial<Omit<PublicClientUserManagerSettings, 'redirect_uri'>> & {\n  redirect_uri: string;\n};\n\nexport type CapacitorNativeUserManagerSettings = Partial<Omit<NativeUserManagerSettings, 'redirect_uri'>> & {\n  redirect_uri: string;\n};\n\nexport type CapacitorSigninArgs = SigninPopupArgs & SigninRedirectArgs;\nexport type CapacitorSignoutArgs = SignoutPopupArgs & SignoutRedirectArgs;\n\ninterface CapacitorWebUserManagerConfigurationBase {\n  settings: CapacitorWebUserManagerSettings;\n  signinMode?: 'popup' | 'redirect';\n  signinArgs?: CapacitorSigninArgs;\n  signoutArgs?: CapacitorSignoutArgs;\n}\n\ntype PopupSignoutSettings = CapacitorWebUserManagerSettings &\n  ({ popup_post_logout_redirect_uri: string } | { post_logout_redirect_uri: string });\n\nexport type CapacitorWebUserManagerConfiguration =\n  | (CapacitorWebUserManagerConfigurationBase & {\n      signoutMode: 'popup';\n      settings: PopupSignoutSettings;\n    })\n  | (CapacitorWebUserManagerConfigurationBase & {\n      signoutMode?: 'redirect';\n    });\n\nexport interface CapacitorNativeUserManagerConfiguration {\n  settings: CapacitorNativeUserManagerSettings;\n  options?: CapacitorOidcNativeOptions;\n  signinArgs?: CapacitorSigninArgs;\n  signoutArgs?: CapacitorSignoutArgs;\n}\n\nexport interface CapacitorNativeUserManagerOverride {\n  settings?: Partial<CapacitorNativeUserManagerSettings>;\n  options?: CapacitorOidcNativeOptions;\n  signinArgs?: CapacitorSigninArgs;\n  signoutArgs?: CapacitorSignoutArgs;\n}\n\nexport interface CapacitorUserManagerConfiguration {\n  common: CapacitorUserManagerCommonSettings;\n  web?: CapacitorWebUserManagerConfiguration;\n  native?: CapacitorNativeUserManagerConfiguration;\n  ios?: CapacitorNativeUserManagerOverride;\n  android?: CapacitorNativeUserManagerOverride;\n}\n\nexport interface StoredSessionV1 {\n  version: 1;\n  issuer: string;\n  clientId: string;\n  accessToken: string;\n  refreshToken?: string;\n  idToken?: string;\n  tokenType: string;\n  scope?: string;\n  expiresAt?: number;\n}\n\nexport interface NativeOpenOptions {\n  url: string;\n  callbackUrl: string;\n  prefersEphemeralWebBrowserSession: boolean;\n}\n\nexport interface NativeStorageOptions {\n  namespace: string;\n  key: string;\n}\n\nexport interface CapacitorOidcPlugin {\n  configure(options: IOSNativeOptions): Promise<void>;\n  open(options: NativeOpenOptions): Promise<{ url: string }>;\n  cancel(): Promise<void>;\n  storageSet(options: NativeStorageOptions & { value: string }): Promise<void>;\n  storageGet(options: NativeStorageOptions): Promise<{ value: string | null }>;\n  storageRemove(options: NativeStorageOptions): Promise<{ value: string | null }>;\n  storageGetAllKeys(options: { namespace: string }): Promise<{ keys: string[] }>;\n  setSessionSnapshot(options: { namespace: string; value: string | null }): Promise<void>;\n}\n"]}

package/dist/esm/user-manager-settings-policy.d.ts

@@ -0,0 +1,2 @@
+export declare const WEB_ONLY_SETTINGS: readonly ["checkSessionIntervalInSeconds", "dpop", "iframeNotifyParentOrigin", "iframeScriptOrigin", "includeIdTokenInSilentSignout", "monitorAnonymousSession", "monitorSession", "popup_post_logout_redirect_uri", "popup_redirect_uri", "popupWindowFeatures", "popupWindowTarget", "query_status_response_type", "redirectMethod", "redirectTarget", "silent_redirect_uri", "silentRequestTimeoutInSeconds", "stateStore", "stopCheckSessionOnError", "userStore"];
+export type WebOnlySetting = (typeof WEB_ONLY_SETTINGS)[number];

package/dist/esm/user-manager-settings-policy.js

@@ -0,0 +1,22 @@
+export const WEB_ONLY_SETTINGS = [
+    'checkSessionIntervalInSeconds',
+    'dpop',
+    'iframeNotifyParentOrigin',
+    'iframeScriptOrigin',
+    'includeIdTokenInSilentSignout',
+    'monitorAnonymousSession',
+    'monitorSession',
+    'popup_post_logout_redirect_uri',
+    'popup_redirect_uri',
+    'popupWindowFeatures',
+    'popupWindowTarget',
+    'query_status_response_type',
+    'redirectMethod',
+    'redirectTarget',
+    'silent_redirect_uri',
+    'silentRequestTimeoutInSeconds',
+    'stateStore',
+    'stopCheckSessionOnError',
+    'userStore',
+];
+//# sourceMappingURL=user-manager-settings-policy.js.map

package/dist/esm/user-manager-settings-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-manager-settings-policy.js","sourceRoot":"","sources":["../../src/user-manager-settings-policy.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,+BAA+B;IAC/B,MAAM;IACN,0BAA0B;IAC1B,oBAAoB;IACpB,+BAA+B;IAC/B,yBAAyB;IACzB,gBAAgB;IAChB,gCAAgC;IAChC,oBAAoB;IACpB,qBAAqB;IACrB,mBAAmB;IACnB,4BAA4B;IAC5B,gBAAgB;IAChB,gBAAgB;IAChB,qBAAqB;IACrB,+BAA+B;IAC/B,YAAY;IACZ,yBAAyB;IACzB,WAAW;CACH,CAAC","sourcesContent":["export const WEB_ONLY_SETTINGS = [\n  'checkSessionIntervalInSeconds',\n  'dpop',\n  'iframeNotifyParentOrigin',\n  'iframeScriptOrigin',\n  'includeIdTokenInSilentSignout',\n  'monitorAnonymousSession',\n  'monitorSession',\n  'popup_post_logout_redirect_uri',\n  'popup_redirect_uri',\n  'popupWindowFeatures',\n  'popupWindowTarget',\n  'query_status_response_type',\n  'redirectMethod',\n  'redirectTarget',\n  'silent_redirect_uri',\n  'silentRequestTimeoutInSeconds',\n  'stateStore',\n  'stopCheckSessionOnError',\n  'userStore',\n] as const;\n\nexport type WebOnlySetting = (typeof WEB_ONLY_SETTINGS)[number];\n"]}

package/dist/plugin.cjs

@@ -118,6 +118,28 @@ class BaseCapacitorUserManager extends oidcClientTs.UserManager {
     }
 }
 
+const WEB_ONLY_SETTINGS = [
+    'checkSessionIntervalInSeconds',
+    'dpop',
+    'iframeNotifyParentOrigin',
+    'iframeScriptOrigin',
+    'includeIdTokenInSilentSignout',
+    'monitorAnonymousSession',
+    'monitorSession',
+    'popup_post_logout_redirect_uri',
+    'popup_redirect_uri',
+    'popupWindowFeatures',
+    'popupWindowTarget',
+    'query_status_response_type',
+    'redirectMethod',
+    'redirectTarget',
+    'silent_redirect_uri',
+    'silentRequestTimeoutInSeconds',
+    'stateStore',
+    'stopCheckSessionOnError',
+    'userStore',
+];
+
 function resolveConfiguration(configuration, platform) {
     if (platform === 'web')
         return resolveWebConfiguration(configuration);
@@ -180,7 +202,7 @@ function assertPublicClient(settings) {
     }
 }
 function assertNativeSettings(settings) {
-    const unsupported = ['dpop', 'monitorSession', 'silent_redirect_uri', 'stateStore', 'userStore'].find((key) => key in settings);
+    const unsupported = WEB_ONLY_SETTINGS.find((key) => key in settings);
     if (unsupported) {
         throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', `Native configuration does not support ${unsupported}`);
     }

package/dist/plugin.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.cjs","sources":["esm/errors.js","esm/base-capacitor-user-manager.js","esm/configuration.js","esm/capacitor-user-manager.js","esm/native.js","esm/capacitor-navigator.js","esm/capacitor-secure-state-store.js","esm/native-capacitor-user-manager.js","esm/web-capacitor-user-manager.js","esm/index.js"],"sourcesContent":["export class CapacitorOidcError extends Error {\n    code;\n    constructor(code, message) {\n        super(message);\n        this.code = code;\n        this.name = 'CapacitorOidcError';\n    }\n}\nexport function unsupported(feature) {\n    throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', `${feature} is not available in a native Capacitor runtime`);\n}\n//# sourceMappingURL=errors.js.map","import { UserManager, } from 'oidc-client-ts';\nimport { unsupported } from './errors.js';\nexport class BaseCapacitorUserManager extends UserManager {\n    automaticRenewalPromise;\n    refreshPromise;\n    signinMode;\n    signoutMode;\n    defaultSigninArgs;\n    defaultSignoutArgs;\n    constructor(configuration, redirectNavigator, popupNavigator, iframeNavigator) {\n        super(configuration.settings, redirectNavigator, popupNavigator, iframeNavigator);\n        this.signinMode = configuration.signinMode;\n        this.signoutMode = configuration.signoutMode;\n        this.defaultSigninArgs = configuration.signinArgs;\n        this.defaultSignoutArgs = configuration.signoutArgs;\n    }\n    async initialize() {\n        await this.getUser();\n    }\n    async signin(args = {}) {\n        const mergedArgs = { ...this.defaultSigninArgs, ...args };\n        if (this.signinMode === 'redirect')\n            return this.signinRedirect(mergedArgs);\n        await this.signinPopup(mergedArgs);\n    }\n    async signout(args = {}) {\n        const mergedArgs = { ...this.defaultSignoutArgs, ...args };\n        if (this.signoutMode === 'redirect')\n            return this.signoutRedirect(mergedArgs);\n        await this.signoutPopup(mergedArgs);\n    }\n    async getValidUser(minimumValiditySeconds = 60) {\n        const user = await this.getUser();\n        if (!user)\n            return null;\n        if (user.expires_in === undefined || user.expires_in > minimumValiditySeconds)\n            return user;\n        return this.signinSilent();\n    }\n    async signinPopup(args = {}) {\n        await this.waitForRenewal();\n        return super.signinPopup(args);\n    }\n    async signoutPopup(args = {}) {\n        await this.waitForRenewal();\n        await super.signoutPopup(args);\n    }\n    async signinRedirect(args = {}) {\n        await this.waitForRenewal();\n        await super.signinRedirect(args);\n    }\n    async signoutRedirect(args = {}) {\n        await this.waitForRenewal();\n        await super.signoutRedirect(args);\n    }\n    signinSilent(args = {}) {\n        if (!this.refreshPromise) {\n            const refresh = this.performSilentSignin(args);\n            this.refreshPromise = refresh.finally(() => {\n                this.refreshPromise = undefined;\n            });\n        }\n        return this.refreshPromise;\n    }\n    async signinResourceOwnerCredentials(_args) {\n        unsupported('Resource Owner Password Credentials');\n    }\n    async removeUser() {\n        await this.waitForRenewal();\n        await this.removeUserWithoutWaiting();\n    }\n    cancel() {\n        return Promise.resolve();\n    }\n    async dispose() {\n        this.stopSilentRenew();\n        await this.disposePlatform();\n        await this.waitForRenewal();\n        await this.cancel();\n    }\n    performSilentSignin(args) {\n        return super.signinSilent(args);\n    }\n    removeUserWithoutWaiting() {\n        return super.removeUser();\n    }\n    checkForAutomaticRenewal() {\n        if (!this.settings.automaticSilentRenew || this.automaticRenewalPromise)\n            return;\n        const renewal = this.getValidUser();\n        this.automaticRenewalPromise = renewal;\n        void renewal\n            .catch((error) => this.events._raiseSilentRenewError(error instanceof Error ? error : new Error('Silent renewal failed')))\n            .finally(() => {\n            if (this.automaticRenewalPromise === renewal)\n                this.automaticRenewalPromise = undefined;\n        });\n    }\n    async waitForRenewal() {\n        await this.automaticRenewalPromise?.catch(() => undefined);\n        await this.refreshPromise?.catch(() => undefined);\n    }\n}\n//# sourceMappingURL=base-capacitor-user-manager.js.map","import { CapacitorOidcError } from './errors.js';\nexport function resolveConfiguration(configuration, platform) {\n    if (platform === 'web')\n        return resolveWebConfiguration(configuration);\n    return resolveNativeConfiguration(configuration, platform);\n}\nexport function resolveLegacyNativeConfiguration(settings, nativeOptions, platform) {\n    if (platform === 'web') {\n        throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', 'Legacy CapacitorUserManager settings are only supported on iOS and Android');\n    }\n    assertPublicClient(settings);\n    if ('dpop' in settings) {\n        throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', 'Native configuration does not support dpop');\n    }\n    return resolvedNativeConfiguration(platform, settings, nativeOptions);\n}\nfunction resolveWebConfiguration(configuration) {\n    const web = configuration.web;\n    if (!web)\n        unsupportedConfiguration('web');\n    const signoutMode = web.signoutMode ?? 'redirect';\n    const settings = { ...configuration.common, ...web.settings };\n    assertPublicClient(settings);\n    if (signoutMode === 'popup' && !settings.popup_post_logout_redirect_uri && !settings.post_logout_redirect_uri) {\n        throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', 'Web popup signout requires post_logout_redirect_uri or popup_post_logout_redirect_uri');\n    }\n    return {\n        platform: 'web',\n        settings,\n        signinMode: web.signinMode ?? 'redirect',\n        signoutMode,\n        signinArgs: web.signinArgs ?? {},\n        signoutArgs: web.signoutArgs ?? {},\n    };\n}\nfunction resolveNativeConfiguration(configuration, platform) {\n    const native = configuration.native;\n    if (!native)\n        unsupportedConfiguration(platform);\n    const override = configuration[platform];\n    const settings = { ...configuration.common, ...native.settings, ...override?.settings };\n    assertPublicClient(settings);\n    assertNativeSettings(settings);\n    return resolvedNativeConfiguration(platform, settings, { ...native.options, ...override?.options }, { ...native.signinArgs, ...override?.signinArgs }, { ...native.signoutArgs, ...override?.signoutArgs });\n}\nfunction resolvedNativeConfiguration(platform, settings, nativeOptions, signinArgs = {}, signoutArgs = {}) {\n    return {\n        platform,\n        settings: { ...settings, response_type: 'code', disablePKCE: false, monitorSession: false },\n        nativeOptions,\n        signinMode: 'popup',\n        signoutMode: 'popup',\n        signinArgs,\n        signoutArgs,\n    };\n}\nfunction assertPublicClient(settings) {\n    const unsupported = ['client_authentication', 'client_secret', 'disablePKCE', 'response_type'].find((key) => key in settings);\n    if (unsupported) {\n        throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', `Public-client configuration does not support ${unsupported}`);\n    }\n}\nfunction assertNativeSettings(settings) {\n    const unsupported = ['dpop', 'monitorSession', 'silent_redirect_uri', 'stateStore', 'userStore'].find((key) => key in settings);\n    if (unsupported) {\n        throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', `Native configuration does not support ${unsupported}`);\n    }\n}\nfunction unsupportedConfiguration(platform) {\n    throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', `No ${platform} configuration was provided`);\n}\n//# sourceMappingURL=configuration.js.map","import { Capacitor } from '@capacitor/core';\nimport { BaseCapacitorUserManager } from './base-capacitor-user-manager.js';\nimport { resolveConfiguration, resolveLegacyNativeConfiguration, } from './configuration.js';\nimport { CapacitorOidcError } from './errors.js';\nexport class CapacitorUserManager extends BaseCapacitorUserManager {\n    static async create(configuration, nativeOptions = {}) {\n        assertRuntime();\n        const platform = currentPlatform();\n        const resolved = 'redirect_uri' in configuration\n            ? resolveLegacyNativeConfiguration(configuration, nativeOptions, platform)\n            : resolveConfiguration(configuration, platform);\n        const manager = await platformUserManagerFactory(resolved);\n        await manager.initialize();\n        return manager;\n    }\n}\nlet platformUserManagerFactory;\nexport function setPlatformUserManagerFactory(factory) {\n    platformUserManagerFactory = factory;\n}\nfunction currentPlatform() {\n    const platform = Capacitor.getPlatform();\n    return platform === 'ios' || platform === 'android' ? platform : 'web';\n}\nfunction assertRuntime() {\n    if (!globalThis.crypto?.subtle || !globalThis.crypto.getRandomValues) {\n        throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', 'Web Crypto is required by oidc-client-ts');\n    }\n}\n//# sourceMappingURL=capacitor-user-manager.js.map","import { registerPlugin } from '@capacitor/core';\nexport const NativeOidc = registerPlugin('CapacitorOidc');\n//# sourceMappingURL=native.js.map","import { CapacitorOidcError, unsupported } from './errors.js';\nimport { NativeOidc } from './native.js';\nexport class CapacitorNavigator {\n    prefersEphemeralWebBrowserSession;\n    constructor(prefersEphemeralWebBrowserSession) {\n        this.prefersEphemeralWebBrowserSession = prefersEphemeralWebBrowserSession;\n    }\n    async prepare() {\n        return new CapacitorWindow(this.prefersEphemeralWebBrowserSession);\n    }\n    async callback() {\n        unsupported('Navigator callbacks');\n    }\n}\nclass CapacitorWindow {\n    prefersEphemeralWebBrowserSession;\n    constructor(prefersEphemeralWebBrowserSession) {\n        this.prefersEphemeralWebBrowserSession = prefersEphemeralWebBrowserSession;\n    }\n    async navigate({ url }) {\n        assertSecureRequestUrl(url);\n        const callbackUrl = callbackUrlFromRequest(url);\n        const response = await NativeOidc.open({\n            url,\n            callbackUrl,\n            prefersEphemeralWebBrowserSession: this.prefersEphemeralWebBrowserSession,\n        });\n        if (!isExpectedCallback(response.url, callbackUrl)) {\n            throw new CapacitorOidcError('INVALID_CALLBACK', 'The authentication callback does not match the configured redirect URI');\n        }\n        return response;\n    }\n    close() {\n        void NativeOidc.cancel();\n    }\n}\nexport function assertSecureRequestUrl(requestUrl) {\n    const url = new URL(requestUrl);\n    const isHttpLoopback = url.protocol === 'http:' &&\n        (url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname === '[::1]');\n    if (url.protocol !== 'https:' && !isHttpLoopback) {\n        throw new CapacitorOidcError('BROWSER_UNAVAILABLE', 'OIDC authorization and logout endpoints must use HTTPS');\n    }\n}\nexport function callbackUrlFromRequest(requestUrl) {\n    const url = new URL(requestUrl);\n    const callback = url.searchParams.get('post_logout_redirect_uri') ??\n        url.searchParams.get('logout_uri') ??\n        url.searchParams.get('redirect_uri');\n    if (!callback) {\n        throw new CapacitorOidcError('INVALID_CALLBACK', 'The OIDC request does not contain a callback URI');\n    }\n    return callback;\n}\nexport function isExpectedCallback(actualValue, expectedValue) {\n    const actual = new URL(actualValue);\n    const expected = new URL(expectedValue);\n    return (actual.protocol.toLowerCase() === expected.protocol.toLowerCase() &&\n        actual.host.toLowerCase() === expected.host.toLowerCase() &&\n        actual.pathname === expected.pathname);\n}\nexport class UnsupportedIframeNavigator {\n    async prepare() {\n        unsupported('Iframe navigation');\n    }\n    async callback() {\n        unsupported('Iframe navigation');\n    }\n}\n//# sourceMappingURL=capacitor-navigator.js.map","import { NativeOidc } from './native.js';\nexport class CapacitorSecureStateStore {\n    namespace;\n    constructor(namespace) {\n        this.namespace = namespace;\n    }\n    async set(key, value) {\n        await NativeOidc.storageSet({ namespace: this.namespace, key, value });\n    }\n    async get(key) {\n        return (await NativeOidc.storageGet({ namespace: this.namespace, key })).value;\n    }\n    async remove(key) {\n        return (await NativeOidc.storageRemove({ namespace: this.namespace, key })).value;\n    }\n    async getAllKeys() {\n        return (await NativeOidc.storageGetAllKeys({ namespace: this.namespace })).keys;\n    }\n}\n//# sourceMappingURL=capacitor-secure-state-store.js.map","import { App } from '@capacitor/app';\nimport { ErrorResponse, } from 'oidc-client-ts';\nimport { CapacitorNavigator, UnsupportedIframeNavigator } from './capacitor-navigator.js';\nimport { CapacitorSecureStateStore } from './capacitor-secure-state-store.js';\nimport { CapacitorUserManager } from './capacitor-user-manager.js';\nimport { unsupported } from './errors.js';\nimport { NativeOidc } from './native.js';\nexport class NativeCapacitorUserManager extends CapacitorUserManager {\n    appStateListener;\n    storageNamespace;\n    constructor(configuration) {\n        const storageNamespace = configuration.nativeOptions?.storageNamespace ?? 'default';\n        const stateStore = new CapacitorSecureStateStore(`${storageNamespace}.transactions`);\n        const userStore = new CapacitorSecureStateStore(`${storageNamespace}.session`);\n        const navigator = new CapacitorNavigator(configuration.nativeOptions?.prefersEphemeralWebBrowserSession ?? false);\n        super({\n            ...configuration,\n            settings: {\n                ...configuration.settings,\n                popup_redirect_uri: configuration.settings.redirect_uri,\n                popup_post_logout_redirect_uri: configuration.settings.post_logout_redirect_uri,\n                stateStore,\n                userStore,\n            },\n        }, navigator, navigator, new UnsupportedIframeNavigator());\n        this.storageNamespace = storageNamespace;\n    }\n    static async fromConfiguration(configuration) {\n        await NativeOidc.configure(configuration.nativeOptions?.ios ?? {});\n        return new NativeCapacitorUserManager(configuration);\n    }\n    async initialize() {\n        await super.initialize();\n        this.appStateListener = await App.addListener('appStateChange', ({ isActive }) => {\n            if (isActive)\n                this.checkForAutomaticRenewal();\n        });\n        this.checkForAutomaticRenewal();\n    }\n    async signinRedirect(_args = {}) {\n        unsupported('Redirect navigation');\n    }\n    async signinRedirectCallback(_url) {\n        unsupported('Redirect navigation');\n    }\n    async signinCallback(_url) {\n        unsupported('Browser callback dispatch');\n    }\n    async signinSilentCallback(_url) {\n        unsupported('Iframe navigation');\n    }\n    async signoutRedirect(_args = {}) {\n        unsupported('Redirect navigation');\n    }\n    async signoutRedirectCallback(_url) {\n        unsupported('Redirect navigation');\n    }\n    async signoutCallback(_url, _keepOpen) {\n        unsupported('Browser callback dispatch');\n    }\n    async signoutSilent(_args = {}) {\n        unsupported('Iframe logout');\n    }\n    async signoutSilentCallback(_url) {\n        unsupported('Iframe logout');\n    }\n    async querySessionStatus(_args = {}) {\n        unsupported('Browser session monitoring');\n    }\n    async storeUser(user) {\n        await super.storeUser(user);\n        await NativeOidc.setSessionSnapshot({\n            namespace: this.storageNamespace,\n            value: user\n                ? JSON.stringify(toStoredSession(user, user.profile.iss ?? this.settings.metadata?.issuer ?? this.settings.authority, this.settings.client_id))\n                : null,\n        });\n    }\n    cancel() {\n        return NativeOidc.cancel();\n    }\n    async disposePlatform() {\n        await this.appStateListener?.remove();\n    }\n    async performSilentSignin(args) {\n        const user = await this.getUser();\n        if (!user?.refresh_token) {\n            if (user?.expired)\n                await this.removeUserWithoutWaiting();\n            return null;\n        }\n        return super.performSilentSignin({ ...args, forceIframeAuth: false }).catch(async (error) => {\n            if (error instanceof ErrorResponse && error.error === 'invalid_grant')\n                await this.removeUserWithoutWaiting();\n            throw error;\n        });\n    }\n}\nfunction toStoredSession(user, issuer, clientId) {\n    return {\n        version: 1,\n        issuer,\n        clientId,\n        accessToken: user.access_token,\n        refreshToken: user.refresh_token,\n        idToken: user.id_token,\n        tokenType: user.token_type,\n        scope: user.scope,\n        expiresAt: user.expires_at,\n    };\n}\n//# sourceMappingURL=native-capacitor-user-manager.js.map","import { CapacitorUserManager } from './capacitor-user-manager.js';\nexport class WebCapacitorUserManager extends CapacitorUserManager {\n    sessionMonitor;\n    disposed = false;\n    constructor(configuration) {\n        super(configuration);\n        this.sessionMonitor = this.captureSessionMonitor();\n    }\n    async querySessionStatus(args = {}) {\n        if (this.disposed)\n            return null;\n        const session = await super.querySessionStatus(args);\n        return this.disposed ? null : session;\n    }\n    disposePlatform() {\n        this.disposed = true;\n        if (this.sessionMonitor) {\n            this.events.removeUserLoaded(this.sessionMonitor.start);\n            this.events.removeUserUnloaded(this.sessionMonitor.stop);\n            this.sessionMonitor.stop();\n        }\n        return Promise.resolve();\n    }\n    captureSessionMonitor() {\n        // oidc-client-ts does not expose public session-monitor lifecycle hooks.\n        const monitor = this._sessionMonitor;\n        if (!monitor)\n            return undefined;\n        const originalStart = monitor._start;\n        const stop = monitor._stop;\n        const start = async (user) => {\n            if (this.disposed)\n                return;\n            await originalStart(user);\n            if (this.disposed)\n                stop();\n        };\n        this.events.removeUserLoaded(originalStart);\n        this.events.addUserLoaded(start);\n        monitor._start = start;\n        return { start, stop };\n    }\n}\n//# sourceMappingURL=web-capacitor-user-manager.js.map","import { CapacitorUserManager, setPlatformUserManagerFactory } from './capacitor-user-manager.js';\nimport { NativeCapacitorUserManager } from './native-capacitor-user-manager.js';\nimport { WebCapacitorUserManager } from './web-capacitor-user-manager.js';\nsetPlatformUserManagerFactory((configuration) => configuration.platform === 'web'\n    ? new WebCapacitorUserManager(configuration)\n    : NativeCapacitorUserManager.fromConfiguration(configuration));\nexport { CapacitorUserManager };\nexport { CapacitorSecureStateStore } from './capacitor-secure-state-store.js';\nexport { CapacitorOidcError } from './errors.js';\nexport { User, WebStorageStateStore } from 'oidc-client-ts';\n//# sourceMappingURL=index.js.map"],"names":["UserManager","Capacitor","registerPlugin","App","ErrorResponse"],"mappings":";;;;;;AAAO,MAAM,kBAAkB,SAAS,KAAK,CAAC;AAC9C,IAAI,IAAI;AACR,IAAI,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE;AAC/B,QAAQ,KAAK,CAAC,OAAO,CAAC;AACtB,QAAQ,IAAI,CAAC,IAAI,GAAG,IAAI;AACxB,QAAQ,IAAI,CAAC,IAAI,GAAG,oBAAoB;AACxC,IAAI;AACJ;AACO,SAAS,WAAW,CAAC,OAAO,EAAE;AACrC,IAAI,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,CAAC,EAAE,OAAO,CAAC,+CAA+C,CAAC,CAAC;AACpH;;ACRO,MAAM,wBAAwB,SAASA,wBAAW,CAAC;AAC1D,IAAI,uBAAuB;AAC3B,IAAI,cAAc;AAClB,IAAI,UAAU;AACd,IAAI,WAAW;AACf,IAAI,iBAAiB;AACrB,IAAI,kBAAkB;AACtB,IAAI,WAAW,CAAC,aAAa,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE;AACnF,QAAQ,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,CAAC;AACzF,QAAQ,IAAI,CAAC,UAAU,GAAG,aAAa,CAAC,UAAU;AAClD,QAAQ,IAAI,CAAC,WAAW,GAAG,aAAa,CAAC,WAAW;AACpD,QAAQ,IAAI,CAAC,iBAAiB,GAAG,aAAa,CAAC,UAAU;AACzD,QAAQ,IAAI,CAAC,kBAAkB,GAAG,aAAa,CAAC,WAAW;AAC3D,IAAI;AACJ,IAAI,MAAM,UAAU,GAAG;AACvB,QAAQ,MAAM,IAAI,CAAC,OAAO,EAAE;AAC5B,IAAI;AACJ,IAAI,MAAM,MAAM,CAAC,IAAI,GAAG,EAAE,EAAE;AAC5B,QAAQ,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC,iBAAiB,EAAE,GAAG,IAAI,EAAE;AACjE,QAAQ,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU;AAC1C,YAAY,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC;AAClD,QAAQ,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC;AAC1C,IAAI;AACJ,IAAI,MAAM,OAAO,CAAC,IAAI,GAAG,EAAE,EAAE;AAC7B,QAAQ,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC,kBAAkB,EAAE,GAAG,IAAI,EAAE;AAClE,QAAQ,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU;AAC3C,YAAY,OAAO,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC;AACnD,QAAQ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC;AAC3C,IAAI;AACJ,IAAI,MAAM,YAAY,CAAC,sBAAsB,GAAG,EAAE,EAAE;AACpD,QAAQ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE;AACzC,QAAQ,IAAI,CAAC,IAAI;AACjB,YAAY,OAAO,IAAI;AACvB,QAAQ,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,GAAG,sBAAsB;AACrF,YAAY,OAAO,IAAI;AACvB,QAAQ,OAAO,IAAI,CAAC,YAAY,EAAE;AAClC,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,IAAI,GAAG,EAAE,EAAE;AACjC,QAAQ,MAAM,IAAI,CAAC,cAAc,EAAE;AACnC,QAAQ,OAAO,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;AACtC,IAAI;AACJ,IAAI,MAAM,YAAY,CAAC,IAAI,GAAG,EAAE,EAAE;AAClC,QAAQ,MAAM,IAAI,CAAC,cAAc,EAAE;AACnC,QAAQ,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC;AACtC,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,IAAI,GAAG,EAAE,EAAE;AACpC,QAAQ,MAAM,IAAI,CAAC,cAAc,EAAE;AACnC,QAAQ,MAAM,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC;AACxC,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,IAAI,GAAG,EAAE,EAAE;AACrC,QAAQ,MAAM,IAAI,CAAC,cAAc,EAAE;AACnC,QAAQ,MAAM,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC;AACzC,IAAI;AACJ,IAAI,YAAY,CAAC,IAAI,GAAG,EAAE,EAAE;AAC5B,QAAQ,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;AAClC,YAAY,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;AAC1D,YAAY,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM;AACxD,gBAAgB,IAAI,CAAC,cAAc,GAAG,SAAS;AAC/C,YAAY,CAAC,CAAC;AACd,QAAQ;AACR,QAAQ,OAAO,IAAI,CAAC,cAAc;AAClC,IAAI;AACJ,IAAI,MAAM,8BAA8B,CAAC,KAAK,EAAE;AAChD,QAAQ,WAAW,CAAC,qCAAqC,CAAC;AAC1D,IAAI;AACJ,IAAI,MAAM,UAAU,GAAG;AACvB,QAAQ,MAAM,IAAI,CAAC,cAAc,EAAE;AACnC,QAAQ,MAAM,IAAI,CAAC,wBAAwB,EAAE;AAC7C,IAAI;AACJ,IAAI,MAAM,GAAG;AACb,QAAQ,OAAO,OAAO,CAAC,OAAO,EAAE;AAChC,IAAI;AACJ,IAAI,MAAM,OAAO,GAAG;AACpB,QAAQ,IAAI,CAAC,eAAe,EAAE;AAC9B,QAAQ,MAAM,IAAI,CAAC,eAAe,EAAE;AACpC,QAAQ,MAAM,IAAI,CAAC,cAAc,EAAE;AACnC,QAAQ,MAAM,IAAI,CAAC,MAAM,EAAE;AAC3B,IAAI;AACJ,IAAI,mBAAmB,CAAC,IAAI,EAAE;AAC9B,QAAQ,OAAO,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC;AACvC,IAAI;AACJ,IAAI,wBAAwB,GAAG;AAC/B,QAAQ,OAAO,KAAK,CAAC,UAAU,EAAE;AACjC,IAAI;AACJ,IAAI,wBAAwB,GAAG;AAC/B,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,IAAI,IAAI,CAAC,uBAAuB;AAC/E,YAAY;AACZ,QAAQ,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE;AAC3C,QAAQ,IAAI,CAAC,uBAAuB,GAAG,OAAO;AAC9C,QAAQ,KAAK;AACb,aAAa,KAAK,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,KAAK,YAAY,KAAK,GAAG,KAAK,GAAG,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;AACrI,aAAa,OAAO,CAAC,MAAM;AAC3B,YAAY,IAAI,IAAI,CAAC,uBAAuB,KAAK,OAAO;AACxD,gBAAgB,IAAI,CAAC,uBAAuB,GAAG,SAAS;AACxD,QAAQ,CAAC,CAAC;AACV,IAAI;AACJ,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,MAAM,IAAI,CAAC,uBAAuB,EAAE,KAAK,CAAC,MAAM,SAAS,CAAC;AAClE,QAAQ,MAAM,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,SAAS,CAAC;AACzD,IAAI;AACJ;;ACrGO,SAAS,oBAAoB,CAAC,aAAa,EAAE,QAAQ,EAAE;AAC9D,IAAI,IAAI,QAAQ,KAAK,KAAK;AAC1B,QAAQ,OAAO,uBAAuB,CAAC,aAAa,CAAC;AACrD,IAAI,OAAO,0BAA0B,CAAC,aAAa,EAAE,QAAQ,CAAC;AAC9D;AACO,SAAS,gCAAgC,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE;AACpF,IAAI,IAAI,QAAQ,KAAK,KAAK,EAAE;AAC5B,QAAQ,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,4EAA4E,CAAC;AACzI,IAAI;AACJ,IAAI,kBAAkB,CAAC,QAAQ,CAAC;AAChC,IAAI,IAAI,MAAM,IAAI,QAAQ,EAAE;AAC5B,QAAQ,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,4CAA4C,CAAC;AACzG,IAAI;AACJ,IAAI,OAAO,2BAA2B,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC;AACzE;AACA,SAAS,uBAAuB,CAAC,aAAa,EAAE;AAChD,IAAI,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG;AACjC,IAAI,IAAI,CAAC,GAAG;AACZ,QAAQ,wBAAwB,CAAC,KAAK,CAAC;AACvC,IAAI,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,UAAU;AACrD,IAAI,MAAM,QAAQ,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE;AACjE,IAAI,kBAAkB,CAAC,QAAQ,CAAC;AAChC,IAAI,IAAI,WAAW,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,8BAA8B,IAAI,CAAC,QAAQ,CAAC,wBAAwB,EAAE;AACnH,QAAQ,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,uFAAuF,CAAC;AACpJ,IAAI;AACJ,IAAI,OAAO;AACX,QAAQ,QAAQ,EAAE,KAAK;AACvB,QAAQ,QAAQ;AAChB,QAAQ,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,UAAU;AAChD,QAAQ,WAAW;AACnB,QAAQ,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE;AACxC,QAAQ,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;AAC1C,KAAK;AACL;AACA,SAAS,0BAA0B,CAAC,aAAa,EAAE,QAAQ,EAAE;AAC7D,IAAI,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM;AACvC,IAAI,IAAI,CAAC,MAAM;AACf,QAAQ,wBAAwB,CAAC,QAAQ,CAAC;AAC1C,IAAI,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC;AAC5C,IAAI,MAAM,QAAQ,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE;AAC3F,IAAI,kBAAkB,CAAC,QAAQ,CAAC;AAChC,IAAI,oBAAoB,CAAC,QAAQ,CAAC;AAClC,IAAI,OAAO,2BAA2B,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,CAAC;AAC/M;AACA,SAAS,2BAA2B,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,WAAW,GAAG,EAAE,EAAE;AAC3G,IAAI,OAAO;AACX,QAAQ,QAAQ;AAChB,QAAQ,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE;AACnG,QAAQ,aAAa;AACrB,QAAQ,UAAU,EAAE,OAAO;AAC3B,QAAQ,WAAW,EAAE,OAAO;AAC5B,QAAQ,UAAU;AAClB,QAAQ,WAAW;AACnB,KAAK;AACL;AACA,SAAS,kBAAkB,CAAC,QAAQ,EAAE;AACtC,IAAI,MAAM,WAAW,GAAG,CAAC,uBAAuB,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,QAAQ,CAAC;AACjI,IAAI,IAAI,WAAW,EAAE;AACrB,QAAQ,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,CAAC,6CAA6C,EAAE,WAAW,CAAC,CAAC,CAAC;AAC1H,IAAI;AACJ;AACA,SAAS,oBAAoB,CAAC,QAAQ,EAAE;AACxC,IAAI,MAAM,WAAW,GAAG,CAAC,MAAM,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,QAAQ,CAAC;AACnI,IAAI,IAAI,WAAW,EAAE;AACrB,QAAQ,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,CAAC,sCAAsC,EAAE,WAAW,CAAC,CAAC,CAAC;AACnH,IAAI;AACJ;AACA,SAAS,wBAAwB,CAAC,QAAQ,EAAE;AAC5C,IAAI,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,2BAA2B,CAAC,CAAC;AACpG;;AClEO,MAAM,oBAAoB,SAAS,wBAAwB,CAAC;AACnE,IAAI,aAAa,MAAM,CAAC,aAAa,EAAE,aAAa,GAAG,EAAE,EAAE;AAC3D,QAAQ,aAAa,EAAE;AACvB,QAAQ,MAAM,QAAQ,GAAG,eAAe,EAAE;AAC1C,QAAQ,MAAM,QAAQ,GAAG,cAAc,IAAI;AAC3C,cAAc,gCAAgC,CAAC,aAAa,EAAE,aAAa,EAAE,QAAQ;AACrF,cAAc,oBAAoB,CAAC,aAAa,EAAE,QAAQ,CAAC;AAC3D,QAAQ,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC,QAAQ,CAAC;AAClE,QAAQ,MAAM,OAAO,CAAC,UAAU,EAAE;AAClC,QAAQ,OAAO,OAAO;AACtB,IAAI;AACJ;AACA,IAAI,0BAA0B;AACvB,SAAS,6BAA6B,CAAC,OAAO,EAAE;AACvD,IAAI,0BAA0B,GAAG,OAAO;AACxC;AACA,SAAS,eAAe,GAAG;AAC3B,IAAI,MAAM,QAAQ,GAAGC,cAAS,CAAC,WAAW,EAAE;AAC5C,IAAI,OAAO,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,SAAS,GAAG,QAAQ,GAAG,KAAK;AAC1E;AACA,SAAS,aAAa,GAAG;AACzB,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,eAAe,EAAE;AAC1E,QAAQ,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,0CAA0C,CAAC;AACvG,IAAI;AACJ;;AC3BO,MAAM,UAAU,GAAGC,mBAAc,CAAC,eAAe,CAAC;;ACClD,MAAM,kBAAkB,CAAC;AAChC,IAAI,iCAAiC;AACrC,IAAI,WAAW,CAAC,iCAAiC,EAAE;AACnD,QAAQ,IAAI,CAAC,iCAAiC,GAAG,iCAAiC;AAClF,IAAI;AACJ,IAAI,MAAM,OAAO,GAAG;AACpB,QAAQ,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,iCAAiC,CAAC;AAC1E,IAAI;AACJ,IAAI,MAAM,QAAQ,GAAG;AACrB,QAAQ,WAAW,CAAC,qBAAqB,CAAC;AAC1C,IAAI;AACJ;AACA,MAAM,eAAe,CAAC;AACtB,IAAI,iCAAiC;AACrC,IAAI,WAAW,CAAC,iCAAiC,EAAE;AACnD,QAAQ,IAAI,CAAC,iCAAiC,GAAG,iCAAiC;AAClF,IAAI;AACJ,IAAI,MAAM,QAAQ,CAAC,EAAE,GAAG,EAAE,EAAE;AAC5B,QAAQ,sBAAsB,CAAC,GAAG,CAAC;AACnC,QAAQ,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC;AACvD,QAAQ,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC;AAC/C,YAAY,GAAG;AACf,YAAY,WAAW;AACvB,YAAY,iCAAiC,EAAE,IAAI,CAAC,iCAAiC;AACrF,SAAS,CAAC;AACV,QAAQ,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE;AAC5D,YAAY,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,wEAAwE,CAAC;AACtI,QAAQ;AACR,QAAQ,OAAO,QAAQ;AACvB,IAAI;AACJ,IAAI,KAAK,GAAG;AACZ,QAAQ,KAAK,UAAU,CAAC,MAAM,EAAE;AAChC,IAAI;AACJ;AACO,SAAS,sBAAsB,CAAC,UAAU,EAAE;AACnD,IAAI,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC;AACnC,IAAI,MAAM,cAAc,GAAG,GAAG,CAAC,QAAQ,KAAK,OAAO;AACnD,SAAS,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;AAClG,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,cAAc,EAAE;AACtD,QAAQ,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,wDAAwD,CAAC;AACrH,IAAI;AACJ;AACO,SAAS,sBAAsB,CAAC,UAAU,EAAE;AACnD,IAAI,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC;AACnC,IAAI,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,0BAA0B,CAAC;AACrE,QAAQ,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC;AAC1C,QAAQ,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC;AAC5C,IAAI,IAAI,CAAC,QAAQ,EAAE;AACnB,QAAQ,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,kDAAkD,CAAC;AAC5G,IAAI;AACJ,IAAI,OAAO,QAAQ;AACnB;AACO,SAAS,kBAAkB,CAAC,WAAW,EAAE,aAAa,EAAE;AAC/D,IAAI,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC;AACvC,IAAI,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC;AAC3C,IAAI,QAAQ,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE;AAC7E,QAAQ,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE;AACjE,QAAQ,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;AAC7C;AACO,MAAM,0BAA0B,CAAC;AACxC,IAAI,MAAM,OAAO,GAAG;AACpB,QAAQ,WAAW,CAAC,mBAAmB,CAAC;AACxC,IAAI;AACJ,IAAI,MAAM,QAAQ,GAAG;AACrB,QAAQ,WAAW,CAAC,mBAAmB,CAAC;AACxC,IAAI;AACJ;;ACnEO,MAAM,yBAAyB,CAAC;AACvC,IAAI,SAAS;AACb,IAAI,WAAW,CAAC,SAAS,EAAE;AAC3B,QAAQ,IAAI,CAAC,SAAS,GAAG,SAAS;AAClC,IAAI;AACJ,IAAI,MAAM,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE;AAC1B,QAAQ,MAAM,UAAU,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AAC9E,IAAI;AACJ,IAAI,MAAM,GAAG,CAAC,GAAG,EAAE;AACnB,QAAQ,OAAO,CAAC,MAAM,UAAU,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK;AACtF,IAAI;AACJ,IAAI,MAAM,MAAM,CAAC,GAAG,EAAE;AACtB,QAAQ,OAAO,CAAC,MAAM,UAAU,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK;AACzF,IAAI;AACJ,IAAI,MAAM,UAAU,GAAG;AACvB,QAAQ,OAAO,CAAC,MAAM,UAAU,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI;AACvF,IAAI;AACJ;;ACXO,MAAM,0BAA0B,SAAS,oBAAoB,CAAC;AACrE,IAAI,gBAAgB;AACpB,IAAI,gBAAgB;AACpB,IAAI,WAAW,CAAC,aAAa,EAAE;AAC/B,QAAQ,MAAM,gBAAgB,GAAG,aAAa,CAAC,aAAa,EAAE,gBAAgB,IAAI,SAAS;AAC3F,QAAQ,MAAM,UAAU,GAAG,IAAI,yBAAyB,CAAC,CAAC,EAAE,gBAAgB,CAAC,aAAa,CAAC,CAAC;AAC5F,QAAQ,MAAM,SAAS,GAAG,IAAI,yBAAyB,CAAC,CAAC,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;AACtF,QAAQ,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAAC,aAAa,CAAC,aAAa,EAAE,iCAAiC,IAAI,KAAK,CAAC;AACzH,QAAQ,KAAK,CAAC;AACd,YAAY,GAAG,aAAa;AAC5B,YAAY,QAAQ,EAAE;AACtB,gBAAgB,GAAG,aAAa,CAAC,QAAQ;AACzC,gBAAgB,kBAAkB,EAAE,aAAa,CAAC,QAAQ,CAAC,YAAY;AACvE,gBAAgB,8BAA8B,EAAE,aAAa,CAAC,QAAQ,CAAC,wBAAwB;AAC/F,gBAAgB,UAAU;AAC1B,gBAAgB,SAAS;AACzB,aAAa;AACb,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,0BAA0B,EAAE,CAAC;AAClE,QAAQ,IAAI,CAAC,gBAAgB,GAAG,gBAAgB;AAChD,IAAI;AACJ,IAAI,aAAa,iBAAiB,CAAC,aAAa,EAAE;AAClD,QAAQ,MAAM,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,aAAa,EAAE,GAAG,IAAI,EAAE,CAAC;AAC1E,QAAQ,OAAO,IAAI,0BAA0B,CAAC,aAAa,CAAC;AAC5D,IAAI;AACJ,IAAI,MAAM,UAAU,GAAG;AACvB,QAAQ,MAAM,KAAK,CAAC,UAAU,EAAE;AAChC,QAAQ,IAAI,CAAC,gBAAgB,GAAG,MAAMC,OAAG,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK;AAC1F,YAAY,IAAI,QAAQ;AACxB,gBAAgB,IAAI,CAAC,wBAAwB,EAAE;AAC/C,QAAQ,CAAC,CAAC;AACV,QAAQ,IAAI,CAAC,wBAAwB,EAAE;AACvC,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,KAAK,GAAG,EAAE,EAAE;AACrC,QAAQ,WAAW,CAAC,qBAAqB,CAAC;AAC1C,IAAI;AACJ,IAAI,MAAM,sBAAsB,CAAC,IAAI,EAAE;AACvC,QAAQ,WAAW,CAAC,qBAAqB,CAAC;AAC1C,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,IAAI,EAAE;AAC/B,QAAQ,WAAW,CAAC,2BAA2B,CAAC;AAChD,IAAI;AACJ,IAAI,MAAM,oBAAoB,CAAC,IAAI,EAAE;AACrC,QAAQ,WAAW,CAAC,mBAAmB,CAAC;AACxC,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,KAAK,GAAG,EAAE,EAAE;AACtC,QAAQ,WAAW,CAAC,qBAAqB,CAAC;AAC1C,IAAI;AACJ,IAAI,MAAM,uBAAuB,CAAC,IAAI,EAAE;AACxC,QAAQ,WAAW,CAAC,qBAAqB,CAAC;AAC1C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE;AAC3C,QAAQ,WAAW,CAAC,2BAA2B,CAAC;AAChD,IAAI;AACJ,IAAI,MAAM,aAAa,CAAC,KAAK,GAAG,EAAE,EAAE;AACpC,QAAQ,WAAW,CAAC,eAAe,CAAC;AACpC,IAAI;AACJ,IAAI,MAAM,qBAAqB,CAAC,IAAI,EAAE;AACtC,QAAQ,WAAW,CAAC,eAAe,CAAC;AACpC,IAAI;AACJ,IAAI,MAAM,kBAAkB,CAAC,KAAK,GAAG,EAAE,EAAE;AACzC,QAAQ,WAAW,CAAC,4BAA4B,CAAC;AACjD,IAAI;AACJ,IAAI,MAAM,SAAS,CAAC,IAAI,EAAE;AAC1B,QAAQ,MAAM,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC;AACnC,QAAQ,MAAM,UAAU,CAAC,kBAAkB,CAAC;AAC5C,YAAY,SAAS,EAAE,IAAI,CAAC,gBAAgB;AAC5C,YAAY,KAAK,EAAE;AACnB,kBAAkB,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;AAC9J,kBAAkB,IAAI;AACtB,SAAS,CAAC;AACV,IAAI;AACJ,IAAI,MAAM,GAAG;AACb,QAAQ,OAAO,UAAU,CAAC,MAAM,EAAE;AAClC,IAAI;AACJ,IAAI,MAAM,eAAe,GAAG;AAC5B,QAAQ,MAAM,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE;AAC7C,IAAI;AACJ,IAAI,MAAM,mBAAmB,CAAC,IAAI,EAAE;AACpC,QAAQ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE;AACzC,QAAQ,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE;AAClC,YAAY,IAAI,IAAI,EAAE,OAAO;AAC7B,gBAAgB,MAAM,IAAI,CAAC,wBAAwB,EAAE;AACrD,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,OAAO,KAAK,CAAC,mBAAmB,CAAC,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK;AACrG,YAAY,IAAI,KAAK,YAAYC,0BAAa,IAAI,KAAK,CAAC,KAAK,KAAK,eAAe;AACjF,gBAAgB,MAAM,IAAI,CAAC,wBAAwB,EAAE;AACrD,YAAY,MAAM,KAAK;AACvB,QAAQ,CAAC,CAAC;AACV,IAAI;AACJ;AACA,SAAS,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE;AACjD,IAAI,OAAO;AACX,QAAQ,OAAO,EAAE,CAAC;AAClB,QAAQ,MAAM;AACd,QAAQ,QAAQ;AAChB,QAAQ,WAAW,EAAE,IAAI,CAAC,YAAY;AACtC,QAAQ,YAAY,EAAE,IAAI,CAAC,aAAa;AACxC,QAAQ,OAAO,EAAE,IAAI,CAAC,QAAQ;AAC9B,QAAQ,SAAS,EAAE,IAAI,CAAC,UAAU;AAClC,QAAQ,KAAK,EAAE,IAAI,CAAC,KAAK;AACzB,QAAQ,SAAS,EAAE,IAAI,CAAC,UAAU;AAClC,KAAK;AACL;;AC7GO,MAAM,uBAAuB,SAAS,oBAAoB,CAAC;AAClE,IAAI,cAAc;AAClB,IAAI,QAAQ,GAAG,KAAK;AACpB,IAAI,WAAW,CAAC,aAAa,EAAE;AAC/B,QAAQ,KAAK,CAAC,aAAa,CAAC;AAC5B,QAAQ,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,qBAAqB,EAAE;AAC1D,IAAI;AACJ,IAAI,MAAM,kBAAkB,CAAC,IAAI,GAAG,EAAE,EAAE;AACxC,QAAQ,IAAI,IAAI,CAAC,QAAQ;AACzB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC;AAC5D,QAAQ,OAAO,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,OAAO;AAC7C,IAAI;AACJ,IAAI,eAAe,GAAG;AACtB,QAAQ,IAAI,CAAC,QAAQ,GAAG,IAAI;AAC5B,QAAQ,IAAI,IAAI,CAAC,cAAc,EAAE;AACjC,YAAY,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;AACnE,YAAY,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;AACpE,YAAY,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE;AACtC,QAAQ;AACR,QAAQ,OAAO,OAAO,CAAC,OAAO,EAAE;AAChC,IAAI;AACJ,IAAI,qBAAqB,GAAG;AAC5B;AACA,QAAQ,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe;AAC5C,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,SAAS;AAC5B,QAAQ,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM;AAC5C,QAAQ,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK;AAClC,QAAQ,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK;AACtC,YAAY,IAAI,IAAI,CAAC,QAAQ;AAC7B,gBAAgB;AAChB,YAAY,MAAM,aAAa,CAAC,IAAI,CAAC;AACrC,YAAY,IAAI,IAAI,CAAC,QAAQ;AAC7B,gBAAgB,IAAI,EAAE;AACtB,QAAQ,CAAC;AACT,QAAQ,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC;AACnD,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;AACxC,QAAQ,OAAO,CAAC,MAAM,GAAG,KAAK;AAC9B,QAAQ,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE;AAC9B,IAAI;AACJ;;ACvCA,6BAA6B,CAAC,CAAC,aAAa,KAAK,aAAa,CAAC,QAAQ,KAAK;AAC5E,MAAM,IAAI,uBAAuB,CAAC,aAAa;AAC/C,MAAM,0BAA0B,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;;;;;;;;;;;;;;"}
+{"version":3,"file":"plugin.cjs","sources":["esm/errors.js","esm/base-capacitor-user-manager.js","esm/user-manager-settings-policy.js","esm/configuration.js","esm/capacitor-user-manager.js","esm/native.js","esm/capacitor-navigator.js","esm/capacitor-secure-state-store.js","esm/native-capacitor-user-manager.js","esm/web-capacitor-user-manager.js","esm/index.js"],"sourcesContent":["export class CapacitorOidcError extends Error {\n    code;\n    constructor(code, message) {\n        super(message);\n        this.code = code;\n        this.name = 'CapacitorOidcError';\n    }\n}\nexport function unsupported(feature) {\n    throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', `${feature} is not available in a native Capacitor runtime`);\n}\n//# sourceMappingURL=errors.js.map","import { UserManager, } from 'oidc-client-ts';\nimport { unsupported } from './errors.js';\nexport class BaseCapacitorUserManager extends UserManager {\n    automaticRenewalPromise;\n    refreshPromise;\n    signinMode;\n    signoutMode;\n    defaultSigninArgs;\n    defaultSignoutArgs;\n    constructor(configuration, redirectNavigator, popupNavigator, iframeNavigator) {\n        super(configuration.settings, redirectNavigator, popupNavigator, iframeNavigator);\n        this.signinMode = configuration.signinMode;\n        this.signoutMode = configuration.signoutMode;\n        this.defaultSigninArgs = configuration.signinArgs;\n        this.defaultSignoutArgs = configuration.signoutArgs;\n    }\n    async initialize() {\n        await this.getUser();\n    }\n    async signin(args = {}) {\n        const mergedArgs = { ...this.defaultSigninArgs, ...args };\n        if (this.signinMode === 'redirect')\n            return this.signinRedirect(mergedArgs);\n        await this.signinPopup(mergedArgs);\n    }\n    async signout(args = {}) {\n        const mergedArgs = { ...this.defaultSignoutArgs, ...args };\n        if (this.signoutMode === 'redirect')\n            return this.signoutRedirect(mergedArgs);\n        await this.signoutPopup(mergedArgs);\n    }\n    async getValidUser(minimumValiditySeconds = 60) {\n        const user = await this.getUser();\n        if (!user)\n            return null;\n        if (user.expires_in === undefined || user.expires_in > minimumValiditySeconds)\n            return user;\n        return this.signinSilent();\n    }\n    async signinPopup(args = {}) {\n        await this.waitForRenewal();\n        return super.signinPopup(args);\n    }\n    async signoutPopup(args = {}) {\n        await this.waitForRenewal();\n        await super.signoutPopup(args);\n    }\n    async signinRedirect(args = {}) {\n        await this.waitForRenewal();\n        await super.signinRedirect(args);\n    }\n    async signoutRedirect(args = {}) {\n        await this.waitForRenewal();\n        await super.signoutRedirect(args);\n    }\n    signinSilent(args = {}) {\n        if (!this.refreshPromise) {\n            const refresh = this.performSilentSignin(args);\n            this.refreshPromise = refresh.finally(() => {\n                this.refreshPromise = undefined;\n            });\n        }\n        return this.refreshPromise;\n    }\n    async signinResourceOwnerCredentials(_args) {\n        unsupported('Resource Owner Password Credentials');\n    }\n    async removeUser() {\n        await this.waitForRenewal();\n        await this.removeUserWithoutWaiting();\n    }\n    cancel() {\n        return Promise.resolve();\n    }\n    async dispose() {\n        this.stopSilentRenew();\n        await this.disposePlatform();\n        await this.waitForRenewal();\n        await this.cancel();\n    }\n    performSilentSignin(args) {\n        return super.signinSilent(args);\n    }\n    removeUserWithoutWaiting() {\n        return super.removeUser();\n    }\n    checkForAutomaticRenewal() {\n        if (!this.settings.automaticSilentRenew || this.automaticRenewalPromise)\n            return;\n        const renewal = this.getValidUser();\n        this.automaticRenewalPromise = renewal;\n        void renewal\n            .catch((error) => this.events._raiseSilentRenewError(error instanceof Error ? error : new Error('Silent renewal failed')))\n            .finally(() => {\n            if (this.automaticRenewalPromise === renewal)\n                this.automaticRenewalPromise = undefined;\n        });\n    }\n    async waitForRenewal() {\n        await this.automaticRenewalPromise?.catch(() => undefined);\n        await this.refreshPromise?.catch(() => undefined);\n    }\n}\n//# sourceMappingURL=base-capacitor-user-manager.js.map","export const WEB_ONLY_SETTINGS = [\n    'checkSessionIntervalInSeconds',\n    'dpop',\n    'iframeNotifyParentOrigin',\n    'iframeScriptOrigin',\n    'includeIdTokenInSilentSignout',\n    'monitorAnonymousSession',\n    'monitorSession',\n    'popup_post_logout_redirect_uri',\n    'popup_redirect_uri',\n    'popupWindowFeatures',\n    'popupWindowTarget',\n    'query_status_response_type',\n    'redirectMethod',\n    'redirectTarget',\n    'silent_redirect_uri',\n    'silentRequestTimeoutInSeconds',\n    'stateStore',\n    'stopCheckSessionOnError',\n    'userStore',\n];\n//# sourceMappingURL=user-manager-settings-policy.js.map","import { CapacitorOidcError } from './errors.js';\nimport { WEB_ONLY_SETTINGS } from './user-manager-settings-policy.js';\nexport function resolveConfiguration(configuration, platform) {\n    if (platform === 'web')\n        return resolveWebConfiguration(configuration);\n    return resolveNativeConfiguration(configuration, platform);\n}\nexport function resolveLegacyNativeConfiguration(settings, nativeOptions, platform) {\n    if (platform === 'web') {\n        throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', 'Legacy CapacitorUserManager settings are only supported on iOS and Android');\n    }\n    assertPublicClient(settings);\n    if ('dpop' in settings) {\n        throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', 'Native configuration does not support dpop');\n    }\n    return resolvedNativeConfiguration(platform, settings, nativeOptions);\n}\nfunction resolveWebConfiguration(configuration) {\n    const web = configuration.web;\n    if (!web)\n        unsupportedConfiguration('web');\n    const signoutMode = web.signoutMode ?? 'redirect';\n    const settings = { ...configuration.common, ...web.settings };\n    assertPublicClient(settings);\n    if (signoutMode === 'popup' && !settings.popup_post_logout_redirect_uri && !settings.post_logout_redirect_uri) {\n        throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', 'Web popup signout requires post_logout_redirect_uri or popup_post_logout_redirect_uri');\n    }\n    return {\n        platform: 'web',\n        settings,\n        signinMode: web.signinMode ?? 'redirect',\n        signoutMode,\n        signinArgs: web.signinArgs ?? {},\n        signoutArgs: web.signoutArgs ?? {},\n    };\n}\nfunction resolveNativeConfiguration(configuration, platform) {\n    const native = configuration.native;\n    if (!native)\n        unsupportedConfiguration(platform);\n    const override = configuration[platform];\n    const settings = { ...configuration.common, ...native.settings, ...override?.settings };\n    assertPublicClient(settings);\n    assertNativeSettings(settings);\n    return resolvedNativeConfiguration(platform, settings, { ...native.options, ...override?.options }, { ...native.signinArgs, ...override?.signinArgs }, { ...native.signoutArgs, ...override?.signoutArgs });\n}\nfunction resolvedNativeConfiguration(platform, settings, nativeOptions, signinArgs = {}, signoutArgs = {}) {\n    return {\n        platform,\n        settings: { ...settings, response_type: 'code', disablePKCE: false, monitorSession: false },\n        nativeOptions,\n        signinMode: 'popup',\n        signoutMode: 'popup',\n        signinArgs,\n        signoutArgs,\n    };\n}\nfunction assertPublicClient(settings) {\n    const unsupported = ['client_authentication', 'client_secret', 'disablePKCE', 'response_type'].find((key) => key in settings);\n    if (unsupported) {\n        throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', `Public-client configuration does not support ${unsupported}`);\n    }\n}\nfunction assertNativeSettings(settings) {\n    const unsupported = WEB_ONLY_SETTINGS.find((key) => key in settings);\n    if (unsupported) {\n        throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', `Native configuration does not support ${unsupported}`);\n    }\n}\nfunction unsupportedConfiguration(platform) {\n    throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', `No ${platform} configuration was provided`);\n}\n//# sourceMappingURL=configuration.js.map","import { Capacitor } from '@capacitor/core';\nimport { BaseCapacitorUserManager } from './base-capacitor-user-manager.js';\nimport { resolveConfiguration, resolveLegacyNativeConfiguration, } from './configuration.js';\nimport { CapacitorOidcError } from './errors.js';\nexport class CapacitorUserManager extends BaseCapacitorUserManager {\n    static async create(configuration, nativeOptions = {}) {\n        assertRuntime();\n        const platform = currentPlatform();\n        const resolved = 'redirect_uri' in configuration\n            ? resolveLegacyNativeConfiguration(configuration, nativeOptions, platform)\n            : resolveConfiguration(configuration, platform);\n        const manager = await platformUserManagerFactory(resolved);\n        await manager.initialize();\n        return manager;\n    }\n}\nlet platformUserManagerFactory;\nexport function setPlatformUserManagerFactory(factory) {\n    platformUserManagerFactory = factory;\n}\nfunction currentPlatform() {\n    const platform = Capacitor.getPlatform();\n    return platform === 'ios' || platform === 'android' ? platform : 'web';\n}\nfunction assertRuntime() {\n    if (!globalThis.crypto?.subtle || !globalThis.crypto.getRandomValues) {\n        throw new CapacitorOidcError('UNSUPPORTED_RUNTIME', 'Web Crypto is required by oidc-client-ts');\n    }\n}\n//# sourceMappingURL=capacitor-user-manager.js.map","import { registerPlugin } from '@capacitor/core';\nexport const NativeOidc = registerPlugin('CapacitorOidc');\n//# sourceMappingURL=native.js.map","import { CapacitorOidcError, unsupported } from './errors.js';\nimport { NativeOidc } from './native.js';\nexport class CapacitorNavigator {\n    prefersEphemeralWebBrowserSession;\n    constructor(prefersEphemeralWebBrowserSession) {\n        this.prefersEphemeralWebBrowserSession = prefersEphemeralWebBrowserSession;\n    }\n    async prepare() {\n        return new CapacitorWindow(this.prefersEphemeralWebBrowserSession);\n    }\n    async callback() {\n        unsupported('Navigator callbacks');\n    }\n}\nclass CapacitorWindow {\n    prefersEphemeralWebBrowserSession;\n    constructor(prefersEphemeralWebBrowserSession) {\n        this.prefersEphemeralWebBrowserSession = prefersEphemeralWebBrowserSession;\n    }\n    async navigate({ url }) {\n        assertSecureRequestUrl(url);\n        const callbackUrl = callbackUrlFromRequest(url);\n        const response = await NativeOidc.open({\n            url,\n            callbackUrl,\n            prefersEphemeralWebBrowserSession: this.prefersEphemeralWebBrowserSession,\n        });\n        if (!isExpectedCallback(response.url, callbackUrl)) {\n            throw new CapacitorOidcError('INVALID_CALLBACK', 'The authentication callback does not match the configured redirect URI');\n        }\n        return response;\n    }\n    close() {\n        void NativeOidc.cancel();\n    }\n}\nexport function assertSecureRequestUrl(requestUrl) {\n    const url = new URL(requestUrl);\n    const isHttpLoopback = url.protocol === 'http:' &&\n        (url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname === '[::1]');\n    if (url.protocol !== 'https:' && !isHttpLoopback) {\n        throw new CapacitorOidcError('BROWSER_UNAVAILABLE', 'OIDC authorization and logout endpoints must use HTTPS');\n    }\n}\nexport function callbackUrlFromRequest(requestUrl) {\n    const url = new URL(requestUrl);\n    const callback = url.searchParams.get('post_logout_redirect_uri') ??\n        url.searchParams.get('logout_uri') ??\n        url.searchParams.get('redirect_uri');\n    if (!callback) {\n        throw new CapacitorOidcError('INVALID_CALLBACK', 'The OIDC request does not contain a callback URI');\n    }\n    return callback;\n}\nexport function isExpectedCallback(actualValue, expectedValue) {\n    const actual = new URL(actualValue);\n    const expected = new URL(expectedValue);\n    return (actual.protocol.toLowerCase() === expected.protocol.toLowerCase() &&\n        actual.host.toLowerCase() === expected.host.toLowerCase() &&\n        actual.pathname === expected.pathname);\n}\nexport class UnsupportedIframeNavigator {\n    async prepare() {\n        unsupported('Iframe navigation');\n    }\n    async callback() {\n        unsupported('Iframe navigation');\n    }\n}\n//# sourceMappingURL=capacitor-navigator.js.map","import { NativeOidc } from './native.js';\nexport class CapacitorSecureStateStore {\n    namespace;\n    constructor(namespace) {\n        this.namespace = namespace;\n    }\n    async set(key, value) {\n        await NativeOidc.storageSet({ namespace: this.namespace, key, value });\n    }\n    async get(key) {\n        return (await NativeOidc.storageGet({ namespace: this.namespace, key })).value;\n    }\n    async remove(key) {\n        return (await NativeOidc.storageRemove({ namespace: this.namespace, key })).value;\n    }\n    async getAllKeys() {\n        return (await NativeOidc.storageGetAllKeys({ namespace: this.namespace })).keys;\n    }\n}\n//# sourceMappingURL=capacitor-secure-state-store.js.map","import { App } from '@capacitor/app';\nimport { ErrorResponse, } from 'oidc-client-ts';\nimport { CapacitorNavigator, UnsupportedIframeNavigator } from './capacitor-navigator.js';\nimport { CapacitorSecureStateStore } from './capacitor-secure-state-store.js';\nimport { CapacitorUserManager } from './capacitor-user-manager.js';\nimport { unsupported } from './errors.js';\nimport { NativeOidc } from './native.js';\nexport class NativeCapacitorUserManager extends CapacitorUserManager {\n    appStateListener;\n    storageNamespace;\n    constructor(configuration) {\n        const storageNamespace = configuration.nativeOptions?.storageNamespace ?? 'default';\n        const stateStore = new CapacitorSecureStateStore(`${storageNamespace}.transactions`);\n        const userStore = new CapacitorSecureStateStore(`${storageNamespace}.session`);\n        const navigator = new CapacitorNavigator(configuration.nativeOptions?.prefersEphemeralWebBrowserSession ?? false);\n        super({\n            ...configuration,\n            settings: {\n                ...configuration.settings,\n                popup_redirect_uri: configuration.settings.redirect_uri,\n                popup_post_logout_redirect_uri: configuration.settings.post_logout_redirect_uri,\n                stateStore,\n                userStore,\n            },\n        }, navigator, navigator, new UnsupportedIframeNavigator());\n        this.storageNamespace = storageNamespace;\n    }\n    static async fromConfiguration(configuration) {\n        await NativeOidc.configure(configuration.nativeOptions?.ios ?? {});\n        return new NativeCapacitorUserManager(configuration);\n    }\n    async initialize() {\n        await super.initialize();\n        this.appStateListener = await App.addListener('appStateChange', ({ isActive }) => {\n            if (isActive)\n                this.checkForAutomaticRenewal();\n        });\n        this.checkForAutomaticRenewal();\n    }\n    async signinRedirect(_args = {}) {\n        unsupported('Redirect navigation');\n    }\n    async signinRedirectCallback(_url) {\n        unsupported('Redirect navigation');\n    }\n    async signinCallback(_url) {\n        unsupported('Browser callback dispatch');\n    }\n    async signinSilentCallback(_url) {\n        unsupported('Iframe navigation');\n    }\n    async signoutRedirect(_args = {}) {\n        unsupported('Redirect navigation');\n    }\n    async signoutRedirectCallback(_url) {\n        unsupported('Redirect navigation');\n    }\n    async signoutCallback(_url, _keepOpen) {\n        unsupported('Browser callback dispatch');\n    }\n    async signoutSilent(_args = {}) {\n        unsupported('Iframe logout');\n    }\n    async signoutSilentCallback(_url) {\n        unsupported('Iframe logout');\n    }\n    async querySessionStatus(_args = {}) {\n        unsupported('Browser session monitoring');\n    }\n    async storeUser(user) {\n        await super.storeUser(user);\n        await NativeOidc.setSessionSnapshot({\n            namespace: this.storageNamespace,\n            value: user\n                ? JSON.stringify(toStoredSession(user, user.profile.iss ?? this.settings.metadata?.issuer ?? this.settings.authority, this.settings.client_id))\n                : null,\n        });\n    }\n    cancel() {\n        return NativeOidc.cancel();\n    }\n    async disposePlatform() {\n        await this.appStateListener?.remove();\n    }\n    async performSilentSignin(args) {\n        const user = await this.getUser();\n        if (!user?.refresh_token) {\n            if (user?.expired)\n                await this.removeUserWithoutWaiting();\n            return null;\n        }\n        return super.performSilentSignin({ ...args, forceIframeAuth: false }).catch(async (error) => {\n            if (error instanceof ErrorResponse && error.error === 'invalid_grant')\n                await this.removeUserWithoutWaiting();\n            throw error;\n        });\n    }\n}\nfunction toStoredSession(user, issuer, clientId) {\n    return {\n        version: 1,\n        issuer,\n        clientId,\n        accessToken: user.access_token,\n        refreshToken: user.refresh_token,\n        idToken: user.id_token,\n        tokenType: user.token_type,\n        scope: user.scope,\n        expiresAt: user.expires_at,\n    };\n}\n//# sourceMappingURL=native-capacitor-user-manager.js.map","import { CapacitorUserManager } from './capacitor-user-manager.js';\nexport class WebCapacitorUserManager extends CapacitorUserManager {\n    sessionMonitor;\n    disposed = false;\n    constructor(configuration) {\n        super(configuration);\n        this.sessionMonitor = this.captureSessionMonitor();\n    }\n    async querySessionStatus(args = {}) {\n        if (this.disposed)\n            return null;\n        const session = await super.querySessionStatus(args);\n        return this.disposed ? null : session;\n    }\n    disposePlatform() {\n        this.disposed = true;\n        if (this.sessionMonitor) {\n            this.events.removeUserLoaded(this.sessionMonitor.start);\n            this.events.removeUserUnloaded(this.sessionMonitor.stop);\n            this.sessionMonitor.stop();\n        }\n        return Promise.resolve();\n    }\n    captureSessionMonitor() {\n        // oidc-client-ts does not expose public session-monitor lifecycle hooks.\n        const monitor = this._sessionMonitor;\n        if (!monitor)\n            return undefined;\n        const originalStart = monitor._start;\n        const stop = monitor._stop;\n        const start = async (user) => {\n            if (this.disposed)\n                return;\n            await originalStart(user);\n            if (this.disposed)\n                stop();\n        };\n        this.events.removeUserLoaded(originalStart);\n        this.events.addUserLoaded(start);\n        monitor._start = start;\n        return { start, stop };\n    }\n}\n//# sourceMappingURL=web-capacitor-user-manager.js.map","import { CapacitorUserManager, setPlatformUserManagerFactory } from './capacitor-user-manager.js';\nimport { NativeCapacitorUserManager } from './native-capacitor-user-manager.js';\nimport { WebCapacitorUserManager } from './web-capacitor-user-manager.js';\nsetPlatformUserManagerFactory((configuration) => configuration.platform === 'web'\n    ? new WebCapacitorUserManager(configuration)\n    : NativeCapacitorUserManager.fromConfiguration(configuration));\nexport { CapacitorUserManager };\nexport { CapacitorSecureStateStore } from './capacitor-secure-state-store.js';\nexport { CapacitorOidcError } from './errors.js';\nexport { User, WebStorageStateStore } from 'oidc-client-ts';\n//# sourceMappingURL=index.js.map"],"names":["UserManager","Capacitor","registerPlugin","App","ErrorResponse"],"mappings":";;;;;;AAAO,MAAM,kBAAkB,SAAS,KAAK,CAAC;AAC9C,IAAI,IAAI;AACR,IAAI,WAAW,CAAC,IAAI,EAAE,OAAO,EAAE;AAC/B,QAAQ,KAAK,CAAC,OAAO,CAAC;AACtB,QAAQ,IAAI,CAAC,IAAI,GAAG,IAAI;AACxB,QAAQ,IAAI,CAAC,IAAI,GAAG,oBAAoB;AACxC,IAAI;AACJ;AACO,SAAS,WAAW,CAAC,OAAO,EAAE;AACrC,IAAI,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,CAAC,EAAE,OAAO,CAAC,+CAA+C,CAAC,CAAC;AACpH;;ACRO,MAAM,wBAAwB,SAASA,wBAAW,CAAC;AAC1D,IAAI,uBAAuB;AAC3B,IAAI,cAAc;AAClB,IAAI,UAAU;AACd,IAAI,WAAW;AACf,IAAI,iBAAiB;AACrB,IAAI,kBAAkB;AACtB,IAAI,WAAW,CAAC,aAAa,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,EAAE;AACnF,QAAQ,KAAK,CAAC,aAAa,CAAC,QAAQ,EAAE,iBAAiB,EAAE,cAAc,EAAE,eAAe,CAAC;AACzF,QAAQ,IAAI,CAAC,UAAU,GAAG,aAAa,CAAC,UAAU;AAClD,QAAQ,IAAI,CAAC,WAAW,GAAG,aAAa,CAAC,WAAW;AACpD,QAAQ,IAAI,CAAC,iBAAiB,GAAG,aAAa,CAAC,UAAU;AACzD,QAAQ,IAAI,CAAC,kBAAkB,GAAG,aAAa,CAAC,WAAW;AAC3D,IAAI;AACJ,IAAI,MAAM,UAAU,GAAG;AACvB,QAAQ,MAAM,IAAI,CAAC,OAAO,EAAE;AAC5B,IAAI;AACJ,IAAI,MAAM,MAAM,CAAC,IAAI,GAAG,EAAE,EAAE;AAC5B,QAAQ,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC,iBAAiB,EAAE,GAAG,IAAI,EAAE;AACjE,QAAQ,IAAI,IAAI,CAAC,UAAU,KAAK,UAAU;AAC1C,YAAY,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC;AAClD,QAAQ,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC;AAC1C,IAAI;AACJ,IAAI,MAAM,OAAO,CAAC,IAAI,GAAG,EAAE,EAAE;AAC7B,QAAQ,MAAM,UAAU,GAAG,EAAE,GAAG,IAAI,CAAC,kBAAkB,EAAE,GAAG,IAAI,EAAE;AAClE,QAAQ,IAAI,IAAI,CAAC,WAAW,KAAK,UAAU;AAC3C,YAAY,OAAO,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC;AACnD,QAAQ,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC;AAC3C,IAAI;AACJ,IAAI,MAAM,YAAY,CAAC,sBAAsB,GAAG,EAAE,EAAE;AACpD,QAAQ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE;AACzC,QAAQ,IAAI,CAAC,IAAI;AACjB,YAAY,OAAO,IAAI;AACvB,QAAQ,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,GAAG,sBAAsB;AACrF,YAAY,OAAO,IAAI;AACvB,QAAQ,OAAO,IAAI,CAAC,YAAY,EAAE;AAClC,IAAI;AACJ,IAAI,MAAM,WAAW,CAAC,IAAI,GAAG,EAAE,EAAE;AACjC,QAAQ,MAAM,IAAI,CAAC,cAAc,EAAE;AACnC,QAAQ,OAAO,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC;AACtC,IAAI;AACJ,IAAI,MAAM,YAAY,CAAC,IAAI,GAAG,EAAE,EAAE;AAClC,QAAQ,MAAM,IAAI,CAAC,cAAc,EAAE;AACnC,QAAQ,MAAM,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC;AACtC,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,IAAI,GAAG,EAAE,EAAE;AACpC,QAAQ,MAAM,IAAI,CAAC,cAAc,EAAE;AACnC,QAAQ,MAAM,KAAK,CAAC,cAAc,CAAC,IAAI,CAAC;AACxC,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,IAAI,GAAG,EAAE,EAAE;AACrC,QAAQ,MAAM,IAAI,CAAC,cAAc,EAAE;AACnC,QAAQ,MAAM,KAAK,CAAC,eAAe,CAAC,IAAI,CAAC;AACzC,IAAI;AACJ,IAAI,YAAY,CAAC,IAAI,GAAG,EAAE,EAAE;AAC5B,QAAQ,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE;AAClC,YAAY,MAAM,OAAO,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;AAC1D,YAAY,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM;AACxD,gBAAgB,IAAI,CAAC,cAAc,GAAG,SAAS;AAC/C,YAAY,CAAC,CAAC;AACd,QAAQ;AACR,QAAQ,OAAO,IAAI,CAAC,cAAc;AAClC,IAAI;AACJ,IAAI,MAAM,8BAA8B,CAAC,KAAK,EAAE;AAChD,QAAQ,WAAW,CAAC,qCAAqC,CAAC;AAC1D,IAAI;AACJ,IAAI,MAAM,UAAU,GAAG;AACvB,QAAQ,MAAM,IAAI,CAAC,cAAc,EAAE;AACnC,QAAQ,MAAM,IAAI,CAAC,wBAAwB,EAAE;AAC7C,IAAI;AACJ,IAAI,MAAM,GAAG;AACb,QAAQ,OAAO,OAAO,CAAC,OAAO,EAAE;AAChC,IAAI;AACJ,IAAI,MAAM,OAAO,GAAG;AACpB,QAAQ,IAAI,CAAC,eAAe,EAAE;AAC9B,QAAQ,MAAM,IAAI,CAAC,eAAe,EAAE;AACpC,QAAQ,MAAM,IAAI,CAAC,cAAc,EAAE;AACnC,QAAQ,MAAM,IAAI,CAAC,MAAM,EAAE;AAC3B,IAAI;AACJ,IAAI,mBAAmB,CAAC,IAAI,EAAE;AAC9B,QAAQ,OAAO,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC;AACvC,IAAI;AACJ,IAAI,wBAAwB,GAAG;AAC/B,QAAQ,OAAO,KAAK,CAAC,UAAU,EAAE;AACjC,IAAI;AACJ,IAAI,wBAAwB,GAAG;AAC/B,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,IAAI,IAAI,CAAC,uBAAuB;AAC/E,YAAY;AACZ,QAAQ,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,EAAE;AAC3C,QAAQ,IAAI,CAAC,uBAAuB,GAAG,OAAO;AAC9C,QAAQ,KAAK;AACb,aAAa,KAAK,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,KAAK,YAAY,KAAK,GAAG,KAAK,GAAG,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;AACrI,aAAa,OAAO,CAAC,MAAM;AAC3B,YAAY,IAAI,IAAI,CAAC,uBAAuB,KAAK,OAAO;AACxD,gBAAgB,IAAI,CAAC,uBAAuB,GAAG,SAAS;AACxD,QAAQ,CAAC,CAAC;AACV,IAAI;AACJ,IAAI,MAAM,cAAc,GAAG;AAC3B,QAAQ,MAAM,IAAI,CAAC,uBAAuB,EAAE,KAAK,CAAC,MAAM,SAAS,CAAC;AAClE,QAAQ,MAAM,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,MAAM,SAAS,CAAC;AACzD,IAAI;AACJ;;ACtGO,MAAM,iBAAiB,GAAG;AACjC,IAAI,+BAA+B;AACnC,IAAI,MAAM;AACV,IAAI,0BAA0B;AAC9B,IAAI,oBAAoB;AACxB,IAAI,+BAA+B;AACnC,IAAI,yBAAyB;AAC7B,IAAI,gBAAgB;AACpB,IAAI,gCAAgC;AACpC,IAAI,oBAAoB;AACxB,IAAI,qBAAqB;AACzB,IAAI,mBAAmB;AACvB,IAAI,4BAA4B;AAChC,IAAI,gBAAgB;AACpB,IAAI,gBAAgB;AACpB,IAAI,qBAAqB;AACzB,IAAI,+BAA+B;AACnC,IAAI,YAAY;AAChB,IAAI,yBAAyB;AAC7B,IAAI,WAAW;AACf,CAAC;;AClBM,SAAS,oBAAoB,CAAC,aAAa,EAAE,QAAQ,EAAE;AAC9D,IAAI,IAAI,QAAQ,KAAK,KAAK;AAC1B,QAAQ,OAAO,uBAAuB,CAAC,aAAa,CAAC;AACrD,IAAI,OAAO,0BAA0B,CAAC,aAAa,EAAE,QAAQ,CAAC;AAC9D;AACO,SAAS,gCAAgC,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE;AACpF,IAAI,IAAI,QAAQ,KAAK,KAAK,EAAE;AAC5B,QAAQ,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,4EAA4E,CAAC;AACzI,IAAI;AACJ,IAAI,kBAAkB,CAAC,QAAQ,CAAC;AAChC,IAAI,IAAI,MAAM,IAAI,QAAQ,EAAE;AAC5B,QAAQ,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,4CAA4C,CAAC;AACzG,IAAI;AACJ,IAAI,OAAO,2BAA2B,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC;AACzE;AACA,SAAS,uBAAuB,CAAC,aAAa,EAAE;AAChD,IAAI,MAAM,GAAG,GAAG,aAAa,CAAC,GAAG;AACjC,IAAI,IAAI,CAAC,GAAG;AACZ,QAAQ,wBAAwB,CAAC,KAAK,CAAC;AACvC,IAAI,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,UAAU;AACrD,IAAI,MAAM,QAAQ,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,GAAG,GAAG,CAAC,QAAQ,EAAE;AACjE,IAAI,kBAAkB,CAAC,QAAQ,CAAC;AAChC,IAAI,IAAI,WAAW,KAAK,OAAO,IAAI,CAAC,QAAQ,CAAC,8BAA8B,IAAI,CAAC,QAAQ,CAAC,wBAAwB,EAAE;AACnH,QAAQ,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,uFAAuF,CAAC;AACpJ,IAAI;AACJ,IAAI,OAAO;AACX,QAAQ,QAAQ,EAAE,KAAK;AACvB,QAAQ,QAAQ;AAChB,QAAQ,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,UAAU;AAChD,QAAQ,WAAW;AACnB,QAAQ,UAAU,EAAE,GAAG,CAAC,UAAU,IAAI,EAAE;AACxC,QAAQ,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,EAAE;AAC1C,KAAK;AACL;AACA,SAAS,0BAA0B,CAAC,aAAa,EAAE,QAAQ,EAAE;AAC7D,IAAI,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM;AACvC,IAAI,IAAI,CAAC,MAAM;AACf,QAAQ,wBAAwB,CAAC,QAAQ,CAAC;AAC1C,IAAI,MAAM,QAAQ,GAAG,aAAa,CAAC,QAAQ,CAAC;AAC5C,IAAI,MAAM,QAAQ,GAAG,EAAE,GAAG,aAAa,CAAC,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,GAAG,QAAQ,EAAE,QAAQ,EAAE;AAC3F,IAAI,kBAAkB,CAAC,QAAQ,CAAC;AAChC,IAAI,oBAAoB,CAAC,QAAQ,CAAC;AAClC,IAAI,OAAO,2BAA2B,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,GAAG,MAAM,CAAC,OAAO,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,UAAU,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,WAAW,EAAE,GAAG,QAAQ,EAAE,WAAW,EAAE,CAAC;AAC/M;AACA,SAAS,2BAA2B,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,UAAU,GAAG,EAAE,EAAE,WAAW,GAAG,EAAE,EAAE;AAC3G,IAAI,OAAO;AACX,QAAQ,QAAQ;AAChB,QAAQ,QAAQ,EAAE,EAAE,GAAG,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE;AACnG,QAAQ,aAAa;AACrB,QAAQ,UAAU,EAAE,OAAO;AAC3B,QAAQ,WAAW,EAAE,OAAO;AAC5B,QAAQ,UAAU;AAClB,QAAQ,WAAW;AACnB,KAAK;AACL;AACA,SAAS,kBAAkB,CAAC,QAAQ,EAAE;AACtC,IAAI,MAAM,WAAW,GAAG,CAAC,uBAAuB,EAAE,eAAe,EAAE,aAAa,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,QAAQ,CAAC;AACjI,IAAI,IAAI,WAAW,EAAE;AACrB,QAAQ,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,CAAC,6CAA6C,EAAE,WAAW,CAAC,CAAC,CAAC;AAC1H,IAAI;AACJ;AACA,SAAS,oBAAoB,CAAC,QAAQ,EAAE;AACxC,IAAI,MAAM,WAAW,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,GAAG,IAAI,QAAQ,CAAC;AACxE,IAAI,IAAI,WAAW,EAAE;AACrB,QAAQ,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,CAAC,sCAAsC,EAAE,WAAW,CAAC,CAAC,CAAC;AACnH,IAAI;AACJ;AACA,SAAS,wBAAwB,CAAC,QAAQ,EAAE;AAC5C,IAAI,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,CAAC,GAAG,EAAE,QAAQ,CAAC,2BAA2B,CAAC,CAAC;AACpG;;ACnEO,MAAM,oBAAoB,SAAS,wBAAwB,CAAC;AACnE,IAAI,aAAa,MAAM,CAAC,aAAa,EAAE,aAAa,GAAG,EAAE,EAAE;AAC3D,QAAQ,aAAa,EAAE;AACvB,QAAQ,MAAM,QAAQ,GAAG,eAAe,EAAE;AAC1C,QAAQ,MAAM,QAAQ,GAAG,cAAc,IAAI;AAC3C,cAAc,gCAAgC,CAAC,aAAa,EAAE,aAAa,EAAE,QAAQ;AACrF,cAAc,oBAAoB,CAAC,aAAa,EAAE,QAAQ,CAAC;AAC3D,QAAQ,MAAM,OAAO,GAAG,MAAM,0BAA0B,CAAC,QAAQ,CAAC;AAClE,QAAQ,MAAM,OAAO,CAAC,UAAU,EAAE;AAClC,QAAQ,OAAO,OAAO;AACtB,IAAI;AACJ;AACA,IAAI,0BAA0B;AACvB,SAAS,6BAA6B,CAAC,OAAO,EAAE;AACvD,IAAI,0BAA0B,GAAG,OAAO;AACxC;AACA,SAAS,eAAe,GAAG;AAC3B,IAAI,MAAM,QAAQ,GAAGC,cAAS,CAAC,WAAW,EAAE;AAC5C,IAAI,OAAO,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,SAAS,GAAG,QAAQ,GAAG,KAAK;AAC1E;AACA,SAAS,aAAa,GAAG;AACzB,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,eAAe,EAAE;AAC1E,QAAQ,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,0CAA0C,CAAC;AACvG,IAAI;AACJ;;AC3BO,MAAM,UAAU,GAAGC,mBAAc,CAAC,eAAe,CAAC;;ACClD,MAAM,kBAAkB,CAAC;AAChC,IAAI,iCAAiC;AACrC,IAAI,WAAW,CAAC,iCAAiC,EAAE;AACnD,QAAQ,IAAI,CAAC,iCAAiC,GAAG,iCAAiC;AAClF,IAAI;AACJ,IAAI,MAAM,OAAO,GAAG;AACpB,QAAQ,OAAO,IAAI,eAAe,CAAC,IAAI,CAAC,iCAAiC,CAAC;AAC1E,IAAI;AACJ,IAAI,MAAM,QAAQ,GAAG;AACrB,QAAQ,WAAW,CAAC,qBAAqB,CAAC;AAC1C,IAAI;AACJ;AACA,MAAM,eAAe,CAAC;AACtB,IAAI,iCAAiC;AACrC,IAAI,WAAW,CAAC,iCAAiC,EAAE;AACnD,QAAQ,IAAI,CAAC,iCAAiC,GAAG,iCAAiC;AAClF,IAAI;AACJ,IAAI,MAAM,QAAQ,CAAC,EAAE,GAAG,EAAE,EAAE;AAC5B,QAAQ,sBAAsB,CAAC,GAAG,CAAC;AACnC,QAAQ,MAAM,WAAW,GAAG,sBAAsB,CAAC,GAAG,CAAC;AACvD,QAAQ,MAAM,QAAQ,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC;AAC/C,YAAY,GAAG;AACf,YAAY,WAAW;AACvB,YAAY,iCAAiC,EAAE,IAAI,CAAC,iCAAiC;AACrF,SAAS,CAAC;AACV,QAAQ,IAAI,CAAC,kBAAkB,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,EAAE;AAC5D,YAAY,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,wEAAwE,CAAC;AACtI,QAAQ;AACR,QAAQ,OAAO,QAAQ;AACvB,IAAI;AACJ,IAAI,KAAK,GAAG;AACZ,QAAQ,KAAK,UAAU,CAAC,MAAM,EAAE;AAChC,IAAI;AACJ;AACO,SAAS,sBAAsB,CAAC,UAAU,EAAE;AACnD,IAAI,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC;AACnC,IAAI,MAAM,cAAc,GAAG,GAAG,CAAC,QAAQ,KAAK,OAAO;AACnD,SAAS,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC;AAClG,IAAI,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,cAAc,EAAE;AACtD,QAAQ,MAAM,IAAI,kBAAkB,CAAC,qBAAqB,EAAE,wDAAwD,CAAC;AACrH,IAAI;AACJ;AACO,SAAS,sBAAsB,CAAC,UAAU,EAAE;AACnD,IAAI,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC;AACnC,IAAI,MAAM,QAAQ,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,0BAA0B,CAAC;AACrE,QAAQ,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC;AAC1C,QAAQ,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC;AAC5C,IAAI,IAAI,CAAC,QAAQ,EAAE;AACnB,QAAQ,MAAM,IAAI,kBAAkB,CAAC,kBAAkB,EAAE,kDAAkD,CAAC;AAC5G,IAAI;AACJ,IAAI,OAAO,QAAQ;AACnB;AACO,SAAS,kBAAkB,CAAC,WAAW,EAAE,aAAa,EAAE;AAC/D,IAAI,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC;AACvC,IAAI,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC;AAC3C,IAAI,QAAQ,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE;AAC7E,QAAQ,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE;AACjE,QAAQ,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,QAAQ;AAC7C;AACO,MAAM,0BAA0B,CAAC;AACxC,IAAI,MAAM,OAAO,GAAG;AACpB,QAAQ,WAAW,CAAC,mBAAmB,CAAC;AACxC,IAAI;AACJ,IAAI,MAAM,QAAQ,GAAG;AACrB,QAAQ,WAAW,CAAC,mBAAmB,CAAC;AACxC,IAAI;AACJ;;ACnEO,MAAM,yBAAyB,CAAC;AACvC,IAAI,SAAS;AACb,IAAI,WAAW,CAAC,SAAS,EAAE;AAC3B,QAAQ,IAAI,CAAC,SAAS,GAAG,SAAS;AAClC,IAAI;AACJ,IAAI,MAAM,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE;AAC1B,QAAQ,MAAM,UAAU,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;AAC9E,IAAI;AACJ,IAAI,MAAM,GAAG,CAAC,GAAG,EAAE;AACnB,QAAQ,OAAO,CAAC,MAAM,UAAU,CAAC,UAAU,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK;AACtF,IAAI;AACJ,IAAI,MAAM,MAAM,CAAC,GAAG,EAAE;AACtB,QAAQ,OAAO,CAAC,MAAM,UAAU,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK;AACzF,IAAI;AACJ,IAAI,MAAM,UAAU,GAAG;AACvB,QAAQ,OAAO,CAAC,MAAM,UAAU,CAAC,iBAAiB,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI;AACvF,IAAI;AACJ;;ACXO,MAAM,0BAA0B,SAAS,oBAAoB,CAAC;AACrE,IAAI,gBAAgB;AACpB,IAAI,gBAAgB;AACpB,IAAI,WAAW,CAAC,aAAa,EAAE;AAC/B,QAAQ,MAAM,gBAAgB,GAAG,aAAa,CAAC,aAAa,EAAE,gBAAgB,IAAI,SAAS;AAC3F,QAAQ,MAAM,UAAU,GAAG,IAAI,yBAAyB,CAAC,CAAC,EAAE,gBAAgB,CAAC,aAAa,CAAC,CAAC;AAC5F,QAAQ,MAAM,SAAS,GAAG,IAAI,yBAAyB,CAAC,CAAC,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;AACtF,QAAQ,MAAM,SAAS,GAAG,IAAI,kBAAkB,CAAC,aAAa,CAAC,aAAa,EAAE,iCAAiC,IAAI,KAAK,CAAC;AACzH,QAAQ,KAAK,CAAC;AACd,YAAY,GAAG,aAAa;AAC5B,YAAY,QAAQ,EAAE;AACtB,gBAAgB,GAAG,aAAa,CAAC,QAAQ;AACzC,gBAAgB,kBAAkB,EAAE,aAAa,CAAC,QAAQ,CAAC,YAAY;AACvE,gBAAgB,8BAA8B,EAAE,aAAa,CAAC,QAAQ,CAAC,wBAAwB;AAC/F,gBAAgB,UAAU;AAC1B,gBAAgB,SAAS;AACzB,aAAa;AACb,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,0BAA0B,EAAE,CAAC;AAClE,QAAQ,IAAI,CAAC,gBAAgB,GAAG,gBAAgB;AAChD,IAAI;AACJ,IAAI,aAAa,iBAAiB,CAAC,aAAa,EAAE;AAClD,QAAQ,MAAM,UAAU,CAAC,SAAS,CAAC,aAAa,CAAC,aAAa,EAAE,GAAG,IAAI,EAAE,CAAC;AAC1E,QAAQ,OAAO,IAAI,0BAA0B,CAAC,aAAa,CAAC;AAC5D,IAAI;AACJ,IAAI,MAAM,UAAU,GAAG;AACvB,QAAQ,MAAM,KAAK,CAAC,UAAU,EAAE;AAChC,QAAQ,IAAI,CAAC,gBAAgB,GAAG,MAAMC,OAAG,CAAC,WAAW,CAAC,gBAAgB,EAAE,CAAC,EAAE,QAAQ,EAAE,KAAK;AAC1F,YAAY,IAAI,QAAQ;AACxB,gBAAgB,IAAI,CAAC,wBAAwB,EAAE;AAC/C,QAAQ,CAAC,CAAC;AACV,QAAQ,IAAI,CAAC,wBAAwB,EAAE;AACvC,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,KAAK,GAAG,EAAE,EAAE;AACrC,QAAQ,WAAW,CAAC,qBAAqB,CAAC;AAC1C,IAAI;AACJ,IAAI,MAAM,sBAAsB,CAAC,IAAI,EAAE;AACvC,QAAQ,WAAW,CAAC,qBAAqB,CAAC;AAC1C,IAAI;AACJ,IAAI,MAAM,cAAc,CAAC,IAAI,EAAE;AAC/B,QAAQ,WAAW,CAAC,2BAA2B,CAAC;AAChD,IAAI;AACJ,IAAI,MAAM,oBAAoB,CAAC,IAAI,EAAE;AACrC,QAAQ,WAAW,CAAC,mBAAmB,CAAC;AACxC,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,KAAK,GAAG,EAAE,EAAE;AACtC,QAAQ,WAAW,CAAC,qBAAqB,CAAC;AAC1C,IAAI;AACJ,IAAI,MAAM,uBAAuB,CAAC,IAAI,EAAE;AACxC,QAAQ,WAAW,CAAC,qBAAqB,CAAC;AAC1C,IAAI;AACJ,IAAI,MAAM,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE;AAC3C,QAAQ,WAAW,CAAC,2BAA2B,CAAC;AAChD,IAAI;AACJ,IAAI,MAAM,aAAa,CAAC,KAAK,GAAG,EAAE,EAAE;AACpC,QAAQ,WAAW,CAAC,eAAe,CAAC;AACpC,IAAI;AACJ,IAAI,MAAM,qBAAqB,CAAC,IAAI,EAAE;AACtC,QAAQ,WAAW,CAAC,eAAe,CAAC;AACpC,IAAI;AACJ,IAAI,MAAM,kBAAkB,CAAC,KAAK,GAAG,EAAE,EAAE;AACzC,QAAQ,WAAW,CAAC,4BAA4B,CAAC;AACjD,IAAI;AACJ,IAAI,MAAM,SAAS,CAAC,IAAI,EAAE;AAC1B,QAAQ,MAAM,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC;AACnC,QAAQ,MAAM,UAAU,CAAC,kBAAkB,CAAC;AAC5C,YAAY,SAAS,EAAE,IAAI,CAAC,gBAAgB;AAC5C,YAAY,KAAK,EAAE;AACnB,kBAAkB,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;AAC9J,kBAAkB,IAAI;AACtB,SAAS,CAAC;AACV,IAAI;AACJ,IAAI,MAAM,GAAG;AACb,QAAQ,OAAO,UAAU,CAAC,MAAM,EAAE;AAClC,IAAI;AACJ,IAAI,MAAM,eAAe,GAAG;AAC5B,QAAQ,MAAM,IAAI,CAAC,gBAAgB,EAAE,MAAM,EAAE;AAC7C,IAAI;AACJ,IAAI,MAAM,mBAAmB,CAAC,IAAI,EAAE;AACpC,QAAQ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE;AACzC,QAAQ,IAAI,CAAC,IAAI,EAAE,aAAa,EAAE;AAClC,YAAY,IAAI,IAAI,EAAE,OAAO;AAC7B,gBAAgB,MAAM,IAAI,CAAC,wBAAwB,EAAE;AACrD,YAAY,OAAO,IAAI;AACvB,QAAQ;AACR,QAAQ,OAAO,KAAK,CAAC,mBAAmB,CAAC,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,KAAK,KAAK;AACrG,YAAY,IAAI,KAAK,YAAYC,0BAAa,IAAI,KAAK,CAAC,KAAK,KAAK,eAAe;AACjF,gBAAgB,MAAM,IAAI,CAAC,wBAAwB,EAAE;AACrD,YAAY,MAAM,KAAK;AACvB,QAAQ,CAAC,CAAC;AACV,IAAI;AACJ;AACA,SAAS,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE;AACjD,IAAI,OAAO;AACX,QAAQ,OAAO,EAAE,CAAC;AAClB,QAAQ,MAAM;AACd,QAAQ,QAAQ;AAChB,QAAQ,WAAW,EAAE,IAAI,CAAC,YAAY;AACtC,QAAQ,YAAY,EAAE,IAAI,CAAC,aAAa;AACxC,QAAQ,OAAO,EAAE,IAAI,CAAC,QAAQ;AAC9B,QAAQ,SAAS,EAAE,IAAI,CAAC,UAAU;AAClC,QAAQ,KAAK,EAAE,IAAI,CAAC,KAAK;AACzB,QAAQ,SAAS,EAAE,IAAI,CAAC,UAAU;AAClC,KAAK;AACL;;AC7GO,MAAM,uBAAuB,SAAS,oBAAoB,CAAC;AAClE,IAAI,cAAc;AAClB,IAAI,QAAQ,GAAG,KAAK;AACpB,IAAI,WAAW,CAAC,aAAa,EAAE;AAC/B,QAAQ,KAAK,CAAC,aAAa,CAAC;AAC5B,QAAQ,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,qBAAqB,EAAE;AAC1D,IAAI;AACJ,IAAI,MAAM,kBAAkB,CAAC,IAAI,GAAG,EAAE,EAAE;AACxC,QAAQ,IAAI,IAAI,CAAC,QAAQ;AACzB,YAAY,OAAO,IAAI;AACvB,QAAQ,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,kBAAkB,CAAC,IAAI,CAAC;AAC5D,QAAQ,OAAO,IAAI,CAAC,QAAQ,GAAG,IAAI,GAAG,OAAO;AAC7C,IAAI;AACJ,IAAI,eAAe,GAAG;AACtB,QAAQ,IAAI,CAAC,QAAQ,GAAG,IAAI;AAC5B,QAAQ,IAAI,IAAI,CAAC,cAAc,EAAE;AACjC,YAAY,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC;AACnE,YAAY,IAAI,CAAC,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC;AACpE,YAAY,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE;AACtC,QAAQ;AACR,QAAQ,OAAO,OAAO,CAAC,OAAO,EAAE;AAChC,IAAI;AACJ,IAAI,qBAAqB,GAAG;AAC5B;AACA,QAAQ,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe;AAC5C,QAAQ,IAAI,CAAC,OAAO;AACpB,YAAY,OAAO,SAAS;AAC5B,QAAQ,MAAM,aAAa,GAAG,OAAO,CAAC,MAAM;AAC5C,QAAQ,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK;AAClC,QAAQ,MAAM,KAAK,GAAG,OAAO,IAAI,KAAK;AACtC,YAAY,IAAI,IAAI,CAAC,QAAQ;AAC7B,gBAAgB;AAChB,YAAY,MAAM,aAAa,CAAC,IAAI,CAAC;AACrC,YAAY,IAAI,IAAI,CAAC,QAAQ;AAC7B,gBAAgB,IAAI,EAAE;AACtB,QAAQ,CAAC;AACT,QAAQ,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC;AACnD,QAAQ,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;AACxC,QAAQ,OAAO,CAAC,MAAM,GAAG,KAAK;AAC9B,QAAQ,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE;AAC9B,IAAI;AACJ;;ACvCA,6BAA6B,CAAC,CAAC,aAAa,KAAK,aAAa,CAAC,QAAQ,KAAK;AAC5E,MAAM,IAAI,uBAAuB,CAAC,aAAa;AAC/C,MAAM,0BAA0B,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;;;;;;;;;;;;;;"}

package/docs/PROVIDERS.md

@@ -1,33 +1,27 @@
 # Provider configuration
 
-`capacitor-oidc` works with providers that support Authorization Code Flow with
-PKCE for public clients and permit token-related requests from the configured
-Capacitor origin.
-
-## Provider checklist
-
-For every provider:
-
-1. Create a native, mobile, SPA, or other public client. Do not create or embed a
-   client secret.
-2. Enable Authorization Code Flow and PKCE with `S256`.
-3. Register every web and native redirect and post-logout redirect URI exactly.
-4. Enable refresh tokens and request the provider's offline-access scope if the
-   app must renew sessions.
-5. Allow the app's Capacitor origin through CORS for discovery, token, refresh,
-   UserInfo, and revocation endpoints used by your configuration.
-6. Use HTTPS for provider endpoints.
-
-The recipes below identify the relevant authority and provider-console choices.
-They do not replace the provider's own security guidance.
-
-| Provider           | Current package validation                                      |
-| ------------------ | --------------------------------------------------------------- |
-| Amazon Cognito     | Basic login tested on a physical iOS device; edge cases remain. |
-| Auth0              | Configuration guidance only.                                    |
-| Keycloak           | Configuration guidance only.                                    |
-| Okta               | Configuration guidance only.                                    |
-| Microsoft Entra ID | Configuration guidance only.                                    |
+The recipes below cover the settings that differ between providers.
+`capacitor-oidc` does not contain provider-specific protocol code; it passes the
+configured OpenID Connect settings to `oidc-client-ts`.
+
+## Requirements
+
+Use a public client that supports Authorization Code Flow with `S256` PKCE.
+Register every web and native redirect URI and post-logout redirect URI exactly,
+and configure the provider application without a client secret. A secret cannot
+be kept in a Capacitor app.
+
+If the app refreshes or revokes tokens, or loads UserInfo from the Capacitor
+runtime, the provider must allow the configured Capacitor origin to call those
+endpoints. Request `offline_access`, or the provider's equivalent, when the app
+needs refresh tokens. Use HTTPS outside local test environments.
+
+## Test status
+
+The basic Amazon Cognito sign-in flow has been tested on a physical iOS device.
+The Auth0, Keycloak, Okta, and Microsoft Entra ID sections document expected
+configuration, but those recipes are not yet covered by the package's provider
+integration tests.
 
 ## Amazon Cognito
 
@@ -188,7 +182,7 @@ and [redirect URI restrictions](https://learn.microsoft.com/en-us/entra/identity
 
 ## Other providers
 
-Start with the generic checklist and the provider's OpenID Connect discovery
+Start with the requirements above and the provider's OpenID Connect discovery
 document. If discovery does not describe a usable native flow, pass explicit
 `metadata` through the upstream `UserManagerSettings` rather than adding
 provider-specific code to this package.

package/docs/README.md

@@ -20,4 +20,4 @@ setup for each native platform and your identity provider.
 - [Requirements and acceptance criteria](../REQUIREMENTS.md)
 - [Testing](TESTING.md)
 - [Publishing](PUBLISHING.md)
-- [Architecture decisions](adr)
+- [Architecture decisions](adr/)

package/docs/adr/index.md

@@ -0,0 +1,6 @@
+# Architecture decisions
+
+- [Use `oidc-client-ts`](0001-use-oidc-client-ts.md)
+- [Keep the native boundary small](0002-keep-the-native-boundary-small.md)
+- [Share session storage with widgets](0003-share-session-storage-with-widgets.md)
+- [Use one manager across platforms](0004-use-one-manager-across-platforms.md)

package/docs/frameworks/ANGULAR.md

@@ -0,0 +1,129 @@
+# Angular integration
+
+The [Angular example](/examples/angular/) keeps one OIDC manager in a root
+service. The service completes browser callbacks, restores the current user,
+and exposes signals for templates.
+
+## Install
+
+```sh
+npm install capacitor-oidc @capacitor/app
+npx cap sync
+```
+
+## Configure the provider
+
+Keep deploy-specific values in an Angular environment file:
+
+```ts
+// src/environments/environment.ts
+export const environment = {
+  authority: 'https://identity.example.com',
+  clientId: 'public-app',
+};
+```
+
+## Create a root service
+
+`providedIn: 'root'` gives the application one manager, independent of route
+and component lifetimes:
+
+```ts
+@Injectable({ providedIn: 'root' })
+export class OidcService {
+  readonly user = signal<User | null>(null);
+
+  private readonly manager = CapacitorUserManager.create({
+    common: {
+      authority: environment.authority,
+      client_id: environment.clientId,
+      scope: 'openid profile offline_access',
+      automaticSilentRenew: false,
+    },
+    web: {
+      settings: {
+        redirect_uri: `${window.location.origin}/callback`,
+        post_logout_redirect_uri: `${window.location.origin}/logout-callback`,
+      },
+    },
+    native: {
+      settings: {
+        redirect_uri: 'capacitor-oidc-example:/callback',
+        post_logout_redirect_uri: 'capacitor-oidc-example:/logout-callback',
+      },
+      options: { storageNamespace: 'angular-example' },
+    },
+  });
+}
+```
+
+The runnable example keeps automatic renewal off so the bundled realm's
+30-second test tokens can be renewed with the example's button. For a normal
+provider, enable automatic renewal and keep its expiry-notification threshold
+below the provider's access-token lifetime.
+
+## Initialize from the root component
+
+The service handles browser callbacks before exposing the restored user:
+
+```ts
+async initialize() {
+  const auth = await this.manager;
+
+  auth.events.addUserLoaded((user) => this.user.set(user));
+  auth.events.addUserUnloaded(() => this.user.set(null));
+
+  if (window.location.pathname === '/callback') {
+    await auth.signinCallback();
+    window.history.replaceState({}, '', '/');
+  } else if (window.location.pathname === '/logout-callback') {
+    await auth.signoutCallback();
+    window.history.replaceState({}, '', '/');
+  }
+
+  this.user.set(await auth.getUser());
+}
+```
+
+Call it once from the root component:
+
+```ts
+export class AppComponent implements OnInit {
+  readonly oidc = inject(OidcService);
+
+  ngOnInit() {
+    void this.oidc.initialize();
+  }
+}
+```
+
+Native callbacks finish inside the plugin and do not need Angular Router
+routes.
+
+## Bind actions
+
+The root service can expose `signin()`, `getValidUser(60)`, and `signout()` as
+methods. Components read the current `user` signal and do not hold their own
+manager.
+
+Call `dispose()` only when the Angular application is shutting down.
+
+## Run the example
+
+```sh
+npm ci
+npm run build
+npm run e2e:keycloak:up
+npm --prefix examples/angular install
+npm --prefix examples/angular run dev
+```
+
+Sign in with the disposable `demo` / `demo` account. Stop the local realm with
+`npm run e2e:keycloak:down` when finished.
+
+This local realm workflow is for the browser example. Android resolves
+`localhost` inside the device or emulator, and native platforms should not use
+the example's cleartext HTTP authority. Before building for iOS or Android,
+replace `environment.authority` with an HTTPS authority reachable from that
+device and register the configured native callback scheme at the provider. See
+[iOS and Android setup](../PLATFORM_SETUP.md).

package/docs/frameworks/REACT.md

@@ -0,0 +1,134 @@
+# React integration
+
+The [React example](/examples/react/) creates its OIDC manager outside the
+component tree, restores the user when the application mounts, and keeps React
+state aligned with the manager's user events.
+
+## Install
+
+```sh
+npm install capacitor-oidc @capacitor/app
+npx cap sync
+```
+
+## Create the manager outside React
+
+A module-level promise prevents component renders from constructing multiple
+managers:
+
+```ts
+// src/auth.ts
+import { CapacitorUserManager } from 'capacitor-oidc';
+
+const manager = CapacitorUserManager.create({
+  common: {
+    authority: import.meta.env.VITE_OIDC_AUTHORITY,
+    client_id: import.meta.env.VITE_OIDC_CLIENT_ID,
+    scope: 'openid profile offline_access',
+    automaticSilentRenew: false,
+  },
+  web: {
+    settings: {
+      redirect_uri: `${window.location.origin}/callback`,
+      post_logout_redirect_uri: `${window.location.origin}/logout-callback`,
+    },
+  },
+  native: {
+    settings: {
+      redirect_uri: 'capacitor-oidc-example:/callback',
+      post_logout_redirect_uri: 'capacitor-oidc-example:/logout-callback',
+    },
+    options: { storageNamespace: 'react-example' },
+  },
+});
+
+export function getUserManager() {
+  return manager;
+}
+
+let callback: Promise<void> | undefined;
+
+export function completeWebCallback(auth: CapacitorUserManager) {
+  callback ??= (async () => {
+    if (window.location.pathname === '/callback') {
+      await auth.signinCallback();
+      window.history.replaceState({}, '', '/');
+    } else if (window.location.pathname === '/logout-callback') {
+      await auth.signoutCallback();
+      window.history.replaceState({}, '', '/');
+    }
+  })();
+
+  return callback;
+}
+```
+
+The runnable example supplies local Keycloak defaults and keeps automatic
+renewal off so its 30-second test tokens can be renewed with the example's
+button. For a normal provider, enable automatic renewal and keep its
+expiry-notification threshold below the provider's access-token lifetime. Set
+the two Vite environment variables for your provider.
+
+## Initialize from the application root
+
+Complete browser callbacks, subscribe to user events, and restore the stored
+user from the root component:
+
+```tsx
+useEffect(() => {
+  let active = true;
+  let auth: CapacitorUserManager | undefined;
+  const userLoaded = (user: User) => active && setUser(user);
+  const userUnloaded = () => active && setUser(null);
+
+  void getUserManager().then(async (manager) => {
+    if (!active) return;
+    auth = manager;
+    manager.events.addUserLoaded(userLoaded);
+    manager.events.addUserUnloaded(userUnloaded);
+    await completeWebCallback(manager);
+    const storedUser = await manager.getUser();
+    if (active) setUser(storedUser);
+  });
+
+  return () => {
+    active = false;
+    auth?.events.removeUserLoaded(userLoaded);
+    auth?.events.removeUserUnloaded(userUnloaded);
+  };
+}, []);
+```
+
+Native callbacks complete inside the plugin and do not require React Router
+routes.
+
+## Bind actions
+
+```ts
+await auth.signin();
+setUser(await auth.getValidUser(60));
+await auth.signout();
+```
+
+Retain the manager when React routes change. Call `dispose()` only when the
+whole application is shutting down.
+
+## Run the example
+
+```sh
+npm ci
+npm run build
+npm run e2e:keycloak:up
+npm --prefix examples/react install
+npm --prefix examples/react run dev
+```
+
+Sign in with the disposable `demo` / `demo` account. Stop the local realm with
+`npm run e2e:keycloak:down` when finished.
+
+This local realm workflow is for the browser example. Android resolves
+`localhost` inside the device or emulator, and native platforms should not use
+the example's cleartext HTTP authority. Before building for iOS or Android, set
+`VITE_OIDC_AUTHORITY` to an HTTPS authority reachable from that device and
+register the configured native callback scheme at the provider. See
+[iOS and Android setup](../PLATFORM_SETUP.md).

package/docs/frameworks/VUE.md

@@ -0,0 +1,118 @@
+# Vue integration
+
+The [Vue example](/examples/vue/) is a small Capacitor application with one
+OIDC manager for the application lifetime. It restores the stored user when
+Vue mounts, completes browser callbacks, and exposes sign-in, renewal, and
+sign-out actions.
+
+## Install
+
+```sh
+npm install capacitor-oidc @capacitor/app
+npx cap sync
+```
+
+## Create the manager once
+
+Keep manager creation outside Vue components so route changes cannot create a
+second manager:
+
+```ts
+// src/auth.ts
+import { CapacitorUserManager } from 'capacitor-oidc';
+
+const manager = CapacitorUserManager.create({
+  common: {
+    authority: import.meta.env.VITE_OIDC_AUTHORITY,
+    client_id: import.meta.env.VITE_OIDC_CLIENT_ID,
+    scope: 'openid profile offline_access',
+    automaticSilentRenew: false,
+  },
+  web: {
+    settings: {
+      redirect_uri: `${window.location.origin}/callback`,
+      post_logout_redirect_uri: `${window.location.origin}/logout-callback`,
+    },
+  },
+  native: {
+    settings: {
+      redirect_uri: 'capacitor-oidc-example:/callback',
+      post_logout_redirect_uri: 'capacitor-oidc-example:/logout-callback',
+    },
+    options: { storageNamespace: 'vue-example' },
+  },
+});
+
+export function getUserManager() {
+  return manager;
+}
+```
+
+The runnable example supplies local Keycloak defaults as a convenience and
+keeps automatic renewal off so its 30-second test tokens can be renewed with
+the example's button. For a normal provider, enable automatic renewal and keep
+its expiry-notification threshold below the provider's access-token lifetime.
+Use environment variables for your provider in an application.
+
+## Restore state and handle callbacks
+
+Initialize authentication from the root component. Browser callback routes
+must be handled before rendering the restored user:
+
+```ts
+const auth = await getUserManager();
+
+if (window.location.pathname === '/callback') {
+  await auth.signinCallback();
+  window.history.replaceState({}, '', '/');
+} else if (window.location.pathname === '/logout-callback') {
+  await auth.signoutCallback();
+  window.history.replaceState({}, '', '/');
+}
+
+user.value = await auth.getUser();
+
+auth.events.addUserLoaded((loadedUser) => {
+  user.value = loadedUser;
+});
+
+auth.events.addUserUnloaded(() => {
+  user.value = null;
+});
+```
+
+Native callbacks are completed by the plugin and do not need Vue Router
+routes.
+
+## Bind actions
+
+```ts
+await auth.signin();
+user.value = await auth.getValidUser(60);
+await auth.signout();
+```
+
+Call `dispose()` only when the application is shutting down, not whenever a
+route component unmounts.
+
+## Run the example
+
+Start the repository's local Keycloak realm, then start the Vue app:
+
+```sh
+npm ci
+npm run build
+npm run e2e:keycloak:up
+npm --prefix examples/vue install
+npm --prefix examples/vue run dev
+```
+
+Sign in with the disposable `demo` / `demo` account. Stop the local realm with
+`npm run e2e:keycloak:down` when finished.
+
+This local realm workflow is for the browser example. Android resolves
+`localhost` inside the device or emulator, and native platforms should not use
+the example's cleartext HTTP authority. Before building for iOS or Android, set
+`VITE_OIDC_AUTHORITY` to an HTTPS authority reachable from that device and
+register the configured native callback scheme at the provider. See
+[iOS and Android setup](../PLATFORM_SETUP.md).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "capacitor-oidc",
-  "version": "0.1.0",
+  "version": "0.1.2",
   "description": "OAuth 2.0 and OpenID Connect authentication for Capacitor web, iOS, and Android, powered by oidc-client-ts.",
   "keywords": [
     "capacitor",
@@ -43,12 +43,15 @@
   "bugs": {
     "url": "https://github.com/jojopirker/capacitor-oidc/issues"
   },
-  "homepage": "https://github.com/jojopirker/capacitor-oidc#readme",
+  "homepage": "https://jojopirker.github.io/capacitor-oidc/",
   "type": "module",
   "scripts": {
     "build": "npm run clean && tsc && rollup -c rollup.config.mjs",
     "check:package": "node -e \"import('./dist/esm/index.js')\"",
     "clean": "rimraf dist",
+    "docs:build": "vitepress build . && cp LICENSE .vitepress/dist/LICENSE",
+    "docs:dev": "vitepress dev .",
+    "docs:preview": "vitepress preview .",
     "e2e:keycloak:down": "docker compose -f test/e2e/keycloak/compose.yml down",
     "e2e:keycloak:up": "test/e2e/keycloak/create-certificate.sh test/e2e/keycloak/.certificates && docker compose -f test/e2e/keycloak/compose.yml up -d",
     "example:build": "npm --prefix example run build",
@@ -79,6 +82,8 @@
     "rimraf": "6.1.0",
     "rollup": "4.62.5",
     "typescript": "5.9.3",
+    "vite": "7.3.6",
+    "vitepress": "2.0.0-alpha.19",
     "vitest": "3.2.7"
   },
   "prettier": "@ionic/prettier-config",