tempest-react-sdk 0.47.0 → 0.49.0

package/dist/auth/passkey.js

@@ -1,10 +1,11 @@
+import { base64ToBytes as e, bytesToBase64 as t } from "../utils/base64.js";
 //#region src/auth/passkey.ts
-var e = class extends Error {
+var n = class extends Error {
 	kind;
 	constructor(e, t, n) {
 		super(t), this.name = "PasskeyError", this.kind = e, this.cause = n;
 	}
-}, t = [
+}, r = [
 	{
 		type: "public-key",
 		alg: -8
@@ -18,24 +19,21 @@ var e = class extends Error {
 		alg: -257
 	}
 ];
-function n() {
+function i() {
 	return globalThis.PublicKeyCredential;
 }
-function r(e) {
-	let t = e.replace(/-/g, "+").replace(/_/g, "/"), n = t.padEnd(t.length + (4 - t.length % 4) % 4, "="), r = atob(n), i = new Uint8Array(r.length);
-	for (let e = 0; e < r.length; e += 1) i[e] = r.charCodeAt(e);
-	return i;
+function a(t) {
+	return e(t);
 }
-function i(e) {
-	let t = e instanceof Uint8Array ? e : new Uint8Array(e), n = "";
-	for (let e of t) n += String.fromCharCode(e);
-	return btoa(n).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+function o(e) {
+	let n = e instanceof Uint8Array ? e : new Uint8Array(e);
+	return t(n, { urlSafe: !0 });
 }
-function a() {
-	return typeof window < "u" && typeof navigator < "u" && navigator.credentials !== void 0 && typeof navigator.credentials.create == "function" && n() !== void 0;
+function s() {
+	return typeof window < "u" && typeof navigator < "u" && navigator.credentials !== void 0 && typeof navigator.credentials.create == "function" && i() !== void 0;
 }
-async function o() {
-	let e = n();
+async function c() {
+	let e = i();
 	if (!e?.isUserVerifyingPlatformAuthenticatorAvailable) return !1;
 	try {
 		return await e.isUserVerifyingPlatformAuthenticatorAvailable();
@@ -43,8 +41,8 @@ async function o() {
 		return !1;
 	}
 }
-async function s() {
-	let e = n();
+async function l() {
+	let e = i();
 	if (!e?.isConditionalMediationAvailable) return !1;
 	try {
 		return await e.isConditionalMediationAvailable();
@@ -52,107 +50,107 @@ async function s() {
 		return !1;
 	}
 }
-function c(t, n) {
-	if (t instanceof e) return t;
-	if (typeof window < "u" && !window.isSecureContext) return new e("insecure", "Passkeys require a secure (HTTPS) connection.", t);
-	if (t instanceof DOMException) switch (t.name) {
-		case "NotAllowedError": return new e("cancelled", "The passkey prompt was dismissed or timed out. The browser does not say which — it must not reveal whether a credential exists.", t);
-		case "InvalidStateError": return new e("already-registered", "This device already has a passkey for this account. Sign in with it instead of creating another.", t);
-		case "NotSupportedError": return new e("not-supported", "No authenticator here supports the requested algorithms. Check the server's pubKeyCredParams.", t);
-		case "SecurityError": return new e("rp-mismatch", "The relying-party id does not match this origin. rp.id must be the page's domain or a registrable parent of it.", t);
-		case "AbortError": return new e("aborted", "The passkey request was aborted.", t);
+function u(e, t) {
+	if (e instanceof n) return e;
+	if (typeof window < "u" && !window.isSecureContext) return new n("insecure", "Passkeys require a secure (HTTPS) connection.", e);
+	if (e instanceof DOMException) switch (e.name) {
+		case "NotAllowedError": return new n("cancelled", "The passkey prompt was dismissed or timed out. The browser does not say which — it must not reveal whether a credential exists.", e);
+		case "InvalidStateError": return new n("already-registered", "This device already has a passkey for this account. Sign in with it instead of creating another.", e);
+		case "NotSupportedError": return new n("not-supported", "No authenticator here supports the requested algorithms. Check the server's pubKeyCredParams.", e);
+		case "SecurityError": return new n("rp-mismatch", "The relying-party id does not match this origin. rp.id must be the page's domain or a registrable parent of it.", e);
+		case "AbortError": return new n("aborted", "The passkey request was aborted.", e);
 	}
-	return t instanceof TypeError ? new e("invalid-options", `The ${n} options the server sent are malformed. Check that challenge, user.id and credential ids are base64url.`, t) : new e("unknown", t instanceof Error ? t.message : `Unexpected error during the passkey ${n} ceremony.`, t);
+	return e instanceof TypeError ? new n("invalid-options", `The ${t} options the server sent are malformed. Check that challenge, user.id and credential ids are base64url.`, e) : new n("unknown", e instanceof Error ? e.message : `Unexpected error during the passkey ${t} ceremony.`, e);
 }
-function l(e) {
+function d(e) {
 	if (e) return e.map((e) => ({
-		id: r(e.id),
+		id: a(e.id),
 		type: e.type,
 		transports: e.transports
 	}));
 }
-function u(n = {}) {
-	let { rpId: u, timeoutMs: d = 6e4, credentials: f } = n;
+function f(e = {}) {
+	let { rpId: t, timeoutMs: i = 6e4, credentials: f } = e;
 	function p() {
 		if (f) return f;
-		if (!a()) throw new e("unsupported", typeof window < "u" && !window.isSecureContext ? "Passkeys require a secure (HTTPS) connection." : "This browser does not support passkeys (WebAuthn).");
+		if (!s()) throw new n("unsupported", typeof window < "u" && !window.isSecureContext ? "Passkeys require a secure (HTTPS) connection." : "This browser does not support passkeys (WebAuthn).");
 		return navigator.credentials;
 	}
-	async function m(n, a = {}) {
-		let o = p(), s = {
-			challenge: r(n.challenge),
+	async function m(e, s = {}) {
+		let c = p(), l = {
+			challenge: a(e.challenge),
 			rp: {
-				name: n.rp.name,
-				id: n.rp.id ?? u
+				name: e.rp.name,
+				id: e.rp.id ?? t
 			},
 			user: {
-				id: r(n.user.id),
-				name: n.user.name,
-				displayName: n.user.displayName
+				id: a(e.user.id),
+				name: e.user.name,
+				displayName: e.user.displayName
 			},
-			pubKeyCredParams: n.pubKeyCredParams ?? t,
-			timeout: n.timeout ?? d,
-			excludeCredentials: l(n.excludeCredentials),
-			authenticatorSelection: n.authenticatorSelection,
-			attestation: n.attestation,
-			extensions: n.extensions
+			pubKeyCredParams: e.pubKeyCredParams ?? r,
+			timeout: e.timeout ?? i,
+			excludeCredentials: d(e.excludeCredentials),
+			authenticatorSelection: e.authenticatorSelection,
+			attestation: e.attestation,
+			extensions: e.extensions
 		}, f;
 		try {
-			f = await o.create({
-				publicKey: s,
-				signal: a.signal
+			f = await c.create({
+				publicKey: l,
+				signal: s.signal
 			});
 		} catch (e) {
-			throw c(e, "register");
+			throw u(e, "register");
 		}
-		if (!f) throw new e("unknown", "The authenticator returned no credential.");
+		if (!f) throw new n("unknown", "The authenticator returned no credential.");
 		let m = f, h = m.response, g = h.getPublicKey?.();
 		return {
 			id: m.id,
-			rawId: i(m.rawId),
+			rawId: o(m.rawId),
 			type: "public-key",
 			authenticatorAttachment: m.authenticatorAttachment ?? null,
 			response: {
-				clientDataJSON: i(h.clientDataJSON),
-				attestationObject: i(h.attestationObject),
+				clientDataJSON: o(h.clientDataJSON),
+				attestationObject: o(h.attestationObject),
 				transports: h.getTransports?.(),
 				publicKeyAlgorithm: h.getPublicKeyAlgorithm?.(),
-				publicKey: g ? i(g) : void 0,
-				authenticatorData: h.getAuthenticatorData ? i(h.getAuthenticatorData()) : void 0
+				publicKey: g ? o(g) : void 0,
+				authenticatorData: h.getAuthenticatorData ? o(h.getAuthenticatorData()) : void 0
 			},
 			clientExtensionResults: m.getClientExtensionResults()
 		};
 	}
-	async function h(t, n = {}) {
-		let a = p(), o = {
-			challenge: r(t.challenge),
-			rpId: t.rpId ?? u,
-			timeout: t.timeout ?? d,
-			allowCredentials: l(t.allowCredentials),
-			userVerification: t.userVerification,
-			extensions: t.extensions
-		}, s;
+	async function h(e, r = {}) {
+		let s = p(), c = {
+			challenge: a(e.challenge),
+			rpId: e.rpId ?? t,
+			timeout: e.timeout ?? i,
+			allowCredentials: d(e.allowCredentials),
+			userVerification: e.userVerification,
+			extensions: e.extensions
+		}, l;
 		try {
-			s = await a.get({
-				publicKey: o,
-				signal: n.signal,
-				mediation: n.mediation
+			l = await s.get({
+				publicKey: c,
+				signal: r.signal,
+				mediation: r.mediation
 			});
 		} catch (e) {
-			throw c(e, "authenticate");
+			throw u(e, "authenticate");
 		}
-		if (!s) throw new e("unknown", "The authenticator returned no credential.");
-		let f = s, m = f.response;
+		if (!l) throw new n("unknown", "The authenticator returned no credential.");
+		let f = l, m = f.response;
 		return {
 			id: f.id,
-			rawId: i(f.rawId),
+			rawId: o(f.rawId),
 			type: "public-key",
 			authenticatorAttachment: f.authenticatorAttachment ?? null,
 			response: {
-				clientDataJSON: i(m.clientDataJSON),
-				authenticatorData: i(m.authenticatorData),
-				signature: i(m.signature),
-				userHandle: m.userHandle ? i(m.userHandle) : null
+				clientDataJSON: o(m.clientDataJSON),
+				authenticatorData: o(m.authenticatorData),
+				signature: o(m.signature),
+				userHandle: m.userHandle ? o(m.userHandle) : null
 			},
 			clientExtensionResults: f.getClientExtensionResults()
 		};
@@ -160,12 +158,12 @@ function u(n = {}) {
 	return {
 		register: m,
 		authenticate: h,
-		isSupported: () => f !== void 0 || a(),
-		isPlatformAuthenticatorAvailable: o,
-		isConditionalMediationAvailable: s
+		isSupported: () => f !== void 0 || s(),
+		isPlatformAuthenticatorAvailable: c,
+		isConditionalMediationAvailable: l
 	};
 }
 //#endregion
-export { t as DEFAULT_PUB_KEY_CRED_PARAMS, e as PasskeyError, r as base64UrlToBytes, i as bytesToBase64Url, c as classifyPasskeyError, u as createPasskeyClient, s as isConditionalMediationAvailable, a as isPasskeySupported, o as isPlatformAuthenticatorAvailable };
+export { r as DEFAULT_PUB_KEY_CRED_PARAMS, n as PasskeyError, a as base64UrlToBytes, o as bytesToBase64Url, u as classifyPasskeyError, f as createPasskeyClient, l as isConditionalMediationAvailable, s as isPasskeySupported, c as isPlatformAuthenticatorAvailable };
 
 //# sourceMappingURL=passkey.js.map

package/dist/auth/passkey.js.map

@@ -1 +1 @@
-{"version":3,"file":"passkey.js","names":[],"sources":["../../src/auth/passkey.ts"],"sourcesContent":["/**\n * @tempest-limits file-lines, function-lines — the WebAuthn client half: the JSON\n * shapes both ceremonies exchange with a backend, base64url ↔ ArrayBuffer, the\n * capability probes and the error classifier. The two ceremonies are near-mirrors\n * that must not drift — register and authenticate encode the same credential fields\n * in the same order — and the file's docstring is also the specification of the four\n * backend routes it expects.\n */\n/**\n * Classified reason a passkey ceremony did not produce a credential.\n *\n * The kinds group the raw `DOMException.name` values the way a UI has to branch\n * on them, which is *not* how the spec groups them:\n *\n * - `\"cancelled\"` covers `NotAllowedError`, which the browser raises both when\n *   the user dismissed the sheet and when the ceremony timed out. They are\n *   indistinguishable **by design** — telling a site \"the user has no credential\n *   for you\" would leak account existence — so a UI must treat them as one thing.\n * - `\"already-registered\"` (`InvalidStateError`) is not really a failure: this\n *   device already holds a credential for this user. The correct reaction is\n *   \"you are already set up on this device\", never a red error.\n * - `\"rp-mismatch\"` (`SecurityError`) is the single most common integration bug:\n *   `rp.id` must equal the page's domain or a registrable parent of it.\n */\nexport type PasskeyErrorKind =\n    | \"unsupported\"\n    | \"insecure\"\n    | \"cancelled\"\n    | \"already-registered\"\n    | \"not-supported\"\n    | \"rp-mismatch\"\n    | \"invalid-options\"\n    | \"aborted\"\n    | \"unknown\";\n\n/** Which ceremony was running, so the message can name it. */\nexport type PasskeyCeremony = \"register\" | \"authenticate\";\n\n/**\n * A passkey failure carrying a stable {@link PasskeyErrorKind} plus an English\n * message safe to show a user.\n *\n * A class rather than the plain `{ kind, message }` object the media classifier\n * returns, because these surface by rejecting a promise: an `Error` subclass keeps\n * stack traces, `instanceof` checks and logging intact, and `kind` is what code\n * branches on.\n */\nexport class PasskeyError extends Error {\n    /** Stable, branchable classification. */\n    readonly kind: PasskeyErrorKind;\n\n    /**\n     * Build a classified passkey error.\n     *\n     * @param kind - The classification a UI branches on.\n     * @param message - English, user-safe explanation.\n     * @param cause - The original thrown value, when there was one.\n     */\n    constructor(kind: PasskeyErrorKind, message: string, cause?: unknown) {\n        super(message);\n        this.name = \"PasskeyError\";\n        this.kind = kind;\n        this.cause = cause;\n    }\n}\n\n/**\n * Minimal subset of `navigator.credentials` the passkey client touches.\n *\n * Declared here — the `<X>Like` pattern the SDK's adapters use — for two reasons:\n * jsdom has no `navigator.credentials` at all, so tests must inject a double; and\n * `mediation: \"conditional\"` is newer than some TypeScript DOM libs, which would\n * otherwise reject the call that makes autofill work.\n */\nexport interface CredentialsContainerLike {\n    /** Runs the registration ceremony. */\n    create(options: {\n        publicKey: PublicKeyCredentialCreationOptions;\n        signal?: AbortSignal;\n    }): Promise<Credential | null>;\n    /** Runs the authentication ceremony. */\n    get(options: {\n        publicKey: PublicKeyCredentialRequestOptions;\n        signal?: AbortSignal;\n        mediation?: string;\n    }): Promise<Credential | null>;\n}\n\n/** How the browser should surface the authentication ceremony. */\nexport type PasskeyMediation = \"optional\" | \"conditional\" | \"required\" | \"silent\";\n\n/**\n * Server-issued registration options, in the base64url JSON shape every WebAuthn\n * backend speaks (`PublicKeyCredentialCreationOptionsJSON` in the spec).\n *\n * `challenge`, `user.id` and every `excludeCredentials[].id` are **base64url**\n * strings here and `ArrayBuffer`s in the DOM API. Converting them is the plumbing\n * this client owns.\n */\nexport interface PasskeyCreationOptionsJSON {\n    /** Base64url server challenge. Single-use; the server must remember it. */\n    challenge: string;\n    /** Relying party. `id` defaults to the client's `rpId`, then to the origin. */\n    rp: { name: string; id?: string };\n    /** The account. `id` is base64url of an opaque, stable user handle. */\n    user: { id: string; name: string; displayName: string };\n    /** Allowed COSE algorithms. Defaults to {@link DEFAULT_PUB_KEY_CRED_PARAMS}. */\n    pubKeyCredParams?: { type: \"public-key\"; alg: number }[];\n    /** Ceremony timeout in ms. Defaults to the client's `timeoutMs`. */\n    timeout?: number;\n    /** Credentials this user already has, so the authenticator refuses a duplicate. */\n    excludeCredentials?: { id: string; type: \"public-key\"; transports?: string[] }[];\n    /** Resident-key / user-verification / attachment requirements. */\n    authenticatorSelection?: AuthenticatorSelectionCriteria;\n    /** Attestation conveyance. Leave unset (`\"none\"`) unless you verify it. */\n    attestation?: AttestationConveyancePreference;\n    /** Client extension inputs (`credProps`, `largeBlob`, …). */\n    extensions?: AuthenticationExtensionsClientInputs;\n}\n\n/** Server-issued authentication options, base64url JSON. */\nexport interface PasskeyRequestOptionsJSON {\n    /** Base64url server challenge. */\n    challenge: string;\n    /** Relying party id. Defaults to the client's `rpId`, then to the origin. */\n    rpId?: string;\n    /** Ceremony timeout in ms. Defaults to the client's `timeoutMs`. */\n    timeout?: number;\n    /** Restrict to these credentials. **Omit it** for usernameless / autofill flows. */\n    allowCredentials?: { id: string; type: \"public-key\"; transports?: string[] }[];\n    /** Whether the authenticator must verify the user (biometric / PIN). */\n    userVerification?: UserVerificationRequirement;\n    /** Client extension inputs. */\n    extensions?: AuthenticationExtensionsClientInputs;\n}\n\n/** What the client sends to the backend to finish registration. */\nexport interface PasskeyRegistrationJSON {\n    /** Base64url credential id. */\n    id: string;\n    /** Same bytes as `id`; both are sent because servers differ on which they read. */\n    rawId: string;\n    type: \"public-key\";\n    /** `\"platform\"` (this device) or `\"cross-platform\"` (a phone or key). */\n    authenticatorAttachment: string | null;\n    response: {\n        /** Base64url client data — the server re-checks challenge, origin and type. */\n        clientDataJSON: string;\n        /** Base64url attestation object, holding the new public key. */\n        attestationObject: string;\n        /** Transports the authenticator advertises, when the browser exposes them. */\n        transports?: string[];\n        /** COSE algorithm of the new key, when the browser exposes it. */\n        publicKeyAlgorithm?: number;\n        /** Base64url SPKI public key, when the browser exposes it. */\n        publicKey?: string;\n        /** Base64url authenticator data, when the browser exposes it. */\n        authenticatorData?: string;\n    };\n    /** Extension outputs — `credProps.rk` tells you whether it is discoverable. */\n    clientExtensionResults: AuthenticationExtensionsClientOutputs;\n}\n\n/** What the client sends to the backend to finish authentication. */\nexport interface PasskeyAuthenticationJSON {\n    /** Base64url credential id — the server looks up the stored public key by it. */\n    id: string;\n    /** Same bytes as `id`. */\n    rawId: string;\n    type: \"public-key\";\n    /** `\"platform\"` or `\"cross-platform\"`. */\n    authenticatorAttachment: string | null;\n    response: {\n        /** Base64url client data. */\n        clientDataJSON: string;\n        /** Base64url authenticator data, carrying the signature counter. */\n        authenticatorData: string;\n        /** Base64url signature over `authenticatorData || sha256(clientDataJSON)`. */\n        signature: string;\n        /** Base64url user handle — present on discoverable credentials, else null. */\n        userHandle: string | null;\n    };\n    /** Extension outputs. */\n    clientExtensionResults: AuthenticationExtensionsClientOutputs;\n}\n\n/** Per-call knobs for {@link PasskeyClient.register}. */\nexport interface PasskeyRegisterInit {\n    /** Cancel the ceremony (closes the browser sheet). */\n    signal?: AbortSignal;\n}\n\n/** Per-call knobs for {@link PasskeyClient.authenticate}. */\nexport interface PasskeyAuthenticateInit extends PasskeyRegisterInit {\n    /**\n     * `\"conditional\"` is the autofill flow: no modal, the browser offers passkeys\n     * inside a field marked `autocomplete=\"webauthn\"`. Requires a `signal`, and\n     * only one conditional request may be live per page.\n     */\n    mediation?: PasskeyMediation;\n}\n\n/** Framework-free WebAuthn client. Build one with {@link createPasskeyClient}. */\nexport interface PasskeyClient {\n    /** Run the registration ceremony and return the JSON your backend verifies. */\n    register(\n        options: PasskeyCreationOptionsJSON,\n        init?: PasskeyRegisterInit,\n    ): Promise<PasskeyRegistrationJSON>;\n    /** Run the authentication ceremony and return the JSON your backend verifies. */\n    authenticate(\n        options: PasskeyRequestOptionsJSON,\n        init?: PasskeyAuthenticateInit,\n    ): Promise<PasskeyAuthenticationJSON>;\n    /**\n     * Whether this client can run a ceremony at all — the WebAuthn API exists, or a\n     * `credentials` container was injected.\n     */\n    isSupported(): boolean;\n    /** Whether this device has a built-in authenticator (Face ID, Hello, …). */\n    isPlatformAuthenticatorAvailable(): Promise<boolean>;\n    /** Whether autofill-driven (`\"conditional\"`) requests are available. */\n    isConditionalMediationAvailable(): Promise<boolean>;\n}\n\n/** Options for {@link createPasskeyClient}. */\nexport interface CreatePasskeyClientOptions {\n    /**\n     * Default relying-party id, applied when the server options omit one. Must be\n     * the page's domain or a registrable parent of it (`app.acme.com` may use\n     * `acme.com`, never the other way round).\n     */\n    rpId?: string;\n    /** Default ceremony timeout in ms. Default `60_000`. */\n    timeoutMs?: number;\n    /** `navigator.credentials` replacement, for tests. */\n    credentials?: CredentialsContainerLike;\n}\n\n/**\n * COSE algorithms offered when the server sends no `pubKeyCredParams`, in\n * preference order.\n *\n * `-8` is Ed25519, which modern authenticators prefer and which produces the\n * smallest signatures. `-7` is ES256, the one algorithm every WebAuthn\n * authenticator supports. `-257` is RS256, needed for TPM-backed Windows Hello.\n * Offering all three is what avoids a `NotSupportedError` on some device you do\n * not own; a server that cannot verify one of them should send its own list.\n */\nexport const DEFAULT_PUB_KEY_CRED_PARAMS: { type: \"public-key\"; alg: number }[] = [\n    { type: \"public-key\", alg: -8 },\n    { type: \"public-key\", alg: -7 },\n    { type: \"public-key\", alg: -257 },\n];\n\n/** Static members of `PublicKeyCredential` that are not in every DOM lib yet. */\ninterface PublicKeyCredentialStatics {\n    isUserVerifyingPlatformAuthenticatorAvailable?: () => Promise<boolean>;\n    isConditionalMediationAvailable?: () => Promise<boolean>;\n}\n\n/** The browser-supplied extras on an attestation response, all optional. */\ninterface AttestationExtras {\n    getTransports?: () => string[];\n    getPublicKey?: () => ArrayBuffer | null;\n    getPublicKeyAlgorithm?: () => number;\n    getAuthenticatorData?: () => ArrayBuffer;\n}\n\nfunction publicKeyCredentialStatics(): PublicKeyCredentialStatics | undefined {\n    return (globalThis as { PublicKeyCredential?: PublicKeyCredentialStatics }).PublicKeyCredential;\n}\n\n/**\n * Decode a base64url string into bytes.\n *\n * WebAuthn transports every binary field as base64url (`-`/`_`, no padding)\n * because that is what survives JSON, while the DOM API insists on\n * `ArrayBuffer`. Getting this pair wrong — usually by feeding plain base64 to\n * `atob` and losing the last byte — is the classic broken-WebAuthn bug, which is\n * why the SDK owns it instead of leaving it to each app.\n *\n * @param value - Base64url text, with or without `=` padding.\n * @returns The decoded bytes.\n */\nexport function base64UrlToBytes(value: string): Uint8Array<ArrayBuffer> {\n    const base64 = value.replace(/-/g, \"+\").replace(/_/g, \"/\");\n    const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), \"=\");\n    const binary = atob(padded);\n    const bytes = new Uint8Array(binary.length);\n    for (let index = 0; index < binary.length; index += 1) {\n        bytes[index] = binary.charCodeAt(index);\n    }\n    return bytes;\n}\n\n/**\n * Encode bytes as an unpadded base64url string.\n *\n * @param value - Bytes to encode, as a view or a raw buffer.\n * @returns Base64url text, safe to put in JSON and in a URL.\n */\nexport function bytesToBase64Url(value: ArrayBuffer | Uint8Array): string {\n    const bytes = value instanceof Uint8Array ? value : new Uint8Array(value);\n    let binary = \"\";\n    for (const byte of bytes) binary += String.fromCharCode(byte);\n    return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\n/**\n * Whether this browser exposes WebAuthn at all.\n *\n * Note that \"supported\" is not \"usable\": WebAuthn also requires a secure context,\n * and a device may have no authenticator. Use\n * {@link isPlatformAuthenticatorAvailable} before offering a passkey button.\n */\nexport function isPasskeySupported(): boolean {\n    return (\n        typeof window !== \"undefined\" &&\n        typeof navigator !== \"undefined\" &&\n        navigator.credentials !== undefined &&\n        typeof navigator.credentials.create === \"function\" &&\n        publicKeyCredentialStatics() !== undefined\n    );\n}\n\n/**\n * Whether the device has a **built-in** authenticator — Face ID, Touch ID,\n * Windows Hello, an Android screen lock.\n *\n * This is the check that decides whether \"Entrar com passkey\" may be shown at\n * all. `isPasskeySupported()` is true on a desktop with no biometrics and no\n * security key, and offering a passkey there sends the user into a sheet that can\n * only be cancelled. A `false` here does not forbid passkeys — a phone can still\n * be used over hybrid/QR — it means the flow needs a second step, so present it\n * as \"usar meu celular\", not as one tap.\n *\n * @returns `false` when the API is missing, so a caller never has to null-check.\n */\nexport async function isPlatformAuthenticatorAvailable(): Promise<boolean> {\n    const statics = publicKeyCredentialStatics();\n    if (!statics?.isUserVerifyingPlatformAuthenticatorAvailable) return false;\n    try {\n        return await statics.isUserVerifyingPlatformAuthenticatorAvailable();\n    } catch {\n        return false;\n    }\n}\n\n/**\n * Whether autofill-driven passkeys (`mediation: \"conditional\"`) are available.\n *\n * @returns `false` when the API is missing or throws.\n */\nexport async function isConditionalMediationAvailable(): Promise<boolean> {\n    const statics = publicKeyCredentialStatics();\n    if (!statics?.isConditionalMediationAvailable) return false;\n    try {\n        return await statics.isConditionalMediationAvailable();\n    } catch {\n        return false;\n    }\n}\n\n/**\n * Map a thrown WebAuthn failure onto a {@link PasskeyError}.\n *\n * The secure-context check runs first for the same reason it does in the media\n * classifier: over plain HTTP the whole API is absent or refuses, and reporting\n * \"not supported\" sends a developer hunting for a polyfill for something an\n * `https://` URL fixes.\n *\n * @param error - Whatever `navigator.credentials` rejected with.\n * @param ceremony - Which ceremony was running, for the message.\n * @returns The classified error, ready to throw or to show.\n */\nexport function classifyPasskeyError(error: unknown, ceremony: PasskeyCeremony): PasskeyError {\n    if (error instanceof PasskeyError) return error;\n\n    if (typeof window !== \"undefined\" && !window.isSecureContext) {\n        return new PasskeyError(\"insecure\", \"Passkeys require a secure (HTTPS) connection.\", error);\n    }\n\n    if (error instanceof DOMException) {\n        switch (error.name) {\n            case \"NotAllowedError\":\n                return new PasskeyError(\n                    \"cancelled\",\n                    \"The passkey prompt was dismissed or timed out. The browser does not say which — it must not reveal whether a credential exists.\",\n                    error,\n                );\n            case \"InvalidStateError\":\n                return new PasskeyError(\n                    \"already-registered\",\n                    \"This device already has a passkey for this account. Sign in with it instead of creating another.\",\n                    error,\n                );\n            case \"NotSupportedError\":\n                return new PasskeyError(\n                    \"not-supported\",\n                    \"No authenticator here supports the requested algorithms. Check the server's pubKeyCredParams.\",\n                    error,\n                );\n            case \"SecurityError\":\n                return new PasskeyError(\n                    \"rp-mismatch\",\n                    \"The relying-party id does not match this origin. rp.id must be the page's domain or a registrable parent of it.\",\n                    error,\n                );\n            case \"AbortError\":\n                return new PasskeyError(\"aborted\", \"The passkey request was aborted.\", error);\n        }\n    }\n\n    if (error instanceof TypeError) {\n        return new PasskeyError(\n            \"invalid-options\",\n            `The ${ceremony} options the server sent are malformed. Check that challenge, user.id and credential ids are base64url.`,\n            error,\n        );\n    }\n\n    return new PasskeyError(\n        \"unknown\",\n        error instanceof Error\n            ? error.message\n            : `Unexpected error during the passkey ${ceremony} ceremony.`,\n        error,\n    );\n}\n\nfunction toDescriptors(\n    list: { id: string; type: \"public-key\"; transports?: string[] }[] | undefined,\n): PublicKeyCredentialDescriptor[] | undefined {\n    if (!list) return undefined;\n    return list.map((item) => ({\n        id: base64UrlToBytes(item.id) as unknown as BufferSource,\n        type: item.type,\n        transports: item.transports as AuthenticatorTransport[] | undefined,\n    }));\n}\n\n/**\n * Build a WebAuthn client: the base64url ↔ `ArrayBuffer` plumbing, the two\n * ceremonies, and one classified error type.\n *\n * ## What your backend must do\n *\n * This is the **client half only**, and a WebAuthn client that documents only its\n * own half is unusable. Four routes are yours to implement:\n *\n * 1. `POST /webauthn/register/begin` → a {@link PasskeyCreationOptionsJSON}. Mint a\n *    random `challenge` (≥16 bytes), store it against the session, and list the\n *    user's existing credentials in `excludeCredentials`.\n * 2. `POST /webauthn/register/finish` ← a {@link PasskeyRegistrationJSON}. Verify\n *    the challenge, `origin` and `type` inside `clientDataJSON`, parse the\n *    attestation object, then store the credential id, public key and signature\n *    counter.\n * 3. `POST /webauthn/signin/begin` → a {@link PasskeyRequestOptionsJSON}. New\n *    challenge. Omit `allowCredentials` for a usernameless or autofill flow.\n * 4. `POST /webauthn/signin/finish` ← a {@link PasskeyAuthenticationJSON}. Look the\n *    credential up by `id`, verify the signature over\n *    `authenticatorData || sha256(clientDataJSON)`, and reject a signature counter\n *    that did not grow (a clone). Only then issue your session token.\n *\n * @param options - Defaults applied when the server options omit them.\n * @returns A client usable from anywhere — React, a plain form, a worker.\n *\n * @example\n * const passkeys = createPasskeyClient({ rpId: \"acme.com\" });\n *\n * const options = await api.post(\"/webauthn/register/begin\");\n * const credential = await passkeys.register(options);\n * await api.post(\"/webauthn/register/finish\", { body: credential });\n */\nexport function createPasskeyClient(options: CreatePasskeyClientOptions = {}): PasskeyClient {\n    const { rpId, timeoutMs = 60_000, credentials } = options;\n\n    function container(): CredentialsContainerLike {\n        if (credentials) return credentials;\n        if (!isPasskeySupported()) {\n            throw new PasskeyError(\n                \"unsupported\",\n                typeof window !== \"undefined\" && !window.isSecureContext\n                    ? \"Passkeys require a secure (HTTPS) connection.\"\n                    : \"This browser does not support passkeys (WebAuthn).\",\n            );\n        }\n        return navigator.credentials as unknown as CredentialsContainerLike;\n    }\n\n    async function register(\n        json: PasskeyCreationOptionsJSON,\n        init: PasskeyRegisterInit = {},\n    ): Promise<PasskeyRegistrationJSON> {\n        const api = container();\n        const publicKey: PublicKeyCredentialCreationOptions = {\n            challenge: base64UrlToBytes(json.challenge) as unknown as BufferSource,\n            rp: { name: json.rp.name, id: json.rp.id ?? rpId },\n            user: {\n                id: base64UrlToBytes(json.user.id) as unknown as BufferSource,\n                name: json.user.name,\n                displayName: json.user.displayName,\n            },\n            pubKeyCredParams: json.pubKeyCredParams ?? DEFAULT_PUB_KEY_CRED_PARAMS,\n            timeout: json.timeout ?? timeoutMs,\n            excludeCredentials: toDescriptors(json.excludeCredentials),\n            authenticatorSelection: json.authenticatorSelection,\n            attestation: json.attestation,\n            extensions: json.extensions,\n        };\n\n        let credential: Credential | null;\n        try {\n            credential = await api.create({ publicKey, signal: init.signal });\n        } catch (error) {\n            throw classifyPasskeyError(error, \"register\");\n        }\n        if (!credential) {\n            throw new PasskeyError(\"unknown\", \"The authenticator returned no credential.\");\n        }\n\n        const typed = credential as PublicKeyCredential;\n        const response = typed.response as AuthenticatorAttestationResponse & AttestationExtras;\n        const publicKeyBytes = response.getPublicKey?.();\n\n        return {\n            id: typed.id,\n            rawId: bytesToBase64Url(typed.rawId),\n            type: \"public-key\",\n            authenticatorAttachment: typed.authenticatorAttachment ?? null,\n            response: {\n                clientDataJSON: bytesToBase64Url(response.clientDataJSON),\n                attestationObject: bytesToBase64Url(response.attestationObject),\n                transports: response.getTransports?.(),\n                publicKeyAlgorithm: response.getPublicKeyAlgorithm?.(),\n                publicKey: publicKeyBytes ? bytesToBase64Url(publicKeyBytes) : undefined,\n                authenticatorData: response.getAuthenticatorData\n                    ? bytesToBase64Url(response.getAuthenticatorData())\n                    : undefined,\n            },\n            clientExtensionResults: typed.getClientExtensionResults(),\n        };\n    }\n\n    async function authenticate(\n        json: PasskeyRequestOptionsJSON,\n        init: PasskeyAuthenticateInit = {},\n    ): Promise<PasskeyAuthenticationJSON> {\n        const api = container();\n        const publicKey: PublicKeyCredentialRequestOptions = {\n            challenge: base64UrlToBytes(json.challenge) as unknown as BufferSource,\n            rpId: json.rpId ?? rpId,\n            timeout: json.timeout ?? timeoutMs,\n            allowCredentials: toDescriptors(json.allowCredentials),\n            userVerification: json.userVerification,\n            extensions: json.extensions,\n        };\n\n        let credential: Credential | null;\n        try {\n            credential = await api.get({\n                publicKey,\n                signal: init.signal,\n                mediation: init.mediation,\n            });\n        } catch (error) {\n            throw classifyPasskeyError(error, \"authenticate\");\n        }\n        if (!credential) {\n            throw new PasskeyError(\"unknown\", \"The authenticator returned no credential.\");\n        }\n\n        const typed = credential as PublicKeyCredential;\n        const response = typed.response as AuthenticatorAssertionResponse;\n\n        return {\n            id: typed.id,\n            rawId: bytesToBase64Url(typed.rawId),\n            type: \"public-key\",\n            authenticatorAttachment: typed.authenticatorAttachment ?? null,\n            response: {\n                clientDataJSON: bytesToBase64Url(response.clientDataJSON),\n                authenticatorData: bytesToBase64Url(response.authenticatorData),\n                signature: bytesToBase64Url(response.signature),\n                userHandle: response.userHandle ? bytesToBase64Url(response.userHandle) : null,\n            },\n            clientExtensionResults: typed.getClientExtensionResults(),\n        };\n    }\n\n    return {\n        register,\n        authenticate,\n        isSupported: () => credentials !== undefined || isPasskeySupported(),\n        isPlatformAuthenticatorAvailable,\n        isConditionalMediationAvailable,\n    };\n}\n"],"mappings":";AA+CA,IAAa,IAAb,cAAkC,MAAM;CAEpC;CASA,YAAY,GAAwB,GAAiB,GAAiB;EAIlE,AAHA,MAAM,CAAO,GACb,KAAK,OAAO,gBACZ,KAAK,OAAO,GACZ,KAAK,QAAQ;CACjB;AACJ,GAyLa,IAAqE;CAC9E;EAAE,MAAM;EAAc,KAAK;CAAG;CAC9B;EAAE,MAAM;EAAc,KAAK;CAAG;CAC9B;EAAE,MAAM;EAAc,KAAK;CAAK;AACpC;AAgBA,SAAS,IAAqE;CAC1E,OAAQ,WAAoE;AAChF;AAcA,SAAgB,EAAiB,GAAwC;CACrE,IAAM,IAAS,EAAM,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG,GACnD,IAAS,EAAO,OAAO,EAAO,UAAW,IAAK,EAAO,SAAS,KAAM,GAAI,GAAG,GAC3E,IAAS,KAAK,CAAM,GACpB,IAAQ,IAAI,WAAW,EAAO,MAAM;CAC1C,KAAK,IAAI,IAAQ,GAAG,IAAQ,EAAO,QAAQ,KAAS,GAChD,EAAM,KAAS,EAAO,WAAW,CAAK;CAE1C,OAAO;AACX;AAQA,SAAgB,EAAiB,GAAyC;CACtE,IAAM,IAAQ,aAAiB,aAAa,IAAQ,IAAI,WAAW,CAAK,GACpE,IAAS;CACb,KAAK,IAAM,KAAQ,GAAO,KAAU,OAAO,aAAa,CAAI;CAC5D,OAAO,KAAK,CAAM,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,GAAG,CAAC,CAAC,QAAQ,OAAO,EAAE;AACjF;AASA,SAAgB,IAA8B;CAC1C,OACI,OAAO,SAAW,OAClB,OAAO,YAAc,OACrB,UAAU,gBAAgB,KAAA,KAC1B,OAAO,UAAU,YAAY,UAAW,cACxC,EAA2B,MAAM,KAAA;AAEzC;AAeA,eAAsB,IAAqD;CACvE,IAAM,IAAU,EAA2B;CAC3C,IAAI,CAAC,GAAS,+CAA+C,OAAO;CACpE,IAAI;EACA,OAAO,MAAM,EAAQ,8CAA8C;CACvE,QAAQ;EACJ,OAAO;CACX;AACJ;AAOA,eAAsB,IAAoD;CACtE,IAAM,IAAU,EAA2B;CAC3C,IAAI,CAAC,GAAS,iCAAiC,OAAO;CACtD,IAAI;EACA,OAAO,MAAM,EAAQ,gCAAgC;CACzD,QAAQ;EACJ,OAAO;CACX;AACJ;AAcA,SAAgB,EAAqB,GAAgB,GAAyC;CAC1F,IAAI,aAAiB,GAAc,OAAO;CAE1C,IAAI,OAAO,SAAW,OAAe,CAAC,OAAO,iBACzC,OAAO,IAAI,EAAa,YAAY,iDAAiD,CAAK;CAG9F,IAAI,aAAiB,cACjB,QAAQ,EAAM,MAAd;EACI,KAAK,mBACD,OAAO,IAAI,EACP,aACA,mIACA,CACJ;EACJ,KAAK,qBACD,OAAO,IAAI,EACP,sBACA,oGACA,CACJ;EACJ,KAAK,qBACD,OAAO,IAAI,EACP,iBACA,iGACA,CACJ;EACJ,KAAK,iBACD,OAAO,IAAI,EACP,eACA,mHACA,CACJ;EACJ,KAAK,cACD,OAAO,IAAI,EAAa,WAAW,oCAAoC,CAAK;CACpF;CAWJ,OARI,aAAiB,YACV,IAAI,EACP,mBACA,OAAO,EAAS,0GAChB,CACJ,IAGG,IAAI,EACP,WACA,aAAiB,QACX,EAAM,UACN,uCAAuC,EAAS,aACtD,CACJ;AACJ;AAEA,SAAS,EACL,GAC2C;CACtC,OACL,OAAO,EAAK,KAAK,OAAU;EACvB,IAAI,EAAiB,EAAK,EAAE;EAC5B,MAAM,EAAK;EACX,YAAY,EAAK;CACrB,EAAE;AACN;AAmCA,SAAgB,EAAoB,IAAsC,CAAC,GAAkB;CACzF,IAAM,EAAE,SAAM,eAAY,KAAQ,mBAAgB;CAElD,SAAS,IAAsC;EAC3C,IAAI,GAAa,OAAO;EACxB,IAAI,CAAC,EAAmB,GACpB,MAAM,IAAI,EACN,eACA,OAAO,SAAW,OAAe,CAAC,OAAO,kBACnC,kDACA,oDACV;EAEJ,OAAO,UAAU;CACrB;CAEA,eAAe,EACX,GACA,IAA4B,CAAC,GACG;EAChC,IAAM,IAAM,EAAU,GAChB,IAAgD;GAClD,WAAW,EAAiB,EAAK,SAAS;GAC1C,IAAI;IAAE,MAAM,EAAK,GAAG;IAAM,IAAI,EAAK,GAAG,MAAM;GAAK;GACjD,MAAM;IACF,IAAI,EAAiB,EAAK,KAAK,EAAE;IACjC,MAAM,EAAK,KAAK;IAChB,aAAa,EAAK,KAAK;GAC3B;GACA,kBAAkB,EAAK,oBAAoB;GAC3C,SAAS,EAAK,WAAW;GACzB,oBAAoB,EAAc,EAAK,kBAAkB;GACzD,wBAAwB,EAAK;GAC7B,aAAa,EAAK;GAClB,YAAY,EAAK;EACrB,GAEI;EACJ,IAAI;GACA,IAAa,MAAM,EAAI,OAAO;IAAE;IAAW,QAAQ,EAAK;GAAO,CAAC;EACpE,SAAS,GAAO;GACZ,MAAM,EAAqB,GAAO,UAAU;EAChD;EACA,IAAI,CAAC,GACD,MAAM,IAAI,EAAa,WAAW,2CAA2C;EAGjF,IAAM,IAAQ,GACR,IAAW,EAAM,UACjB,IAAiB,EAAS,eAAe;EAE/C,OAAO;GACH,IAAI,EAAM;GACV,OAAO,EAAiB,EAAM,KAAK;GACnC,MAAM;GACN,yBAAyB,EAAM,2BAA2B;GAC1D,UAAU;IACN,gBAAgB,EAAiB,EAAS,cAAc;IACxD,mBAAmB,EAAiB,EAAS,iBAAiB;IAC9D,YAAY,EAAS,gBAAgB;IACrC,oBAAoB,EAAS,wBAAwB;IACrD,WAAW,IAAiB,EAAiB,CAAc,IAAI,KAAA;IAC/D,mBAAmB,EAAS,uBACtB,EAAiB,EAAS,qBAAqB,CAAC,IAChD,KAAA;GACV;GACA,wBAAwB,EAAM,0BAA0B;EAC5D;CACJ;CAEA,eAAe,EACX,GACA,IAAgC,CAAC,GACC;EAClC,IAAM,IAAM,EAAU,GAChB,IAA+C;GACjD,WAAW,EAAiB,EAAK,SAAS;GAC1C,MAAM,EAAK,QAAQ;GACnB,SAAS,EAAK,WAAW;GACzB,kBAAkB,EAAc,EAAK,gBAAgB;GACrD,kBAAkB,EAAK;GACvB,YAAY,EAAK;EACrB,GAEI;EACJ,IAAI;GACA,IAAa,MAAM,EAAI,IAAI;IACvB;IACA,QAAQ,EAAK;IACb,WAAW,EAAK;GACpB,CAAC;EACL,SAAS,GAAO;GACZ,MAAM,EAAqB,GAAO,cAAc;EACpD;EACA,IAAI,CAAC,GACD,MAAM,IAAI,EAAa,WAAW,2CAA2C;EAGjF,IAAM,IAAQ,GACR,IAAW,EAAM;EAEvB,OAAO;GACH,IAAI,EAAM;GACV,OAAO,EAAiB,EAAM,KAAK;GACnC,MAAM;GACN,yBAAyB,EAAM,2BAA2B;GAC1D,UAAU;IACN,gBAAgB,EAAiB,EAAS,cAAc;IACxD,mBAAmB,EAAiB,EAAS,iBAAiB;IAC9D,WAAW,EAAiB,EAAS,SAAS;IAC9C,YAAY,EAAS,aAAa,EAAiB,EAAS,UAAU,IAAI;GAC9E;GACA,wBAAwB,EAAM,0BAA0B;EAC5D;CACJ;CAEA,OAAO;EACH;EACA;EACA,mBAAmB,MAAgB,KAAA,KAAa,EAAmB;EACnE;EACA;CACJ;AACJ"}
+{"version":3,"file":"passkey.js","names":[],"sources":["../../src/auth/passkey.ts"],"sourcesContent":["/**\n * @tempest-limits file-lines, function-lines — the WebAuthn client half: the JSON\n * shapes both ceremonies exchange with a backend, base64url ↔ ArrayBuffer, the\n * capability probes and the error classifier. The two ceremonies are near-mirrors\n * that must not drift — register and authenticate encode the same credential fields\n * in the same order — and the file's docstring is also the specification of the four\n * backend routes it expects.\n */\n\nimport { base64ToBytes, bytesToBase64 } from \"@/utils/base64\";\n\n/**\n * Classified reason a passkey ceremony did not produce a credential.\n *\n * The kinds group the raw `DOMException.name` values the way a UI has to branch\n * on them, which is *not* how the spec groups them:\n *\n * - `\"cancelled\"` covers `NotAllowedError`, which the browser raises both when\n *   the user dismissed the sheet and when the ceremony timed out. They are\n *   indistinguishable **by design** — telling a site \"the user has no credential\n *   for you\" would leak account existence — so a UI must treat them as one thing.\n * - `\"already-registered\"` (`InvalidStateError`) is not really a failure: this\n *   device already holds a credential for this user. The correct reaction is\n *   \"you are already set up on this device\", never a red error.\n * - `\"rp-mismatch\"` (`SecurityError`) is the single most common integration bug:\n *   `rp.id` must equal the page's domain or a registrable parent of it.\n */\nexport type PasskeyErrorKind =\n    | \"unsupported\"\n    | \"insecure\"\n    | \"cancelled\"\n    | \"already-registered\"\n    | \"not-supported\"\n    | \"rp-mismatch\"\n    | \"invalid-options\"\n    | \"aborted\"\n    | \"unknown\";\n\n/** Which ceremony was running, so the message can name it. */\nexport type PasskeyCeremony = \"register\" | \"authenticate\";\n\n/**\n * A passkey failure carrying a stable {@link PasskeyErrorKind} plus an English\n * message safe to show a user.\n *\n * A class rather than the plain `{ kind, message }` object the media classifier\n * returns, because these surface by rejecting a promise: an `Error` subclass keeps\n * stack traces, `instanceof` checks and logging intact, and `kind` is what code\n * branches on.\n */\nexport class PasskeyError extends Error {\n    /** Stable, branchable classification. */\n    readonly kind: PasskeyErrorKind;\n\n    /**\n     * Build a classified passkey error.\n     *\n     * @param kind - The classification a UI branches on.\n     * @param message - English, user-safe explanation.\n     * @param cause - The original thrown value, when there was one.\n     */\n    constructor(kind: PasskeyErrorKind, message: string, cause?: unknown) {\n        super(message);\n        this.name = \"PasskeyError\";\n        this.kind = kind;\n        this.cause = cause;\n    }\n}\n\n/**\n * Minimal subset of `navigator.credentials` the passkey client touches.\n *\n * Declared here — the `<X>Like` pattern the SDK's adapters use — for two reasons:\n * jsdom has no `navigator.credentials` at all, so tests must inject a double; and\n * `mediation: \"conditional\"` is newer than some TypeScript DOM libs, which would\n * otherwise reject the call that makes autofill work.\n */\nexport interface CredentialsContainerLike {\n    /** Runs the registration ceremony. */\n    create(options: {\n        publicKey: PublicKeyCredentialCreationOptions;\n        signal?: AbortSignal;\n    }): Promise<Credential | null>;\n    /** Runs the authentication ceremony. */\n    get(options: {\n        publicKey: PublicKeyCredentialRequestOptions;\n        signal?: AbortSignal;\n        mediation?: string;\n    }): Promise<Credential | null>;\n}\n\n/** How the browser should surface the authentication ceremony. */\nexport type PasskeyMediation = \"optional\" | \"conditional\" | \"required\" | \"silent\";\n\n/**\n * Server-issued registration options, in the base64url JSON shape every WebAuthn\n * backend speaks (`PublicKeyCredentialCreationOptionsJSON` in the spec).\n *\n * `challenge`, `user.id` and every `excludeCredentials[].id` are **base64url**\n * strings here and `ArrayBuffer`s in the DOM API. Converting them is the plumbing\n * this client owns.\n */\nexport interface PasskeyCreationOptionsJSON {\n    /** Base64url server challenge. Single-use; the server must remember it. */\n    challenge: string;\n    /** Relying party. `id` defaults to the client's `rpId`, then to the origin. */\n    rp: { name: string; id?: string };\n    /** The account. `id` is base64url of an opaque, stable user handle. */\n    user: { id: string; name: string; displayName: string };\n    /** Allowed COSE algorithms. Defaults to {@link DEFAULT_PUB_KEY_CRED_PARAMS}. */\n    pubKeyCredParams?: { type: \"public-key\"; alg: number }[];\n    /** Ceremony timeout in ms. Defaults to the client's `timeoutMs`. */\n    timeout?: number;\n    /** Credentials this user already has, so the authenticator refuses a duplicate. */\n    excludeCredentials?: { id: string; type: \"public-key\"; transports?: string[] }[];\n    /** Resident-key / user-verification / attachment requirements. */\n    authenticatorSelection?: AuthenticatorSelectionCriteria;\n    /** Attestation conveyance. Leave unset (`\"none\"`) unless you verify it. */\n    attestation?: AttestationConveyancePreference;\n    /** Client extension inputs (`credProps`, `largeBlob`, …). */\n    extensions?: AuthenticationExtensionsClientInputs;\n}\n\n/** Server-issued authentication options, base64url JSON. */\nexport interface PasskeyRequestOptionsJSON {\n    /** Base64url server challenge. */\n    challenge: string;\n    /** Relying party id. Defaults to the client's `rpId`, then to the origin. */\n    rpId?: string;\n    /** Ceremony timeout in ms. Defaults to the client's `timeoutMs`. */\n    timeout?: number;\n    /** Restrict to these credentials. **Omit it** for usernameless / autofill flows. */\n    allowCredentials?: { id: string; type: \"public-key\"; transports?: string[] }[];\n    /** Whether the authenticator must verify the user (biometric / PIN). */\n    userVerification?: UserVerificationRequirement;\n    /** Client extension inputs. */\n    extensions?: AuthenticationExtensionsClientInputs;\n}\n\n/** What the client sends to the backend to finish registration. */\nexport interface PasskeyRegistrationJSON {\n    /** Base64url credential id. */\n    id: string;\n    /** Same bytes as `id`; both are sent because servers differ on which they read. */\n    rawId: string;\n    type: \"public-key\";\n    /** `\"platform\"` (this device) or `\"cross-platform\"` (a phone or key). */\n    authenticatorAttachment: string | null;\n    response: {\n        /** Base64url client data — the server re-checks challenge, origin and type. */\n        clientDataJSON: string;\n        /** Base64url attestation object, holding the new public key. */\n        attestationObject: string;\n        /** Transports the authenticator advertises, when the browser exposes them. */\n        transports?: string[];\n        /** COSE algorithm of the new key, when the browser exposes it. */\n        publicKeyAlgorithm?: number;\n        /** Base64url SPKI public key, when the browser exposes it. */\n        publicKey?: string;\n        /** Base64url authenticator data, when the browser exposes it. */\n        authenticatorData?: string;\n    };\n    /** Extension outputs — `credProps.rk` tells you whether it is discoverable. */\n    clientExtensionResults: AuthenticationExtensionsClientOutputs;\n}\n\n/** What the client sends to the backend to finish authentication. */\nexport interface PasskeyAuthenticationJSON {\n    /** Base64url credential id — the server looks up the stored public key by it. */\n    id: string;\n    /** Same bytes as `id`. */\n    rawId: string;\n    type: \"public-key\";\n    /** `\"platform\"` or `\"cross-platform\"`. */\n    authenticatorAttachment: string | null;\n    response: {\n        /** Base64url client data. */\n        clientDataJSON: string;\n        /** Base64url authenticator data, carrying the signature counter. */\n        authenticatorData: string;\n        /** Base64url signature over `authenticatorData || sha256(clientDataJSON)`. */\n        signature: string;\n        /** Base64url user handle — present on discoverable credentials, else null. */\n        userHandle: string | null;\n    };\n    /** Extension outputs. */\n    clientExtensionResults: AuthenticationExtensionsClientOutputs;\n}\n\n/** Per-call knobs for {@link PasskeyClient.register}. */\nexport interface PasskeyRegisterInit {\n    /** Cancel the ceremony (closes the browser sheet). */\n    signal?: AbortSignal;\n}\n\n/** Per-call knobs for {@link PasskeyClient.authenticate}. */\nexport interface PasskeyAuthenticateInit extends PasskeyRegisterInit {\n    /**\n     * `\"conditional\"` is the autofill flow: no modal, the browser offers passkeys\n     * inside a field marked `autocomplete=\"webauthn\"`. Requires a `signal`, and\n     * only one conditional request may be live per page.\n     */\n    mediation?: PasskeyMediation;\n}\n\n/** Framework-free WebAuthn client. Build one with {@link createPasskeyClient}. */\nexport interface PasskeyClient {\n    /** Run the registration ceremony and return the JSON your backend verifies. */\n    register(\n        options: PasskeyCreationOptionsJSON,\n        init?: PasskeyRegisterInit,\n    ): Promise<PasskeyRegistrationJSON>;\n    /** Run the authentication ceremony and return the JSON your backend verifies. */\n    authenticate(\n        options: PasskeyRequestOptionsJSON,\n        init?: PasskeyAuthenticateInit,\n    ): Promise<PasskeyAuthenticationJSON>;\n    /**\n     * Whether this client can run a ceremony at all — the WebAuthn API exists, or a\n     * `credentials` container was injected.\n     */\n    isSupported(): boolean;\n    /** Whether this device has a built-in authenticator (Face ID, Hello, …). */\n    isPlatformAuthenticatorAvailable(): Promise<boolean>;\n    /** Whether autofill-driven (`\"conditional\"`) requests are available. */\n    isConditionalMediationAvailable(): Promise<boolean>;\n}\n\n/** Options for {@link createPasskeyClient}. */\nexport interface CreatePasskeyClientOptions {\n    /**\n     * Default relying-party id, applied when the server options omit one. Must be\n     * the page's domain or a registrable parent of it (`app.acme.com` may use\n     * `acme.com`, never the other way round).\n     */\n    rpId?: string;\n    /** Default ceremony timeout in ms. Default `60_000`. */\n    timeoutMs?: number;\n    /** `navigator.credentials` replacement, for tests. */\n    credentials?: CredentialsContainerLike;\n}\n\n/**\n * COSE algorithms offered when the server sends no `pubKeyCredParams`, in\n * preference order.\n *\n * `-8` is Ed25519, which modern authenticators prefer and which produces the\n * smallest signatures. `-7` is ES256, the one algorithm every WebAuthn\n * authenticator supports. `-257` is RS256, needed for TPM-backed Windows Hello.\n * Offering all three is what avoids a `NotSupportedError` on some device you do\n * not own; a server that cannot verify one of them should send its own list.\n */\nexport const DEFAULT_PUB_KEY_CRED_PARAMS: { type: \"public-key\"; alg: number }[] = [\n    { type: \"public-key\", alg: -8 },\n    { type: \"public-key\", alg: -7 },\n    { type: \"public-key\", alg: -257 },\n];\n\n/** Static members of `PublicKeyCredential` that are not in every DOM lib yet. */\ninterface PublicKeyCredentialStatics {\n    isUserVerifyingPlatformAuthenticatorAvailable?: () => Promise<boolean>;\n    isConditionalMediationAvailable?: () => Promise<boolean>;\n}\n\n/** The browser-supplied extras on an attestation response, all optional. */\ninterface AttestationExtras {\n    getTransports?: () => string[];\n    getPublicKey?: () => ArrayBuffer | null;\n    getPublicKeyAlgorithm?: () => number;\n    getAuthenticatorData?: () => ArrayBuffer;\n}\n\nfunction publicKeyCredentialStatics(): PublicKeyCredentialStatics | undefined {\n    return (globalThis as { PublicKeyCredential?: PublicKeyCredentialStatics }).PublicKeyCredential;\n}\n\n/**\n * Decode a base64url string into bytes.\n *\n * WebAuthn transports every binary field as base64url (`-`/`_`, no padding)\n * because that is what survives JSON, while the DOM API insists on\n * `ArrayBuffer`. Getting this pair wrong — usually by feeding plain base64 to\n * `atob` and losing the last byte — is the classic broken-WebAuthn bug, which is\n * why the SDK owns it instead of leaving it to each app.\n *\n * This is the WebAuthn-facing name for {@link base64ToBytes}; the codec itself is\n * shared, so the padding rule has one implementation rather than three.\n *\n * @param value - Base64url text, with or without `=` padding.\n * @returns The decoded bytes.\n */\nexport function base64UrlToBytes(value: string): Uint8Array<ArrayBuffer> {\n    return base64ToBytes(value);\n}\n\n/**\n * Encode bytes as an unpadded base64url string.\n *\n * Normalises `ArrayBuffer` to a view — which is what the WebAuthn response\n * fields hand over — and delegates the encoding to {@link bytesToBase64}.\n *\n * @param value - Bytes to encode, as a view or a raw buffer.\n * @returns Base64url text, safe to put in JSON and in a URL.\n */\nexport function bytesToBase64Url(value: ArrayBuffer | Uint8Array): string {\n    const bytes = value instanceof Uint8Array ? value : new Uint8Array(value);\n    return bytesToBase64(bytes, { urlSafe: true });\n}\n\n/**\n * Whether this browser exposes WebAuthn at all.\n *\n * Note that \"supported\" is not \"usable\": WebAuthn also requires a secure context,\n * and a device may have no authenticator. Use\n * {@link isPlatformAuthenticatorAvailable} before offering a passkey button.\n */\nexport function isPasskeySupported(): boolean {\n    return (\n        typeof window !== \"undefined\" &&\n        typeof navigator !== \"undefined\" &&\n        navigator.credentials !== undefined &&\n        typeof navigator.credentials.create === \"function\" &&\n        publicKeyCredentialStatics() !== undefined\n    );\n}\n\n/**\n * Whether the device has a **built-in** authenticator — Face ID, Touch ID,\n * Windows Hello, an Android screen lock.\n *\n * This is the check that decides whether \"Entrar com passkey\" may be shown at\n * all. `isPasskeySupported()` is true on a desktop with no biometrics and no\n * security key, and offering a passkey there sends the user into a sheet that can\n * only be cancelled. A `false` here does not forbid passkeys — a phone can still\n * be used over hybrid/QR — it means the flow needs a second step, so present it\n * as \"usar meu celular\", not as one tap.\n *\n * @returns `false` when the API is missing, so a caller never has to null-check.\n */\nexport async function isPlatformAuthenticatorAvailable(): Promise<boolean> {\n    const statics = publicKeyCredentialStatics();\n    if (!statics?.isUserVerifyingPlatformAuthenticatorAvailable) return false;\n    try {\n        return await statics.isUserVerifyingPlatformAuthenticatorAvailable();\n    } catch {\n        return false;\n    }\n}\n\n/**\n * Whether autofill-driven passkeys (`mediation: \"conditional\"`) are available.\n *\n * @returns `false` when the API is missing or throws.\n */\nexport async function isConditionalMediationAvailable(): Promise<boolean> {\n    const statics = publicKeyCredentialStatics();\n    if (!statics?.isConditionalMediationAvailable) return false;\n    try {\n        return await statics.isConditionalMediationAvailable();\n    } catch {\n        return false;\n    }\n}\n\n/**\n * Map a thrown WebAuthn failure onto a {@link PasskeyError}.\n *\n * The secure-context check runs first for the same reason it does in the media\n * classifier: over plain HTTP the whole API is absent or refuses, and reporting\n * \"not supported\" sends a developer hunting for a polyfill for something an\n * `https://` URL fixes.\n *\n * @param error - Whatever `navigator.credentials` rejected with.\n * @param ceremony - Which ceremony was running, for the message.\n * @returns The classified error, ready to throw or to show.\n */\nexport function classifyPasskeyError(error: unknown, ceremony: PasskeyCeremony): PasskeyError {\n    if (error instanceof PasskeyError) return error;\n\n    if (typeof window !== \"undefined\" && !window.isSecureContext) {\n        return new PasskeyError(\"insecure\", \"Passkeys require a secure (HTTPS) connection.\", error);\n    }\n\n    if (error instanceof DOMException) {\n        switch (error.name) {\n            case \"NotAllowedError\":\n                return new PasskeyError(\n                    \"cancelled\",\n                    \"The passkey prompt was dismissed or timed out. The browser does not say which — it must not reveal whether a credential exists.\",\n                    error,\n                );\n            case \"InvalidStateError\":\n                return new PasskeyError(\n                    \"already-registered\",\n                    \"This device already has a passkey for this account. Sign in with it instead of creating another.\",\n                    error,\n                );\n            case \"NotSupportedError\":\n                return new PasskeyError(\n                    \"not-supported\",\n                    \"No authenticator here supports the requested algorithms. Check the server's pubKeyCredParams.\",\n                    error,\n                );\n            case \"SecurityError\":\n                return new PasskeyError(\n                    \"rp-mismatch\",\n                    \"The relying-party id does not match this origin. rp.id must be the page's domain or a registrable parent of it.\",\n                    error,\n                );\n            case \"AbortError\":\n                return new PasskeyError(\"aborted\", \"The passkey request was aborted.\", error);\n        }\n    }\n\n    if (error instanceof TypeError) {\n        return new PasskeyError(\n            \"invalid-options\",\n            `The ${ceremony} options the server sent are malformed. Check that challenge, user.id and credential ids are base64url.`,\n            error,\n        );\n    }\n\n    return new PasskeyError(\n        \"unknown\",\n        error instanceof Error\n            ? error.message\n            : `Unexpected error during the passkey ${ceremony} ceremony.`,\n        error,\n    );\n}\n\nfunction toDescriptors(\n    list: { id: string; type: \"public-key\"; transports?: string[] }[] | undefined,\n): PublicKeyCredentialDescriptor[] | undefined {\n    if (!list) return undefined;\n    return list.map((item) => ({\n        id: base64UrlToBytes(item.id) as unknown as BufferSource,\n        type: item.type,\n        transports: item.transports as AuthenticatorTransport[] | undefined,\n    }));\n}\n\n/**\n * Build a WebAuthn client: the base64url ↔ `ArrayBuffer` plumbing, the two\n * ceremonies, and one classified error type.\n *\n * ## What your backend must do\n *\n * This is the **client half only**, and a WebAuthn client that documents only its\n * own half is unusable. Four routes are yours to implement:\n *\n * 1. `POST /webauthn/register/begin` → a {@link PasskeyCreationOptionsJSON}. Mint a\n *    random `challenge` (≥16 bytes), store it against the session, and list the\n *    user's existing credentials in `excludeCredentials`.\n * 2. `POST /webauthn/register/finish` ← a {@link PasskeyRegistrationJSON}. Verify\n *    the challenge, `origin` and `type` inside `clientDataJSON`, parse the\n *    attestation object, then store the credential id, public key and signature\n *    counter.\n * 3. `POST /webauthn/signin/begin` → a {@link PasskeyRequestOptionsJSON}. New\n *    challenge. Omit `allowCredentials` for a usernameless or autofill flow.\n * 4. `POST /webauthn/signin/finish` ← a {@link PasskeyAuthenticationJSON}. Look the\n *    credential up by `id`, verify the signature over\n *    `authenticatorData || sha256(clientDataJSON)`, and reject a signature counter\n *    that did not grow (a clone). Only then issue your session token.\n *\n * @param options - Defaults applied when the server options omit them.\n * @returns A client usable from anywhere — React, a plain form, a worker.\n *\n * @example\n * const passkeys = createPasskeyClient({ rpId: \"acme.com\" });\n *\n * const options = await api.post(\"/webauthn/register/begin\");\n * const credential = await passkeys.register(options);\n * await api.post(\"/webauthn/register/finish\", { body: credential });\n */\nexport function createPasskeyClient(options: CreatePasskeyClientOptions = {}): PasskeyClient {\n    const { rpId, timeoutMs = 60_000, credentials } = options;\n\n    function container(): CredentialsContainerLike {\n        if (credentials) return credentials;\n        if (!isPasskeySupported()) {\n            throw new PasskeyError(\n                \"unsupported\",\n                typeof window !== \"undefined\" && !window.isSecureContext\n                    ? \"Passkeys require a secure (HTTPS) connection.\"\n                    : \"This browser does not support passkeys (WebAuthn).\",\n            );\n        }\n        return navigator.credentials as unknown as CredentialsContainerLike;\n    }\n\n    async function register(\n        json: PasskeyCreationOptionsJSON,\n        init: PasskeyRegisterInit = {},\n    ): Promise<PasskeyRegistrationJSON> {\n        const api = container();\n        const publicKey: PublicKeyCredentialCreationOptions = {\n            challenge: base64UrlToBytes(json.challenge) as unknown as BufferSource,\n            rp: { name: json.rp.name, id: json.rp.id ?? rpId },\n            user: {\n                id: base64UrlToBytes(json.user.id) as unknown as BufferSource,\n                name: json.user.name,\n                displayName: json.user.displayName,\n            },\n            pubKeyCredParams: json.pubKeyCredParams ?? DEFAULT_PUB_KEY_CRED_PARAMS,\n            timeout: json.timeout ?? timeoutMs,\n            excludeCredentials: toDescriptors(json.excludeCredentials),\n            authenticatorSelection: json.authenticatorSelection,\n            attestation: json.attestation,\n            extensions: json.extensions,\n        };\n\n        let credential: Credential | null;\n        try {\n            credential = await api.create({ publicKey, signal: init.signal });\n        } catch (error) {\n            throw classifyPasskeyError(error, \"register\");\n        }\n        if (!credential) {\n            throw new PasskeyError(\"unknown\", \"The authenticator returned no credential.\");\n        }\n\n        const typed = credential as PublicKeyCredential;\n        const response = typed.response as AuthenticatorAttestationResponse & AttestationExtras;\n        const publicKeyBytes = response.getPublicKey?.();\n\n        return {\n            id: typed.id,\n            rawId: bytesToBase64Url(typed.rawId),\n            type: \"public-key\",\n            authenticatorAttachment: typed.authenticatorAttachment ?? null,\n            response: {\n                clientDataJSON: bytesToBase64Url(response.clientDataJSON),\n                attestationObject: bytesToBase64Url(response.attestationObject),\n                transports: response.getTransports?.(),\n                publicKeyAlgorithm: response.getPublicKeyAlgorithm?.(),\n                publicKey: publicKeyBytes ? bytesToBase64Url(publicKeyBytes) : undefined,\n                authenticatorData: response.getAuthenticatorData\n                    ? bytesToBase64Url(response.getAuthenticatorData())\n                    : undefined,\n            },\n            clientExtensionResults: typed.getClientExtensionResults(),\n        };\n    }\n\n    async function authenticate(\n        json: PasskeyRequestOptionsJSON,\n        init: PasskeyAuthenticateInit = {},\n    ): Promise<PasskeyAuthenticationJSON> {\n        const api = container();\n        const publicKey: PublicKeyCredentialRequestOptions = {\n            challenge: base64UrlToBytes(json.challenge) as unknown as BufferSource,\n            rpId: json.rpId ?? rpId,\n            timeout: json.timeout ?? timeoutMs,\n            allowCredentials: toDescriptors(json.allowCredentials),\n            userVerification: json.userVerification,\n            extensions: json.extensions,\n        };\n\n        let credential: Credential | null;\n        try {\n            credential = await api.get({\n                publicKey,\n                signal: init.signal,\n                mediation: init.mediation,\n            });\n        } catch (error) {\n            throw classifyPasskeyError(error, \"authenticate\");\n        }\n        if (!credential) {\n            throw new PasskeyError(\"unknown\", \"The authenticator returned no credential.\");\n        }\n\n        const typed = credential as PublicKeyCredential;\n        const response = typed.response as AuthenticatorAssertionResponse;\n\n        return {\n            id: typed.id,\n            rawId: bytesToBase64Url(typed.rawId),\n            type: \"public-key\",\n            authenticatorAttachment: typed.authenticatorAttachment ?? null,\n            response: {\n                clientDataJSON: bytesToBase64Url(response.clientDataJSON),\n                authenticatorData: bytesToBase64Url(response.authenticatorData),\n                signature: bytesToBase64Url(response.signature),\n                userHandle: response.userHandle ? bytesToBase64Url(response.userHandle) : null,\n            },\n            clientExtensionResults: typed.getClientExtensionResults(),\n        };\n    }\n\n    return {\n        register,\n        authenticate,\n        isSupported: () => credentials !== undefined || isPasskeySupported(),\n        isPlatformAuthenticatorAvailable,\n        isConditionalMediationAvailable,\n    };\n}\n"],"mappings":";;AAkDA,IAAa,IAAb,cAAkC,MAAM;CAEpC;CASA,YAAY,GAAwB,GAAiB,GAAiB;EAIlE,AAHA,MAAM,CAAO,GACb,KAAK,OAAO,gBACZ,KAAK,OAAO,GACZ,KAAK,QAAQ;CACjB;AACJ,GAyLa,IAAqE;CAC9E;EAAE,MAAM;EAAc,KAAK;CAAG;CAC9B;EAAE,MAAM;EAAc,KAAK;CAAG;CAC9B;EAAE,MAAM;EAAc,KAAK;CAAK;AACpC;AAgBA,SAAS,IAAqE;CAC1E,OAAQ,WAAoE;AAChF;AAiBA,SAAgB,EAAiB,GAAwC;CACrE,OAAO,EAAc,CAAK;AAC9B;AAWA,SAAgB,EAAiB,GAAyC;CACtE,IAAM,IAAQ,aAAiB,aAAa,IAAQ,IAAI,WAAW,CAAK;CACxE,OAAO,EAAc,GAAO,EAAE,SAAS,GAAK,CAAC;AACjD;AASA,SAAgB,IAA8B;CAC1C,OACI,OAAO,SAAW,OAClB,OAAO,YAAc,OACrB,UAAU,gBAAgB,KAAA,KAC1B,OAAO,UAAU,YAAY,UAAW,cACxC,EAA2B,MAAM,KAAA;AAEzC;AAeA,eAAsB,IAAqD;CACvE,IAAM,IAAU,EAA2B;CAC3C,IAAI,CAAC,GAAS,+CAA+C,OAAO;CACpE,IAAI;EACA,OAAO,MAAM,EAAQ,8CAA8C;CACvE,QAAQ;EACJ,OAAO;CACX;AACJ;AAOA,eAAsB,IAAoD;CACtE,IAAM,IAAU,EAA2B;CAC3C,IAAI,CAAC,GAAS,iCAAiC,OAAO;CACtD,IAAI;EACA,OAAO,MAAM,EAAQ,gCAAgC;CACzD,QAAQ;EACJ,OAAO;CACX;AACJ;AAcA,SAAgB,EAAqB,GAAgB,GAAyC;CAC1F,IAAI,aAAiB,GAAc,OAAO;CAE1C,IAAI,OAAO,SAAW,OAAe,CAAC,OAAO,iBACzC,OAAO,IAAI,EAAa,YAAY,iDAAiD,CAAK;CAG9F,IAAI,aAAiB,cACjB,QAAQ,EAAM,MAAd;EACI,KAAK,mBACD,OAAO,IAAI,EACP,aACA,mIACA,CACJ;EACJ,KAAK,qBACD,OAAO,IAAI,EACP,sBACA,oGACA,CACJ;EACJ,KAAK,qBACD,OAAO,IAAI,EACP,iBACA,iGACA,CACJ;EACJ,KAAK,iBACD,OAAO,IAAI,EACP,eACA,mHACA,CACJ;EACJ,KAAK,cACD,OAAO,IAAI,EAAa,WAAW,oCAAoC,CAAK;CACpF;CAWJ,OARI,aAAiB,YACV,IAAI,EACP,mBACA,OAAO,EAAS,0GAChB,CACJ,IAGG,IAAI,EACP,WACA,aAAiB,QACX,EAAM,UACN,uCAAuC,EAAS,aACtD,CACJ;AACJ;AAEA,SAAS,EACL,GAC2C;CACtC,OACL,OAAO,EAAK,KAAK,OAAU;EACvB,IAAI,EAAiB,EAAK,EAAE;EAC5B,MAAM,EAAK;EACX,YAAY,EAAK;CACrB,EAAE;AACN;AAmCA,SAAgB,EAAoB,IAAsC,CAAC,GAAkB;CACzF,IAAM,EAAE,SAAM,eAAY,KAAQ,mBAAgB;CAElD,SAAS,IAAsC;EAC3C,IAAI,GAAa,OAAO;EACxB,IAAI,CAAC,EAAmB,GACpB,MAAM,IAAI,EACN,eACA,OAAO,SAAW,OAAe,CAAC,OAAO,kBACnC,kDACA,oDACV;EAEJ,OAAO,UAAU;CACrB;CAEA,eAAe,EACX,GACA,IAA4B,CAAC,GACG;EAChC,IAAM,IAAM,EAAU,GAChB,IAAgD;GAClD,WAAW,EAAiB,EAAK,SAAS;GAC1C,IAAI;IAAE,MAAM,EAAK,GAAG;IAAM,IAAI,EAAK,GAAG,MAAM;GAAK;GACjD,MAAM;IACF,IAAI,EAAiB,EAAK,KAAK,EAAE;IACjC,MAAM,EAAK,KAAK;IAChB,aAAa,EAAK,KAAK;GAC3B;GACA,kBAAkB,EAAK,oBAAoB;GAC3C,SAAS,EAAK,WAAW;GACzB,oBAAoB,EAAc,EAAK,kBAAkB;GACzD,wBAAwB,EAAK;GAC7B,aAAa,EAAK;GAClB,YAAY,EAAK;EACrB,GAEI;EACJ,IAAI;GACA,IAAa,MAAM,EAAI,OAAO;IAAE;IAAW,QAAQ,EAAK;GAAO,CAAC;EACpE,SAAS,GAAO;GACZ,MAAM,EAAqB,GAAO,UAAU;EAChD;EACA,IAAI,CAAC,GACD,MAAM,IAAI,EAAa,WAAW,2CAA2C;EAGjF,IAAM,IAAQ,GACR,IAAW,EAAM,UACjB,IAAiB,EAAS,eAAe;EAE/C,OAAO;GACH,IAAI,EAAM;GACV,OAAO,EAAiB,EAAM,KAAK;GACnC,MAAM;GACN,yBAAyB,EAAM,2BAA2B;GAC1D,UAAU;IACN,gBAAgB,EAAiB,EAAS,cAAc;IACxD,mBAAmB,EAAiB,EAAS,iBAAiB;IAC9D,YAAY,EAAS,gBAAgB;IACrC,oBAAoB,EAAS,wBAAwB;IACrD,WAAW,IAAiB,EAAiB,CAAc,IAAI,KAAA;IAC/D,mBAAmB,EAAS,uBACtB,EAAiB,EAAS,qBAAqB,CAAC,IAChD,KAAA;GACV;GACA,wBAAwB,EAAM,0BAA0B;EAC5D;CACJ;CAEA,eAAe,EACX,GACA,IAAgC,CAAC,GACC;EAClC,IAAM,IAAM,EAAU,GAChB,IAA+C;GACjD,WAAW,EAAiB,EAAK,SAAS;GAC1C,MAAM,EAAK,QAAQ;GACnB,SAAS,EAAK,WAAW;GACzB,kBAAkB,EAAc,EAAK,gBAAgB;GACrD,kBAAkB,EAAK;GACvB,YAAY,EAAK;EACrB,GAEI;EACJ,IAAI;GACA,IAAa,MAAM,EAAI,IAAI;IACvB;IACA,QAAQ,EAAK;IACb,WAAW,EAAK;GACpB,CAAC;EACL,SAAS,GAAO;GACZ,MAAM,EAAqB,GAAO,cAAc;EACpD;EACA,IAAI,CAAC,GACD,MAAM,IAAI,EAAa,WAAW,2CAA2C;EAGjF,IAAM,IAAQ,GACR,IAAW,EAAM;EAEvB,OAAO;GACH,IAAI,EAAM;GACV,OAAO,EAAiB,EAAM,KAAK;GACnC,MAAM;GACN,yBAAyB,EAAM,2BAA2B;GAC1D,UAAU;IACN,gBAAgB,EAAiB,EAAS,cAAc;IACxD,mBAAmB,EAAiB,EAAS,iBAAiB;IAC9D,WAAW,EAAiB,EAAS,SAAS;IAC9C,YAAY,EAAS,aAAa,EAAiB,EAAS,UAAU,IAAI;GAC9E;GACA,wBAAwB,EAAM,0BAA0B;EAC5D;CACJ;CAEA,OAAO;EACH;EACA;EACA,mBAAmB,MAAgB,KAAA,KAAa,EAAmB;EACnE;EACA;CACJ;AACJ"}

package/dist/charts.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./charts/scales.cjs"),t=require("./charts/palette.cjs"),n=require("./charts/use-chart-colors.cjs"),r=require("./charts/AreaChart.cjs"),i=require("./charts/BarChart.cjs"),a=require("./charts/LineChart.cjs"),o=require("./charts/PieChart.cjs"),s=require("./charts/RadarChart.cjs");exports.AreaChart=r.AreaChart,exports.BarChart=i.BarChart,exports.DEFAULT_CHART_COLORS=t.DEFAULT_CHART_COLORS,exports.DIVERGING_STEP_COUNT=e.DIVERGING_STEP_COUNT,exports.LineChart=a.LineChart,exports.ORDINAL_START_STEP=e.ORDINAL_START_STEP,exports.PieChart=o.PieChart,exports.RadarChart=s.RadarChart,exports.SEQUENTIAL_STEP_COUNT=e.SEQUENTIAL_STEP_COUNT,exports.divergingScale=e.divergingScale,exports.resolveChartChrome=t.resolveChartChrome,exports.resolveChartColors=t.resolveChartColors,exports.scaleSteps=e.scaleSteps,exports.sequentialScale=e.sequentialScale,exports.useChartColors=n.useChartColors;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./charts/palette.cjs"),t=require("./charts/use-chart-colors.cjs"),n=require("./charts/scales.cjs"),r=require("./charts/AreaChart.cjs"),i=require("./charts/BarChart.cjs"),a=require("./charts/LineChart.cjs"),o=require("./charts/PieChart.cjs"),s=require("./charts/RadarChart.cjs");exports.AreaChart=r.AreaChart,exports.BarChart=i.BarChart,exports.DEFAULT_CHART_COLORS=e.DEFAULT_CHART_COLORS,exports.DIVERGING_STEP_COUNT=n.DIVERGING_STEP_COUNT,exports.LineChart=a.LineChart,exports.ORDINAL_START_STEP=n.ORDINAL_START_STEP,exports.PieChart=o.PieChart,exports.RadarChart=s.RadarChart,exports.SEQUENTIAL_STEP_COUNT=n.SEQUENTIAL_STEP_COUNT,exports.divergingScale=n.divergingScale,exports.resolveChartChrome=e.resolveChartChrome,exports.resolveChartColors=e.resolveChartColors,exports.scaleSteps=n.scaleSteps,exports.sequentialScale=n.sequentialScale,exports.useChartColors=t.useChartColors;

package/dist/charts.js

@@ -1,9 +1,9 @@
-import { DIVERGING_STEP_COUNT as e, ORDINAL_START_STEP as t, SEQUENTIAL_STEP_COUNT as n, divergingScale as r, scaleSteps as i, sequentialScale as a } from "./charts/scales.js";
-import { DEFAULT_CHART_COLORS as o, resolveChartChrome as s, resolveChartColors as c } from "./charts/palette.js";
-import { useChartColors as l } from "./charts/use-chart-colors.js";
+import { DEFAULT_CHART_COLORS as e, resolveChartChrome as t, resolveChartColors as n } from "./charts/palette.js";
+import { useChartColors as r } from "./charts/use-chart-colors.js";
+import { DIVERGING_STEP_COUNT as i, ORDINAL_START_STEP as a, SEQUENTIAL_STEP_COUNT as o, divergingScale as s, scaleSteps as c, sequentialScale as l } from "./charts/scales.js";
 import { AreaChart as u } from "./charts/AreaChart.js";
 import { BarChart as d } from "./charts/BarChart.js";
 import { LineChart as f } from "./charts/LineChart.js";
 import { PieChart as p } from "./charts/PieChart.js";
 import { RadarChart as m } from "./charts/RadarChart.js";
-export { u as AreaChart, d as BarChart, o as DEFAULT_CHART_COLORS, e as DIVERGING_STEP_COUNT, f as LineChart, t as ORDINAL_START_STEP, p as PieChart, m as RadarChart, n as SEQUENTIAL_STEP_COUNT, r as divergingScale, s as resolveChartChrome, c as resolveChartColors, i as scaleSteps, a as sequentialScale, l as useChartColors };
+export { u as AreaChart, d as BarChart, e as DEFAULT_CHART_COLORS, i as DIVERGING_STEP_COUNT, f as LineChart, a as ORDINAL_START_STEP, p as PieChart, m as RadarChart, o as SEQUENTIAL_STEP_COUNT, s as divergingScale, t as resolveChartChrome, n as resolveChartColors, c as scaleSteps, l as sequentialScale, r as useChartColors };

package/dist/components/AIChat/AIChatTurn.cjs

@@ -1,3 +1,3 @@
-const e=require("../../utils/cn.cjs"),t=require("../../utils/numbers.cjs"),n=require("../VisuallyHidden/VisuallyHidden.cjs"),r=require("../CopyButton/CopyButton.cjs"),i=require("../Collapsible/Collapsible.cjs"),a=require("./ai-chat-turns.cjs"),o=require("./AIChat.module.cjs"),s=require("../Markdown/Markdown.cjs");let c=require("react"),l=require("react/jsx-runtime"),u=require("lucide-react");function d({message:d,locale:f=`pt-BR`,canRegenerate:p=!1,onRegenerate:m,onFeedback:h,onEditSubmit:g,onEditError:_,onRetry:v,renderAvatar:y,renderContent:b,vote:x,defaultReasoningOpen:S=!1,showLineNumbers:C=!1}){let w=a.aiChatStrings(f),{role:T,content:E,reasoning:D,streaming:O,error:k,model:A,createdAt:j,attachments:M}=d,[N,P]=(0,c.useState)(null),[F,I]=(0,c.useState)(!1),[L,R]=(0,c.useState)(E),[z,B]=(0,c.useState)(!1),V=x??N,H=T===`user`,U=(0,c.useMemo)(()=>(0,l.jsx)(s.Markdown,{source:E,showLineNumbers:C,className:o.default.markdownRoot}),[E,C]),W=b?b(d):H?(0,l.jsx)(`div`,{className:o.default.plain,children:E}):E===``?null:U,G=async()=>{let e=L.trim();if(!(!e||z||!g)){B(!0);try{await g(d,e),I(!1)}catch(e){_?.(e)}finally{B(!1)}}},K=e=>{V!==e&&(P(e),h?.(d,e))},q=!O&&!F,J=h!==void 0||p&&m!==void 0;return(0,l.jsxs)(`article`,{className:e.cn(o.default.turn,H&&o.default.userTurn,T===`system`&&o.default.systemTurn,O&&o.default.streamingTurn),"aria-busy":O||void 0,"data-role":T,children:[(0,l.jsxs)(`header`,{className:o.default.turnHeader,children:[y&&(0,l.jsx)(`span`,{className:o.default.avatar,"aria-hidden":`true`,children:y(d)}),(0,l.jsx)(`span`,{className:e.cn(o.default.role,H&&o.default.visuallyHiddenRole),children:a.roleLabel(T,w)}),A&&!H&&(0,l.jsx)(`span`,{className:o.default.model,children:A}),j!==void 0&&(0,l.jsx)(`time`,{className:o.default.time,dateTime:new Date(j).toISOString(),children:a.turnTime(j,f)})]}),M&&M.length>0&&(0,l.jsx)(`ul`,{className:o.default.attachments,children:M.map(e=>(0,l.jsx)(`li`,{className:o.default.attachment,children:e.url?(0,l.jsx)(`img`,{className:o.default.thumb,src:e.url,alt:e.name}):(0,l.jsxs)(l.Fragment,{children:[(0,l.jsx)(`span`,{className:o.default.attachmentName,children:e.name}),(0,l.jsx)(`span`,{className:o.default.attachmentMeta,children:e.size===void 0?e.mimeType:t.formatBytes(e.size)})]})},e.id))}),D&&(0,l.jsx)(i.Collapsible,{className:o.default.reasoning,defaultOpen:S||O===!0&&E===``,trigger:(0,l.jsxs)(l.Fragment,{children:[(0,l.jsx)(u.ChevronRight,{className:o.default.reasoningChevron,size:14,"aria-hidden":!0}),w.reasoning]}),children:(0,l.jsx)(`div`,{className:o.default.reasoningBody,children:D})}),F?(0,l.jsxs)(`div`,{className:o.default.editor,children:[(0,l.jsx)(n.VisuallyHidden,{children:(0,l.jsx)(`label`,{htmlFor:`${d.id}-edit`,children:w.editing})}),(0,l.jsx)(`textarea`,{id:`${d.id}-edit`,className:o.default.editField,value:L,rows:Math.min(L.split(`
+const e=require("../../utils/cn.cjs"),t=require("../VisuallyHidden/VisuallyHidden.cjs"),n=require("../../utils/numbers.cjs"),r=require("../CopyButton/CopyButton.cjs"),i=require("../Collapsible/Collapsible.cjs"),a=require("./ai-chat-turns.cjs"),o=require("./AIChat.module.cjs"),s=require("../Markdown/Markdown.cjs");let c=require("react"),l=require("react/jsx-runtime"),u=require("lucide-react");function d({message:d,locale:f=`pt-BR`,canRegenerate:p=!1,onRegenerate:m,onFeedback:h,onEditSubmit:g,onEditError:_,onRetry:v,renderAvatar:y,renderContent:b,vote:x,defaultReasoningOpen:S=!1,showLineNumbers:C=!1}){let w=a.aiChatStrings(f),{role:T,content:E,reasoning:D,streaming:O,error:k,model:A,createdAt:j,attachments:M}=d,[N,P]=(0,c.useState)(null),[F,I]=(0,c.useState)(!1),[L,R]=(0,c.useState)(E),[z,B]=(0,c.useState)(!1),V=x??N,H=T===`user`,U=(0,c.useMemo)(()=>(0,l.jsx)(s.Markdown,{source:E,showLineNumbers:C,className:o.default.markdownRoot}),[E,C]),W=b?b(d):H?(0,l.jsx)(`div`,{className:o.default.plain,children:E}):E===``?null:U,G=async()=>{let e=L.trim();if(!(!e||z||!g)){B(!0);try{await g(d,e),I(!1)}catch(e){_?.(e)}finally{B(!1)}}},K=e=>{V!==e&&(P(e),h?.(d,e))},q=!O&&!F,J=h!==void 0||p&&m!==void 0;return(0,l.jsxs)(`article`,{className:e.cn(o.default.turn,H&&o.default.userTurn,T===`system`&&o.default.systemTurn,O&&o.default.streamingTurn),"aria-busy":O||void 0,"data-role":T,children:[(0,l.jsxs)(`header`,{className:o.default.turnHeader,children:[y&&(0,l.jsx)(`span`,{className:o.default.avatar,"aria-hidden":`true`,children:y(d)}),(0,l.jsx)(`span`,{className:e.cn(o.default.role,H&&o.default.visuallyHiddenRole),children:a.roleLabel(T,w)}),A&&!H&&(0,l.jsx)(`span`,{className:o.default.model,children:A}),j!==void 0&&(0,l.jsx)(`time`,{className:o.default.time,dateTime:new Date(j).toISOString(),children:a.turnTime(j,f)})]}),M&&M.length>0&&(0,l.jsx)(`ul`,{className:o.default.attachments,children:M.map(e=>(0,l.jsx)(`li`,{className:o.default.attachment,children:e.url?(0,l.jsx)(`img`,{className:o.default.thumb,src:e.url,alt:e.name}):(0,l.jsxs)(l.Fragment,{children:[(0,l.jsx)(`span`,{className:o.default.attachmentName,children:e.name}),(0,l.jsx)(`span`,{className:o.default.attachmentMeta,children:e.size===void 0?e.mimeType:n.formatBytes(e.size)})]})},e.id))}),D&&(0,l.jsx)(i.Collapsible,{className:o.default.reasoning,defaultOpen:S||O===!0&&E===``,trigger:(0,l.jsxs)(l.Fragment,{children:[(0,l.jsx)(u.ChevronRight,{className:o.default.reasoningChevron,size:14,"aria-hidden":!0}),w.reasoning]}),children:(0,l.jsx)(`div`,{className:o.default.reasoningBody,children:D})}),F?(0,l.jsxs)(`div`,{className:o.default.editor,children:[(0,l.jsx)(t.VisuallyHidden,{children:(0,l.jsx)(`label`,{htmlFor:`${d.id}-edit`,children:w.editing})}),(0,l.jsx)(`textarea`,{id:`${d.id}-edit`,className:o.default.editField,value:L,rows:Math.min(L.split(`
 `).length+1,10),onChange:e=>R(e.target.value)}),(0,l.jsxs)(`div`,{className:o.default.editActions,children:[(0,l.jsx)(`button`,{type:`button`,className:o.default.ghost,onClick:()=>{R(E),I(!1)},children:w.cancel}),(0,l.jsx)(`button`,{type:`button`,className:o.default.primary,disabled:z||L.trim()===``,onClick:()=>void G(),children:w.save})]})]}):(0,l.jsxs)(`div`,{className:e.cn(o.default.body,O&&o.default.streamingBody),children:[W,O===!0&&E===``&&(0,l.jsxs)(`span`,{className:o.default.dots,"aria-hidden":`true`,children:[(0,l.jsx)(`span`,{}),(0,l.jsx)(`span`,{}),(0,l.jsx)(`span`,{})]})]}),k&&(0,l.jsxs)(`p`,{className:o.default.error,role:`alert`,children:[(0,l.jsx)(`span`,{children:k}),v&&(0,l.jsx)(`button`,{type:`button`,className:o.default.retry,onClick:()=>v(d),children:w.retry})]}),q&&(0,l.jsxs)(`div`,{className:o.default.actions,"aria-label":w.turnActions,role:`group`,children:[(0,l.jsx)(r.CopyButton,{className:o.default.action,value:E,"aria-label":w.copy,title:w.copy,children:(0,l.jsx)(u.Copy,{size:14,"aria-hidden":!0})}),H&&g&&(0,l.jsx)(`button`,{type:`button`,className:o.default.action,"aria-label":w.edit,title:w.edit,onClick:()=>{R(E),I(!0)},children:(0,l.jsx)(u.Pencil,{size:14,"aria-hidden":!0})}),!H&&J&&(0,l.jsxs)(l.Fragment,{children:[p&&m&&(0,l.jsx)(`button`,{type:`button`,className:o.default.action,"aria-label":w.regenerate,title:w.regenerate,onClick:()=>m(d),children:(0,l.jsx)(u.RefreshCw,{size:14,"aria-hidden":!0})}),h&&(0,l.jsxs)(l.Fragment,{children:[(0,l.jsx)(`button`,{type:`button`,className:e.cn(o.default.action,V===`up`&&o.default.actionActive),"aria-label":w.good,title:w.good,"aria-pressed":V===`up`,onClick:()=>K(`up`),children:(0,l.jsx)(u.ThumbsUp,{size:14,"aria-hidden":!0})}),(0,l.jsx)(`button`,{type:`button`,className:e.cn(o.default.action,V===`down`&&o.default.actionActive),"aria-label":w.bad,title:w.bad,"aria-pressed":V===`down`,onClick:()=>K(`down`),children:(0,l.jsx)(u.ThumbsDown,{size:14,"aria-hidden":!0})})]})]})]})]})}exports.AIChatTurn=d;
 //# sourceMappingURL=AIChatTurn.cjs.map

package/dist/components/AIChat/AIChatTurn.js

@@ -1,6 +1,6 @@
 import { cn as e } from "../../utils/cn.js";
-import { formatBytes as t } from "../../utils/numbers.js";
-import { VisuallyHidden as n } from "../VisuallyHidden/VisuallyHidden.js";
+import { VisuallyHidden as t } from "../VisuallyHidden/VisuallyHidden.js";
+import { formatBytes as n } from "../../utils/numbers.js";
 import { CopyButton as ee } from "../CopyButton/CopyButton.js";
 import { Collapsible as r } from "../Collapsible/Collapsible.js";
 import { aiChatStrings as i, roleLabel as a, turnTime as o } from "./ai-chat-turns.js";
@@ -74,7 +74,7 @@ function b({ message: b, locale: x = "pt-BR", canRegenerate: S = !1, onRegenerat
 						children: e.name
 					}), /* @__PURE__ */ f("span", {
 						className: s.attachmentMeta,
-						children: e.size === void 0 ? e.mimeType : t(e.size)
+						children: e.size === void 0 ? e.mimeType : n(e.size)
 					})] })
 				}, e.id))
 			}),
@@ -94,7 +94,7 @@ function b({ message: b, locale: x = "pt-BR", canRegenerate: S = !1, onRegenerat
 			W ? /* @__PURE__ */ p("div", {
 				className: s.editor,
 				children: [
-					/* @__PURE__ */ f(n, { children: /* @__PURE__ */ f("label", {
+					/* @__PURE__ */ f(t, { children: /* @__PURE__ */ f("label", {
 						htmlFor: `${b.id}-edit`,
 						children: N.editing
 					}) }),

package/dist/components/AppBar/use-sticky-body-warning.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"use-sticky-body-warning.cjs","names":[],"sources":["../../../src/components/AppBar/use-sticky-body-warning.ts"],"sourcesContent":["import { useEffect } from \"react\";\n\nimport { isDevBuild } from \"../../utils\";\n\n/**\n * The one line of the app's own CSS that silently defeats `sticky`.\n *\n * `body { overflow-x: hidden }` is how most apps stop a too-wide child from\n * panning the page sideways. It also, per CSS Overflow 3, forces the computed\n * `overflow-y` to `auto` — a value the author never wrote — which makes the\n * body a **scroll container**. Every sticky descendant then pins to the body's\n * scrollport instead of the viewport, and that scrollport travels with the\n * document: measured in Chromium at 390px with a long page, the bar sat at\n * `top: -900px` after scrolling 900px, i.e. off screen.\n *\n * Nothing about that reads as a CSS problem from the app's side. The bar still\n * reports `position: sticky` in DevTools, the markup is unchanged, and on\n * desktop the screens usually fit without scrolling so the bug never shows. It\n * surfaces on Chrome Android, where the collapsing URL bar makes every screen a\n * scrolling screen — and it gets reported as \"the app bar is broken\", because\n * that is what the user sees.\n *\n * Hence this warning: the SDK cannot fix it from inside the component (a sticky\n * element has no way to opt out of its scroll container, and a rule the SDK\n * ships in its reset loses to the app's own stylesheet, which is imported\n * after), but it can name the cause in one console line.\n *\n * `clip` is the fix because it clamps the same horizontal overflow without\n * creating a scroll container. It has to be on `html` **and** `body` — with it\n * on only one of them the document still panned to `x: 500` in the same\n * measurement.\n */\nconst MESSAGE =\n    \"[tempest-react-sdk] <AppBar sticky /> will not stick: `document.body` has \" +\n    \"`overflow-x: hidden`, which forces its computed `overflow-y` to `auto` and makes the \" +\n    \"body a scroll container. The bar then pins to the body's scrollport instead of the \" +\n    \"viewport and scrolls off the top with the content — most visibly on Chrome Android. \" +\n    \"Fix: `html, body { overflow-x: clip }`, on both elements, since neither clamps alone. \" +\n    \"Pass `sticky={false}` if the bar is meant to scroll away.\";\n\n/** Set once the warning has been printed, so re-renders do not bury the console. */\nlet warned = false;\n\n/**\n * Reset the warn-once latch. Test-only — the latch is module state, and a suite\n * that renders more than one bar would otherwise see the warning only once.\n */\nexport function resetStickyBodyWarning(): void {\n    warned = false;\n}\n\n/**\n * Warn once, in development, when the page's own CSS will keep a sticky bar\n * from sticking.\n *\n * Reads the body's `overflow-x` rather than walking the ancestors, because that\n * single declaration is the whole failure mode: an app that genuinely wants the\n * body to scroll writes `overflow-y: auto` itself, and a sticky bar inside a\n * scroll container the app chose on purpose behaves exactly as intended. What\n * is never intentional is acquiring that scroll container as a side effect of\n * clamping the other axis.\n *\n * @param enabled - Whether the bar is actually sticky. A bar rendered with\n *   `sticky={false}` has nothing to lose and stays quiet.\n */\nexport function useStickyBodyWarning(enabled: boolean): void {\n    useEffect(() => {\n        if (!enabled || warned || !isDevBuild()) return;\n        if (typeof document === \"undefined\" || !document.body) return;\n        if (getComputedStyle(document.body).overflowX !== \"hidden\") return;\n        warned = true;\n        console.warn(MESSAGE);\n    }, [enabled]);\n}\n"],"mappings":"mEAgCA,IAAM,EACF,wdAQA,EAAS,GAwBb,SAAgB,EAAqB,EAAwB,EACzD,EAAA,EAAA,UAAA,KAAgB,CACR,CAAC,GAAW,GAAU,CAAC,EAAA,WAAW,GAClC,OAAO,SAAa,KAAe,CAAC,SAAS,MAC7C,iBAAiB,SAAS,IAAI,CAAC,CAAC,YAAc,WAClD,EAAS,GACT,QAAQ,KAAK,CAAO,EACxB,EAAG,CAAC,CAAO,CAAC,CAChB"}
+{"version":3,"file":"use-sticky-body-warning.cjs","names":[],"sources":["../../../src/components/AppBar/use-sticky-body-warning.ts"],"sourcesContent":["import { useEffect } from \"react\";\n\nimport { isDevBuild } from \"../../utils/dev-mode\";\n\n/**\n * The one line of the app's own CSS that silently defeats `sticky`.\n *\n * `body { overflow-x: hidden }` is how most apps stop a too-wide child from\n * panning the page sideways. It also, per CSS Overflow 3, forces the computed\n * `overflow-y` to `auto` — a value the author never wrote — which makes the\n * body a **scroll container**. Every sticky descendant then pins to the body's\n * scrollport instead of the viewport, and that scrollport travels with the\n * document: measured in Chromium at 390px with a long page, the bar sat at\n * `top: -900px` after scrolling 900px, i.e. off screen.\n *\n * Nothing about that reads as a CSS problem from the app's side. The bar still\n * reports `position: sticky` in DevTools, the markup is unchanged, and on\n * desktop the screens usually fit without scrolling so the bug never shows. It\n * surfaces on Chrome Android, where the collapsing URL bar makes every screen a\n * scrolling screen — and it gets reported as \"the app bar is broken\", because\n * that is what the user sees.\n *\n * Hence this warning: the SDK cannot fix it from inside the component (a sticky\n * element has no way to opt out of its scroll container, and a rule the SDK\n * ships in its reset loses to the app's own stylesheet, which is imported\n * after), but it can name the cause in one console line.\n *\n * `clip` is the fix because it clamps the same horizontal overflow without\n * creating a scroll container. It has to be on `html` **and** `body` — with it\n * on only one of them the document still panned to `x: 500` in the same\n * measurement.\n */\nconst MESSAGE =\n    \"[tempest-react-sdk] <AppBar sticky /> will not stick: `document.body` has \" +\n    \"`overflow-x: hidden`, which forces its computed `overflow-y` to `auto` and makes the \" +\n    \"body a scroll container. The bar then pins to the body's scrollport instead of the \" +\n    \"viewport and scrolls off the top with the content — most visibly on Chrome Android. \" +\n    \"Fix: `html, body { overflow-x: clip }`, on both elements, since neither clamps alone. \" +\n    \"Pass `sticky={false}` if the bar is meant to scroll away.\";\n\n/** Set once the warning has been printed, so re-renders do not bury the console. */\nlet warned = false;\n\n/**\n * Reset the warn-once latch. Test-only — the latch is module state, and a suite\n * that renders more than one bar would otherwise see the warning only once.\n */\nexport function resetStickyBodyWarning(): void {\n    warned = false;\n}\n\n/**\n * Warn once, in development, when the page's own CSS will keep a sticky bar\n * from sticking.\n *\n * Reads the body's `overflow-x` rather than walking the ancestors, because that\n * single declaration is the whole failure mode: an app that genuinely wants the\n * body to scroll writes `overflow-y: auto` itself, and a sticky bar inside a\n * scroll container the app chose on purpose behaves exactly as intended. What\n * is never intentional is acquiring that scroll container as a side effect of\n * clamping the other axis.\n *\n * @param enabled - Whether the bar is actually sticky. A bar rendered with\n *   `sticky={false}` has nothing to lose and stays quiet.\n */\nexport function useStickyBodyWarning(enabled: boolean): void {\n    useEffect(() => {\n        if (!enabled || warned || !isDevBuild()) return;\n        if (typeof document === \"undefined\" || !document.body) return;\n        if (getComputedStyle(document.body).overflowX !== \"hidden\") return;\n        warned = true;\n        console.warn(MESSAGE);\n    }, [enabled]);\n}\n"],"mappings":"mEAgCA,IAAM,EACF,wdAQA,EAAS,GAwBb,SAAgB,EAAqB,EAAwB,EACzD,EAAA,EAAA,UAAA,KAAgB,CACR,CAAC,GAAW,GAAU,CAAC,EAAA,WAAW,GAClC,OAAO,SAAa,KAAe,CAAC,SAAS,MAC7C,iBAAiB,SAAS,IAAI,CAAC,CAAC,YAAc,WAClD,EAAS,GACT,QAAQ,KAAK,CAAO,EACxB,EAAG,CAAC,CAAO,CAAC,CAChB"}

package/dist/components/AppBar/use-sticky-body-warning.js.map

@@ -1 +1 @@
-{"version":3,"file":"use-sticky-body-warning.js","names":[],"sources":["../../../src/components/AppBar/use-sticky-body-warning.ts"],"sourcesContent":["import { useEffect } from \"react\";\n\nimport { isDevBuild } from \"../../utils\";\n\n/**\n * The one line of the app's own CSS that silently defeats `sticky`.\n *\n * `body { overflow-x: hidden }` is how most apps stop a too-wide child from\n * panning the page sideways. It also, per CSS Overflow 3, forces the computed\n * `overflow-y` to `auto` — a value the author never wrote — which makes the\n * body a **scroll container**. Every sticky descendant then pins to the body's\n * scrollport instead of the viewport, and that scrollport travels with the\n * document: measured in Chromium at 390px with a long page, the bar sat at\n * `top: -900px` after scrolling 900px, i.e. off screen.\n *\n * Nothing about that reads as a CSS problem from the app's side. The bar still\n * reports `position: sticky` in DevTools, the markup is unchanged, and on\n * desktop the screens usually fit without scrolling so the bug never shows. It\n * surfaces on Chrome Android, where the collapsing URL bar makes every screen a\n * scrolling screen — and it gets reported as \"the app bar is broken\", because\n * that is what the user sees.\n *\n * Hence this warning: the SDK cannot fix it from inside the component (a sticky\n * element has no way to opt out of its scroll container, and a rule the SDK\n * ships in its reset loses to the app's own stylesheet, which is imported\n * after), but it can name the cause in one console line.\n *\n * `clip` is the fix because it clamps the same horizontal overflow without\n * creating a scroll container. It has to be on `html` **and** `body` — with it\n * on only one of them the document still panned to `x: 500` in the same\n * measurement.\n */\nconst MESSAGE =\n    \"[tempest-react-sdk] <AppBar sticky /> will not stick: `document.body` has \" +\n    \"`overflow-x: hidden`, which forces its computed `overflow-y` to `auto` and makes the \" +\n    \"body a scroll container. The bar then pins to the body's scrollport instead of the \" +\n    \"viewport and scrolls off the top with the content — most visibly on Chrome Android. \" +\n    \"Fix: `html, body { overflow-x: clip }`, on both elements, since neither clamps alone. \" +\n    \"Pass `sticky={false}` if the bar is meant to scroll away.\";\n\n/** Set once the warning has been printed, so re-renders do not bury the console. */\nlet warned = false;\n\n/**\n * Reset the warn-once latch. Test-only — the latch is module state, and a suite\n * that renders more than one bar would otherwise see the warning only once.\n */\nexport function resetStickyBodyWarning(): void {\n    warned = false;\n}\n\n/**\n * Warn once, in development, when the page's own CSS will keep a sticky bar\n * from sticking.\n *\n * Reads the body's `overflow-x` rather than walking the ancestors, because that\n * single declaration is the whole failure mode: an app that genuinely wants the\n * body to scroll writes `overflow-y: auto` itself, and a sticky bar inside a\n * scroll container the app chose on purpose behaves exactly as intended. What\n * is never intentional is acquiring that scroll container as a side effect of\n * clamping the other axis.\n *\n * @param enabled - Whether the bar is actually sticky. A bar rendered with\n *   `sticky={false}` has nothing to lose and stays quiet.\n */\nexport function useStickyBodyWarning(enabled: boolean): void {\n    useEffect(() => {\n        if (!enabled || warned || !isDevBuild()) return;\n        if (typeof document === \"undefined\" || !document.body) return;\n        if (getComputedStyle(document.body).overflowX !== \"hidden\") return;\n        warned = true;\n        console.warn(MESSAGE);\n    }, [enabled]);\n}\n"],"mappings":";;;AAgCA,IAAM,IACF,ydAQA,IAAS;AAwBb,SAAgB,EAAqB,GAAwB;CACzD,QAAgB;EACR,CAAC,KAAW,KAAU,CAAC,EAAW,KAClC,OAAO,WAAa,OAAe,CAAC,SAAS,QAC7C,iBAAiB,SAAS,IAAI,CAAC,CAAC,cAAc,aAClD,IAAS,IACT,QAAQ,KAAK,CAAO;CACxB,GAAG,CAAC,CAAO,CAAC;AAChB"}
+{"version":3,"file":"use-sticky-body-warning.js","names":[],"sources":["../../../src/components/AppBar/use-sticky-body-warning.ts"],"sourcesContent":["import { useEffect } from \"react\";\n\nimport { isDevBuild } from \"../../utils/dev-mode\";\n\n/**\n * The one line of the app's own CSS that silently defeats `sticky`.\n *\n * `body { overflow-x: hidden }` is how most apps stop a too-wide child from\n * panning the page sideways. It also, per CSS Overflow 3, forces the computed\n * `overflow-y` to `auto` — a value the author never wrote — which makes the\n * body a **scroll container**. Every sticky descendant then pins to the body's\n * scrollport instead of the viewport, and that scrollport travels with the\n * document: measured in Chromium at 390px with a long page, the bar sat at\n * `top: -900px` after scrolling 900px, i.e. off screen.\n *\n * Nothing about that reads as a CSS problem from the app's side. The bar still\n * reports `position: sticky` in DevTools, the markup is unchanged, and on\n * desktop the screens usually fit without scrolling so the bug never shows. It\n * surfaces on Chrome Android, where the collapsing URL bar makes every screen a\n * scrolling screen — and it gets reported as \"the app bar is broken\", because\n * that is what the user sees.\n *\n * Hence this warning: the SDK cannot fix it from inside the component (a sticky\n * element has no way to opt out of its scroll container, and a rule the SDK\n * ships in its reset loses to the app's own stylesheet, which is imported\n * after), but it can name the cause in one console line.\n *\n * `clip` is the fix because it clamps the same horizontal overflow without\n * creating a scroll container. It has to be on `html` **and** `body` — with it\n * on only one of them the document still panned to `x: 500` in the same\n * measurement.\n */\nconst MESSAGE =\n    \"[tempest-react-sdk] <AppBar sticky /> will not stick: `document.body` has \" +\n    \"`overflow-x: hidden`, which forces its computed `overflow-y` to `auto` and makes the \" +\n    \"body a scroll container. The bar then pins to the body's scrollport instead of the \" +\n    \"viewport and scrolls off the top with the content — most visibly on Chrome Android. \" +\n    \"Fix: `html, body { overflow-x: clip }`, on both elements, since neither clamps alone. \" +\n    \"Pass `sticky={false}` if the bar is meant to scroll away.\";\n\n/** Set once the warning has been printed, so re-renders do not bury the console. */\nlet warned = false;\n\n/**\n * Reset the warn-once latch. Test-only — the latch is module state, and a suite\n * that renders more than one bar would otherwise see the warning only once.\n */\nexport function resetStickyBodyWarning(): void {\n    warned = false;\n}\n\n/**\n * Warn once, in development, when the page's own CSS will keep a sticky bar\n * from sticking.\n *\n * Reads the body's `overflow-x` rather than walking the ancestors, because that\n * single declaration is the whole failure mode: an app that genuinely wants the\n * body to scroll writes `overflow-y: auto` itself, and a sticky bar inside a\n * scroll container the app chose on purpose behaves exactly as intended. What\n * is never intentional is acquiring that scroll container as a side effect of\n * clamping the other axis.\n *\n * @param enabled - Whether the bar is actually sticky. A bar rendered with\n *   `sticky={false}` has nothing to lose and stays quiet.\n */\nexport function useStickyBodyWarning(enabled: boolean): void {\n    useEffect(() => {\n        if (!enabled || warned || !isDevBuild()) return;\n        if (typeof document === \"undefined\" || !document.body) return;\n        if (getComputedStyle(document.body).overflowX !== \"hidden\") return;\n        warned = true;\n        console.warn(MESSAGE);\n    }, [enabled]);\n}\n"],"mappings":";;;AAgCA,IAAM,IACF,ydAQA,IAAS;AAwBb,SAAgB,EAAqB,GAAwB;CACzD,QAAgB;EACR,CAAC,KAAW,KAAU,CAAC,EAAW,KAClC,OAAO,WAAa,OAAe,CAAC,SAAS,QAC7C,iBAAiB,SAAS,IAAI,CAAC,CAAC,cAAc,aAClD,IAAS,IACT,QAAQ,KAAK,CAAO;CACxB,GAAG,CAAC,CAAO,CAAC;AAChB"}

package/dist/components/BarList/BarList.cjs

@@ -1,2 +1,2 @@
-const e=require("../../utils/cn.cjs"),t=require("./bar-list-model.cjs"),n=require("./BarList.module.cjs");let r=require("react/jsx-runtime");function i({items:i,valueFormatter:a,showPercentage:o=!1,sort:s=`desc`,max:c,otherLabel:l,className:u,...d}){let f=t.buildBarListRows(i,s,c,l);return(0,r.jsx)(`ul`,{className:e.cn(n.default.list,u),...d,children:f.map(e=>(0,r.jsxs)(`li`,{className:n.default.item,children:[(0,r.jsxs)(`div`,{className:n.default.line,children:[(0,r.jsx)(`span`,{className:n.default.label,children:e.label}),(0,r.jsxs)(`span`,{className:n.default.value,children:[a?a(e.value):e.value,o&&(0,r.jsxs)(`span`,{className:n.default.percentage,children:[Math.round(e.percentage),`%`]})]})]}),(0,r.jsx)(`div`,{className:n.default.track,"aria-hidden":`true`,children:(0,r.jsx)(`div`,{className:n.default.fill,style:{width:`${e.width}%`,backgroundColor:e.color??`var(--tempest-chart-${e.index%8+1})`}})})]},`${e.label}-${e.index}`))})}exports.BarList=i;
+const e=require("../../utils/cn.cjs"),t=require("../../charts/use-chart-colors.cjs"),n=require("./bar-list-model.cjs"),r=require("./BarList.module.cjs");let i=require("react"),a=require("react/jsx-runtime");function o({items:o,valueFormatter:s,showPercentage:c=!1,sort:l=`desc`,max:u,otherLabel:d,className:f,...p}){let m=(0,i.useMemo)(()=>n.buildBarListRows(o,l,u,d),[o,l,u,d]),h=t.useChartColors();return(0,a.jsx)(`ul`,{className:e.cn(r.default.list,f),...p,children:m.map(e=>(0,a.jsxs)(`li`,{className:r.default.item,children:[(0,a.jsxs)(`div`,{className:r.default.line,children:[(0,a.jsx)(`span`,{className:r.default.label,children:e.label}),(0,a.jsxs)(`span`,{className:r.default.value,children:[s?s(e.value):e.value,c&&(0,a.jsxs)(`span`,{className:r.default.percentage,children:[Math.round(e.percentage),`%`]})]})]}),(0,a.jsx)(`div`,{className:r.default.track,"aria-hidden":`true`,children:(0,a.jsx)(`div`,{className:r.default.fill,style:{width:`${e.width}%`,backgroundColor:e.color??h[e.index%h.length]}})})]},`${e.label}-${e.index}`))})}exports.BarList=o;
 //# sourceMappingURL=BarList.cjs.map

package/dist/components/BarList/BarList.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"BarList.cjs","names":[],"sources":["../../../src/components/BarList/BarList.tsx"],"sourcesContent":["import type { HTMLAttributes } from \"react\";\n\nimport { cn } from \"@/utils/cn\";\n\nimport { buildBarListRows, type BarListItem, type BarListSort } from \"./bar-list-model\";\nimport styles from \"./BarList.module.css\";\n\nexport type { BarListItem, BarListSort } from \"./bar-list-model\";\n\nexport interface BarListProps extends Omit<HTMLAttributes<HTMLUListElement>, \"children\"> {\n    /** The rows. Entries whose value is not finite are dropped. */\n    items: readonly BarListItem[];\n    /** Render the number. Defaults to the value as-is. */\n    valueFormatter?: (value: number) => string;\n    /** Show each row's share of the total next to its value. Default `false`. */\n    showPercentage?: boolean;\n    /** Ordering. Default `\"desc\"`, which is what a ranking means. */\n    sort?: BarListSort;\n    /** Keep at most this many rows. */\n    max?: number;\n    /**\n     * Label for one aggregated row holding everything `max` cut off.\n     *\n     * Without it, `max` simply truncates. The aggregate row only appears when more\n     * than one row was cut — collapsing a single row into \"others\" hides its name\n     * for nothing.\n     */\n    otherLabel?: string;\n}\n\n/**\n * A ranked distribution: label, proportional bar, value, optional share.\n *\n * The most common chart on an admin panel, and the one the SDK kept sending\n * people to write by hand — `Progress` is a single bar and `Sparkline` is a time\n * series, so a \"users per plan\" block ended up reimplemented per screen, each\n * with its own CSS and its own `.sort()`.\n *\n * It is a **list**, not a picture: `<ul>` / `<li>` with the value written as\n * text, the bar `aria-hidden` behind it. A screen reader reads \"Free, 128, 62%\"\n * because that text is there, not because an `aria-label` restates a drawing.\n * Which is also why the label never sits on top of the bar — text over a tinted\n * fill has to be re-verified against that fill, and the SDK has been caught by\n * that twice.\n *\n * Bar width is relative to the **largest** row, so the biggest bar fills the\n * track; the percentage is the row's share of the **total**. They are different\n * numbers on purpose: a width scaled by the total leaves every bar short in a\n * long list, which is when the chart is needed most.\n *\n * @example\n * <BarList\n *     items={[{ label: \"Free\", value: 128 }, { label: \"Pro\", value: 32 }]}\n *     valueFormatter={(n) => `${n} ativos`}\n *     showPercentage\n *     max={5}\n *     otherLabel=\"Outros\"\n * />\n *\n * @param props - Items plus presentation.\n * @returns The list.\n */\nexport function BarList({\n    items,\n    valueFormatter,\n    showPercentage = false,\n    sort = \"desc\",\n    max,\n    otherLabel,\n    className,\n    ...rest\n}: BarListProps) {\n    const rows = buildBarListRows(items, sort, max, otherLabel);\n\n    return (\n        <ul className={cn(styles.list, className)} {...rest}>\n            {rows.map((row) => (\n                <li key={`${row.label}-${row.index}`} className={styles.item}>\n                    <div className={styles.line}>\n                        <span className={styles.label}>{row.label}</span>\n                        <span className={styles.value}>\n                            {valueFormatter ? valueFormatter(row.value) : row.value}\n                            {showPercentage && (\n                                <span className={styles.percentage}>\n                                    {Math.round(row.percentage)}%\n                                </span>\n                            )}\n                        </span>\n                    </div>\n                    <div className={styles.track} aria-hidden=\"true\">\n                        <div\n                            className={styles.fill}\n                            style={{\n                                width: `${row.width}%`,\n                                backgroundColor:\n                                    row.color ?? `var(--tempest-chart-${(row.index % 8) + 1})`,\n                            }}\n                        />\n                    </div>\n                </li>\n            ))}\n        </ul>\n    );\n}\n"],"mappings":"6IA8DA,SAAgB,EAAQ,CACpB,QACA,iBACA,iBAAiB,GACjB,OAAO,OACP,MACA,aACA,YACA,GAAG,GACU,CACb,IAAM,EAAO,EAAA,iBAAiB,EAAO,EAAM,EAAK,CAAU,EAE1D,OACI,EAAA,EAAA,IAAA,CAAC,KAAD,CAAI,UAAW,EAAA,GAAG,EAAA,QAAO,KAAM,CAAS,EAAG,GAAI,EAC1C,SAAA,EAAK,IAAK,IACP,EAAA,EAAA,KAAA,CAAC,KAAD,CAAsC,UAAW,EAAA,QAAO,KAAxD,SAAA,EACI,EAAA,EAAA,KAAA,CAAC,MAAD,CAAK,UAAW,EAAA,QAAO,KAAvB,SAAA,EACI,EAAA,EAAA,IAAA,CAAC,OAAD,CAAM,UAAW,EAAA,QAAO,MAAQ,SAAA,EAAI,KAAY,CAAA,GAChD,EAAA,EAAA,KAAA,CAAC,OAAD,CAAM,UAAW,EAAA,QAAO,MAAxB,SAAA,CACK,EAAiB,EAAe,EAAI,KAAK,EAAI,EAAI,MACjD,IACG,EAAA,EAAA,KAAA,CAAC,OAAD,CAAM,UAAW,EAAA,QAAO,WAAxB,SAAA,CACK,KAAK,MAAM,EAAI,UAAU,EAAE,GAC1B,CAER,CAAA,CAAA,CACL,CAAA,CAAA,CACL,CAAA,GAAA,EAAA,EAAA,IAAA,CAAC,MAAD,CAAK,UAAW,EAAA,QAAO,MAAO,cAAY,OACtC,UAAA,EAAA,EAAA,IAAA,CAAC,MAAD,CACI,UAAW,EAAA,QAAO,KAClB,MAAO,CACH,MAAO,GAAG,EAAI,MAAM,GACpB,gBACI,EAAI,OAAS,uBAAwB,EAAI,MAAQ,EAAK,EAAE,EAChE,CACH,CAAA,CACA,CAAA,CACL,CAtBK,EAAA,GAAG,EAAI,MAAM,GAAG,EAAI,OAsBzB,CACP,CACD,CAAA,CAEZ"}
+{"version":3,"file":"BarList.cjs","names":[],"sources":["../../../src/components/BarList/BarList.tsx"],"sourcesContent":["import { useMemo, type HTMLAttributes } from \"react\";\n\nimport { useChartColors } from \"@/charts/use-chart-colors\";\nimport { cn } from \"@/utils/cn\";\n\nimport { buildBarListRows, type BarListItem, type BarListSort } from \"./bar-list-model\";\nimport styles from \"./BarList.module.css\";\n\nexport type { BarListItem, BarListSort } from \"./bar-list-model\";\n\nexport interface BarListProps extends Omit<HTMLAttributes<HTMLUListElement>, \"children\"> {\n    /** The rows. Entries whose value is not finite are dropped. */\n    items: readonly BarListItem[];\n    /** Render the number. Defaults to the value as-is. */\n    valueFormatter?: (value: number) => string;\n    /** Show each row's share of the total next to its value. Default `false`. */\n    showPercentage?: boolean;\n    /** Ordering. Default `\"desc\"`, which is what a ranking means. */\n    sort?: BarListSort;\n    /** Keep at most this many rows. */\n    max?: number;\n    /**\n     * Label for one aggregated row holding everything `max` cut off.\n     *\n     * Without it, `max` simply truncates. The aggregate row only appears when more\n     * than one row was cut — collapsing a single row into \"others\" hides its name\n     * for nothing.\n     */\n    otherLabel?: string;\n}\n\n/**\n * A ranked distribution: label, proportional bar, value, optional share.\n *\n * The most common chart on an admin panel, and the one the SDK kept sending\n * people to write by hand — `Progress` is a single bar and `Sparkline` is a time\n * series, so a \"users per plan\" block ended up reimplemented per screen, each\n * with its own CSS and its own `.sort()`.\n *\n * It is a **list**, not a picture: `<ul>` / `<li>` with the value written as\n * text, the bar `aria-hidden` behind it. A screen reader reads \"Free, 128, 62%\"\n * because that text is there, not because an `aria-label` restates a drawing.\n * Which is also why the label never sits on top of the bar — text over a tinted\n * fill has to be re-verified against that fill, and the SDK has been caught by\n * that twice.\n *\n * Bar width is relative to the **largest** row, so the biggest bar fills the\n * track; the percentage is the row's share of the **total**. They are different\n * numbers on purpose: a width scaled by the total leaves every bar short in a\n * long list, which is when the chart is needed most.\n *\n * Colors come from {@link useChartColors}, the same resolver every chart in the\n * SDK uses, so a theme that declares fewer series than the eight\n * `--tempest-chart-*` slots cycles within its own palette. Reading the tokens\n * through CSS `var()` could not do that: the count lives in\n * `--tempest-chart-count`, which CSS cannot use as a modulus, so a six-color\n * brand palette got the SDK's leftover defaults in rows seven and eight — the\n * exact regression that token exists to prevent. `palette.ts` imports nothing,\n * so this pulls no chart library into the slice.\n *\n * @example\n * <BarList\n *     items={[{ label: \"Free\", value: 128 }, { label: \"Pro\", value: 32 }]}\n *     valueFormatter={(n) => `${n} ativos`}\n *     showPercentage\n *     max={5}\n *     otherLabel=\"Outros\"\n * />\n *\n * @param props - Items plus presentation.\n * @returns The list.\n */\nexport function BarList({\n    items,\n    valueFormatter,\n    showPercentage = false,\n    sort = \"desc\",\n    max,\n    otherLabel,\n    className,\n    ...rest\n}: BarListProps) {\n    const rows = useMemo(\n        () => buildBarListRows(items, sort, max, otherLabel),\n        [items, sort, max, otherLabel],\n    );\n    const palette = useChartColors();\n\n    return (\n        <ul className={cn(styles.list, className)} {...rest}>\n            {rows.map((row) => (\n                <li key={`${row.label}-${row.index}`} className={styles.item}>\n                    <div className={styles.line}>\n                        <span className={styles.label}>{row.label}</span>\n                        <span className={styles.value}>\n                            {valueFormatter ? valueFormatter(row.value) : row.value}\n                            {showPercentage && (\n                                <span className={styles.percentage}>\n                                    {Math.round(row.percentage)}%\n                                </span>\n                            )}\n                        </span>\n                    </div>\n                    <div className={styles.track} aria-hidden=\"true\">\n                        <div\n                            className={styles.fill}\n                            style={{\n                                width: `${row.width}%`,\n                                backgroundColor: row.color ?? palette[row.index % palette.length],\n                            }}\n                        />\n                    </div>\n                </li>\n            ))}\n        </ul>\n    );\n}\n"],"mappings":"+MAwEA,SAAgB,EAAQ,CACpB,QACA,iBACA,iBAAiB,GACjB,OAAO,OACP,MACA,aACA,YACA,GAAG,GACU,CACb,IAAM,GAAA,EAAO,EAAA,QAAA,KACH,EAAA,iBAAiB,EAAO,EAAM,EAAK,CAAU,EACnD,CAAC,EAAO,EAAM,EAAK,CAAU,CACjC,EACM,EAAU,EAAA,eAAe,EAE/B,OACI,EAAA,EAAA,IAAA,CAAC,KAAD,CAAI,UAAW,EAAA,GAAG,EAAA,QAAO,KAAM,CAAS,EAAG,GAAI,EAC1C,SAAA,EAAK,IAAK,IACP,EAAA,EAAA,KAAA,CAAC,KAAD,CAAsC,UAAW,EAAA,QAAO,KAAxD,SAAA,EACI,EAAA,EAAA,KAAA,CAAC,MAAD,CAAK,UAAW,EAAA,QAAO,KAAvB,SAAA,EACI,EAAA,EAAA,IAAA,CAAC,OAAD,CAAM,UAAW,EAAA,QAAO,MAAQ,SAAA,EAAI,KAAY,CAAA,GAChD,EAAA,EAAA,KAAA,CAAC,OAAD,CAAM,UAAW,EAAA,QAAO,MAAxB,SAAA,CACK,EAAiB,EAAe,EAAI,KAAK,EAAI,EAAI,MACjD,IACG,EAAA,EAAA,KAAA,CAAC,OAAD,CAAM,UAAW,EAAA,QAAO,WAAxB,SAAA,CACK,KAAK,MAAM,EAAI,UAAU,EAAE,GAC1B,CAER,CAAA,CAAA,CACL,CAAA,CAAA,CACL,CAAA,GAAA,EAAA,EAAA,IAAA,CAAC,MAAD,CAAK,UAAW,EAAA,QAAO,MAAO,cAAY,OACtC,UAAA,EAAA,EAAA,IAAA,CAAC,MAAD,CACI,UAAW,EAAA,QAAO,KAClB,MAAO,CACH,MAAO,GAAG,EAAI,MAAM,GACpB,gBAAiB,EAAI,OAAS,EAAQ,EAAI,MAAQ,EAAQ,OAC9D,CACH,CAAA,CACA,CAAA,CACL,CArBK,EAAA,GAAG,EAAI,MAAM,GAAG,EAAI,OAqBzB,CACP,CACD,CAAA,CAEZ"}