react-native-oauth-essentials 1.0.11 → 1.1.1

package/lib/module/index.js

@@ -2,63 +2,165 @@
 
 import OauthEssentials from "./NativeOauthEssentials.js";
 import { Platform } from 'react-native';
-import { CredentialsType } from "./types.js";
+import { CredentialError, CredentialsType } from "./types.js";
+import { buildAuthorizationUrl, buildTokenRequestBody, getUrlScheme, parseRedirectParams } from "./oauth.js";
+import { createCredentialError } from "./errors.js";
+import { resolveGoogleClientId, splitGoogleArgs, warnIgnored, warnOnce } from "./platform.js";
 export * from "./types.js";
+export { isCredentialError } from "./errors.js";
 const APPLE_ID_CACHED_RESULTS = new Map();
 
 /**
- * Performs the google sign in.
- * @param webClientId
- * @param options
+ * Shows the Google sign in UI and resolves with the signed in account.
  *
- * You should rely on GOOGLE_ID_SUPPORTED constant to check if you can use this method.
- * [Available on Android and IOS].
+ * iOS: configures GoogleSignIn with the iOS client id (+ `serverClientId`, `hostedDomain`) and
+ * presents it from the top most view controller, passing `hint`, `scopes` and `nonce`. If the app is
+ * not active it waits up to 2 seconds for it to become active. The client id falls back to
+ * `GIDClientID` and `serverClientId` to `webClientId`, then to `GIDServerClientID` (Info.plist).
+ * Android: shows the Credential Manager bottom sheet (`mode: 'bottomSheet'`, falls back to the
+ * "Sign in with Google" flow when there is no credential and `authorizedAccounts` is not set) or
+ * the "Sign in with Google" flow (`mode: 'button'`). When `scopes` or `offlineAccess` are set it
+ * then asks for authorization, which may show a consent screen.
+ *
+ * Resolves `GOOGLE_ID`, or `CANCELLED` when the user dismisses the UI (or declines the consent
+ * screen on Android).
+ * Rejects with `CONFIGURATION_ERROR` (no client id; iOS: the reversed client id URL scheme is not in
+ * Info.plist, the message has the exact scheme), `NOT_SUPPORTED_ERROR` (Android, no Play Services),
+ * `NO_ACTIVITY_ERROR`,
+ * `NO_SIGN_IN_AVAILABLE` (Android), `BROWSER_UNAVAILABLE` (iOS: app not active, its window not in
+ * the foreground, Guided Access or Safari could not be opened), `SIMULTANEOUS_CALL_ERROR` (iOS: a Google sign in is pending) or
+ * `INVALID_RESULT_ERROR`.
+ * Emits `onCredentialSuccess` / `onCredentialFailure`.
+ *
+ * @param clientId - `{ iosClientId, webClientId }` (see {@link GoogleClientIds}), or one client id
+ * string used as is (the iOS client id on iOS, the web client id on Android). Optional: without it
+ * the ids are read from the app config (`googleSignIn()` or `googleSignIn(options)`), see
+ * {@link GoogleClientIds}.
+ * @param options - See {@link GoogleSignInOptions}.
+ */
+
+export async function googleSignIn(clientIdOrOptions, maybeOptions) {
+  const {
+    clientId,
+    options
+  } = splitGoogleArgs(clientIdOrOptions, maybeOptions);
+  warnIgnored('googleSignIn', Platform.OS, options, Platform.OS === 'ios' ? GOOGLE_IOS_IGNORED : ['hint']);
+  const resolved = resolveGoogleClientId(Platform.OS, clientId, {
+    ...options
+  });
+  return await OauthEssentials.googleSignIn(resolved.clientId, parseGoogleIdOptions(resolved.options));
+}
+const GOOGLE_IOS_IGNORED = ['authorizedAccounts', 'autoSelectEnabled', 'mode', 'offlineAccess'];
+
+/**
+ * Restores a previous Google sign in.
+ *
+ * iOS: calls GoogleSignIn `restorePreviousSignIn`, which never shows UI and refreshes the tokens.
+ * `hint`, `scopes`, `nonce` and `offlineAccess` are ignored and `serverAuthCode` is always null.
+ * Android: shows the Credential Manager bottom sheet filtered to accounts that already signed in to
+ * the app with auto select on, so it signs in without UI when there is a single one. `mode` and
+ * `hint` are ignored. When `scopes`/`offlineAccess` are set, authorization is only requested without UI:
+ * if consent is needed the result has `accessToken: null`.
+ *
+ * Resolves `GOOGLE_ID`, or `CANCELLED` when the user dismisses the Android sheet.
+ * Rejects with `NO_SIGN_IN_AVAILABLE` when there is nothing to restore, plus the same errors as
+ * {@link googleSignIn} (it shares the iOS simultaneous call lock with it). Takes the same
+ * `clientId` as {@link googleSignIn} (also optional).
+ * Emits `onCredentialSuccess` / `onCredentialFailure`.
+ */
+
+export async function googleSilentSignIn(clientIdOrOptions, maybeOptions) {
+  const {
+    clientId,
+    options
+  } = splitGoogleArgs(clientIdOrOptions, maybeOptions);
+  warnIgnored('googleSilentSignIn', Platform.OS, options, Platform.OS === 'ios' ? [...GOOGLE_IOS_IGNORED, 'hint', 'scopes', 'nonce'] : ['hint', 'mode']);
+  const resolved = resolveGoogleClientId(Platform.OS, clientId, {
+    ...options
+  });
+  return await OauthEssentials.googleSilentSignIn(resolved.clientId, parseGoogleIdOptions(resolved.options));
+}
+
+/**
+ * Clears the stored sign in state.
+ *
+ * iOS: calls GoogleSignIn `signOut` (removes the Google session from the keychain, so
+ * {@link googleSilentSignIn} rejects afterwards). It does not affect Apple ID or passwords.
+ * Android: calls Credential Manager `clearCredentialState`, which turns off auto select for every
+ * provider until the user picks an account again.
+ *
+ * Resolves `true`. Rejects with `INVALID_RESULT_ERROR` (Android only) when clearing fails.
+ * Does not emit events.
  */
-export async function googleSignIn(webClientId, options) {
-  return await OauthEssentials.googleSignIn(webClientId, parseGoogleIdOptions(options));
+export async function signOut() {
+  return await OauthEssentials.signOut();
 }
 
 /**
- * Gets the stored password.
- * If does not have an stored password, returns false.
+ * Shows the saved passwords of the app and resolves with the one the user picks.
+ *
+ * iOS: `ASAuthorizationPasswordProvider` request (iOS 16+ only offers credentials already saved on
+ * the device). Resolves `PASSWORD`, or the `CANCELLED` result when the user dismisses it or there
+ * is no saved password. Rejects with `INVALID_RESULT_ERROR` on other errors and
+ * `SIMULTANEOUS_CALL_ERROR` while a previous call is pending.
+ * Android: Credential Manager `GetPasswordOption`. Resolves `PASSWORD`, or `CANCELLED` when the user
+ * dismisses it or there is no saved password. Rejects with `NOT_SUPPORTED_ERROR` without Play
+ * Services, `NO_ACTIVITY_ERROR` and `INVALID_RESULT_ERROR` on other errors.
  *
- * You should rely on PASSWORD_SUPPORTED constant to check if you can use this method.
- * [Available on Android and IOS].
+ * Emits `onCredentialSuccess` / `onCredentialFailure`.
  */
 export async function getPassword() {
-  const result = await OauthEssentials.getPassword();
-  return result || false;
+  return await OauthEssentials.getPassword();
 }
 
 /**
- * Performs the password sign in.
- * Cannot be a already stored password.
- * @param {string} username
- * @param {string} password
+ * Saves a username and password in the platform password manager. It does not authenticate the
+ * user against anything.
+ *
+ * iOS: does nothing and resolves `false` (iOS has no API to save a password without an associated
+ * domain; use the `textContentType` props of your inputs so iOS offers to save it).
+ * Android: Credential Manager `createCredential(CreatePasswordRequest)`, which shows the save
+ * prompt. Resolves `true` when saved, `false` on any error (including the user declining).
+ * Rejects with `NOT_SUPPORTED_ERROR` without Play Services and `NO_ACTIVITY_ERROR`.
  *
- * You should rely on PASSWORD_SUPPORTED constant to check if you can use this method.
- * [Available on Android and IOS].
+ * Does not emit events, except `onCredentialFailure` for the Android rejections.
  */
 export async function passwordSignIn(username, password) {
+  if (Platform.OS === 'ios') {
+    warnOnce('passwordSignIn', 'ios', 'does nothing on iOS: set textContentType on your inputs so iOS offers to save the password.');
+  }
   return await OauthEssentials.passwordSignIn(username, password);
 }
 
 /**
- * Initiates the Apple Sign-In process.
- * On IOS devices it handles it smoothly using the latest UI workflow.
- * On Android it dispatches the androidWebUrl to device default browser for handling it.
- * you need to implement on your backend the redirect logic and validation accordingly to the link below
- * @see [Apple Sign In REST API Documentation](https://developer.apple.com/documentation/signinwithapplerestapi)
+ * Signs in with Apple.
+ *
+ * iOS: native Sign in with Apple sheet requesting `fullName` and `email`, with `options.nonce` and
+ * `options.state`. Resolves `APPLE_ID`, or `CANCELLED` when the user dismisses it. Rejects with
+ * `INVALID_RESULT_ERROR` on other errors and `SIMULTANEOUS_CALL_ERROR` while a previous call is
+ * pending. Apple only sends `email`/`fullName` on the first authorization: this function keeps the
+ * first result of each `user` in memory (until the app is killed) and fills empty `email`/`fullName`
+ * with it.
+ * Android: opens `androidWebUrl` in a Custom Tab; `options` is ignored (put the nonce in your url).
+ * Your backend must run the Apple web flow and redirect to `<applicationId>://oauth/callback`.
+ * Resolves `WEB_APPLE_ID` with the redirect url, or `CANCELLED` when the user closes the tab or
+ * another browser session (`appleSignIn`/`oauthSignIn`) starts. Rejects with `INVALID_RESULT_ERROR`
+ * (invalid url), `NO_ACTIVITY_ERROR` or `BROWSER_UNAVAILABLE` (no browser installed).
  *
- * @param {string} androidWebUrl - The web URL on Android where the user will complete the OAuth flow. **[Android only]**
+ * Emits `onCredentialSuccess` / `onCredentialFailure`.
+ * @see [Sign in with Apple REST API](https://developer.apple.com/documentation/signinwithapplerestapi)
  *
- * @returns {AppleIdCredentialResult|WebAppleIdCredentialResult} Returns AppleIdCredentialResult on IOS devices and WebAppleIdCredentialResult on android.
+ * @param androidWebUrl - Web url that starts the Apple flow. Required on Android, ignored on iOS.
+ * @param options - See {@link AppleSignInOptions}. iOS only.
  */
-export async function appleSignIn(androidWebUrl) {
+export async function appleSignIn(androidWebUrl, options) {
+  if (Platform.OS !== 'ios') {
+    warnIgnored('appleSignIn', Platform.OS, options, ['nonce', 'state']);
+  }
   const result = await OauthEssentials.appleSignIn(Platform.select({
-    ios: undefined,
-    android: androidWebUrl
-  }));
+    ios: null,
+    default: androidWebUrl ?? null
+  }), options ?? {});
   if (result.type === CredentialsType.APPLE_ID) {
     if (APPLE_ID_CACHED_RESULTS.has(result.data.user)) {
       // Reuse the fullName and email provided
@@ -73,41 +175,305 @@ export async function appleSignIn(androidWebUrl) {
     } else {
       APPLE_ID_CACHED_RESULTS.set(result.data.user, result.data);
     }
-    return result;
-  } else {
-    return result;
   }
+  return result;
+}
+
+/**
+ * Asks Apple whether the user is still signed in to the app with Apple ID, without UI
+ * (`ASAuthorizationAppleIDProvider.getCredentialState`).
+ * Call it on app start and sign the user out when it is not `AUTHORIZED`.
+ *
+ * Resolves `AUTHORIZED`, `REVOKED`, `TRANSFERRED` or `NOT_FOUND`. Rejects with
+ * `INVALID_RESULT_ERROR` when the check fails, and always with `NOT_SUPPORTED_ERROR` on Android.
+ * Does not emit events.
+ *
+ * @param userId - The `user` field of the AppleIdCredentialResult.
+ */
+export async function getAppleIdCredentialState(userId) {
+  return await OauthEssentials.getAppleIdCredentialState(userId);
 }
 
 /**
- * Performs all sign in methods available on the platform at once.
- * This is supposed to be used on app start to get any existing sign in.
+ * Shows a single picker with the credentials the user already has, meant for app start.
+ *
+ * iOS: Apple ID + saved passwords (`clientId` is ignored, Google is not included; only
+ * `options.nonce` is used, for Apple ID). On iOS 16+ only credentials already on the device are
+ * offered. Resolves `APPLE_ID` or `PASSWORD`, or `CANCELLED` when the user dismisses it or nothing
+ * is available. Rejects with `INVALID_RESULT_ERROR` or `SIMULTANEOUS_CALL_ERROR`.
+ * Android: Credential Manager with Google ID (bottom sheet option with the web client id,
+ * `authorizedAccounts`, `autoSelectEnabled` and `nonce`) + saved passwords. Apple is not included
+ * and `mode`, `hint`, `scopes`, `offlineAccess`, `hostedDomain` and `serverClientId` are ignored.
+ * Resolves `GOOGLE_ID` or `PASSWORD`, or `CANCELLED`. Rejects with `CONFIGURATION_ERROR` (no web
+ * client id), `NOT_SUPPORTED_ERROR` (no Play Services), `NO_ACTIVITY_ERROR`,
+ * `NO_SIGN_IN_AVAILABLE` or `INVALID_RESULT_ERROR`.
+ *
+ * Ignored options produce a warning in development.
+ * `clientId` is optional like in {@link googleSignIn}: without it the web client id is read from
+ * the app config.
+ *
+ * Emits `onCredentialSuccess` / `onCredentialFailure`.
  */
-export async function hybridSignIn(googleClientId, options) {
-  return await OauthEssentials.hybridSignIn(googleClientId, parseGoogleIdOptions(options));
+
+export async function hybridSignIn(clientIdOrOptions, maybeOptions) {
+  const {
+    clientId,
+    options
+  } = splitGoogleArgs(clientIdOrOptions, maybeOptions);
+  if (Platform.OS === 'ios') {
+    if (clientId) {
+      warnOnce('hybridSignIn', 'clientId', 'the Google client id is ignored on iOS (Google is not offered there, only Apple ID and passwords).');
+    }
+    warnIgnored('hybridSignIn', 'ios', options, [...GOOGLE_IOS_IGNORED, 'hint', 'scopes', 'hostedDomain', 'serverClientId']);
+  } else {
+    warnIgnored('hybridSignIn', Platform.OS, options, ['hint', 'mode', 'scopes', 'offlineAccess', 'hostedDomain', 'serverClientId']);
+  }
+  const resolved = resolveGoogleClientId(Platform.OS, clientId, {
+    ...options
+  });
+  return await OauthEssentials.hybridSignIn(resolved.clientId, parseGoogleIdOptions(resolved.options));
 }
 
+/** Result of {@link hybridSignIn}: Apple ID only on iOS, Google ID only on Android. */
+
 /**
- * Creates a passkey.
- * @param options
+ * Creates a passkey from a WebAuthn `PublicKeyCredentialCreationOptions` JSON (`requestJson`).
+ *
+ * iOS 16+: platform passkey registration. Reads `challenge`, `rp.id`, `user.id`, `user.name`,
+ * `authenticatorSelection.userVerification`, `attestation` and, on iOS 17.4+,
+ * `excludeCredentials`; other fields are ignored. `data` is a JSON string with `id`, `rawId`,
+ * `type` and `response.clientDataJSON`/`attestationObject` (base64url). Rejects with
+ * `NOT_SUPPORTED_ERROR` below iOS 16 and `SIMULTANEOUS_CALL_ERROR` while a passkey call is pending.
+ * Android 9+: Credential Manager `CreatePublicKeyCredentialRequest` with the whole JSON and
+ * `preferImmediatelyAvailableCredentials`. `data` is the registration response JSON returned by
+ * Credential Manager. Rejects with `NOT_SUPPORTED_ERROR` below Android 9 and `NO_ACTIVITY_ERROR`.
+ *
+ * Resolves `PASSKEY`, or `CANCELLED` when the user dismisses it. Rejects with
+ * `INVALID_RESULT_ERROR` for an invalid/missing `requestJson` and other errors.
+ * Emits `onCredentialSuccess` / `onCredentialFailure`. Send `data` to your server to verify it.
  */
 export async function createPassKey(options) {
+  warnPasskeyOptions('createPassKey', options);
   return await OauthEssentials.createPassKey(options);
 }
+
+/**
+ * Signs in with a passkey from a WebAuthn `PublicKeyCredentialRequestOptions` JSON (`requestJson`).
+ *
+ * iOS 16+: platform passkey assertion. Reads `challenge`, `rpId`, `allowCredentials` and
+ * `userVerification`. With `mediation: 'autofill'` it does not show a sheet: it waits until the user
+ * picks a passkey in the QuickType bar of a `textContentType="username"` field, and any other
+ * passkey call (or {@link cancelPassKeyAutoFill}) resolves it as `CANCELLED`. Otherwise it shows a
+ * sheet that only offers passkeys available on the device (no "other device" QR option), so it
+ * resolves `CANCELLED` when there is none. `data` is a JSON string with `id`, `rawId`, `type` and
+ * `response.clientDataJSON`/`authenticatorData`/`signature`/`userHandle` (base64url).
+ * Rejects with `NOT_SUPPORTED_ERROR` below iOS 16 and `SIMULTANEOUS_CALL_ERROR` while a modal
+ * passkey call is pending.
+ * Android 9+: Credential Manager `GetPublicKeyCredentialOption` with the whole JSON and
+ * `preferImmediatelyAvailableCredentials`; `mediation` is ignored. `data` is the authentication
+ * response JSON returned by Credential Manager. Rejects with `NOT_SUPPORTED_ERROR` below Android 9,
+ * `NO_ACTIVITY_ERROR` and `NO_SIGN_IN_AVAILABLE` (no passkey).
+ *
+ * Resolves `PASSKEY`, or `CANCELLED` when the user dismisses it. Rejects with
+ * `INVALID_RESULT_ERROR` for an invalid/missing `requestJson` and other errors.
+ * Emits `onCredentialSuccess` / `onCredentialFailure`. Send `data` to your server to verify it.
+ */
+export async function getPassKey(options) {
+  warnPasskeyOptions('getPassKey', options);
+  return await OauthEssentials.getPassKey(options);
+}
+function warnPasskeyOptions(method, options) {
+  if (Platform.OS === 'ios') {
+    if (options?.preferImmediatelyAvailableCredentials === false) {
+      warnOnce(method, 'preferImmediatelyAvailableCredentials', '"preferImmediatelyAvailableCredentials: false" is ignored on iOS (modal requests only offer passkeys on the device).');
+    }
+  } else if (options?.mediation === 'autofill') {
+    warnOnce(method, 'mediation', '"mediation: \'autofill\'" is ignored on Android.');
+  }
+}
+
+/**
+ * Cancels a pending `getPassKey({ mediation: 'autofill' })` request, for example when the sign in
+ * screen unmounts. The cancelled `getPassKey` resolves `CANCELLED` (and emits it).
+ *
+ * Resolves `true` when a pending AutoFill request was cancelled, `false` when there was none.
+ * Always resolves `false` on Android and below iOS 16.
+ */
+export async function cancelPassKeyAutoFill() {
+  return await OauthEssentials.cancelPassKeyAutoFill();
+}
+
+/**
+ * Signs in with any OAuth 2.0 / OpenID Connect provider using the authorization code flow.
+ *
+ * 1. Generates a random `state` and a PKCE S256 verifier/challenge on the native side.
+ * 2. Builds `authorizationEndpoint?response_type=code&client_id&redirect_uri&state[&scope]
+ *    [&code_challenge&code_challenge_method=S256]` + `additionalParameters` (which may override
+ *    `scope`; the other parameters above are reserved and ignored there, with a dev warning).
+ * 3. Opens it in `ASWebAuthenticationSession` (iOS, `prefersEphemeralSession`, waits up to 2 seconds
+ *    for the app to be active) or a Custom Tab (Android) and waits for the redirect to `redirectUri`.
+ *    On Android the redirect must reach `CustomTabsActivity`: use `OAUTH_REDIRECT_URI` or add an
+ *    intent filter for your uri.
+ * 4. Checks that the returned `state` matches, then reads `code` (query or fragment).
+ * 5. When `tokenEndpoint` is set, POSTs `grant_type=authorization_code`, `code`, `client_id`,
+ *    `redirect_uri` and `code_verifier` as a form and returns the JSON response in `tokens`
+ *    (no client secret is sent, the id_token is not validated).
+ *
+ * Resolves `OAUTH`, or `CANCELLED` when the user closes the browser, the provider returns
+ * `error=access_denied` or (Android) another browser session starts.
+ * Rejects with `INVALID_RESULT_ERROR` (state mismatch, provider error, no code, token endpoint
+ * returned non 2xx or non JSON), `NETWORK_ERROR` (token request failed), `CONFIGURATION_ERROR`
+ * (invalid `redirectUri`), `BROWSER_UNAVAILABLE` (iOS: Guided Access, app not active or its window
+ * not in the foreground; Android: no browser), `NO_ACTIVITY_ERROR` or `SIMULTANEOUS_CALL_ERROR` (iOS).
+ * Does not emit events.
+ */
+export async function oauthSignIn(options) {
+  if (Platform.OS !== 'ios') {
+    warnIgnored('oauthSignIn', Platform.OS, options, ['prefersEphemeralSession']);
+  }
+  const redirectUri = options.redirectUri ?? OAUTH_REDIRECT_URI;
+  const usePKCE = options.usePKCE !== false;
+  const pkce = await OauthEssentials.generatePkce();
+  const url = buildAuthorizationUrl({
+    authorizationEndpoint: options.authorizationEndpoint,
+    clientId: options.clientId,
+    redirectUri,
+    scopes: options.scopes,
+    additionalParameters: options.additionalParameters,
+    state: pkce.state,
+    codeChallenge: usePKCE ? pkce.codeChallenge : undefined
+  });
+  const session = await OauthEssentials.openAuthSession(url, {
+    callbackScheme: getUrlScheme(redirectUri),
+    prefersEphemeralSession: options.prefersEphemeralSession === true
+  });
+  if (session.type === CredentialsType.CANCELLED || !session.data) {
+    return {
+      type: CredentialsType.CANCELLED,
+      data: null
+    };
+  }
+  const params = parseRedirectParams(session.data.url);
+  if (params.state !== pkce.state) {
+    throw oauthError('State mismatch in authorization response');
+  }
+  if (params.error) {
+    if (params.error === 'access_denied') {
+      return {
+        type: CredentialsType.CANCELLED,
+        data: null
+      };
+    }
+    throw oauthError(params.error_description ?? params.error);
+  }
+  if (!params.code) {
+    throw oauthError('Authorization response has no code');
+  }
+  const codeVerifier = usePKCE ? pkce.codeVerifier : null;
+  let tokens = null;
+  if (options.tokenEndpoint) {
+    let response;
+    try {
+      response = await fetch(options.tokenEndpoint, {
+        method: 'POST',
+        headers: {
+          'Content-Type': 'application/x-www-form-urlencoded',
+          'Accept': 'application/json'
+        },
+        body: buildTokenRequestBody({
+          code: params.code,
+          clientId: options.clientId,
+          redirectUri,
+          codeVerifier
+        })
+      });
+    } catch (e) {
+      throw createCredentialError(CredentialError.NETWORK_ERROR, `Token request failed: ${e instanceof Error ? e.message : String(e)}`, e);
+    }
+    try {
+      tokens = await response.json();
+    } catch (e) {
+      throw createCredentialError(CredentialError.INVALID_RESULT_ERROR, `Token endpoint returned a non JSON response (status ${response.status})`, e);
+    }
+    if (!response.ok) {
+      throw oauthError(String(tokens.error_description ?? tokens.error ?? response.status));
+    }
+  }
+  return {
+    type: CredentialsType.OAUTH,
+    data: {
+      code: params.code,
+      state: params.state,
+      redirectUri,
+      codeVerifier,
+      params,
+      tokens
+    }
+  };
+}
+function oauthError(message) {
+  return createCredentialError(CredentialError.INVALID_RESULT_ERROR, message);
+}
+
+/**
+ * Called with the same `{ type, data }` the promise resolves with (including `CANCELLED`), for
+ * `googleSignIn`, `googleSilentSignIn`, `getPassword`, `appleSignIn`, `hybridSignIn`,
+ * `createPassKey` and `getPassKey`. Not called by `signOut`, `passwordSignIn`,
+ * `getAppleIdCredentialState`, `cancelPassKeyAutoFill` and `oauthSignIn`.
+ */
+export function addCredentialSuccessListener(listener) {
+  return OauthEssentials.onCredentialSuccess(listener);
+}
+
+/**
+ * Called with `{ code, message }` when one of the methods listed in
+ * {@link addCredentialSuccessListener} rejects. `SIMULTANEOUS_CALL_ERROR`, the iOS
+ * `NOT_SUPPORTED_ERROR` below iOS 16 and the iOS missing `requestJson` error are not emitted.
+ */
+export function addCredentialFailureListener(listener) {
+  return OauthEssentials.onCredentialFailure(event => listener(event));
+}
+
+/**
+ * Called when iOS posts `credentialRevokedNotification`, i.e. the user stopped using Apple ID with
+ * the app while it is running. Sign the user out when it fires. Never called on Android.
+ */
+export function addAppleIdCredentialRevokedListener(listener) {
+  return OauthEssentials.onAppleIdCredentialRevoked(() => listener());
+}
 function parseGoogleIdOptions(options) {
   const bridgeOptions = {
     authorizedAccounts: false,
-    autoSelectEnabled: false
+    autoSelectEnabled: false,
+    mode: 'bottomSheet'
   };
-  const hasOptions = options && typeof options === 'object' && Object.keys(options).length > 0;
-  if (hasOptions) {
-    if (Platform.OS === 'android') {
-      if (options.hasOwnProperty('authorizedAccounts')) {
-        bridgeOptions.authorizedAccounts = options.authorizedAccounts === true;
-      }
-      if (options.hasOwnProperty('autoSelectEnabled')) {
-        bridgeOptions.autoSelectEnabled = options.autoSelectEnabled === true;
-      }
+  if (options && typeof options === 'object') {
+    if (options.authorizedAccounts !== undefined) {
+      bridgeOptions.authorizedAccounts = options.authorizedAccounts === true;
+    }
+    if (options.autoSelectEnabled !== undefined) {
+      bridgeOptions.autoSelectEnabled = options.autoSelectEnabled === true;
+    }
+    if (options.mode === 'button') {
+      bridgeOptions.mode = 'button';
+    }
+    if (options.offlineAccess !== undefined) {
+      bridgeOptions.offlineAccess = options.offlineAccess === true;
+    }
+    if (typeof options.nonce === 'string') {
+      bridgeOptions.nonce = options.nonce;
+    }
+    if (typeof options.hint === 'string') {
+      bridgeOptions.hint = options.hint;
+    }
+    if (typeof options.hostedDomain === 'string') {
+      bridgeOptions.hostedDomain = options.hostedDomain;
+    }
+    if (typeof options.serverClientId === 'string') {
+      bridgeOptions.serverClientId = options.serverClientId;
+    }
+    if (Array.isArray(options.scopes)) {
+      bridgeOptions.scopes = options.scopes.filter(s => typeof s === 'string');
     }
   }
   return bridgeOptions;
@@ -115,34 +481,42 @@ function parseGoogleIdOptions(options) {
 const CONSTANTS = OauthEssentials.getConstants();
 
 /**
- * Google Play are supported.
- * It always false on IOS, cause IOS does not use Google Play Services.
+ * Android: Google Play Services are installed and up to date (read once, when the module loads).
+ * iOS: always false.
  */
 export const GOOGLE_PLAY_SERVICES_SUPPORTED = CONSTANTS.GOOGLE_PLAY_SERVICES_SUPPORTED;
 
 /**
- * The password method is supported.
+ * iOS: always true. Android: same as `GOOGLE_PLAY_SERVICES_SUPPORTED` (`getPassword` and
+ * `passwordSignIn` reject with `NOT_SUPPORTED_ERROR` without Play Services).
  */
 export const PASSWORD_SUPPORTED = CONSTANTS.PASSWORD_SUPPORTED;
 
 /**
- * Google Play id sign in is supported.
- * You should mainly rely on this constant to check if you can use google sign in.
+ * iOS: always true. Android: same as `GOOGLE_PLAY_SERVICES_SUPPORTED`.
  */
 export const GOOGLE_ID_SUPPORTED = CONSTANTS.GOOGLE_ID_SUPPORTED;
 
 /**
- * Gets if Apple id sign in is supported.
+ * Always true (native on iOS, web flow in a Custom Tab on Android).
  */
 export const APPLE_ID_SUPPORTED = CONSTANTS.APPLE_ID_SUPPORTED;
 
 /**
- * Gets if "hybrid" is supported in this platform.
+ * iOS: always true. Android: same as `GOOGLE_PLAY_SERVICES_SUPPORTED` (`hybridSignIn` rejects with
+ * `NOT_SUPPORTED_ERROR` without Play Services).
  */
 export const HYBRID_SUPPORTED = CONSTANTS.HYBRID_SUPPORTED;
 
 /**
- * Gets if passkeys are supported.
+ * iOS 16+ / Android 9+ (API 28).
  */
 export const PASSKEYS_SUPPORTED = CONSTANTS.PASSKEYS_SUPPORTED;
+
+/**
+ * Default redirect uri of `oauthSignIn`: `<bundle id, lowercased>://oauth/callback` on iOS and
+ * `<applicationId>://oauth/callback` on Android (the uri the library's `CustomTabsActivity`
+ * intent filter handles).
+ */
+export const OAUTH_REDIRECT_URI = CONSTANTS.OAUTH_REDIRECT_URI;
 //# sourceMappingURL=index.js.map

package/lib/module/index.js.map

@@ -1 +1 @@
-{"version":3,"names":["OauthEssentials","Platform","CredentialsType","APPLE_ID_CACHED_RESULTS","Map","googleSignIn","webClientId","options","parseGoogleIdOptions","getPassword","result","passwordSignIn","username","password","appleSignIn","androidWebUrl","select","ios","undefined","android","type","APPLE_ID","has","data","user","cached","get","fullName","email","set","hybridSignIn","googleClientId","createPassKey","bridgeOptions","authorizedAccounts","autoSelectEnabled","hasOptions","Object","keys","length","OS","hasOwnProperty","CONSTANTS","getConstants","GOOGLE_PLAY_SERVICES_SUPPORTED","PASSWORD_SUPPORTED","GOOGLE_ID_SUPPORTED","APPLE_ID_SUPPORTED","HYBRID_SUPPORTED","PASSKEYS_SUPPORTED"],"sourceRoot":"../../src","sources":["index.tsx"],"mappings":";;AAAA,OAAOA,eAAe,MAAM,4BAAyB;AACrD,SAASC,QAAQ,QAAQ,cAAc;AACvC,SAGEC,eAAe,QAOV,YAAS;AAEhB,cAAc,YAAS;AACvB,MAAMC,uBAAuB,GAAG,IAAIC,GAAG,CAGrC,CAAC;;AAEH;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,YAAYA,CAChCC,WAAmB,EACnBC,OAA6B,EACkC;EAC/D,OAAQ,MAAMP,eAAe,CAACK,YAAY,CACxCC,WAAW,EACXE,oBAAoB,CAACD,OAAO,CAC9B,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeE,WAAWA,CAAA,EAA8C;EAC7E,MAAMC,MAAM,GAAG,MAAMV,eAAe,CAACS,WAAW,CAAC,CAAC;EAClD,OAAQC,MAAM,IAAiC,KAAK;AACtD;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,cAAcA,CAClCC,QAAgB,EAChBC,QAAgB,EACE;EAClB,OAAO,MAAMb,eAAe,CAACW,cAAc,CAACC,QAAQ,EAAEC,QAAQ,CAAC;AACjE;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,WAAWA,CAC/BC,aAAsB,EACyC;EAC/D,MAAML,MAAM,GAAI,MAAMV,eAAe,CAACc,WAAW,CAC/Cb,QAAQ,CAACe,MAAM,CAAC;IACdC,GAAG,EAAEC,SAAS;IACdC,OAAO,EAAEJ;EACX,CAAC,CACH,CAA0D;EAC1D,IAAIL,MAAM,CAACU,IAAI,KAAKlB,eAAe,CAACmB,QAAQ,EAAE;IAC5C,IAAIlB,uBAAuB,CAACmB,GAAG,CAACZ,MAAM,CAACa,IAAI,CAACC,IAAI,CAAC,EAAE;MACjD;MACA,MAAMC,MAAM,GAAGtB,uBAAuB,CAACuB,GAAG,CACxChB,MAAM,CAACa,IAAI,CAACC,IACd,CAAoC;MAEpC,MAAMD,IAAI,GAAGb,MAAM,CAACa,IAAI;MACxB,IAAI,CAACA,IAAI,CAACI,QAAQ,EAAE;QAClBJ,IAAI,CAACI,QAAQ,GAAGF,MAAM,CAACE,QAAQ;MACjC;MACA,IAAI,CAACJ,IAAI,CAACK,KAAK,EAAE;QACfL,IAAI,CAACK,KAAK,GAAGH,MAAM,CAACG,KAAK;MAC3B;IACF,CAAC,MAAM;MACLzB,uBAAuB,CAAC0B,GAAG,CAACnB,MAAM,CAACa,IAAI,CAACC,IAAI,EAAEd,MAAM,CAACa,IAAI,CAAC;IAC5D;IACA,OAAOb,MAAM;EACf,CAAC,MAAM;IACL,OAAOA,MAAM;EACf;AACF;;AAEA;AACA;AACA;AACA;AACA,OAAO,eAAeoB,YAAYA,CAChCC,cAAsB,EACtBxB,OAA6B,EAM7B;EACA,OAAQ,MAAMP,eAAe,CAAC8B,YAAY,CACxCC,cAAc,EACdvB,oBAAoB,CAACD,OAAO,CAC9B,CAAC;AAIH;;AAEA;AACA;AACA;AACA;AACA,OAAO,eAAeyB,aAAaA,CACjCzB,OAAuB,EACW;EAClC,OAAQ,MAAMP,eAAe,CAACgC,aAAa,CACzCzB,OACF,CAAC;AACH;AAEA,SAASC,oBAAoBA,CAACD,OAAa,EAAE;EAC3C,MAAM0B,aAAkC,GAAG;IACzCC,kBAAkB,EAAE,KAAK;IACzBC,iBAAiB,EAAE;EACrB,CAAC;EAED,MAAMC,UAAU,GACd7B,OAAO,IAAI,OAAOA,OAAO,KAAK,QAAQ,IAAI8B,MAAM,CAACC,IAAI,CAAC/B,OAAO,CAAC,CAACgC,MAAM,GAAG,CAAC;EAE3E,IAAIH,UAAU,EAAE;IACd,IAAInC,QAAQ,CAACuC,EAAE,KAAK,SAAS,EAAE;MAC7B,IAAIjC,OAAO,CAACkC,cAAc,CAAC,oBAAoB,CAAC,EAAE;QAChDR,aAAa,CAACC,kBAAkB,GAAG3B,OAAO,CAAC2B,kBAAkB,KAAK,IAAI;MACxE;MACA,IAAI3B,OAAO,CAACkC,cAAc,CAAC,mBAAmB,CAAC,EAAE;QAC/CR,aAAa,CAACE,iBAAiB,GAAG5B,OAAO,CAAC4B,iBAAiB,KAAK,IAAI;MACtE;IACF;EACF;EACA,OAAOF,aAAa;AACtB;AAEA,MAAMS,SAAS,GAAG1C,eAAe,CAAC2C,YAAY,CAAC,CAAC;;AAEhD;AACA;AACA;AACA;AACA,OAAO,MAAMC,8BAA8B,GACzCF,SAAS,CAACE,8BAA8B;;AAE1C;AACA;AACA;AACA,OAAO,MAAMC,kBAAkB,GAAGH,SAAS,CAACG,kBAAkB;;AAE9D;AACA;AACA;AACA;AACA,OAAO,MAAMC,mBAAmB,GAAGJ,SAAS,CAACI,mBAAmB;;AAEhE;AACA;AACA;AACA,OAAO,MAAMC,kBAAkB,GAAGL,SAAS,CAACK,kBAAkB;;AAE9D;AACA;AACA;AACA,OAAO,MAAMC,gBAAgB,GAAGN,SAAS,CAACM,gBAAgB;;AAE1D;AACA;AACA;AACA,OAAO,MAAMC,kBAAkB,GAAGP,SAAS,CAACO,kBAAkB","ignoreList":[]}
+{"version":3,"names":["OauthEssentials","Platform","CredentialError","CredentialsType","buildAuthorizationUrl","buildTokenRequestBody","getUrlScheme","parseRedirectParams","createCredentialError","resolveGoogleClientId","splitGoogleArgs","warnIgnored","warnOnce","isCredentialError","APPLE_ID_CACHED_RESULTS","Map","googleSignIn","clientIdOrOptions","maybeOptions","clientId","options","OS","GOOGLE_IOS_IGNORED","resolved","parseGoogleIdOptions","googleSilentSignIn","signOut","getPassword","passwordSignIn","username","password","appleSignIn","androidWebUrl","result","select","ios","default","type","APPLE_ID","has","data","user","cached","get","fullName","email","set","getAppleIdCredentialState","userId","hybridSignIn","createPassKey","warnPasskeyOptions","getPassKey","method","preferImmediatelyAvailableCredentials","mediation","cancelPassKeyAutoFill","oauthSignIn","redirectUri","OAUTH_REDIRECT_URI","usePKCE","pkce","generatePkce","url","authorizationEndpoint","scopes","additionalParameters","state","codeChallenge","undefined","session","openAuthSession","callbackScheme","prefersEphemeralSession","CANCELLED","params","oauthError","error","error_description","code","codeVerifier","tokens","tokenEndpoint","response","fetch","headers","body","e","NETWORK_ERROR","Error","message","String","json","INVALID_RESULT_ERROR","status","ok","OAUTH","addCredentialSuccessListener","listener","onCredentialSuccess","addCredentialFailureListener","onCredentialFailure","event","addAppleIdCredentialRevokedListener","onAppleIdCredentialRevoked","bridgeOptions","authorizedAccounts","autoSelectEnabled","mode","offlineAccess","nonce","hint","hostedDomain","serverClientId","Array","isArray","filter","s","CONSTANTS","getConstants","GOOGLE_PLAY_SERVICES_SUPPORTED","PASSWORD_SUPPORTED","GOOGLE_ID_SUPPORTED","APPLE_ID_SUPPORTED","HYBRID_SUPPORTED","PASSKEYS_SUPPORTED"],"sourceRoot":"../../src","sources":["index.tsx"],"mappings":";;AAAA,OAAOA,eAAe,MAAM,4BAAyB;AACrD,SAAiCC,QAAQ,QAAQ,cAAc;AAC/D,SAOEC,eAAe,EACfC,eAAe,QAWV,YAAS;AAChB,SACEC,qBAAqB,EACrBC,qBAAqB,EACrBC,YAAY,EACZC,mBAAmB,QAEd,YAAS;AAChB,SAASC,qBAAqB,QAAQ,aAAU;AAChD,SACEC,qBAAqB,EACrBC,eAAe,EACfC,WAAW,EACXC,QAAQ,QACH,eAAY;AAEnB,cAAc,YAAS;AACvB,SAASC,iBAAiB,QAAQ,aAAU;AAC5C,MAAMC,uBAAuB,GAAG,IAAIC,GAAG,CAGrC,CAAC;;AAEH;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAQA,OAAO,eAAeC,YAAYA,CAChCC,iBAA+D,EAC/DC,YAAkC,EAC6B;EAC/D,MAAM;IAAEC,QAAQ;IAAEC;EAAQ,CAAC,GAAGV,eAAe,CAC3CO,iBAAiB,EACjBC,YACF,CAAC;EACDP,WAAW,CACT,cAAc,EACdV,QAAQ,CAACoB,EAAE,EACXD,OAAO,EACPnB,QAAQ,CAACoB,EAAE,KAAK,KAAK,GAAGC,kBAAkB,GAAG,CAAC,MAAM,CACtD,CAAC;EACD,MAAMC,QAAQ,GAAGd,qBAAqB,CAACR,QAAQ,CAACoB,EAAE,EAAEF,QAAQ,EAAE;IAC5D,GAAGC;EACL,CAAC,CAAC;EACF,OAAQ,MAAMpB,eAAe,CAACgB,YAAY,CACxCO,QAAQ,CAACJ,QAAQ,EACjBK,oBAAoB,CAACD,QAAQ,CAACH,OAAO,CACvC,CAAC;AACH;AAEA,MAAME,kBAAkB,GAAG,CACzB,oBAAoB,EACpB,mBAAmB,EACnB,MAAM,EACN,eAAe,CACP;;AAEV;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAQA,OAAO,eAAeG,kBAAkBA,CACtCR,iBAA+D,EAC/DC,YAAkC,EAC6B;EAC/D,MAAM;IAAEC,QAAQ;IAAEC;EAAQ,CAAC,GAAGV,eAAe,CAC3CO,iBAAiB,EACjBC,YACF,CAAC;EACDP,WAAW,CACT,oBAAoB,EACpBV,QAAQ,CAACoB,EAAE,EACXD,OAAO,EACPnB,QAAQ,CAACoB,EAAE,KAAK,KAAK,GACjB,CAAC,GAAGC,kBAAkB,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAC,GAClD,CAAC,MAAM,EAAE,MAAM,CACrB,CAAC;EACD,MAAMC,QAAQ,GAAGd,qBAAqB,CAACR,QAAQ,CAACoB,EAAE,EAAEF,QAAQ,EAAE;IAC5D,GAAGC;EACL,CAAC,CAAC;EACF,OAAQ,MAAMpB,eAAe,CAACyB,kBAAkB,CAC9CF,QAAQ,CAACJ,QAAQ,EACjBK,oBAAoB,CAACD,QAAQ,CAACH,OAAO,CACvC,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeM,OAAOA,CAAA,EAAqB;EAChD,OAAO,MAAM1B,eAAe,CAAC0B,OAAO,CAAC,CAAC;AACxC;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,WAAWA,CAAA,EAE/B;EACA,OAAQ,MAAM3B,eAAe,CAAC2B,WAAW,CAAC,CAAC;AAG7C;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,cAAcA,CAClCC,QAAgB,EAChBC,QAAgB,EACE;EAClB,IAAI7B,QAAQ,CAACoB,EAAE,KAAK,KAAK,EAAE;IACzBT,QAAQ,CACN,gBAAgB,EAChB,KAAK,EACL,6FACF,CAAC;EACH;EACA,OAAO,MAAMZ,eAAe,CAAC4B,cAAc,CAACC,QAAQ,EAAEC,QAAQ,CAAC;AACjE;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,WAAWA,CAC/BC,aAAsB,EACtBZ,OAA4B,EAK5B;EACA,IAAInB,QAAQ,CAACoB,EAAE,KAAK,KAAK,EAAE;IACzBV,WAAW,CAAC,aAAa,EAAEV,QAAQ,CAACoB,EAAE,EAAED,OAAO,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;EACtE;EACA,MAAMa,MAAM,GAAI,MAAMjC,eAAe,CAAC+B,WAAW,CAC/C9B,QAAQ,CAACiC,MAAM,CAAC;IACdC,GAAG,EAAE,IAAI;IACTC,OAAO,EAAEJ,aAAa,IAAI;EAC5B,CAAC,CAAC,EACFZ,OAAO,IAAI,CAAC,CACd,CAG6B;EAC7B,IAAIa,MAAM,CAACI,IAAI,KAAKlC,eAAe,CAACmC,QAAQ,EAAE;IAC5C,IAAIxB,uBAAuB,CAACyB,GAAG,CAACN,MAAM,CAACO,IAAI,CAACC,IAAI,CAAC,EAAE;MACjD;MACA,MAAMC,MAAM,GAAG5B,uBAAuB,CAAC6B,GAAG,CACxCV,MAAM,CAACO,IAAI,CAACC,IACd,CAAoC;MAEpC,MAAMD,IAAI,GAAGP,MAAM,CAACO,IAAI;MACxB,IAAI,CAACA,IAAI,CAACI,QAAQ,EAAE;QAClBJ,IAAI,CAACI,QAAQ,GAAGF,MAAM,CAACE,QAAQ;MACjC;MACA,IAAI,CAACJ,IAAI,CAACK,KAAK,EAAE;QACfL,IAAI,CAACK,KAAK,GAAGH,MAAM,CAACG,KAAK;MAC3B;IACF,CAAC,MAAM;MACL/B,uBAAuB,CAACgC,GAAG,CAACb,MAAM,CAACO,IAAI,CAACC,IAAI,EAAER,MAAM,CAACO,IAAI,CAAC;IAC5D;EACF;EACA,OAAOP,MAAM;AACf;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAec,yBAAyBA,CAC7CC,MAAc,EACmB;EACjC,OAAQ,MAAMhD,eAAe,CAAC+C,yBAAyB,CACrDC,MACF,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAQA,OAAO,eAAeC,YAAYA,CAChChC,iBAA+D,EAC/DC,YAAkC,EACL;EAC7B,MAAM;IAAEC,QAAQ;IAAEC;EAAQ,CAAC,GAAGV,eAAe,CAC3CO,iBAAiB,EACjBC,YACF,CAAC;EACD,IAAIjB,QAAQ,CAACoB,EAAE,KAAK,KAAK,EAAE;IACzB,IAAIF,QAAQ,EAAE;MACZP,QAAQ,CACN,cAAc,EACd,UAAU,EACV,oGACF,CAAC;IACH;IACAD,WAAW,CAAC,cAAc,EAAE,KAAK,EAAES,OAAO,EAAE,CAC1C,GAAGE,kBAAkB,EACrB,MAAM,EACN,QAAQ,EACR,cAAc,EACd,gBAAgB,CACjB,CAAC;EACJ,CAAC,MAAM;IACLX,WAAW,CAAC,cAAc,EAAEV,QAAQ,CAACoB,EAAE,EAAED,OAAO,EAAE,CAChD,MAAM,EACN,MAAM,EACN,QAAQ,EACR,eAAe,EACf,cAAc,EACd,gBAAgB,CACjB,CAAC;EACJ;EACA,MAAMG,QAAQ,GAAGd,qBAAqB,CAACR,QAAQ,CAACoB,EAAE,EAAEF,QAAQ,EAAE;IAC5D,GAAGC;EACL,CAAC,CAAC;EACF,OAAQ,MAAMpB,eAAe,CAACiD,YAAY,CACxC1B,QAAQ,CAACJ,QAAQ,EACjBK,oBAAoB,CAACD,QAAQ,CAACH,OAAO,CACvC,CAAC;AACH;;AAEA;;AAOA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAe8B,aAAaA,CACjC9B,OAAuB,EACuC;EAC9D+B,kBAAkB,CAAC,eAAe,EAAE/B,OAAO,CAAC;EAC5C,OAAQ,MAAMpB,eAAe,CAACkD,aAAa,CAAC9B,OAAO,CAAC;AAGtD;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAegC,UAAUA,CAC9BhC,OAAuB,EACuC;EAC9D+B,kBAAkB,CAAC,YAAY,EAAE/B,OAAO,CAAC;EACzC,OAAQ,MAAMpB,eAAe,CAACoD,UAAU,CAAChC,OAAO,CAAC;AAGnD;AAEA,SAAS+B,kBAAkBA,CAACE,MAAc,EAAEjC,OAAwB,EAAE;EACpE,IAAInB,QAAQ,CAACoB,EAAE,KAAK,KAAK,EAAE;IACzB,IAAID,OAAO,EAAEkC,qCAAqC,KAAK,KAAK,EAAE;MAC5D1C,QAAQ,CACNyC,MAAM,EACN,uCAAuC,EACvC,sHACF,CAAC;IACH;EACF,CAAC,MAAM,IAAIjC,OAAO,EAAEmC,SAAS,KAAK,UAAU,EAAE;IAC5C3C,QAAQ,CACNyC,MAAM,EACN,WAAW,EACX,kDACF,CAAC;EACH;AACF;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeG,qBAAqBA,CAAA,EAAqB;EAC9D,OAAO,MAAMxD,eAAe,CAACwD,qBAAqB,CAAC,CAAC;AACtD;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,eAAeC,WAAWA,CAC/BrC,OAA2B,EACiC;EAC5D,IAAInB,QAAQ,CAACoB,EAAE,KAAK,KAAK,EAAE;IACzBV,WAAW,CAAC,aAAa,EAAEV,QAAQ,CAACoB,EAAE,EAAED,OAAO,EAAE,CAC/C,yBAAyB,CAC1B,CAAC;EACJ;EACA,MAAMsC,WAAW,GAAGtC,OAAO,CAACsC,WAAW,IAAIC,kBAAkB;EAC7D,MAAMC,OAAO,GAAGxC,OAAO,CAACwC,OAAO,KAAK,KAAK;EACzC,MAAMC,IAAI,GAAI,MAAM7D,eAAe,CAAC8D,YAAY,CAAC,CAAc;EAE/D,MAAMC,GAAG,GAAG3D,qBAAqB,CAAC;IAChC4D,qBAAqB,EAAE5C,OAAO,CAAC4C,qBAAqB;IACpD7C,QAAQ,EAAEC,OAAO,CAACD,QAAQ;IAC1BuC,WAAW;IACXO,MAAM,EAAE7C,OAAO,CAAC6C,MAAM;IACtBC,oBAAoB,EAAE9C,OAAO,CAAC8C,oBAAoB;IAClDC,KAAK,EAAEN,IAAI,CAACM,KAAK;IACjBC,aAAa,EAAER,OAAO,GAAGC,IAAI,CAACO,aAAa,GAAGC;EAChD,CAAC,CAAC;EAEF,MAAMC,OAAO,GAAI,MAAMtE,eAAe,CAACuE,eAAe,CAACR,GAAG,EAAE;IAC1DS,cAAc,EAAElE,YAAY,CAACoD,WAAW,CAAC;IACzCe,uBAAuB,EAAErD,OAAO,CAACqD,uBAAuB,KAAK;EAC/D,CAAC,CAAoD;EAErD,IAAIH,OAAO,CAACjC,IAAI,KAAKlC,eAAe,CAACuE,SAAS,IAAI,CAACJ,OAAO,CAAC9B,IAAI,EAAE;IAC/D,OAAO;MAAEH,IAAI,EAAElC,eAAe,CAACuE,SAAS;MAAElC,IAAI,EAAE;IAAK,CAAC;EACxD;EAEA,MAAMmC,MAAM,GAAGpE,mBAAmB,CAAC+D,OAAO,CAAC9B,IAAI,CAACuB,GAAG,CAAC;EACpD,IAAIY,MAAM,CAACR,KAAK,KAAKN,IAAI,CAACM,KAAK,EAAE;IAC/B,MAAMS,UAAU,CAAC,0CAA0C,CAAC;EAC9D;EACA,IAAID,MAAM,CAACE,KAAK,EAAE;IAChB,IAAIF,MAAM,CAACE,KAAK,KAAK,eAAe,EAAE;MACpC,OAAO;QAAExC,IAAI,EAAElC,eAAe,CAACuE,SAAS;QAAElC,IAAI,EAAE;MAAK,CAAC;IACxD;IACA,MAAMoC,UAAU,CAACD,MAAM,CAACG,iBAAiB,IAAIH,MAAM,CAACE,KAAK,CAAC;EAC5D;EACA,IAAI,CAACF,MAAM,CAACI,IAAI,EAAE;IAChB,MAAMH,UAAU,CAAC,oCAAoC,CAAC;EACxD;EAEA,MAAMI,YAAY,GAAGpB,OAAO,GAAGC,IAAI,CAACmB,YAAY,GAAG,IAAI;EACvD,IAAIC,MAAsC,GAAG,IAAI;EACjD,IAAI7D,OAAO,CAAC8D,aAAa,EAAE;IACzB,IAAIC,QAAkB;IACtB,IAAI;MACFA,QAAQ,GAAG,MAAMC,KAAK,CAAChE,OAAO,CAAC8D,aAAa,EAAE;QAC5C7B,MAAM,EAAE,MAAM;QACdgC,OAAO,EAAE;UACP,cAAc,EAAE,mCAAmC;UACnD,QAAQ,EAAE;QACZ,CAAC;QACDC,IAAI,EAAEjF,qBAAqB,CAAC;UAC1B0E,IAAI,EAAEJ,MAAM,CAACI,IAAI;UACjB5D,QAAQ,EAAEC,OAAO,CAACD,QAAQ;UAC1BuC,WAAW;UACXsB;QACF,CAAC;MACH,CAAC,CAAC;IACJ,CAAC,CAAC,OAAOO,CAAC,EAAE;MACV,MAAM/E,qBAAqB,CACzBN,eAAe,CAACsF,aAAa,EAC7B,yBAAyBD,CAAC,YAAYE,KAAK,GAAGF,CAAC,CAACG,OAAO,GAAGC,MAAM,CAACJ,CAAC,CAAC,EAAE,EACrEA,CACF,CAAC;IACH;IACA,IAAI;MACFN,MAAM,GAAI,MAAME,QAAQ,CAACS,IAAI,CAAC,CAA6B;IAC7D,CAAC,CAAC,OAAOL,CAAC,EAAE;MACV,MAAM/E,qBAAqB,CACzBN,eAAe,CAAC2F,oBAAoB,EACpC,uDAAuDV,QAAQ,CAACW,MAAM,GAAG,EACzEP,CACF,CAAC;IACH;IACA,IAAI,CAACJ,QAAQ,CAACY,EAAE,EAAE;MAChB,MAAMnB,UAAU,CACde,MAAM,CAACV,MAAM,CAACH,iBAAiB,IAAIG,MAAM,CAACJ,KAAK,IAAIM,QAAQ,CAACW,MAAM,CACpE,CAAC;IACH;EACF;EAEA,OAAO;IACLzD,IAAI,EAAElC,eAAe,CAAC6F,KAAK;IAC3BxD,IAAI,EAAE;MACJuC,IAAI,EAAEJ,MAAM,CAACI,IAAI;MACjBZ,KAAK,EAAEQ,MAAM,CAACR,KAAK;MACnBT,WAAW;MACXsB,YAAY;MACZL,MAAM;MACNM;IACF;EACF,CAAC;AACH;AAEA,SAASL,UAAUA,CAACc,OAAe,EAAE;EACnC,OAAOlF,qBAAqB,CAACN,eAAe,CAAC2F,oBAAoB,EAAEH,OAAO,CAAC;AAC7E;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASO,4BAA4BA,CAC1CC,QAAiD,EAC9B;EACnB,OAAOlG,eAAe,CAACmG,mBAAmB,CAACD,QAAQ,CAAC;AACtD;;AAEA;AACA;AACA;AACA;AACA;AACA,OAAO,SAASE,4BAA4BA,CAC1CF,QAAiD,EAC9B;EACnB,OAAOlG,eAAe,CAACqG,mBAAmB,CAAEC,KAAK,IAC/CJ,QAAQ,CAACI,KAA+B,CAC1C,CAAC;AACH;;AAEA;AACA;AACA;AACA;AACA,OAAO,SAASC,mCAAmCA,CACjDL,QAAoB,EACD;EACnB,OAAOlG,eAAe,CAACwG,0BAA0B,CAAC,MAAMN,QAAQ,CAAC,CAAC,CAAC;AACrE;AAEA,SAAS1E,oBAAoBA,CAACJ,OAA6B,EAAE;EAC3D,MAAMqF,aAAkC,GAAG;IACzCC,kBAAkB,EAAE,KAAK;IACzBC,iBAAiB,EAAE,KAAK;IACxBC,IAAI,EAAE;EACR,CAAC;EAED,IAAIxF,OAAO,IAAI,OAAOA,OAAO,KAAK,QAAQ,EAAE;IAC1C,IAAIA,OAAO,CAACsF,kBAAkB,KAAKrC,SAAS,EAAE;MAC5CoC,aAAa,CAACC,kBAAkB,GAAGtF,OAAO,CAACsF,kBAAkB,KAAK,IAAI;IACxE;IACA,IAAItF,OAAO,CAACuF,iBAAiB,KAAKtC,SAAS,EAAE;MAC3CoC,aAAa,CAACE,iBAAiB,GAAGvF,OAAO,CAACuF,iBAAiB,KAAK,IAAI;IACtE;IACA,IAAIvF,OAAO,CAACwF,IAAI,KAAK,QAAQ,EAAE;MAC7BH,aAAa,CAACG,IAAI,GAAG,QAAQ;IAC/B;IACA,IAAIxF,OAAO,CAACyF,aAAa,KAAKxC,SAAS,EAAE;MACvCoC,aAAa,CAACI,aAAa,GAAGzF,OAAO,CAACyF,aAAa,KAAK,IAAI;IAC9D;IACA,IAAI,OAAOzF,OAAO,CAAC0F,KAAK,KAAK,QAAQ,EAAE;MACrCL,aAAa,CAACK,KAAK,GAAG1F,OAAO,CAAC0F,KAAK;IACrC;IACA,IAAI,OAAO1F,OAAO,CAAC2F,IAAI,KAAK,QAAQ,EAAE;MACpCN,aAAa,CAACM,IAAI,GAAG3F,OAAO,CAAC2F,IAAI;IACnC;IACA,IAAI,OAAO3F,OAAO,CAAC4F,YAAY,KAAK,QAAQ,EAAE;MAC5CP,aAAa,CAACO,YAAY,GAAG5F,OAAO,CAAC4F,YAAY;IACnD;IACA,IAAI,OAAO5F,OAAO,CAAC6F,cAAc,KAAK,QAAQ,EAAE;MAC9CR,aAAa,CAACQ,cAAc,GAAG7F,OAAO,CAAC6F,cAAc;IACvD;IACA,IAAIC,KAAK,CAACC,OAAO,CAAC/F,OAAO,CAAC6C,MAAM,CAAC,EAAE;MACjCwC,aAAa,CAACxC,MAAM,GAAG7C,OAAO,CAAC6C,MAAM,CAACmD,MAAM,CACzCC,CAAC,IAAK,OAAOA,CAAC,KAAK,QACtB,CAAC;IACH;EACF;EACA,OAAOZ,aAAa;AACtB;AAEA,MAAMa,SAAS,GAAGtH,eAAe,CAACuH,YAAY,CAAC,CAAC;;AAEhD;AACA;AACA;AACA;AACA,OAAO,MAAMC,8BAA8B,GACzCF,SAAS,CAACE,8BAA8B;;AAE1C;AACA;AACA;AACA;AACA,OAAO,MAAMC,kBAAkB,GAAGH,SAAS,CAACG,kBAAkB;;AAE9D;AACA;AACA;AACA,OAAO,MAAMC,mBAAmB,GAAGJ,SAAS,CAACI,mBAAmB;;AAEhE;AACA;AACA;AACA,OAAO,MAAMC,kBAAkB,GAAGL,SAAS,CAACK,kBAAkB;;AAE9D;AACA;AACA;AACA;AACA,OAAO,MAAMC,gBAAgB,GAAGN,SAAS,CAACM,gBAAgB;;AAE1D;AACA;AACA;AACA,OAAO,MAAMC,kBAAkB,GAAGP,SAAS,CAACO,kBAAkB;;AAE9D;AACA;AACA;AACA;AACA;AACA,OAAO,MAAMlE,kBAAkB,GAAG2D,SAAS,CAAC3D,kBAAkB","ignoreList":[]}