tempest-react-sdk 0.78.0 → 0.79.0

package/dist/auth/create-tempest-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"create-tempest-auth.js","names":[],"sources":["../../src/auth/create-tempest-auth.ts"],"sourcesContent":["import { createApiClient, SessionSupersededError } from \"../http\";\nimport { isDevBuild } from \"../utils/dev-mode\";\nimport type { ApiClient, CsrfOptions, RequestAuthContext, RetryOptions } from \"../http\";\nimport { createAuthStore } from \"./create-auth-store\";\nimport type { AuthState } from \"./create-auth-store\";\nimport { createRefreshQueue } from \"./refresh-queue\";\n\n/** The token envelope returned by a Tempest FastAPI SDK login/refresh route. */\nexport interface TempestTokenResponse {\n    /** The bearer access token. */\n    access_token: string;\n    /** Token type — always `\"bearer\"` for the SDK. */\n    token_type?: string;\n    /** Optional refresh token (when the API returns it in the body, not a cookie). */\n    refresh_token?: string;\n}\n\n/**\n * What {@link CreateTempestAuthOptions.onSessionEnd} receives about the session\n * that just ended.\n */\nexport interface TempestSessionEnd<TUser> {\n    /**\n     * Why it ended: `\"logout\"` for an explicit `logout()`, `\"expired\"` when the\n     * client ended it on its own — the refresh failed, or the request replayed\n     * after a refresh still came back `401` — and `\"switch\"` when `login()`\n     * succeeded for another set of credentials while this session was live.\n     */\n    reason: \"logout\" | \"expired\" | \"switch\";\n    /** The user of the ended session, as the store held it. */\n    user: TUser | null;\n    /** The access token of the ended session, or `null` when it had none. */\n    token: string | null;\n    /**\n     * A client that sends the ended session's access token — the store has\n     * already been cleared, so `auth.api` no longer does.\n     *\n     * Use it for the server-side half of the teardown, such as deleting this\n     * browser's push subscription. It never refreshes and never ends a session:\n     * a `401` here just rejects. On `\"logout\"` the token is usually still\n     * valid; on `\"expired\"` the server has already refused it, so expect the\n     * call to fail and keep the local half of the teardown independent of it.\n     */\n    api: ApiClient;\n}\n\nexport interface CreateTempestAuthOptions<TUser> {\n    /** Base URL of the API. Required. */\n    baseURL: string;\n    /**\n     * Path segment the API is mounted under, such as `\"/api\"`, forwarded to\n     * every client this preset builds — see the `prefix` option of\n     * `createApiClient`.\n     *\n     * Safe to combine with the default paths below: the prefix is applied at\n     * most once, so `\"/api/auth/login\"` under a `\"/api\"` prefix stays\n     * `\"/api/auth/login\"`.\n     */\n    prefix?: string;\n    /** Login route (`POST`). Default: `\"/api/auth/login\"`. */\n    loginPath?: string;\n    /** Refresh route (`POST`). Default: `\"/api/auth/refresh\"`. */\n    refreshPath?: string;\n    /**\n     * Server-side logout route (`POST`), called by an explicit `logout()` to\n     * revoke the ending session. Off by default.\n     *\n     * `logout()` alone only clears client state, and an HttpOnly refresh\n     * cookie is out of its reach: with `withCredentials`, the cookie stays\n     * redeemable until the backend revokes it. The tempest-fastapi-sdk mounts\n     * `POST /auth/logout` (`204`, idempotent) when it stores refresh tokens in\n     * the database — at `/auth/cookie/logout` when it delivers tokens both in\n     * the body and in cookies — and stateless refresh tokens cannot be\n     * revoked, so the route is absent there.\n     *\n     * The request goes out through the ended session's client (the same one\n     * `onSessionEnd` receives, carrying its access token), with the body that\n     * `refreshBody` builds from the refresh token stored before the clear:\n     * `{ refresh_token }` in body mode, no body in cookie mode, which is what\n     * that route reads. The local clear does not wait on it — `isAuthenticated`\n     * is still `false` when `logout()` returns — but the promise `logout()`\n     * returns does, so a navigation after `await auth.logout()` does not abort\n     * it. A failure (network, `4xx`, `5xx`) is swallowed: revocation is\n     * best-effort and never keeps the user signed in. A `login()` started\n     * while it is in flight waits for it, because the logout response clears\n     * the auth cookies and would otherwise clear the new account's.\n     *\n     * Only an explicit `logout()` revokes. On `\"switch\"` the cookie jar already\n     * holds the new account's cookie, and on `\"expired\"` the server has already\n     * refused the session.\n     *\n     * Overlapping sign-outs each send their own revocation, and `login()` waits\n     * for all of them — at most 10 seconds, so one that\n     * never answers delays the sign-in instead of blocking it. In cookie mode,\n     * a revocation also waits (within the same bound) for the login and\n     * refresh responses that were in flight when `logout()` ran: the server\n     * sets the ended session's cookie when that response arrives, and a\n     * revocation sent earlier would leave it behind. In body mode, the refresh\n     * token such a superseded response brings back is revoked on its own.\n     */\n    logoutPath?: string;\n    /**\n     * Called with the error when a `logoutPath` revocation fails — network\n     * failure, `4xx` or `5xx`. `logout()` still resolves, since the local\n     * sign-out already happened; this is where the app logs or retries. A dev\n     * build also warns in the console. Errors it throws are swallowed.\n     */\n    onLogoutError?: (error: unknown) => void;\n    /** Optional current-user route (`GET`) called after login/refresh. */\n    mePath?: string;\n    /** Persist key for the store. Default: `\"tempest-auth\"`. */\n    storeName?: string;\n    /** Storage backend. Default: `\"local\"`. */\n    storage?: \"local\" | \"session\";\n    /** Send cookies (needed when the refresh token lives in an httpOnly cookie). */\n    withCredentials?: boolean;\n    /**\n     * CSRF token for every write, forwarded to `createApiClient`'s `csrf`. Off\n     * by default; `true` echoes the `csrf_token` cookie as `X-CSRF-Token`.\n     *\n     * The pair to `withCredentials`: once the refresh token lives in a cookie,\n     * the browser attaches it to a `POST /auth/refresh` that another site\n     * triggers. Login and refresh carry the header too — they go out with\n     * `skipAuth`, and the CSRF header does not follow auth.\n     */\n    csrf?: boolean | CsrfOptions;\n    /** Custom fetch implementation (testing / SSR). Defaults to `globalThis.fetch`. */\n    fetcher?: typeof fetch;\n    /**\n     * Extract tokens from a login/refresh response. Default reads\n     * `access_token` + `refresh_token`.\n     */\n    parseTokens?: (data: unknown) => { token: string; refreshToken?: string };\n    /** Pull the user out of the login response, when the API embeds it. */\n    parseUser?: (data: unknown) => TUser | null;\n    /**\n     * Build the refresh request body. Default sends `{ refresh_token }` when a\n     * refresh token is stored, else `undefined` (cookie-based refresh).\n     */\n    refreshBody?: (refreshToken: string | null) => unknown;\n    /**\n     * Retry policy for `api`, forwarded to {@link createApiClient}. Off by\n     * default; `true` enables the conservative built-in policy, which never\n     * replays a write.\n     */\n    retry?: boolean | RetryOptions;\n    /**\n     * Where to send the browser when the session ends — a hard navigation via\n     * `window.location.assign`, after the store is cleared.\n     *\n     * **Prefer leaving this unset.** `logout()` already clears the store, so a\n     * `<RouteGuard when={isAuthenticated} redirectTo=\"/login\">` wrapped around\n     * the protected area navigates on its own, which keeps the SPA alive and the\n     * router history intact. Reach for this only when the expiry can happen\n     * outside any guarded subtree and a full reload is acceptable.\n     */\n    redirectTo?: string;\n    /**\n     * Tear down per-user state when a session ends — on an explicit `logout()`,\n     * when the client ends the session on its own after a failed refresh, and\n     * when a successful `login()` replaces a live session. Without it, the automatic path had no place to hook into, and\n     * state derived from the user (a push subscription, a persisted query\n     * cache, a background-sync queue) survived into the next account.\n     *\n     * Order, on every path:\n     *\n     * 1. any refresh still in flight is superseded, so it cannot reinstall the\n     *    ending session's tokens;\n     * 2. the store and the stored refresh token are cleared — synchronously, so\n     *    `isAuthenticated` is already `false` when `logout()` returns;\n     * 3. this hook runs with a {@link TempestSessionEnd} whose `api` still sends\n     *    the ended session's access token;\n     * 4. on `\"expired\"` with `redirectTo` set, the browser navigates — after the\n     *    hook settled, even if it threw; on `\"switch\"`, the new session is\n     *    installed — after the hook settled, even if it threw.\n     *\n     * It may be async. `logout()` resolves when it settles and rejects with what\n     * it threw; on the automatic path the error is swallowed, because the\n     * request that ended the session already rejects with its own `401`. It\n     * runs once per session: a second `logout()`, or the other requests of a\n     * burst of `401`s, find nothing left to end and skip it.\n     *\n     * On `\"switch\"` the hook runs only **after** the new credentials were\n     * accepted, so a failed `login()` leaves the live session untouched. It runs\n     * **before** the new session is installed: teardown of the previous\n     * account's state (clearing a persisted cache, a background-sync queue) has\n     * to finish before the new account's requests start filling them, or it\n     * would wipe — or race with — the new account's data. The cost is that\n     * `isAuthenticated` is `false` while the hook runs, which a route guard may\n     * act on; keep the hook short. Its error is swallowed there, since the\n     * login itself succeeded.\n     *\n     * Inside the hook, reach the backend only through `session.api`. `auth.api`\n     * goes out with no token; `auth.login()` waits on the teardown in progress —\n     * this hook — and never settles. Telling the hook apart from an outside\n     * caller would need an async context the browser does not have, so this is\n     * a documented rule, not a runtime check.\n     */\n    onSessionEnd?: (session: TempestSessionEnd<TUser>) => void | Promise<void>;\n}\n\nexport interface TempestAuth<TUser, TCredentials> {\n    /** The persisted Zustand auth store hook (compatible with `<AuthGuard>`). */\n    useAuthStore: ReturnType<typeof createAuthStore<TUser>>;\n    /** A `createApiClient` wired with bearer auth + 401 → refresh → retry. */\n    api: ApiClient;\n    /** Authenticate, store the session, and resolve the user (or null). */\n    login: (credentials: TCredentials) => Promise<TUser | null>;\n    /**\n     * End the session: supersede any refresh in flight, clear the store and the\n     * stored refresh token, then run `onSessionEnd`.\n     *\n     * The store is cleared synchronously, before the first `await`, so callers\n     * that ignore the promise see the signed-out state at once. The promise\n     * resolves when `onSessionEnd` settled — and, with `logoutPath`, when the\n     * server-side revocation settled too — and rejects with the hook's error;\n     * a failed revocation never rejects it.\n     */\n    logout: () => Promise<void>;\n    /**\n     * Refresh the access token (deduplicated across concurrent callers).\n     *\n     * @throws {SessionSupersededError} When the session ended or changed while\n     *   the refresh was in flight; its tokens were discarded.\n     */\n    refresh: () => Promise<void>;\n    /** The current access token, or null. */\n    getToken: () => string | null;\n}\n\n/**\n * How long `login()` waits for pending `logoutPath` revocations, and how long a\n * cookie-mode revocation waits for the login or refresh responses still in\n * flight when `logout()` ran, before going ahead anyway.\n *\n * A bound, not a guess at latency: a fetcher that ignores abort, or a backend\n * that never answers, would otherwise leave the next `login()` waiting forever.\n * Ten seconds is past any healthy round trip and short enough that a stuck\n * revocation costs a slow sign-in, not a dead one.\n */\nconst LOGOUT_REVOCATION_WAIT_MS = 10_000;\n\n/**\n * Wait until every promise settled, or until `ms` passed, whichever is first.\n *\n * @param pending - What to wait for; rejections count as settled.\n * @param ms - The bound.\n * @returns A promise that always resolves.\n */\nfunction settleWithin(pending: readonly Promise<unknown>[], ms: number): Promise<void> {\n    if (pending.length === 0) return Promise.resolve();\n    return new Promise<void>((resolve) => {\n        const timer = setTimeout(resolve, ms);\n        void Promise.allSettled(pending).then(() => {\n            clearTimeout(timer);\n            resolve();\n        });\n    });\n}\n\nfunction defaultParseTokens(data: unknown): { token: string; refreshToken?: string } {\n    const d = (data ?? {}) as TempestTokenResponse;\n    return { token: d.access_token, refreshToken: d.refresh_token };\n}\n\n/**\n * Turn-key auth preset wiring `createAuthStore` + `createRefreshQueue` +\n * `createApiClient` to the Tempest FastAPI SDK auth contract: login returns\n * `{ access_token, token_type }`, requests carry `Authorization: Bearer`, and a\n * `401` triggers a single deduplicated refresh + replay.\n *\n * The session is cleared whenever that path ends unauthorized anyway — the\n * refresh threw, or the replay came back `401` — so a refresh token that the\n * backend has revoked cannot leave the app holding a dead session. With\n * `redirectTo` set, the browser also leaves the page; without it, clearing the\n * store is enough for a `<RouteGuard>` to navigate on its own.\n *\n * Every refresh is bound to a **session epoch**, bumped by `logout()` and by a\n * `login()` whose credentials were accepted. A refresh that resolves after its epoch ended discards\n * what it brought back and rejects with {@link SessionSupersededError}, which\n * the client passes through without ending the new session. Before 0.77.0 a\n * refresh that was in flight during `logout()` reinstalled the old tokens —\n * and after `logout()` + `login(B)`, replaced B's token with A's while the UI\n * showed B (#435). A `401` from a request sent under an ended session is\n * refused the same way, instead of being replayed as the account signed in now.\n *\n * A `401` from a request that carried no token, while no session is installed,\n * surfaces without a refresh: in cookie mode that refresh would be answered by\n * the HttpOnly cookie `logout()` cannot clear, signing the previous account\n * back in (#474). With a `login()` in flight, that `401` waits for it and\n * replays with the token it installed, or surfaces when it failed — still\n * without a refresh (#496). Restore a session at boot with an explicit\n * `refresh()`, and pass `logoutPath` so the backend revokes the cookie:\n * without a working revocation, that boot `refresh()` restores the previous\n * account for whoever uses the browser next.\n *\n * Refreshes are collapsed per rotation, not just per overlap: a `401` whose\n * request left with a token that has since been replaced in the same session\n * replays with the new token and refreshes nothing. Three expired requests take\n * one refresh whether their `401`s arrive together or one after another.\n *\n * @example\n * const auth = createTempestAuth<User, { email: string; password: string }>({\n *     baseURL: import.meta.env.VITE_API_URL,\n *     mePath: \"/api/auth/me\",\n * });\n *\n * await auth.login({ email, password });   // stores session, returns the user\n * const orders = await auth.api.get(\"/api/orders\");  // sends the bearer token\n * await auth.logout();                      // clears, then runs onSessionEnd\n *\n * @param options - The auth configuration.\n * @returns The store hook, a wired API client, and login/logout/refresh helpers.\n */\nexport function createTempestAuth<TUser, TCredentials = { email: string; password: string }>(\n    options: CreateTempestAuthOptions<TUser>,\n): TempestAuth<TUser, TCredentials> {\n    const {\n        baseURL,\n        prefix,\n        loginPath = \"/api/auth/login\",\n        refreshPath = \"/api/auth/refresh\",\n        logoutPath,\n        onLogoutError,\n        mePath,\n        storeName = \"tempest-auth\",\n        storage = \"local\",\n        withCredentials = false,\n        csrf,\n        fetcher,\n        parseTokens = defaultParseTokens,\n        parseUser,\n        refreshBody = (rt) => (rt ? { refresh_token: rt } : undefined),\n        retry,\n        redirectTo,\n        onSessionEnd,\n    } = options;\n\n    const useAuthStore = createAuthStore<TUser>({ name: storeName, storage });\n    const refreshKey = `${storeName}-refresh`;\n\n    function storageImpl(): Storage | null {\n        if (typeof window === \"undefined\") return null;\n        return storage === \"session\" ? window.sessionStorage : window.localStorage;\n    }\n    function readRefreshToken(): string | null {\n        return storageImpl()?.getItem(refreshKey) ?? null;\n    }\n    function writeRefreshToken(token: string | null): void {\n        const s = storageImpl();\n        if (!s) return;\n        if (token) s.setItem(refreshKey, token);\n        else s.removeItem(refreshKey);\n    }\n\n    const state = (): AuthState<TUser> => useAuthStore.getState();\n    const getToken = (): string | null => state().token;\n\n    /**\n     * Load the current user, without letting a `401` end the session.\n     *\n     * `skipAuthRetry` is what keeps this one client honest: the call is\n     * authenticated, but a `401` here surfaces instead of triggering a refresh\n     * and `onUnauthorized`. That was the behaviour of the throwaway client this\n     * used to build per invocation, and it is the reason the preset needed\n     * three clients before 0.66.0.\n     *\n     * Bound to the epoch current when the request leaves, like `rotate()`: a\n     * profile that resolves after `logout()` — or after `logout()` +\n     * `login(B)` — is discarded instead of written next to B's token, and the\n     * `login()` that asked for it rejects as superseded (#473).\n     *\n     * @throws {SessionSupersededError} When the epoch changed while the\n     *   request was in flight, on success and on failure alike.\n     */\n    async function fetchUser(): Promise<TUser | null> {\n        if (!mePath) return state().user;\n        const started = epoch;\n        let user: TUser;\n        try {\n            user = await api.get<TUser>(mePath, { skipAuthRetry: true });\n        } catch (error) {\n            if (epoch !== started) throw new SessionSupersededError();\n            throw error;\n        }\n        if (epoch !== started) throw new SessionSupersededError();\n        state().setUser(user);\n        return user;\n    }\n\n    let epoch = 0;\n    let ending: Promise<void> = Promise.resolve();\n    let hooksRunning = 0;\n    const loginsInFlight = new Set<Promise<unknown>>();\n    const revocations = new Set<Promise<void>>();\n    const credentialRequests = new Set<Promise<unknown>>();\n    const rotatingEpochs = new Set<number>();\n\n    /**\n     * Track a login or refresh request until it settles, so a cookie-mode\n     * revocation can wait for the response that sets the cookie it revokes.\n     *\n     * @param request - The request in flight.\n     * @returns The same request.\n     */\n    function trackCredentialRequest<T>(request: Promise<T>): Promise<T> {\n        const settled = request.then(\n            () => undefined,\n            () => undefined,\n        );\n        credentialRequests.add(settled);\n        void settled.then(() => credentialRequests.delete(settled));\n        return request;\n    }\n\n    /**\n     * Surface a failed revocation: `onLogoutError`, plus a console warning in a\n     * dev build.\n     *\n     * @param error - What the revocation rejected with.\n     */\n    function reportLogoutError(error: unknown): void {\n        if (isDevBuild()) {\n            console.warn(\n                \"[tempest-react-sdk] createTempestAuth: logoutPath revocation failed\",\n                error,\n            );\n        }\n        try {\n            onLogoutError?.(error);\n        } catch {\n            return;\n        }\n    }\n\n    /**\n     * Send one `logoutPath` revocation and track it until it settles. Never\n     * rejects.\n     *\n     * @param build - Produces the request, after whatever wait it needs.\n     * @returns A promise settling when the revocation settled.\n     */\n    function trackRevocation(build: () => Promise<unknown>): Promise<void> {\n        const tracked = (async () => {\n            try {\n                await build();\n            } catch (error) {\n                reportLogoutError(error);\n            }\n        })();\n        revocations.add(tracked);\n        void tracked.then(() => revocations.delete(tracked));\n        return tracked;\n    }\n\n    /**\n     * Revoke, in body mode, the refresh token a superseded login or refresh\n     * brought back. Nobody can use it — the client discarded it — but it would\n     * stay valid on the server until it expires.\n     *\n     * Cookie mode is left to `revoke()`, which waits for these responses\n     * instead: re-sending a cookie revocation here could carry whichever\n     * account's cookie the browser holds by then.\n     *\n     * @param token - The superseded response's access token.\n     * @param refreshToken - The superseded response's refresh token.\n     */\n    function revokeDiscarded(token: string | null, refreshToken: string | undefined): void {\n        if (!logoutPath || withCredentials || !refreshToken) return;\n        void trackRevocation(() =>\n            endedSessionApi(token).post<unknown>(logoutPath, {\n                body: refreshBody(refreshToken),\n            }),\n        );\n    }\n\n    /**\n     * A client that sends an ended session's access token, and never refreshes\n     * or ends a session: a `401` there just rejects.\n     *\n     * @param token - The ended session's access token.\n     * @returns The client `onSessionEnd` and the `logoutPath` call go through.\n     */\n    function endedSessionApi(token: string | null): ApiClient {\n        return createApiClient({\n            baseURL,\n            prefix,\n            withCredentials,\n            csrf,\n            fetcher,\n            getToken: () => token,\n        });\n    }\n\n    /**\n     * Start a new session epoch: supersede the refresh in flight and give the\n     * new epoch a refresh queue of its own, so a `401` under the new session\n     * never joins the old session's refresh.\n     *\n     * The client reads the epoch when each attempt leaves (`getSessionEpoch`),\n     * which is what ties a `401` to the session that sent it — no set of\n     * tokens to keep, and nothing that grows with the session's length.\n     */\n    function nextEpoch(): void {\n        epoch += 1;\n        queue = createRefreshQueue(rotate);\n    }\n\n    /**\n     * Perform one refresh for the epoch that is current when it starts.\n     *\n     * Checked again after the round trip, on success and on failure alike: a\n     * refresh that fails after `logout()` + `login(B)` must not reach\n     * `onUnauthorized` either, or it would end B's session.\n     *\n     * @throws {SessionSupersededError} When the epoch changed during the call.\n     */\n    async function rotate(): Promise<void> {\n        const started = epoch;\n        rotatingEpochs.add(started);\n        try {\n            let data: unknown;\n            try {\n                data = await trackCredentialRequest(\n                    api.post<unknown>(refreshPath, {\n                        body: refreshBody(readRefreshToken()),\n                        skipAuth: true,\n                    }),\n                );\n            } catch (error) {\n                if (epoch !== started) throw new SessionSupersededError();\n                throw error;\n            }\n            const { token, refreshToken } = parseTokens(data);\n            if (epoch !== started) {\n                revokeDiscarded(token ?? null, refreshToken);\n                throw new SessionSupersededError();\n            }\n            state().setToken(token);\n            if (refreshToken) writeRefreshToken(refreshToken);\n        } finally {\n            rotatingEpochs.delete(started);\n        }\n    }\n\n    let queue = createRefreshQueue(rotate);\n\n    /**\n     * Whether a `401` must be left alone: no refresh, no ending the session.\n     *\n     * Two cases, both of the current epoch: an attempt that carried no token\n     * while a session is now installed (it left before the sign-in, and\n     * refreshing or ending the new session for it would punish the wrong\n     * session); and an attempt whose token the session has since rotated past\n     * (the rotation it would trigger already happened).\n     *\n     * @param context - The attempt's credential.\n     * @returns Whether the attempt is stale within the current session.\n     */\n    function staleWithinSession(context: RequestAuthContext): boolean {\n        const current = getToken();\n        if (current === null) return false;\n        return context.token === null || context.token !== current;\n    }\n\n    /**\n     * Whether nothing could make a tokenless `401` worth a refresh: no access\n     * token and no stored refresh token.\n     *\n     * With `withCredentials`, the refresh would otherwise be answered by an\n     * HttpOnly cookie the client cannot see or clear — after `logout()`, that\n     * signed the previous account back in for whoever used the browser next\n     * (#474). A `login()` in flight does not count as a session either: the\n     * cookie a refresh would present during it is still the ended account's\n     * (#496). Restoring a session from the cookie is an explicit `refresh()`,\n     * typically at boot, which this does not touch.\n     *\n     * @returns Whether no session is installed.\n     */\n    function signedOut(): boolean {\n        return getToken() === null && readRefreshToken() === null;\n    }\n\n    /**\n     * Settle a tokenless `401` that arrived with no session installed while a\n     * `login()` is in flight: wait for every login in flight, then let the\n     * request replay when one of them installed a token.\n     *\n     * No refresh is sent. In cookie mode one would present whatever cookie\n     * the browser holds — after `logout()` without a working `logoutPath`,\n     * the previous account's: a failed login then left the client signed in\n     * as that account, and a successful one could have its cookie overwritten\n     * by the refresh's late `Set-Cookie` (#496).\n     *\n     * Skipped while an `onSessionEnd` hook runs: an account switch waits on\n     * that hook, so a hook awaiting `auth.api` would wait on itself.\n     *\n     * @throws {Error} When no login is in flight, a hook is running, or every\n     *   login settled without installing a token — the `401` surfaces as is.\n     */\n    async function awaitLogins(): Promise<void> {\n        if (loginsInFlight.size > 0 && hooksRunning === 0) {\n            await Promise.allSettled([...loginsInFlight]);\n            if (getToken() !== null) return;\n        }\n        throw new Error(\"anonymous 401 with no session\");\n    }\n\n    /**\n     * The `refresh` the client calls on a `401`.\n     *\n     * - An attempt from an ended epoch is refused rather than replayed as\n     *   whoever is signed in now.\n     * - A token this session already rotated past: the replay just picks up the\n     *   new one — no second refresh.\n     * - No token, while a session is now installed: the `401` surfaces as is.\n     * - No token, and no session installed: joins this epoch's refresh when\n     *   one is already in flight — the boot `refresh()` restoring a session\n     *   from the cookie, which the request then replays under; otherwise waits\n     *   for a `login()` in flight and replays with its token, see\n     *   `awaitLogins`; otherwise surfaces the `401` as is, see `signedOut`.\n     * - Otherwise: join or start this epoch's refresh.\n     *\n     * @param context - The credential and epoch the rejected attempt left with.\n     * @throws {SessionSupersededError} When the attempt belongs to an ended\n     *   session, or the session changed during the refresh.\n     */\n    async function refreshFor(context: RequestAuthContext): Promise<void> {\n        if (context.epoch !== null && context.epoch !== epoch) throw new SessionSupersededError();\n        if (staleWithinSession(context)) {\n            if (context.token === null) throw new Error(\"anonymous 401 under a live session\");\n            return;\n        }\n        if (context.token === null && signedOut()) {\n            if (rotatingEpochs.has(epoch)) return queue();\n            return awaitLogins();\n        }\n        return queue();\n    }\n\n    /**\n     * The client's `onUnauthorized`: end the session only when the `401` is the\n     * current session's own.\n     *\n     * The replay after a refresh is checked here too — it can come back `401`\n     * after the user signed out and another account signed in, and ending the\n     * session then would sign the new account out. A tokenless `401` with no\n     * session installed ends nothing either: there is no session to end, and\n     * ending \"nothing\" used to move the epoch and supersede the boot\n     * `refresh()` in flight.\n     *\n     * @param context - The credential and epoch of the attempt that failed.\n     * @throws {SessionSupersededError} When that attempt belongs to an ended\n     *   session.\n     */\n    async function onUnauthorized(_response: Response, context: RequestAuthContext): Promise<void> {\n        if (context.epoch !== null && context.epoch !== epoch) throw new SessionSupersededError();\n        if (staleWithinSession(context)) return;\n        if (context.token === null && signedOut()) return;\n        await endSession();\n    }\n\n    /**\n     * Authenticate and install the new session.\n     *\n     * The previous session ends only once the new credentials are accepted: a\n     * login that fails leaves it, and the refresh it may have in flight,\n     * untouched. When one was live, `onSessionEnd` runs with `\"switch\"` before\n     * the new tokens are installed — see the option for why that order. A\n     * `logout()` still tearing down is awaited the same way, so the new\n     * account's state never starts before the previous one's teardown ended.\n     * Never call it from inside `onSessionEnd`: it would wait on that hook.\n     * Every `logoutPath` revocation still in flight is awaited before the\n     * request leaves — at most {@link LOGOUT_REVOCATION_WAIT_MS} — so a\n     * cookie-clearing response cannot land after the new account's cookies.\n     *\n     * @param credentials - Sent as the login body.\n     * @returns The user of the new session, or null.\n     * @throws {SessionSupersededError} When a `logout()` or another `login()`\n     *   moved the session while this one was in flight — during its request,\n     *   during the teardown or while `mePath` was loading the user; the new\n     *   tokens, or the user, are discarded.\n     */\n    async function login(credentials: TCredentials): Promise<TUser | null> {\n        if (revocations.size > 0) await settleWithin([...revocations], LOGOUT_REVOCATION_WAIT_MS);\n        const run = signIn(credentials);\n        loginsInFlight.add(run);\n        try {\n            return await run;\n        } finally {\n            loginsInFlight.delete(run);\n        }\n    }\n\n    /**\n     * The body of `login()`, tracked in `loginsInFlight` by its caller so a\n     * tokenless `401` during the sign-in waits for it and replays with the\n     * token it installs, see `awaitLogins`. Tracking starts only after a\n     * pending revocation settled.\n     *\n     * @param credentials - Sent as the login body.\n     * @returns The user of the new session, or null.\n     * @throws {SessionSupersededError} See `login()`.\n     */\n    async function signIn(credentials: TCredentials): Promise<TUser | null> {\n        const started = epoch;\n        const data = await trackCredentialRequest(\n            api.post<unknown>(loginPath, {\n                body: credentials,\n                skipAuth: true,\n            }),\n        );\n        const { token, refreshToken } = parseTokens(data);\n        if (epoch !== started) {\n            revokeDiscarded(token ?? null, refreshToken);\n            throw new SessionSupersededError();\n        }\n        const { done } = finish(\"switch\");\n        const mine = epoch;\n        await done.catch(() => undefined);\n        if (epoch !== mine) throw new SessionSupersededError();\n        state().setToken(token);\n        writeRefreshToken(refreshToken ?? null);\n        const embedded = parseUser?.(data);\n        if (embedded != null) {\n            state().setUser(embedded);\n            return embedded;\n        }\n        return fetchUser();\n    }\n\n    /**\n     * End the current session, synchronously up to the hook.\n     *\n     * The epoch moves first, so a refresh resolving between here and the hook\n     * is already superseded. The hook only runs when there was a session to\n     * end — a token, a stored refresh token or a user — which is what keeps a\n     * burst of `401`s from running it once per request.\n     *\n     * With nothing left to end, the caller waits on the teardown already under\n     * way (`ending`, which never rejects, so a later no-op does not inherit an\n     * old error). Two callers skip that wait while a hook is running, because\n     * they may be the hook itself and would wait on their own teardown forever:\n     * `endSession` — a hook awaiting `auth.api` goes out tokenless, gets a\n     * `401`, and lands here — and a `logout()` with no session left. `login()`\n     * (`\"switch\"`) always waits: the new account's state must not start while\n     * the previous one's teardown is still clearing it. A hook awaiting\n     * `auth.login()` therefore never settles — misuse the option documents.\n     *\n     * `\"expired\"` with nothing live leaves the epoch alone: there is nothing to\n     * supersede but a refresh with no session behind it — the boot `refresh()`\n     * restoring one from the cookie — and moving the epoch would throw that\n     * away. `logout()` and `login()` always move it, since they must supersede\n     * such a refresh.\n     *\n     * The returned `done` is a fresh promise derived from the hook, not the one\n     * `ending` holds: a `logout()` nobody awaits still surfaces the hook's error\n     * as an unhandled rejection instead of losing it.\n     *\n     * @param reason - Whether the caller signed out, the client gave up, or a\n     *   login replaced the session.\n     * @returns Whether a live session ended here, and a promise settling with\n     *   the hook.\n     */\n    function finish(reason: TempestSessionEnd<TUser>[\"reason\"]): {\n        live: boolean;\n        done: Promise<void>;\n    } {\n        const { user, token } = state();\n        const live = token !== null || user !== null || readRefreshToken() !== null;\n        if (live || reason !== \"expired\") nextEpoch();\n        state().logout();\n        writeRefreshToken(null);\n        if (!live) {\n            const wait = reason === \"switch\" || hooksRunning === 0;\n            return { live, done: wait ? ending : Promise.resolve() };\n        }\n        if (!onSessionEnd) return { live, done: Promise.resolve() };\n        const sessionApi = endedSessionApi(token);\n        hooksRunning += 1;\n        const run = (async () => {\n            try {\n                await onSessionEnd({ reason, user, token, api: sessionApi });\n            } finally {\n                hooksRunning -= 1;\n            }\n        })();\n        ending = run.then(\n            () => undefined,\n            () => undefined,\n        );\n        return { live, done: run.then(() => undefined) };\n    }\n\n    /**\n     * Send the `logoutPath` revocation for the session about to end, with the\n     * credentials it holds now — read before `finish` clears them.\n     *\n     * Skipped without `logoutPath`, and in body mode when there is nothing to\n     * revoke; in cookie mode it always goes out, since the cookie it revokes is\n     * invisible to the client. Never rejects.\n     *\n     * In cookie mode it first waits — at most\n     * {@link LOGOUT_REVOCATION_WAIT_MS} — for the login and refresh responses\n     * in flight right now: each one sets a cookie for the session this\n     * `logout()` ends, and a revocation that left before it would leave that\n     * cookie behind.\n     *\n     * @returns A promise settling when the revocation settled, or null when\n     *   none was sent.\n     */\n    function revoke(): Promise<void> | null {\n        if (!logoutPath) return null;\n        const path = logoutPath;\n        const { token, user } = state();\n        const refreshToken = readRefreshToken();\n        if (!withCredentials && token === null && user === null && refreshToken === null) {\n            return null;\n        }\n        const inFlight = withCredentials ? [...credentialRequests] : [];\n        return trackRevocation(async () => {\n            await settleWithin(inFlight, LOGOUT_REVOCATION_WAIT_MS);\n            return endedSessionApi(token).post<unknown>(path, { body: refreshBody(refreshToken) });\n        });\n    }\n\n    function logout(): Promise<void> {\n        const revocation = revoke();\n        const { done } = finish(\"logout\");\n        if (!revocation) return done;\n        return Promise.all([revocation, done]).then(() => undefined);\n    }\n\n    /**\n     * End the session after the client gave up on it and, when `redirectTo`\n     * is set, leave the page once `onSessionEnd` settled.\n     *\n     * Separate from `logout` so an explicit sign-out stays a pure state change:\n     * a caller that already navigates itself would otherwise get a second,\n     * competing navigation. The hook is awaited before navigating because a\n     * hard navigation aborts whatever request it still had in flight. Only the\n     * call that ended a live session navigates; the rest of a burst of `401`s\n     * waits on the same teardown, or returns at once inside a hook.\n     */\n    async function endSession(): Promise<void> {\n        const { live, done } = finish(\"expired\");\n        await done.catch(() => undefined);\n        if (live && redirectTo && typeof window !== \"undefined\") {\n            window.location.assign(redirectTo);\n        }\n    }\n\n    const api = createApiClient({\n        baseURL,\n        prefix,\n        withCredentials,\n        csrf,\n        fetcher,\n        getToken,\n        getSessionEpoch: () => epoch,\n        refresh: refreshFor,\n        retry,\n        onUnauthorized,\n    });\n\n    const refresh = (): Promise<void> => queue();\n\n    return { useAuthStore, api, login, logout, refresh, getToken };\n}\n"],"mappings":";;;;;;AAgPA,IAAM,IAA4B;AASlC,SAAS,EAAa,GAAsC,GAA2B;CAEnF,OADI,EAAQ,WAAW,IAAU,QAAQ,QAAQ,IAC1C,IAAI,SAAe,MAAY;EAClC,IAAM,IAAQ,WAAW,GAAS,CAAE;EACpC,QAAa,WAAW,CAAO,CAAC,CAAC,WAAW;GAExC,AADA,aAAa,CAAK,GAClB,EAAQ;EACZ,CAAC;CACL,CAAC;AACL;AAEA,SAAS,EAAmB,GAAyD;CACjF,IAAM,IAAK,KAAQ,CAAC;CACpB,OAAO;EAAE,OAAO,EAAE;EAAc,cAAc,EAAE;CAAc;AAClE;AAmDA,SAAgB,EACZ,GACgC;CAChC,IAAM,EACF,YACA,WACA,eAAY,mBACZ,kBAAc,qBACd,eACA,mBACA,WACA,eAAY,gBACZ,aAAU,SACV,qBAAkB,IAClB,SACA,YACA,iBAAc,GACd,cACA,kBAAe,MAAQ,IAAK,EAAE,eAAe,EAAG,IAAI,KAAA,GACpD,WACA,eACA,oBACA,GAEE,IAAe,EAAuB;EAAE,MAAM;EAAW;CAAQ,CAAC,GAClE,IAAa,GAAG,EAAU;CAEhC,SAAS,IAA8B;EAEnC,OADI,OAAO,SAAW,MAAoB,OACnC,MAAY,YAAY,OAAO,iBAAiB,OAAO;CAClE;CACA,SAAS,IAAkC;EACvC,OAAO,EAAY,CAAC,EAAE,QAAQ,CAAU,KAAK;CACjD;CACA,SAAS,EAAkB,GAA4B;EACnD,IAAM,IAAI,EAAY;EACjB,MACD,IAAO,EAAE,QAAQ,GAAY,CAAK,IACjC,EAAE,WAAW,CAAU;CAChC;CAEA,IAAM,UAAgC,EAAa,SAAS,GACtD,UAAgC,EAAM,CAAC,CAAC;CAmB9C,eAAe,IAAmC;EAC9C,IAAI,CAAC,GAAQ,OAAO,EAAM,CAAC,CAAC;EAC5B,IAAM,IAAU,GACZ;EACJ,IAAI;GACA,IAAO,MAAM,EAAI,IAAW,GAAQ,EAAE,eAAe,GAAK,CAAC;EAC/D,SAAS,GAAO;GAEZ,MADI,MAAU,IACR,IADuB,IAAI,EAAuB;EAE5D;EACA,IAAI,MAAU,GAAS,MAAM,IAAI,EAAuB;EAExD,OADA,EAAM,CAAC,CAAC,QAAQ,CAAI,GACb;CACX;CAEA,IAAI,IAAQ,GACR,IAAwB,QAAQ,QAAQ,GACxC,IAAe,GACb,oBAAiB,IAAI,IAAsB,GAC3C,oBAAc,IAAI,IAAmB,GACrC,oBAAqB,IAAI,IAAsB,GAC/C,oBAAiB,IAAI,IAAY;CASvC,SAAS,EAA0B,GAAiC;EAChE,IAAM,IAAU,EAAQ,WACd,KAAA,SACA,KAAA,CACV;EAGA,OAFA,EAAmB,IAAI,CAAO,GAC9B,EAAa,WAAW,EAAmB,OAAO,CAAO,CAAC,GACnD;CACX;CAQA,SAAS,EAAkB,GAAsB;EAC7C,AAAI,EAAW,KACX,QAAQ,KACJ,uEACA,CACJ;EAEJ,IAAI;GACA,KAAgB,CAAK;EACzB,QAAQ;GACJ;EACJ;CACJ;CASA,SAAS,EAAgB,GAA8C;EACnE,IAAM,KAAW,YAAY;GACzB,IAAI;IACA,MAAM,EAAM;GAChB,SAAS,GAAO;IACZ,EAAkB,CAAK;GAC3B;EACJ,EAAA,CAAG;EAGH,OAFA,EAAY,IAAI,CAAO,GACvB,EAAa,WAAW,EAAY,OAAO,CAAO,CAAC,GAC5C;CACX;CAcA,SAAS,EAAgB,GAAsB,GAAwC;EAC/E,AAAC,KAAc,MAAoB,KACvC,QACI,EAAgB,CAAK,CAAC,CAAC,KAAc,GAAY,EAC7C,MAAM,EAAY,CAAY,EAClC,CAAC,CACL;CACJ;CASA,SAAS,EAAgB,GAAiC;EACtD,OAAO,EAAgB;GACnB;GACA;GACA;GACA;GACA;GACA,gBAAgB;EACpB,CAAC;CACL;CAWA,SAAS,IAAkB;EAEvB,AADA,KAAS,GACT,IAAQ,EAAmB,CAAM;CACrC;CAWA,eAAe,IAAwB;EACnC,IAAM,IAAU;EAChB,EAAe,IAAI,CAAO;EAC1B,IAAI;GACA,IAAI;GACJ,IAAI;IACA,IAAO,MAAM,EACT,EAAI,KAAc,IAAa;KAC3B,MAAM,EAAY,EAAiB,CAAC;KACpC,UAAU;IACd,CAAC,CACL;GACJ,SAAS,GAAO;IAEZ,MADI,MAAU,IACR,IADuB,IAAI,EAAuB;GAE5D;GACA,IAAM,EAAE,UAAO,oBAAiB,EAAY,CAAI;GAChD,IAAI,MAAU,GAEV,MADA,EAAgB,KAAS,MAAM,CAAY,GACrC,IAAI,EAAuB;GAGrC,AADA,EAAM,CAAC,CAAC,SAAS,CAAK,GAClB,KAAc,EAAkB,CAAY;EACpD,UAAU;GACN,EAAe,OAAO,CAAO;EACjC;CACJ;CAEA,IAAI,IAAQ,EAAmB,CAAM;CAcrC,SAAS,EAAmB,GAAsC;EAC9D,IAAM,IAAU,EAAS;EAEzB,OADI,MAAY,OAAa,KACtB,EAAQ,UAAU,QAAQ,EAAQ,UAAU;CACvD;CAgBA,SAAS,IAAqB;EAC1B,OAAO,EAAS,MAAM,QAAQ,EAAiB,MAAM;CACzD;CAmBA,eAAe,IAA6B;QACpC,EAAe,OAAO,KAAK,MAAiB,MAC5C,MAAM,QAAQ,WAAW,CAAC,GAAG,CAAc,CAAC,GACxC,EAAS,MAAM,QAEvB,MAAU,MAAM,+BAA+B;CACnD;CAqBA,eAAe,EAAW,GAA4C;EAClE,IAAI,EAAQ,UAAU,QAAQ,EAAQ,UAAU,GAAO,MAAM,IAAI,EAAuB;EACxF,IAAI,EAAmB,CAAO,GAAG;GAC7B,IAAI,EAAQ,UAAU,MAAM,MAAU,MAAM,oCAAoC;GAChF;EACJ;EAKA,OAJI,EAAQ,UAAU,QAAQ,EAAU,IAChC,EAAe,IAAI,CAAK,IAAU,EAAM,IACrC,EAAY,IAEhB,EAAM;CACjB;CAiBA,eAAe,EAAe,GAAqB,GAA4C;EAC3F,IAAI,EAAQ,UAAU,QAAQ,EAAQ,UAAU,GAAO,MAAM,IAAI,EAAuB;EACpF,EAAmB,CAAO,KAC1B,EAAQ,UAAU,QAAQ,EAAU,KACxC,MAAM,GAAW;CACrB;CAuBA,eAAe,GAAM,GAAkD;EACnE,AAAI,EAAY,OAAO,KAAG,MAAM,EAAa,CAAC,GAAG,CAAW,GAAG,CAAyB;EACxF,IAAM,IAAM,GAAO,CAAW;EAC9B,EAAe,IAAI,CAAG;EACtB,IAAI;GACA,OAAO,MAAM;EACjB,UAAU;GACN,EAAe,OAAO,CAAG;EAC7B;CACJ;CAYA,eAAe,GAAO,GAAkD;EACpE,IAAM,IAAU,GACV,IAAO,MAAM,EACf,EAAI,KAAc,GAAW;GACzB,MAAM;GACN,UAAU;EACd,CAAC,CACL,GACM,EAAE,UAAO,oBAAiB,EAAY,CAAI;EAChD,IAAI,MAAU,GAEV,MADA,EAAgB,KAAS,MAAM,CAAY,GACrC,IAAI,EAAuB;EAErC,IAAM,EAAE,YAAS,EAAO,QAAQ,GAC1B,IAAO;EAEb,IADA,MAAM,EAAK,YAAY,KAAA,CAAS,GAC5B,MAAU,GAAM,MAAM,IAAI,EAAuB;EAErD,AADA,EAAM,CAAC,CAAC,SAAS,CAAK,GACtB,EAAkB,KAAgB,IAAI;EACtC,IAAM,IAAW,IAAY,CAAI;EAKjC,OAJI,KAAY,OAIT,EAAU,KAHb,EAAM,CAAC,CAAC,QAAQ,CAAQ,GACjB;CAGf;CAmCA,SAAS,EAAO,GAGd;EACE,IAAM,EAAE,SAAM,aAAU,EAAM,GACxB,IAAO,MAAU,QAAQ,MAAS,QAAQ,EAAiB,MAAM;EAIvE,KAHI,KAAQ,MAAW,cAAW,EAAU,GAC5C,EAAM,CAAC,CAAC,OAAO,GACf,EAAkB,IAAI,GAClB,CAAC,GAED,OAAO;GAAE;GAAM,MADF,MAAW,YAAY,MAAiB,IACzB,IAAS,QAAQ,QAAQ;EAAE;EAE3D,IAAI,CAAC,GAAc,OAAO;GAAE;GAAM,MAAM,QAAQ,QAAQ;EAAE;EAC1D,IAAM,IAAa,EAAgB,CAAK;EACxC,KAAgB;EAChB,IAAM,KAAO,YAAY;GACrB,IAAI;IACA,MAAM,EAAa;KAAE;KAAQ;KAAM;KAAO,KAAK;IAAW,CAAC;GAC/D,UAAU;IACN;GACJ;EACJ,EAAA,CAAG;EAKH,OAJA,IAAS,EAAI,WACH,KAAA,SACA,KAAA,CACV,GACO;GAAE;GAAM,MAAM,EAAI,WAAW,KAAA,CAAS;EAAE;CACnD;CAmBA,SAAS,KAA+B;EACpC,IAAI,CAAC,GAAY,OAAO;EACxB,IAAM,IAAO,GACP,EAAE,UAAO,YAAS,EAAM,GACxB,IAAe,EAAiB;EACtC,IAAI,CAAC,KAAmB,MAAU,QAAQ,MAAS,QAAQ,MAAiB,MACxE,OAAO;EAEX,IAAM,IAAW,IAAkB,CAAC,GAAG,CAAkB,IAAI,CAAC;EAC9D,OAAO,EAAgB,aACnB,MAAM,EAAa,GAAU,CAAyB,GAC/C,EAAgB,CAAK,CAAC,CAAC,KAAc,GAAM,EAAE,MAAM,EAAY,CAAY,EAAE,CAAC,EACxF;CACL;CAEA,SAAS,KAAwB;EAC7B,IAAM,IAAa,GAAO,GACpB,EAAE,YAAS,EAAO,QAAQ;EAEhC,OADK,IACE,QAAQ,IAAI,CAAC,GAAY,CAAI,CAAC,CAAC,CAAC,WAAW,KAAA,CAAS,IADnC;CAE5B;CAaA,eAAe,KAA4B;EACvC,IAAM,EAAE,SAAM,YAAS,EAAO,SAAS;EAEvC,AADA,MAAM,EAAK,YAAY,KAAA,CAAS,GAC5B,KAAQ,KAAc,OAAO,SAAW,OACxC,OAAO,SAAS,OAAO,CAAU;CAEzC;CAEA,IAAM,IAAM,EAAgB;EACxB;EACA;EACA;EACA;EACA;EACA;EACA,uBAAuB;EACvB,SAAS;EACT;EACA;CACJ,CAAC;CAID,OAAO;EAAE;EAAc;EAAK;EAAO;EAAQ,eAFN,EAAM;EAES;CAAS;AACjE"}
+{"version":3,"file":"create-tempest-auth.js","names":["LOGOUT_REVOCATION_WAIT_MS","settleWithin","pending","timer","resolve","ms","defaultParseTokens","d","data","createTempestAuth","rt","options","useAuthStore","createAuthStore","storeName","refreshKey","storageImpl","storage","readRefreshToken","writeRefreshToken","s","token","state","getToken","fetchUser","mePath","started","epoch","user","api","error","SessionSupersededError","ending","hooksRunning","loginsInFlight","revocations","credentialRequests","rotatingEpochs","trackCredentialRequest","settled","request","reportLogoutError","isDevBuild","trackRevocation","tracked","build","revokeDiscarded","logoutPath","refreshToken","endedSessionApi","refreshBody","createApiClient","nextEpoch","createRefreshQueue","rotate","refreshPath","parseTokens","queue","staleWithinSession","current","context","signedOut","awaitLogins","refreshFor","onUnauthorized","endSession","login","run","signIn","credentials","loginPath","finish","mine","done","embedded","parseUser","live","reason","onSessionEnd","sessionApi","revoke","path","withCredentials","inFlight","logout","revocation","redirectTo"],"sources":["../../src/auth/create-tempest-auth.ts"],"sourcesContent":["import { createApiClient, SessionSupersededError } from \"../http\";\nimport { isDevBuild } from \"../utils/dev-mode\";\nimport type { ApiClient, CsrfOptions, RequestAuthContext, RetryOptions } from \"../http\";\nimport { createAuthStore } from \"./create-auth-store\";\nimport type { AuthState } from \"./create-auth-store\";\nimport { createRefreshQueue } from \"./refresh-queue\";\n\n/** The token envelope returned by a Tempest FastAPI SDK login/refresh route. */\nexport interface TempestTokenResponse {\n    /** The bearer access token. */\n    access_token: string;\n    /** Token type — always `\"bearer\"` for the SDK. */\n    token_type?: string;\n    /** Optional refresh token (when the API returns it in the body, not a cookie). */\n    refresh_token?: string;\n}\n\n/**\n * What {@link CreateTempestAuthOptions.onSessionEnd} receives about the session\n * that just ended.\n */\nexport interface TempestSessionEnd<TUser> {\n    /**\n     * Why it ended: `\"logout\"` for an explicit `logout()`, `\"expired\"` when the\n     * client ended it on its own — the refresh failed, or the request replayed\n     * after a refresh still came back `401` — and `\"switch\"` when `login()`\n     * succeeded for another set of credentials while this session was live.\n     */\n    reason: \"logout\" | \"expired\" | \"switch\";\n    /** The user of the ended session, as the store held it. */\n    user: TUser | null;\n    /** The access token of the ended session, or `null` when it had none. */\n    token: string | null;\n    /**\n     * A client that sends the ended session's access token — the store has\n     * already been cleared, so `auth.api` no longer does.\n     *\n     * Use it for the server-side half of the teardown, such as deleting this\n     * browser's push subscription. It never refreshes and never ends a session:\n     * a `401` here just rejects. On `\"logout\"` the token is usually still\n     * valid; on `\"expired\"` the server has already refused it, so expect the\n     * call to fail and keep the local half of the teardown independent of it.\n     */\n    api: ApiClient;\n}\n\nexport interface CreateTempestAuthOptions<TUser> {\n    /** Base URL of the API. Required. */\n    baseURL: string;\n    /**\n     * Path segment the API is mounted under, such as `\"/api\"`, forwarded to\n     * every client this preset builds — see the `prefix` option of\n     * `createApiClient`.\n     *\n     * Safe to combine with the default paths below: the prefix is applied at\n     * most once, so `\"/api/auth/login\"` under a `\"/api\"` prefix stays\n     * `\"/api/auth/login\"`.\n     */\n    prefix?: string;\n    /** Login route (`POST`). Default: `\"/api/auth/login\"`. */\n    loginPath?: string;\n    /** Refresh route (`POST`). Default: `\"/api/auth/refresh\"`. */\n    refreshPath?: string;\n    /**\n     * Server-side logout route (`POST`), called by an explicit `logout()` to\n     * revoke the ending session. Off by default.\n     *\n     * `logout()` alone only clears client state, and an HttpOnly refresh\n     * cookie is out of its reach: with `withCredentials`, the cookie stays\n     * redeemable until the backend revokes it. The tempest-fastapi-sdk mounts\n     * `POST /auth/logout` (`204`, idempotent) when it stores refresh tokens in\n     * the database — at `/auth/cookie/logout` when it delivers tokens both in\n     * the body and in cookies — and stateless refresh tokens cannot be\n     * revoked, so the route is absent there.\n     *\n     * The request goes out through the ended session's client (the same one\n     * `onSessionEnd` receives, carrying its access token), with the body that\n     * `refreshBody` builds from the refresh token stored before the clear:\n     * `{ refresh_token }` in body mode, no body in cookie mode, which is what\n     * that route reads. The local clear does not wait on it — `isAuthenticated`\n     * is still `false` when `logout()` returns — but the promise `logout()`\n     * returns does, so a navigation after `await auth.logout()` does not abort\n     * it. A failure (network, `4xx`, `5xx`) is swallowed: revocation is\n     * best-effort and never keeps the user signed in. A `login()` started\n     * while it is in flight waits for it, because the logout response clears\n     * the auth cookies and would otherwise clear the new account's.\n     *\n     * Only an explicit `logout()` revokes. On `\"switch\"` the cookie jar already\n     * holds the new account's cookie, and on `\"expired\"` the server has already\n     * refused the session.\n     *\n     * Overlapping sign-outs each send their own revocation, and `login()` waits\n     * for all of them — at most 10 seconds, so one that\n     * never answers delays the sign-in instead of blocking it. In cookie mode,\n     * a revocation also waits (within the same bound) for the login and\n     * refresh responses that were in flight when `logout()` ran: the server\n     * sets the ended session's cookie when that response arrives, and a\n     * revocation sent earlier would leave it behind. In body mode, the refresh\n     * token such a superseded response brings back is revoked on its own.\n     */\n    logoutPath?: string;\n    /**\n     * Called with the error when a `logoutPath` revocation fails — network\n     * failure, `4xx` or `5xx`. `logout()` still resolves, since the local\n     * sign-out already happened; this is where the app logs or retries. A dev\n     * build also warns in the console. Errors it throws are swallowed.\n     */\n    onLogoutError?: (error: unknown) => void;\n    /** Optional current-user route (`GET`) called after login/refresh. */\n    mePath?: string;\n    /** Persist key for the store. Default: `\"tempest-auth\"`. */\n    storeName?: string;\n    /** Storage backend. Default: `\"local\"`. */\n    storage?: \"local\" | \"session\";\n    /** Send cookies (needed when the refresh token lives in an httpOnly cookie). */\n    withCredentials?: boolean;\n    /**\n     * CSRF token for every write, forwarded to `createApiClient`'s `csrf`. Off\n     * by default; `true` echoes the `csrf_token` cookie as `X-CSRF-Token`.\n     *\n     * The pair to `withCredentials`: once the refresh token lives in a cookie,\n     * the browser attaches it to a `POST /auth/refresh` that another site\n     * triggers. Login and refresh carry the header too — they go out with\n     * `skipAuth`, and the CSRF header does not follow auth.\n     */\n    csrf?: boolean | CsrfOptions;\n    /** Custom fetch implementation (testing / SSR). Defaults to `globalThis.fetch`. */\n    fetcher?: typeof fetch;\n    /**\n     * Extract tokens from a login/refresh response. Default reads\n     * `access_token` + `refresh_token`.\n     */\n    parseTokens?: (data: unknown) => { token: string; refreshToken?: string };\n    /** Pull the user out of the login response, when the API embeds it. */\n    parseUser?: (data: unknown) => TUser | null;\n    /**\n     * Build the refresh request body. Default sends `{ refresh_token }` when a\n     * refresh token is stored, else `undefined` (cookie-based refresh).\n     */\n    refreshBody?: (refreshToken: string | null) => unknown;\n    /**\n     * Retry policy for `api`, forwarded to {@link createApiClient}. Off by\n     * default; `true` enables the conservative built-in policy, which never\n     * replays a write.\n     */\n    retry?: boolean | RetryOptions;\n    /**\n     * Where to send the browser when the session ends — a hard navigation via\n     * `window.location.assign`, after the store is cleared.\n     *\n     * **Prefer leaving this unset.** `logout()` already clears the store, so a\n     * `<RouteGuard when={isAuthenticated} redirectTo=\"/login\">` wrapped around\n     * the protected area navigates on its own, which keeps the SPA alive and the\n     * router history intact. Reach for this only when the expiry can happen\n     * outside any guarded subtree and a full reload is acceptable.\n     */\n    redirectTo?: string;\n    /**\n     * Tear down per-user state when a session ends — on an explicit `logout()`,\n     * when the client ends the session on its own after a failed refresh, and\n     * when a successful `login()` replaces a live session. Without it, the automatic path had no place to hook into, and\n     * state derived from the user (a push subscription, a persisted query\n     * cache, a background-sync queue) survived into the next account.\n     *\n     * Order, on every path:\n     *\n     * 1. any refresh still in flight is superseded, so it cannot reinstall the\n     *    ending session's tokens;\n     * 2. the store and the stored refresh token are cleared — synchronously, so\n     *    `isAuthenticated` is already `false` when `logout()` returns;\n     * 3. this hook runs with a {@link TempestSessionEnd} whose `api` still sends\n     *    the ended session's access token;\n     * 4. on `\"expired\"` with `redirectTo` set, the browser navigates — after the\n     *    hook settled, even if it threw; on `\"switch\"`, the new session is\n     *    installed — after the hook settled, even if it threw.\n     *\n     * It may be async. `logout()` resolves when it settles and rejects with what\n     * it threw; on the automatic path the error is swallowed, because the\n     * request that ended the session already rejects with its own `401`. It\n     * runs once per session: a second `logout()`, or the other requests of a\n     * burst of `401`s, find nothing left to end and skip it.\n     *\n     * On `\"switch\"` the hook runs only **after** the new credentials were\n     * accepted, so a failed `login()` leaves the live session untouched. It runs\n     * **before** the new session is installed: teardown of the previous\n     * account's state (clearing a persisted cache, a background-sync queue) has\n     * to finish before the new account's requests start filling them, or it\n     * would wipe — or race with — the new account's data. The cost is that\n     * `isAuthenticated` is `false` while the hook runs, which a route guard may\n     * act on; keep the hook short. Its error is swallowed there, since the\n     * login itself succeeded.\n     *\n     * Inside the hook, reach the backend only through `session.api`. `auth.api`\n     * goes out with no token; `auth.login()` waits on the teardown in progress —\n     * this hook — and never settles. Telling the hook apart from an outside\n     * caller would need an async context the browser does not have, so this is\n     * a documented rule, not a runtime check.\n     */\n    onSessionEnd?: (session: TempestSessionEnd<TUser>) => void | Promise<void>;\n}\n\nexport interface TempestAuth<TUser, TCredentials> {\n    /** The persisted Zustand auth store hook (compatible with `<AuthGuard>`). */\n    useAuthStore: ReturnType<typeof createAuthStore<TUser>>;\n    /** A `createApiClient` wired with bearer auth + 401 → refresh → retry. */\n    api: ApiClient;\n    /** Authenticate, store the session, and resolve the user (or null). */\n    login: (credentials: TCredentials) => Promise<TUser | null>;\n    /**\n     * End the session: supersede any refresh in flight, clear the store and the\n     * stored refresh token, then run `onSessionEnd`.\n     *\n     * The store is cleared synchronously, before the first `await`, so callers\n     * that ignore the promise see the signed-out state at once. The promise\n     * resolves when `onSessionEnd` settled — and, with `logoutPath`, when the\n     * server-side revocation settled too — and rejects with the hook's error;\n     * a failed revocation never rejects it.\n     */\n    logout: () => Promise<void>;\n    /**\n     * Refresh the access token (deduplicated across concurrent callers).\n     *\n     * @throws {SessionSupersededError} When the session ended or changed while\n     *   the refresh was in flight; its tokens were discarded.\n     */\n    refresh: () => Promise<void>;\n    /** The current access token, or null. */\n    getToken: () => string | null;\n}\n\n/**\n * How long `login()` waits for pending `logoutPath` revocations, and how long a\n * cookie-mode revocation waits for the login or refresh responses still in\n * flight when `logout()` ran, before going ahead anyway.\n *\n * A bound, not a guess at latency: a fetcher that ignores abort, or a backend\n * that never answers, would otherwise leave the next `login()` waiting forever.\n * Ten seconds is past any healthy round trip and short enough that a stuck\n * revocation costs a slow sign-in, not a dead one.\n */\nconst LOGOUT_REVOCATION_WAIT_MS = 10_000;\n\n/**\n * Wait until every promise settled, or until `ms` passed, whichever is first.\n *\n * @param pending - What to wait for; rejections count as settled.\n * @param ms - The bound.\n * @returns A promise that always resolves.\n */\nfunction settleWithin(pending: readonly Promise<unknown>[], ms: number): Promise<void> {\n    if (pending.length === 0) return Promise.resolve();\n    return new Promise<void>((resolve) => {\n        const timer = setTimeout(resolve, ms);\n        void Promise.allSettled(pending).then(() => {\n            clearTimeout(timer);\n            resolve();\n        });\n    });\n}\n\nfunction defaultParseTokens(data: unknown): { token: string; refreshToken?: string } {\n    const d = (data ?? {}) as TempestTokenResponse;\n    return { token: d.access_token, refreshToken: d.refresh_token };\n}\n\n/**\n * Turn-key auth preset wiring `createAuthStore` + `createRefreshQueue` +\n * `createApiClient` to the Tempest FastAPI SDK auth contract: login returns\n * `{ access_token, token_type }`, requests carry `Authorization: Bearer`, and a\n * `401` triggers a single deduplicated refresh + replay.\n *\n * The session is cleared whenever that path ends unauthorized anyway — the\n * refresh threw, or the replay came back `401` — so a refresh token that the\n * backend has revoked cannot leave the app holding a dead session. With\n * `redirectTo` set, the browser also leaves the page; without it, clearing the\n * store is enough for a `<RouteGuard>` to navigate on its own.\n *\n * Every refresh is bound to a **session epoch**, bumped by `logout()` and by a\n * `login()` whose credentials were accepted. A refresh that resolves after its epoch ended discards\n * what it brought back and rejects with {@link SessionSupersededError}, which\n * the client passes through without ending the new session. Before 0.77.0 a\n * refresh that was in flight during `logout()` reinstalled the old tokens —\n * and after `logout()` + `login(B)`, replaced B's token with A's while the UI\n * showed B (#435). A `401` from a request sent under an ended session is\n * refused the same way, instead of being replayed as the account signed in now.\n *\n * A `401` from a request that carried no token, while no session is installed,\n * surfaces without a refresh: in cookie mode that refresh would be answered by\n * the HttpOnly cookie `logout()` cannot clear, signing the previous account\n * back in (#474). With a `login()` in flight, that `401` waits for it and\n * replays with the token it installed, or surfaces when it failed — still\n * without a refresh (#496). Restore a session at boot with an explicit\n * `refresh()`, and pass `logoutPath` so the backend revokes the cookie:\n * without a working revocation, that boot `refresh()` restores the previous\n * account for whoever uses the browser next.\n *\n * Refreshes are collapsed per rotation, not just per overlap: a `401` whose\n * request left with a token that has since been replaced in the same session\n * replays with the new token and refreshes nothing. Three expired requests take\n * one refresh whether their `401`s arrive together or one after another.\n *\n * @example\n * const auth = createTempestAuth<User, { email: string; password: string }>({\n *     baseURL: import.meta.env.VITE_API_URL,\n *     mePath: \"/api/auth/me\",\n * });\n *\n * await auth.login({ email, password });   // stores session, returns the user\n * const orders = await auth.api.get(\"/api/orders\");  // sends the bearer token\n * await auth.logout();                      // clears, then runs onSessionEnd\n *\n * @param options - The auth configuration.\n * @returns The store hook, a wired API client, and login/logout/refresh helpers.\n */\nexport function createTempestAuth<TUser, TCredentials = { email: string; password: string }>(\n    options: CreateTempestAuthOptions<TUser>,\n): TempestAuth<TUser, TCredentials> {\n    const {\n        baseURL,\n        prefix,\n        loginPath = \"/api/auth/login\",\n        refreshPath = \"/api/auth/refresh\",\n        logoutPath,\n        onLogoutError,\n        mePath,\n        storeName = \"tempest-auth\",\n        storage = \"local\",\n        withCredentials = false,\n        csrf,\n        fetcher,\n        parseTokens = defaultParseTokens,\n        parseUser,\n        refreshBody = (rt) => (rt ? { refresh_token: rt } : undefined),\n        retry,\n        redirectTo,\n        onSessionEnd,\n    } = options;\n\n    const useAuthStore = createAuthStore<TUser>({ name: storeName, storage });\n    const refreshKey = `${storeName}-refresh`;\n\n    function storageImpl(): Storage | null {\n        if (typeof window === \"undefined\") return null;\n        return storage === \"session\" ? window.sessionStorage : window.localStorage;\n    }\n    function readRefreshToken(): string | null {\n        return storageImpl()?.getItem(refreshKey) ?? null;\n    }\n    function writeRefreshToken(token: string | null): void {\n        const s = storageImpl();\n        if (!s) return;\n        if (token) s.setItem(refreshKey, token);\n        else s.removeItem(refreshKey);\n    }\n\n    const state = (): AuthState<TUser> => useAuthStore.getState();\n    const getToken = (): string | null => state().token;\n\n    /**\n     * Load the current user, without letting a `401` end the session.\n     *\n     * `skipAuthRetry` is what keeps this one client honest: the call is\n     * authenticated, but a `401` here surfaces instead of triggering a refresh\n     * and `onUnauthorized`. That was the behaviour of the throwaway client this\n     * used to build per invocation, and it is the reason the preset needed\n     * three clients before 0.66.0.\n     *\n     * Bound to the epoch current when the request leaves, like `rotate()`: a\n     * profile that resolves after `logout()` — or after `logout()` +\n     * `login(B)` — is discarded instead of written next to B's token, and the\n     * `login()` that asked for it rejects as superseded (#473).\n     *\n     * @throws {SessionSupersededError} When the epoch changed while the\n     *   request was in flight, on success and on failure alike.\n     */\n    async function fetchUser(): Promise<TUser | null> {\n        if (!mePath) return state().user;\n        const started = epoch;\n        let user: TUser;\n        try {\n            user = await api.get<TUser>(mePath, { skipAuthRetry: true });\n        } catch (error) {\n            if (epoch !== started) throw new SessionSupersededError();\n            throw error;\n        }\n        if (epoch !== started) throw new SessionSupersededError();\n        state().setUser(user);\n        return user;\n    }\n\n    let epoch = 0;\n    let ending: Promise<void> = Promise.resolve();\n    let hooksRunning = 0;\n    const loginsInFlight = new Set<Promise<unknown>>();\n    const revocations = new Set<Promise<void>>();\n    const credentialRequests = new Set<Promise<unknown>>();\n    const rotatingEpochs = new Set<number>();\n\n    /**\n     * Track a login or refresh request until it settles, so a cookie-mode\n     * revocation can wait for the response that sets the cookie it revokes.\n     *\n     * @param request - The request in flight.\n     * @returns The same request.\n     */\n    function trackCredentialRequest<T>(request: Promise<T>): Promise<T> {\n        const settled = request.then(\n            () => undefined,\n            () => undefined,\n        );\n        credentialRequests.add(settled);\n        void settled.then(() => credentialRequests.delete(settled));\n        return request;\n    }\n\n    /**\n     * Surface a failed revocation: `onLogoutError`, plus a console warning in a\n     * dev build.\n     *\n     * @param error - What the revocation rejected with.\n     */\n    function reportLogoutError(error: unknown): void {\n        if (isDevBuild()) {\n            console.warn(\n                \"[tempest-react-sdk] createTempestAuth: logoutPath revocation failed\",\n                error,\n            );\n        }\n        try {\n            onLogoutError?.(error);\n        } catch {\n            return;\n        }\n    }\n\n    /**\n     * Send one `logoutPath` revocation and track it until it settles. Never\n     * rejects.\n     *\n     * @param build - Produces the request, after whatever wait it needs.\n     * @returns A promise settling when the revocation settled.\n     */\n    function trackRevocation(build: () => Promise<unknown>): Promise<void> {\n        const tracked = (async () => {\n            try {\n                await build();\n            } catch (error) {\n                reportLogoutError(error);\n            }\n        })();\n        revocations.add(tracked);\n        void tracked.then(() => revocations.delete(tracked));\n        return tracked;\n    }\n\n    /**\n     * Revoke, in body mode, the refresh token a superseded login or refresh\n     * brought back. Nobody can use it — the client discarded it — but it would\n     * stay valid on the server until it expires.\n     *\n     * Cookie mode is left to `revoke()`, which waits for these responses\n     * instead: re-sending a cookie revocation here could carry whichever\n     * account's cookie the browser holds by then.\n     *\n     * @param token - The superseded response's access token.\n     * @param refreshToken - The superseded response's refresh token.\n     */\n    function revokeDiscarded(token: string | null, refreshToken: string | undefined): void {\n        if (!logoutPath || withCredentials || !refreshToken) return;\n        void trackRevocation(() =>\n            endedSessionApi(token).post<unknown>(logoutPath, {\n                body: refreshBody(refreshToken),\n            }),\n        );\n    }\n\n    /**\n     * A client that sends an ended session's access token, and never refreshes\n     * or ends a session: a `401` there just rejects.\n     *\n     * @param token - The ended session's access token.\n     * @returns The client `onSessionEnd` and the `logoutPath` call go through.\n     */\n    function endedSessionApi(token: string | null): ApiClient {\n        return createApiClient({\n            baseURL,\n            prefix,\n            withCredentials,\n            csrf,\n            fetcher,\n            getToken: () => token,\n        });\n    }\n\n    /**\n     * Start a new session epoch: supersede the refresh in flight and give the\n     * new epoch a refresh queue of its own, so a `401` under the new session\n     * never joins the old session's refresh.\n     *\n     * The client reads the epoch when each attempt leaves (`getSessionEpoch`),\n     * which is what ties a `401` to the session that sent it — no set of\n     * tokens to keep, and nothing that grows with the session's length.\n     */\n    function nextEpoch(): void {\n        epoch += 1;\n        queue = createRefreshQueue(rotate);\n    }\n\n    /**\n     * Perform one refresh for the epoch that is current when it starts.\n     *\n     * Checked again after the round trip, on success and on failure alike: a\n     * refresh that fails after `logout()` + `login(B)` must not reach\n     * `onUnauthorized` either, or it would end B's session.\n     *\n     * @throws {SessionSupersededError} When the epoch changed during the call.\n     */\n    async function rotate(): Promise<void> {\n        const started = epoch;\n        rotatingEpochs.add(started);\n        try {\n            let data: unknown;\n            try {\n                data = await trackCredentialRequest(\n                    api.post<unknown>(refreshPath, {\n                        body: refreshBody(readRefreshToken()),\n                        skipAuth: true,\n                    }),\n                );\n            } catch (error) {\n                if (epoch !== started) throw new SessionSupersededError();\n                throw error;\n            }\n            const { token, refreshToken } = parseTokens(data);\n            if (epoch !== started) {\n                revokeDiscarded(token ?? null, refreshToken);\n                throw new SessionSupersededError();\n            }\n            state().setToken(token);\n            if (refreshToken) writeRefreshToken(refreshToken);\n        } finally {\n            rotatingEpochs.delete(started);\n        }\n    }\n\n    let queue = createRefreshQueue(rotate);\n\n    /**\n     * Whether a `401` must be left alone: no refresh, no ending the session.\n     *\n     * Two cases, both of the current epoch: an attempt that carried no token\n     * while a session is now installed (it left before the sign-in, and\n     * refreshing or ending the new session for it would punish the wrong\n     * session); and an attempt whose token the session has since rotated past\n     * (the rotation it would trigger already happened).\n     *\n     * @param context - The attempt's credential.\n     * @returns Whether the attempt is stale within the current session.\n     */\n    function staleWithinSession(context: RequestAuthContext): boolean {\n        const current = getToken();\n        if (current === null) return false;\n        return context.token === null || context.token !== current;\n    }\n\n    /**\n     * Whether nothing could make a tokenless `401` worth a refresh: no access\n     * token and no stored refresh token.\n     *\n     * With `withCredentials`, the refresh would otherwise be answered by an\n     * HttpOnly cookie the client cannot see or clear — after `logout()`, that\n     * signed the previous account back in for whoever used the browser next\n     * (#474). A `login()` in flight does not count as a session either: the\n     * cookie a refresh would present during it is still the ended account's\n     * (#496). Restoring a session from the cookie is an explicit `refresh()`,\n     * typically at boot, which this does not touch.\n     *\n     * @returns Whether no session is installed.\n     */\n    function signedOut(): boolean {\n        return getToken() === null && readRefreshToken() === null;\n    }\n\n    /**\n     * Settle a tokenless `401` that arrived with no session installed while a\n     * `login()` is in flight: wait for every login in flight, then let the\n     * request replay when one of them installed a token.\n     *\n     * No refresh is sent. In cookie mode one would present whatever cookie\n     * the browser holds — after `logout()` without a working `logoutPath`,\n     * the previous account's: a failed login then left the client signed in\n     * as that account, and a successful one could have its cookie overwritten\n     * by the refresh's late `Set-Cookie` (#496).\n     *\n     * Skipped while an `onSessionEnd` hook runs: an account switch waits on\n     * that hook, so a hook awaiting `auth.api` would wait on itself.\n     *\n     * @throws {Error} When no login is in flight, a hook is running, or every\n     *   login settled without installing a token — the `401` surfaces as is.\n     */\n    async function awaitLogins(): Promise<void> {\n        if (loginsInFlight.size > 0 && hooksRunning === 0) {\n            await Promise.allSettled([...loginsInFlight]);\n            if (getToken() !== null) return;\n        }\n        throw new Error(\"anonymous 401 with no session\");\n    }\n\n    /**\n     * The `refresh` the client calls on a `401`.\n     *\n     * - An attempt from an ended epoch is refused rather than replayed as\n     *   whoever is signed in now.\n     * - A token this session already rotated past: the replay just picks up the\n     *   new one — no second refresh.\n     * - No token, while a session is now installed: the `401` surfaces as is.\n     * - No token, and no session installed: joins this epoch's refresh when\n     *   one is already in flight — the boot `refresh()` restoring a session\n     *   from the cookie, which the request then replays under; otherwise waits\n     *   for a `login()` in flight and replays with its token, see\n     *   `awaitLogins`; otherwise surfaces the `401` as is, see `signedOut`.\n     * - Otherwise: join or start this epoch's refresh.\n     *\n     * @param context - The credential and epoch the rejected attempt left with.\n     * @throws {SessionSupersededError} When the attempt belongs to an ended\n     *   session, or the session changed during the refresh.\n     */\n    async function refreshFor(context: RequestAuthContext): Promise<void> {\n        if (context.epoch !== null && context.epoch !== epoch) throw new SessionSupersededError();\n        if (staleWithinSession(context)) {\n            if (context.token === null) throw new Error(\"anonymous 401 under a live session\");\n            return;\n        }\n        if (context.token === null && signedOut()) {\n            if (rotatingEpochs.has(epoch)) return queue();\n            return awaitLogins();\n        }\n        return queue();\n    }\n\n    /**\n     * The client's `onUnauthorized`: end the session only when the `401` is the\n     * current session's own.\n     *\n     * The replay after a refresh is checked here too — it can come back `401`\n     * after the user signed out and another account signed in, and ending the\n     * session then would sign the new account out. A tokenless `401` with no\n     * session installed ends nothing either: there is no session to end, and\n     * ending \"nothing\" used to move the epoch and supersede the boot\n     * `refresh()` in flight.\n     *\n     * @param context - The credential and epoch of the attempt that failed.\n     * @throws {SessionSupersededError} When that attempt belongs to an ended\n     *   session.\n     */\n    async function onUnauthorized(_response: Response, context: RequestAuthContext): Promise<void> {\n        if (context.epoch !== null && context.epoch !== epoch) throw new SessionSupersededError();\n        if (staleWithinSession(context)) return;\n        if (context.token === null && signedOut()) return;\n        await endSession();\n    }\n\n    /**\n     * Authenticate and install the new session.\n     *\n     * The previous session ends only once the new credentials are accepted: a\n     * login that fails leaves it, and the refresh it may have in flight,\n     * untouched. When one was live, `onSessionEnd` runs with `\"switch\"` before\n     * the new tokens are installed — see the option for why that order. A\n     * `logout()` still tearing down is awaited the same way, so the new\n     * account's state never starts before the previous one's teardown ended.\n     * Never call it from inside `onSessionEnd`: it would wait on that hook.\n     * Every `logoutPath` revocation still in flight is awaited before the\n     * request leaves — at most {@link LOGOUT_REVOCATION_WAIT_MS} — so a\n     * cookie-clearing response cannot land after the new account's cookies.\n     *\n     * @param credentials - Sent as the login body.\n     * @returns The user of the new session, or null.\n     * @throws {SessionSupersededError} When a `logout()` or another `login()`\n     *   moved the session while this one was in flight — during its request,\n     *   during the teardown or while `mePath` was loading the user; the new\n     *   tokens, or the user, are discarded.\n     */\n    async function login(credentials: TCredentials): Promise<TUser | null> {\n        if (revocations.size > 0) await settleWithin([...revocations], LOGOUT_REVOCATION_WAIT_MS);\n        const run = signIn(credentials);\n        loginsInFlight.add(run);\n        try {\n            return await run;\n        } finally {\n            loginsInFlight.delete(run);\n        }\n    }\n\n    /**\n     * The body of `login()`, tracked in `loginsInFlight` by its caller so a\n     * tokenless `401` during the sign-in waits for it and replays with the\n     * token it installs, see `awaitLogins`. Tracking starts only after a\n     * pending revocation settled.\n     *\n     * @param credentials - Sent as the login body.\n     * @returns The user of the new session, or null.\n     * @throws {SessionSupersededError} See `login()`.\n     */\n    async function signIn(credentials: TCredentials): Promise<TUser | null> {\n        const started = epoch;\n        const data = await trackCredentialRequest(\n            api.post<unknown>(loginPath, {\n                body: credentials,\n                skipAuth: true,\n            }),\n        );\n        const { token, refreshToken } = parseTokens(data);\n        if (epoch !== started) {\n            revokeDiscarded(token ?? null, refreshToken);\n            throw new SessionSupersededError();\n        }\n        const { done } = finish(\"switch\");\n        const mine = epoch;\n        await done.catch(() => undefined);\n        if (epoch !== mine) throw new SessionSupersededError();\n        state().setToken(token);\n        writeRefreshToken(refreshToken ?? null);\n        const embedded = parseUser?.(data);\n        if (embedded != null) {\n            state().setUser(embedded);\n            return embedded;\n        }\n        return fetchUser();\n    }\n\n    /**\n     * End the current session, synchronously up to the hook.\n     *\n     * The epoch moves first, so a refresh resolving between here and the hook\n     * is already superseded. The hook only runs when there was a session to\n     * end — a token, a stored refresh token or a user — which is what keeps a\n     * burst of `401`s from running it once per request.\n     *\n     * With nothing left to end, the caller waits on the teardown already under\n     * way (`ending`, which never rejects, so a later no-op does not inherit an\n     * old error). Two callers skip that wait while a hook is running, because\n     * they may be the hook itself and would wait on their own teardown forever:\n     * `endSession` — a hook awaiting `auth.api` goes out tokenless, gets a\n     * `401`, and lands here — and a `logout()` with no session left. `login()`\n     * (`\"switch\"`) always waits: the new account's state must not start while\n     * the previous one's teardown is still clearing it. A hook awaiting\n     * `auth.login()` therefore never settles — misuse the option documents.\n     *\n     * `\"expired\"` with nothing live leaves the epoch alone: there is nothing to\n     * supersede but a refresh with no session behind it — the boot `refresh()`\n     * restoring one from the cookie — and moving the epoch would throw that\n     * away. `logout()` and `login()` always move it, since they must supersede\n     * such a refresh.\n     *\n     * The returned `done` is a fresh promise derived from the hook, not the one\n     * `ending` holds: a `logout()` nobody awaits still surfaces the hook's error\n     * as an unhandled rejection instead of losing it.\n     *\n     * @param reason - Whether the caller signed out, the client gave up, or a\n     *   login replaced the session.\n     * @returns Whether a live session ended here, and a promise settling with\n     *   the hook.\n     */\n    function finish(reason: TempestSessionEnd<TUser>[\"reason\"]): {\n        live: boolean;\n        done: Promise<void>;\n    } {\n        const { user, token } = state();\n        const live = token !== null || user !== null || readRefreshToken() !== null;\n        if (live || reason !== \"expired\") nextEpoch();\n        state().logout();\n        writeRefreshToken(null);\n        if (!live) {\n            const wait = reason === \"switch\" || hooksRunning === 0;\n            return { live, done: wait ? ending : Promise.resolve() };\n        }\n        if (!onSessionEnd) return { live, done: Promise.resolve() };\n        const sessionApi = endedSessionApi(token);\n        hooksRunning += 1;\n        const run = (async () => {\n            try {\n                await onSessionEnd({ reason, user, token, api: sessionApi });\n            } finally {\n                hooksRunning -= 1;\n            }\n        })();\n        ending = run.then(\n            () => undefined,\n            () => undefined,\n        );\n        return { live, done: run.then(() => undefined) };\n    }\n\n    /**\n     * Send the `logoutPath` revocation for the session about to end, with the\n     * credentials it holds now — read before `finish` clears them.\n     *\n     * Skipped without `logoutPath`, and in body mode when there is nothing to\n     * revoke; in cookie mode it always goes out, since the cookie it revokes is\n     * invisible to the client. Never rejects.\n     *\n     * In cookie mode it first waits — at most\n     * {@link LOGOUT_REVOCATION_WAIT_MS} — for the login and refresh responses\n     * in flight right now: each one sets a cookie for the session this\n     * `logout()` ends, and a revocation that left before it would leave that\n     * cookie behind.\n     *\n     * @returns A promise settling when the revocation settled, or null when\n     *   none was sent.\n     */\n    function revoke(): Promise<void> | null {\n        if (!logoutPath) return null;\n        const path = logoutPath;\n        const { token, user } = state();\n        const refreshToken = readRefreshToken();\n        if (!withCredentials && token === null && user === null && refreshToken === null) {\n            return null;\n        }\n        const inFlight = withCredentials ? [...credentialRequests] : [];\n        return trackRevocation(async () => {\n            await settleWithin(inFlight, LOGOUT_REVOCATION_WAIT_MS);\n            return endedSessionApi(token).post<unknown>(path, { body: refreshBody(refreshToken) });\n        });\n    }\n\n    function logout(): Promise<void> {\n        const revocation = revoke();\n        const { done } = finish(\"logout\");\n        if (!revocation) return done;\n        return Promise.all([revocation, done]).then(() => undefined);\n    }\n\n    /**\n     * End the session after the client gave up on it and, when `redirectTo`\n     * is set, leave the page once `onSessionEnd` settled.\n     *\n     * Separate from `logout` so an explicit sign-out stays a pure state change:\n     * a caller that already navigates itself would otherwise get a second,\n     * competing navigation. The hook is awaited before navigating because a\n     * hard navigation aborts whatever request it still had in flight. Only the\n     * call that ended a live session navigates; the rest of a burst of `401`s\n     * waits on the same teardown, or returns at once inside a hook.\n     */\n    async function endSession(): Promise<void> {\n        const { live, done } = finish(\"expired\");\n        await done.catch(() => undefined);\n        if (live && redirectTo && typeof window !== \"undefined\") {\n            window.location.assign(redirectTo);\n        }\n    }\n\n    const api = createApiClient({\n        baseURL,\n        prefix,\n        withCredentials,\n        csrf,\n        fetcher,\n        getToken,\n        getSessionEpoch: () => epoch,\n        refresh: refreshFor,\n        retry,\n        onUnauthorized,\n    });\n\n    const refresh = (): Promise<void> => queue();\n\n    return { useAuthStore, api, login, logout, refresh, getToken };\n}\n"],"mappings":";;;;;;AAgPA,IAAMA,IAA4B;AASlC,SAASC,EAAa,GAAsC,GAA2B;CAEnF,OADIC,EAAQ,WAAW,IAAU,QAAQ,QAAQ,IAC1C,IAAI,SAAe,MAAY;EAClC,IAAMC,IAAQ,WAAWC,GAASC,CAAE;EACpC,QAAa,WAAWH,CAAO,CAAC,CAAC,WAAW;GAExC,AADA,aAAaC,CAAK,GAClBC,EAAQ;EACZ,CAAC;CACL,CAAC;AACL;AAEA,SAASE,EAAmB,GAAyD;CACjF,IAAMC,IAAKC,KAAQ,CAAC;CACpB,OAAO;EAAE,OAAOD,EAAE;EAAc,cAAcA,EAAE;CAAc;AAClE;AAmDA,SAAgBE,EACZ,GACgC;CAChC,IAAM,EACF,YACA,WACA,eAAY,mBACZ,kBAAc,qBACd,eACA,mBACA,WACA,eAAY,gBACZ,aAAU,SACV,qBAAkB,IAClB,SACA,YACA,iBAAcH,GACd,cACA,kBAAe,MAAQI,IAAK,EAAE,eAAeA,EAAG,IAAI,KAAA,GACpD,WACA,eACA,oBACAC,GAEEC,IAAeC,EAAuB;EAAE,MAAMC;EAAW;CAAQ,CAAC,GAClEC,IAAa,GAAGD,EAAU;CAEhC,SAASE,IAA8B;EAEnC,OADI,OAAO,SAAW,MAAoB,OACnCC,MAAY,YAAY,OAAO,iBAAiB,OAAO;CAClE;CACA,SAASC,IAAkC;EACvC,OAAOF,EAAY,CAAC,EAAE,QAAQD,CAAU,KAAK;CACjD;CACA,SAASI,EAAkB,GAA4B;EACnD,IAAMC,IAAIJ,EAAY;EACtB,AAAKI,MACDC,IAAOD,EAAE,QAAQL,GAAYM,CAAK,IACjCD,EAAE,WAAWL,CAAU;CAChC;CAEA,IAAMO,UAAgCV,EAAa,SAAS,GACtDW,UAAgCD,EAAM,CAAC,CAAC;CAmB9C,eAAeE,IAAmC;EAC9C,IAAI,CAACC,GAAQ,OAAOH,EAAM,CAAC,CAAC;EAC5B,IAAMI,IAAUC,GACZC;EACJ,IAAI;GACA,IAAO,MAAMC,EAAI,IAAWJ,GAAQ,EAAE,eAAe,GAAK,CAAC;EAC/D,SAASK,GAAO;GAEZ,MADIH,MAAUD,IACRI,IADuB,IAAIC,EAAuB;EAE5D;EACA,IAAIJ,MAAUD,GAAS,MAAM,IAAIK,EAAuB;EAExD,OADAT,EAAM,CAAC,CAAC,QAAQM,CAAI,GACbA;CACX;CAEA,IAAID,IAAQ,GACRK,IAAwB,QAAQ,QAAQ,GACxCC,IAAe,GACbC,oBAAiB,IAAI,IAAsB,GAC3CC,oBAAc,IAAI,IAAmB,GACrCC,oBAAqB,IAAI,IAAsB,GAC/CC,oBAAiB,IAAI,IAAY;CASvC,SAASC,EAA0B,GAAiC;EAChE,IAAMC,IAAUC,EAAQ,WACd,KAAA,SACA,KAAA,CACV;EAGA,OAFAJ,EAAmB,IAAIG,CAAO,GAC9BA,EAAa,WAAWH,EAAmB,OAAOG,CAAO,CAAC,GACnDC;CACX;CAQA,SAASC,EAAkB,GAAsB;EAC7C,AAAIC,EAAW,KACX,QAAQ,KACJ,uEACAZ,CACJ;EAEJ,IAAI;GACA,KAAgBA,CAAK;EACzB,QAAQ;GACJ;EACJ;CACJ;CASA,SAASa,EAAgB,GAA8C;EACnE,IAAMC,KAAW,YAAY;GACzB,IAAI;IACA,MAAMC,EAAM;GAChB,SAASf,GAAO;IACZ,EAAkBA,CAAK;GAC3B;EACJ,EAAA,CAAG;EAGH,OAFAK,EAAY,IAAIS,CAAO,GACvBA,EAAa,WAAWT,EAAY,OAAOS,CAAO,CAAC,GAC5CA;CACX;CAcA,SAASE,EAAgB,GAAsB,GAAwC;EACnF,AAAKC,KAAc,MAAoBC,KACvCL,QACIM,EAAgB5B,CAAK,CAAC,CAAC,KAAc0B,GAAY,EAC7C,MAAMG,EAAYF,CAAY,EAClC,CAAC,CACL;CACJ;CASA,SAASC,EAAgB,GAAiC;EACtD,OAAOE,EAAgB;GACnB;GACA;GACA;GACA;GACA;GACA,gBAAgB9B;EACpB,CAAC;CACL;CAWA,SAAS+B,IAAkB;EAEvB,AADA,KAAS,GACT,IAAQC,EAAmBC,CAAM;CACrC;CAWA,eAAeA,IAAwB;EACnC,IAAM5B,IAAUC;EAChB,EAAe,IAAID,CAAO;EAC1B,IAAI;GACA,IAAIlB;GACJ,IAAI;IACA,IAAO,MAAM8B,EACTT,EAAI,KAAc0B,IAAa;KAC3B,MAAML,EAAYhC,EAAiB,CAAC;KACpC,UAAU;IACd,CAAC,CACL;GACJ,SAASY,GAAO;IAEZ,MADIH,MAAUD,IACRI,IADuB,IAAIC,EAAuB;GAE5D;GACA,IAAM,EAAE,UAAO,oBAAiByB,EAAYhD,CAAI;GAChD,IAAImB,MAAUD,GAEV,MADAoB,EAAgBzB,KAAS,MAAM2B,CAAY,GACrC,IAAIjB,EAAuB;GAGrC,AADAT,EAAM,CAAC,CAAC,SAASD,CAAK,GAClB2B,KAAc7B,EAAkB6B,CAAY;EACpD,UAAU;GACN,EAAe,OAAOtB,CAAO;EACjC;CACJ;CAEA,IAAI+B,IAAQJ,EAAmBC,CAAM;CAcrC,SAASI,EAAmB,GAAsC;EAC9D,IAAMC,IAAUpC,EAAS;EAEzB,OADIoC,MAAY,OAAa,KACtBC,EAAQ,UAAU,QAAQA,EAAQ,UAAUD;CACvD;CAgBA,SAASE,IAAqB;EAC1B,OAAOtC,EAAS,MAAM,QAAQL,EAAiB,MAAM;CACzD;CAmBA,eAAe4C,IAA6B;EACxC,IACI,EADA5B,EAAe,OAAO,KAAKD,MAAiB,MAC5C,MAAM,QAAQ,WAAW,CAAC,GAAGC,CAAc,CAAC,GACxCX,EAAS,MAAM,QAEvB,MAAU,MAAM,+BAA+B;CACnD;CAqBA,eAAewC,EAAW,GAA4C;EAClE,IAAIH,EAAQ,UAAU,QAAQA,EAAQ,UAAUjC,GAAO,MAAM,IAAII,EAAuB;EACxF,IAAI2B,EAAmBE,CAAO,GAC1B;OAAIA,EAAQ,UAAU,MAAM,MAAU,MAAM,oCAAoC;EAAA,OAOpF,OAJIA,EAAQ,UAAU,QAAQC,EAAU,IAChCxB,EAAe,IAAIV,CAAK,IAAU8B,EAAM,IACrCK,EAAY,IAEhBL,EAAM;CACjB;CAiBA,eAAeO,EAAe,GAAqB,GAA4C;EAC3F,IAAIJ,EAAQ,UAAU,QAAQA,EAAQ,UAAUjC,GAAO,MAAM,IAAII,EAAuB;EACxF,AAAI2B,EAAmBE,CAAO,KAC1BA,EAAQ,UAAU,QAAQC,EAAU,KACxC,MAAMI,GAAW;CACrB;CAuBA,eAAeC,GAAM,GAAkD;EACnE,AAAI/B,EAAY,OAAO,KAAG,MAAMlC,EAAa,CAAC,GAAGkC,CAAW,GAAGnC,CAAyB;EACxF,IAAMmE,IAAMC,GAAOC,CAAW;EAC9B,EAAe,IAAIF,CAAG;EACtB,IAAI;GACA,OAAO,MAAMA;EACjB,UAAU;GACN,EAAe,OAAOA,CAAG;EAC7B;CACJ;CAYA,eAAeC,GAAO,GAAkD;EACpE,IAAM1C,IAAUC,GACVnB,IAAO,MAAM8B,EACfT,EAAI,KAAcyC,GAAW;GACzB,MAAMD;GACN,UAAU;EACd,CAAC,CACL,GACM,EAAE,UAAO,oBAAiBb,EAAYhD,CAAI;EAChD,IAAImB,MAAUD,GAEV,MADAoB,EAAgBzB,KAAS,MAAM2B,CAAY,GACrC,IAAIjB,EAAuB;EAErC,IAAM,EAAE,YAASwC,EAAO,QAAQ,GAC1BC,IAAO7C;EAEb,IADA,MAAM8C,EAAK,YAAY,KAAA,CAAS,GAC5B9C,MAAU6C,GAAM,MAAM,IAAIzC,EAAuB;EAErD,AADAT,EAAM,CAAC,CAAC,SAASD,CAAK,GACtBF,EAAkB6B,KAAgB,IAAI;EACtC,IAAM0B,IAAWC,IAAYnE,CAAI;EAKjC,OAJIkE,KAAY,OAITlD,EAAU,KAHbF,EAAM,CAAC,CAAC,QAAQoD,CAAQ,GACjBA;CAGf;CAmCA,SAASH,EAAO,GAGd;EACE,IAAM,EAAE,SAAM,aAAUjD,EAAM,GACxBsD,IAAOvD,MAAU,QAAQO,MAAS,QAAQV,EAAiB,MAAM;EAIvE,KAHI0D,KAAQC,MAAW,cAAWzB,EAAU,GAC5C9B,EAAM,CAAC,CAAC,OAAO,GACfH,EAAkB,IAAI,GAClB,CAACyD,GAED,OAAO;GAAE;GAAM,MADFC,MAAW,YAAY5C,MAAiB,IACzBD,IAAS,QAAQ,QAAQ;EAAE;EAE3D,IAAI,CAAC8C,GAAc,OAAO;GAAE;GAAM,MAAM,QAAQ,QAAQ;EAAE;EAC1D,IAAMC,IAAa9B,EAAgB5B,CAAK;EACxC,KAAgB;EAChB,IAAM8C,KAAO,YAAY;GACrB,IAAI;IACA,MAAMW,EAAa;KAAE;KAAQ;KAAM;KAAO,KAAKC;IAAW,CAAC;GAC/D,UAAU;IACN;GACJ;EACJ,EAAA,CAAG;EAKH,OAJA,IAASZ,EAAI,WACH,KAAA,SACA,KAAA,CACV,GACO;GAAE;GAAM,MAAMA,EAAI,WAAW,KAAA,CAAS;EAAE;CACnD;CAmBA,SAASa,KAA+B;EACpC,IAAI,CAACjC,GAAY,OAAO;EACxB,IAAMkC,IAAOlC,GACP,EAAE,UAAO,YAASzB,EAAM,GACxB0B,IAAe9B,EAAiB;EACtC,IAAI,CAACgE,KAAmB7D,MAAU,QAAQO,MAAS,QAAQoB,MAAiB,MACxE,OAAO;EAEX,IAAMmC,IAAWD,IAAkB,CAAC,GAAG9C,CAAkB,IAAI,CAAC;EAC9D,OAAOO,EAAgB,aACnB,MAAM1C,EAAakF,GAAUnF,CAAyB,GAC/CiD,EAAgB5B,CAAK,CAAC,CAAC,KAAc4D,GAAM,EAAE,MAAM/B,EAAYF,CAAY,EAAE,CAAC,EACxF;CACL;CAEA,SAASoC,KAAwB;EAC7B,IAAMC,IAAaL,GAAO,GACpB,EAAE,YAAST,EAAO,QAAQ;EAEhC,OADKc,IACE,QAAQ,IAAI,CAACA,GAAYZ,CAAI,CAAC,CAAC,CAAC,WAAW,KAAA,CAAS,IADnCA;CAE5B;CAaA,eAAeR,KAA4B;EACvC,IAAM,EAAE,SAAM,YAASM,EAAO,SAAS;EAEvC,AADA,MAAME,EAAK,YAAY,KAAA,CAAS,GAC5BG,KAAQU,KAAc,OAAO,SAAW,OACxC,OAAO,SAAS,OAAOA,CAAU;CAEzC;CAEA,IAAMzD,IAAMsB,EAAgB;EACxB;EACA;EACA;EACA;EACA;EACA;EACA,uBAAuBxB;EACvB,SAASoC;EACT;EACA;CACJ,CAAC;CAID,OAAO;EAAE;EAAc;EAAK;EAAO;EAAQ,eAFNN,EAAM;EAES;CAAS;AACjE"}

package/dist/auth/jwt.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.cjs","names":[],"sources":["../../src/auth/jwt.ts"],"sourcesContent":["export interface DecodedJWT {\n    header: Record<string, unknown>;\n    payload: Record<string, unknown> & { exp?: number; iat?: number; sub?: string };\n    signature: string;\n}\n\nfunction base64UrlDecode(input: string): string {\n    const padded = input.replace(/-/g, \"+\").replace(/_/g, \"/\");\n    const padding = padded.length % 4 === 0 ? \"\" : \"=\".repeat(4 - (padded.length % 4));\n    if (typeof atob !== \"undefined\") {\n        return atob(padded + padding);\n    }\n    return Buffer.from(padded + padding, \"base64\").toString(\"binary\");\n}\n\n/**\n * Decode a JWT into header/payload/signature. Does **not** verify the\n * signature — for that, do it server-side or use a JOSE library on the\n * client.\n *\n * @throws If the token shape is invalid (missing parts, bad JSON).\n */\nexport function decodeJWT(token: string): DecodedJWT {\n    const parts = token.split(\".\");\n    if (parts.length !== 3) throw new Error(\"Invalid JWT: must contain three segments.\");\n    const [headerSeg, payloadSeg, signature] = parts as [string, string, string];\n    try {\n        return {\n            header: JSON.parse(base64UrlDecode(headerSeg)),\n            payload: JSON.parse(base64UrlDecode(payloadSeg)),\n            signature,\n        };\n    } catch {\n        throw new Error(\"Invalid JWT: header or payload is not valid JSON.\");\n    }\n}\n\n/**\n * Return true when the JWT's `exp` claim is in the past (or missing).\n *\n * @param token - JWT to inspect.\n * @param leewaySeconds - Treat tokens expiring within this window as expired.\n */\nexport function isJWTExpired(token: string, leewaySeconds = 0): boolean {\n    try {\n        const { payload } = decodeJWT(token);\n        if (typeof payload.exp !== \"number\") return true;\n        const nowSeconds = Math.floor(Date.now() / 1000);\n        return payload.exp <= nowSeconds + leewaySeconds;\n    } catch {\n        return true;\n    }\n}\n"],"mappings":"AAMA,SAAS,EAAgB,EAAuB,CAC5C,IAAM,EAAS,EAAM,QAAQ,KAAM,GAAG,CAAC,CAAC,QAAQ,KAAM,GAAG,EACnD,EAAU,EAAO,OAAS,GAAM,EAAI,GAAK,IAAI,OAAO,EAAK,EAAO,OAAS,CAAE,EAIjF,OAHI,OAAO,KAAS,IACT,KAAK,EAAS,CAAO,EAEzB,OAAO,KAAK,EAAS,EAAS,QAAQ,CAAC,CAAC,SAAS,QAAQ,CACpE,CASA,SAAgB,EAAU,EAA2B,CACjD,IAAM,EAAQ,EAAM,MAAM,GAAG,EAC7B,GAAI,EAAM,SAAW,EAAG,MAAU,MAAM,2CAA2C,EACnF,GAAM,CAAC,EAAW,EAAY,GAAa,EAC3C,GAAI,CACA,MAAO,CACH,OAAQ,KAAK,MAAM,EAAgB,CAAS,CAAC,EAC7C,QAAS,KAAK,MAAM,EAAgB,CAAU,CAAC,EAC/C,WACJ,CACJ,MAAQ,CACJ,MAAU,MAAM,mDAAmD,CACvE,CACJ,CAQA,SAAgB,EAAa,EAAe,EAAgB,EAAY,CACpE,GAAI,CACA,GAAM,CAAE,WAAY,EAAU,CAAK,EACnC,GAAI,OAAO,EAAQ,KAAQ,SAAU,MAAO,GAC5C,IAAM,EAAa,KAAK,MAAM,KAAK,IAAI,EAAI,GAAI,EAC/C,OAAO,EAAQ,KAAO,EAAa,CACvC,MAAQ,CACJ,MAAO,EACX,CACJ"}
+{"version":3,"file":"jwt.cjs","names":["base64UrlDecode","padded","input","padding","decodeJWT","parts","token","headerSeg","payloadSeg","signature","isJWTExpired","payload","nowSeconds","leewaySeconds"],"sources":["../../src/auth/jwt.ts"],"sourcesContent":["export interface DecodedJWT {\n    header: Record<string, unknown>;\n    payload: Record<string, unknown> & { exp?: number; iat?: number; sub?: string };\n    signature: string;\n}\n\nfunction base64UrlDecode(input: string): string {\n    const padded = input.replace(/-/g, \"+\").replace(/_/g, \"/\");\n    const padding = padded.length % 4 === 0 ? \"\" : \"=\".repeat(4 - (padded.length % 4));\n    if (typeof atob !== \"undefined\") {\n        return atob(padded + padding);\n    }\n    return Buffer.from(padded + padding, \"base64\").toString(\"binary\");\n}\n\n/**\n * Decode a JWT into header/payload/signature. Does **not** verify the\n * signature — for that, do it server-side or use a JOSE library on the\n * client.\n *\n * @throws If the token shape is invalid (missing parts, bad JSON).\n */\nexport function decodeJWT(token: string): DecodedJWT {\n    const parts = token.split(\".\");\n    if (parts.length !== 3) throw new Error(\"Invalid JWT: must contain three segments.\");\n    const [headerSeg, payloadSeg, signature] = parts as [string, string, string];\n    try {\n        return {\n            header: JSON.parse(base64UrlDecode(headerSeg)),\n            payload: JSON.parse(base64UrlDecode(payloadSeg)),\n            signature,\n        };\n    } catch {\n        throw new Error(\"Invalid JWT: header or payload is not valid JSON.\");\n    }\n}\n\n/**\n * Return true when the JWT's `exp` claim is in the past (or missing).\n *\n * @param token - JWT to inspect.\n * @param leewaySeconds - Treat tokens expiring within this window as expired.\n */\nexport function isJWTExpired(token: string, leewaySeconds = 0): boolean {\n    try {\n        const { payload } = decodeJWT(token);\n        if (typeof payload.exp !== \"number\") return true;\n        const nowSeconds = Math.floor(Date.now() / 1000);\n        return payload.exp <= nowSeconds + leewaySeconds;\n    } catch {\n        return true;\n    }\n}\n"],"mappings":"AAMA,SAASA,EAAgB,EAAuB,CAC5C,IAAMC,EAASC,EAAM,QAAQ,KAAM,GAAG,CAAC,CAAC,QAAQ,KAAM,GAAG,EACnDC,EAAUF,EAAO,OAAS,GAAM,EAAI,GAAK,IAAI,OAAO,EAAKA,EAAO,OAAS,CAAE,EAIjF,OAHI,OAAO,KAAS,IACT,KAAKA,EAASE,CAAO,EAEzB,OAAO,KAAKF,EAASE,EAAS,QAAQ,CAAC,CAAC,SAAS,QAAQ,CACpE,CASA,SAAgBC,EAAU,EAA2B,CACjD,IAAMC,EAAQC,EAAM,MAAM,GAAG,EAC7B,GAAID,EAAM,SAAW,EAAG,MAAU,MAAM,2CAA2C,EACnF,GAAM,CAACE,EAAWC,EAAYC,GAAaJ,EAC3C,GAAI,CACA,MAAO,CACH,OAAQ,KAAK,MAAML,EAAgBO,CAAS,CAAC,EAC7C,QAAS,KAAK,MAAMP,EAAgBQ,CAAU,CAAC,EAC/C,WACJ,CACJ,MAAQ,CACJ,MAAU,MAAM,mDAAmD,CACvE,CACJ,CAQA,SAAgBE,EAAa,EAAe,EAAgB,EAAY,CACpE,GAAI,CACA,GAAM,CAAE,WAAYN,EAAUE,CAAK,EACnC,GAAI,OAAOK,EAAQ,KAAQ,SAAU,MAAO,GAC5C,IAAMC,EAAa,KAAK,MAAM,KAAK,IAAI,EAAI,GAAI,EAC/C,OAAOD,EAAQ,KAAOC,EAAaC,CACvC,MAAQ,CACJ,MAAO,EACX,CACJ,C"}

package/dist/auth/jwt.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.js","names":[],"sources":["../../src/auth/jwt.ts"],"sourcesContent":["export interface DecodedJWT {\n    header: Record<string, unknown>;\n    payload: Record<string, unknown> & { exp?: number; iat?: number; sub?: string };\n    signature: string;\n}\n\nfunction base64UrlDecode(input: string): string {\n    const padded = input.replace(/-/g, \"+\").replace(/_/g, \"/\");\n    const padding = padded.length % 4 === 0 ? \"\" : \"=\".repeat(4 - (padded.length % 4));\n    if (typeof atob !== \"undefined\") {\n        return atob(padded + padding);\n    }\n    return Buffer.from(padded + padding, \"base64\").toString(\"binary\");\n}\n\n/**\n * Decode a JWT into header/payload/signature. Does **not** verify the\n * signature — for that, do it server-side or use a JOSE library on the\n * client.\n *\n * @throws If the token shape is invalid (missing parts, bad JSON).\n */\nexport function decodeJWT(token: string): DecodedJWT {\n    const parts = token.split(\".\");\n    if (parts.length !== 3) throw new Error(\"Invalid JWT: must contain three segments.\");\n    const [headerSeg, payloadSeg, signature] = parts as [string, string, string];\n    try {\n        return {\n            header: JSON.parse(base64UrlDecode(headerSeg)),\n            payload: JSON.parse(base64UrlDecode(payloadSeg)),\n            signature,\n        };\n    } catch {\n        throw new Error(\"Invalid JWT: header or payload is not valid JSON.\");\n    }\n}\n\n/**\n * Return true when the JWT's `exp` claim is in the past (or missing).\n *\n * @param token - JWT to inspect.\n * @param leewaySeconds - Treat tokens expiring within this window as expired.\n */\nexport function isJWTExpired(token: string, leewaySeconds = 0): boolean {\n    try {\n        const { payload } = decodeJWT(token);\n        if (typeof payload.exp !== \"number\") return true;\n        const nowSeconds = Math.floor(Date.now() / 1000);\n        return payload.exp <= nowSeconds + leewaySeconds;\n    } catch {\n        return true;\n    }\n}\n"],"mappings":";AAMA,SAAS,EAAgB,GAAuB;CAC5C,IAAM,IAAS,EAAM,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG,GACnD,IAAU,EAAO,SAAS,KAAM,IAAI,KAAK,IAAI,OAAO,IAAK,EAAO,SAAS,CAAE;CAIjF,OAHI,OAAO,OAAS,MACT,KAAK,IAAS,CAAO,IAEzB,OAAO,KAAK,IAAS,GAAS,QAAQ,CAAC,CAAC,SAAS,QAAQ;AACpE;AASA,SAAgB,EAAU,GAA2B;CACjD,IAAM,IAAQ,EAAM,MAAM,GAAG;CAC7B,IAAI,EAAM,WAAW,GAAG,MAAU,MAAM,2CAA2C;CACnF,IAAM,CAAC,GAAW,GAAY,KAAa;CAC3C,IAAI;EACA,OAAO;GACH,QAAQ,KAAK,MAAM,EAAgB,CAAS,CAAC;GAC7C,SAAS,KAAK,MAAM,EAAgB,CAAU,CAAC;GAC/C;EACJ;CACJ,QAAQ;EACJ,MAAU,MAAM,mDAAmD;CACvE;AACJ;AAQA,SAAgB,EAAa,GAAe,IAAgB,GAAY;CACpE,IAAI;EACA,IAAM,EAAE,eAAY,EAAU,CAAK;EACnC,IAAI,OAAO,EAAQ,OAAQ,UAAU,OAAO;EAC5C,IAAM,IAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EAC/C,OAAO,EAAQ,OAAO,IAAa;CACvC,QAAQ;EACJ,OAAO;CACX;AACJ"}
+{"version":3,"file":"jwt.js","names":["base64UrlDecode","padded","input","padding","decodeJWT","parts","token","headerSeg","payloadSeg","signature","isJWTExpired","payload","nowSeconds","leewaySeconds"],"sources":["../../src/auth/jwt.ts"],"sourcesContent":["export interface DecodedJWT {\n    header: Record<string, unknown>;\n    payload: Record<string, unknown> & { exp?: number; iat?: number; sub?: string };\n    signature: string;\n}\n\nfunction base64UrlDecode(input: string): string {\n    const padded = input.replace(/-/g, \"+\").replace(/_/g, \"/\");\n    const padding = padded.length % 4 === 0 ? \"\" : \"=\".repeat(4 - (padded.length % 4));\n    if (typeof atob !== \"undefined\") {\n        return atob(padded + padding);\n    }\n    return Buffer.from(padded + padding, \"base64\").toString(\"binary\");\n}\n\n/**\n * Decode a JWT into header/payload/signature. Does **not** verify the\n * signature — for that, do it server-side or use a JOSE library on the\n * client.\n *\n * @throws If the token shape is invalid (missing parts, bad JSON).\n */\nexport function decodeJWT(token: string): DecodedJWT {\n    const parts = token.split(\".\");\n    if (parts.length !== 3) throw new Error(\"Invalid JWT: must contain three segments.\");\n    const [headerSeg, payloadSeg, signature] = parts as [string, string, string];\n    try {\n        return {\n            header: JSON.parse(base64UrlDecode(headerSeg)),\n            payload: JSON.parse(base64UrlDecode(payloadSeg)),\n            signature,\n        };\n    } catch {\n        throw new Error(\"Invalid JWT: header or payload is not valid JSON.\");\n    }\n}\n\n/**\n * Return true when the JWT's `exp` claim is in the past (or missing).\n *\n * @param token - JWT to inspect.\n * @param leewaySeconds - Treat tokens expiring within this window as expired.\n */\nexport function isJWTExpired(token: string, leewaySeconds = 0): boolean {\n    try {\n        const { payload } = decodeJWT(token);\n        if (typeof payload.exp !== \"number\") return true;\n        const nowSeconds = Math.floor(Date.now() / 1000);\n        return payload.exp <= nowSeconds + leewaySeconds;\n    } catch {\n        return true;\n    }\n}\n"],"mappings":";AAMA,SAASA,EAAgB,GAAuB;CAC5C,IAAMC,IAASC,EAAM,QAAQ,MAAM,GAAG,CAAC,CAAC,QAAQ,MAAM,GAAG,GACnDC,IAAUF,EAAO,SAAS,KAAM,IAAI,KAAK,IAAI,OAAO,IAAKA,EAAO,SAAS,CAAE;CAIjF,OAHI,OAAO,OAAS,MACT,KAAKA,IAASE,CAAO,IAEzB,OAAO,KAAKF,IAASE,GAAS,QAAQ,CAAC,CAAC,SAAS,QAAQ;AACpE;AASA,SAAgBC,EAAU,GAA2B;CACjD,IAAMC,IAAQC,EAAM,MAAM,GAAG;CAC7B,IAAID,EAAM,WAAW,GAAG,MAAU,MAAM,2CAA2C;CACnF,IAAM,CAACE,GAAWC,GAAYC,KAAaJ;CAC3C,IAAI;EACA,OAAO;GACH,QAAQ,KAAK,MAAML,EAAgBO,CAAS,CAAC;GAC7C,SAAS,KAAK,MAAMP,EAAgBQ,CAAU,CAAC;GAC/C;EACJ;CACJ,QAAQ;EACJ,MAAU,MAAM,mDAAmD;CACvE;AACJ;AAQA,SAAgBE,EAAa,GAAe,IAAgB,GAAY;CACpE,IAAI;EACA,IAAM,EAAE,eAAYN,EAAUE,CAAK;EACnC,IAAI,OAAOK,EAAQ,OAAQ,UAAU,OAAO;EAC5C,IAAMC,IAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EAC/C,OAAOD,EAAQ,OAAOC,IAAaC;CACvC,QAAQ;EACJ,OAAO;CACX;AACJ"}

package/dist/auth/lazy-with-retry.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"lazy-with-retry.cjs","names":[],"sources":["../../src/auth/lazy-with-retry.ts"],"sourcesContent":["import { lazy } from \"react\";\nimport type { ComponentType } from \"react\";\n\n/**\n * Any React component, whatever props it declares.\n *\n * Props sit in a *parameter* position, so a bound over them is contravariant:\n * `ComponentType<unknown>` reads as \"a component that accepts every possible\n * props object\", and only a component that declares no props at all satisfies\n * it. A page typed `({ mode }: Props) => …` is rejected, and so is one whose\n * props are entirely optional. `any` is the only bound that admits every\n * component — which is why React itself declares `lazy` and\n * `LazyExoticComponent` as `ComponentType<any>`. `ComponentType<never>` is not\n * an escape: it fails React's own bound through\n * `ComponentClass.getDerivedStateFromProps`, where the props land back in a\n * covariant position.\n *\n * This relaxes the *bound* only. `T` is still inferred as the concrete\n * component, so the rendered element keeps checking its props and `preload()`\n * still resolves to the concrete module.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\ntype AnyComponent = ComponentType<any>;\n\nexport interface LazyWithRetryOptions {\n    /** Max attempts. Default: 3. */\n    retries?: number;\n    /** Initial delay (ms) before retrying. Default: 400. */\n    initialDelay?: number;\n    /**\n     * Reload the page after every retry fails. Helps when the stale chunk\n     * error is caused by an old `index.html` referencing deleted bundles.\n     * Default: true.\n     */\n    reloadOnFinalFailure?: boolean;\n}\n\n/** A lazy component that can also be fetched ahead of being rendered. */\nexport type PreloadableLazy<T extends AnyComponent> = ReturnType<typeof lazy<T>> & {\n    /**\n     * Start fetching the chunk now, before anything renders it.\n     *\n     * Call it on the interaction that makes the route likely — hovering the\n     * link, opening the menu that holds it, finishing the step before it — so\n     * the chunk is warm by the time the user commits and the suspense fallback\n     * never appears.\n     *\n     * Shares its work with the render path: whichever fires first performs the\n     * single fetch and the other awaits the same promise. Safe to call\n     * repeatedly.\n     *\n     * @returns The module, once loaded. Rejects when every retry failed; that\n     *   rejection is already handled internally, so a fire-and-forget call\n     *   never surfaces as an unhandled rejection.\n     */\n    preload: () => Promise<{ default: T }>;\n};\n\n/**\n * Wrap `React.lazy` with automatic retry and a `preload()` method.\n *\n * Common cause of failure: deployed-then-cached `index.html` references chunk\n * filenames that no longer exist. Retrying after a short delay typically picks\n * up the new bundle; a final `location.reload()` recovers from stale\n * `index.html`.\n *\n * The wrapped component keeps its own props: `T` is inferred from the module\n * the factory resolves to, so a page declaring required, optional or no props\n * all pass through and the rendered element is still checked against them. See\n * {@link AnyComponent} for why the constraint has to be written the way it is.\n *\n * @param factory Dynamic import of the module whose `default` is the component.\n * @param options Retry count, initial backoff and the final-failure reload.\n * @returns The lazy component, carrying an extra `preload()`.\n *\n * @example\n * const Settings = lazyWithRetry(() => import(\"./Settings\"));\n *\n * // Warm the chunk when the route becomes likely, not when it is needed.\n * <a href=\"/settings\" onMouseEnter={() => void Settings.preload()}>Settings</a>\n */\nexport function lazyWithRetry<T extends AnyComponent>(\n    factory: () => Promise<{ default: T }>,\n    options: LazyWithRetryOptions = {},\n): PreloadableLazy<T> {\n    const { retries = 3, initialDelay = 400, reloadOnFinalFailure = true } = options;\n\n    async function load(attempt = 1): Promise<{ default: T }> {\n        try {\n            return await factory();\n        } catch (error) {\n            if (attempt >= retries) {\n                if (reloadOnFinalFailure && typeof window !== \"undefined\") {\n                    window.location.reload();\n                }\n                throw error;\n            }\n            await new Promise((resolve) => setTimeout(resolve, initialDelay * 2 ** (attempt - 1)));\n            return load(attempt + 1);\n        }\n    }\n\n    let pending: Promise<{ default: T }> | null = null;\n\n    /**\n     * Run `load` at most once at a time, so preloading and rendering never\n     * fetch the same chunk twice.\n     *\n     * The internal `catch` does two jobs: it clears the memo, so a component\n     * that failed can be tried again once an error boundary resets, and it\n     * marks the promise as handled, so a `preload()` nobody awaited does not\n     * raise an unhandled rejection. Callers still get a promise that rejects.\n     */\n    function loadOnce(): Promise<{ default: T }> {\n        if (!pending) {\n            pending = load();\n            pending.catch(() => {\n                pending = null;\n            });\n        }\n        return pending;\n    }\n\n    const component = lazy(loadOnce) as PreloadableLazy<T>;\n    component.preload = loadOnce;\n    return component;\n}\n"],"mappings":"uBAiFA,SAAgB,EACZ,EACA,EAAgC,CAAC,EACf,CAClB,GAAM,CAAE,UAAU,EAAG,eAAe,IAAK,uBAAuB,IAAS,EAEzE,eAAe,EAAK,EAAU,EAA4B,CACtD,GAAI,CACA,OAAO,MAAM,EAAQ,CACzB,OAAS,EAAO,CACZ,GAAI,GAAW,EAIX,MAHI,GAAwB,OAAO,OAAW,KAC1C,OAAO,SAAS,OAAO,EAErB,EAGV,OADA,MAAM,IAAI,QAAS,GAAY,WAAW,EAAS,EAAe,IAAM,EAAU,EAAE,CAAC,EAC9E,EAAK,EAAU,CAAC,CAC3B,CACJ,CAEA,IAAI,EAA0C,KAW9C,SAAS,GAAoC,CAOzC,OANK,IACD,EAAU,EAAK,EACf,EAAQ,UAAY,CAChB,EAAU,IACd,CAAC,GAEE,CACX,CAEA,IAAM,GAAA,EAAY,EAAA,KAAA,CAAK,CAAQ,EAE/B,MADA,GAAU,QAAU,EACb,CACX"}
+{"version":3,"file":"lazy-with-retry.cjs","names":["lazy","react","lazyWithRetry","options","load","factory","error","attempt","retries","reloadOnFinalFailure","resolve","initialDelay","pending","loadOnce","component"],"sources":["../../src/auth/lazy-with-retry.ts"],"sourcesContent":["import { lazy } from \"react\";\nimport type { ComponentType } from \"react\";\n\n/**\n * Any React component, whatever props it declares.\n *\n * Props sit in a *parameter* position, so a bound over them is contravariant:\n * `ComponentType<unknown>` reads as \"a component that accepts every possible\n * props object\", and only a component that declares no props at all satisfies\n * it. A page typed `({ mode }: Props) => …` is rejected, and so is one whose\n * props are entirely optional. `any` is the only bound that admits every\n * component — which is why React itself declares `lazy` and\n * `LazyExoticComponent` as `ComponentType<any>`. `ComponentType<never>` is not\n * an escape: it fails React's own bound through\n * `ComponentClass.getDerivedStateFromProps`, where the props land back in a\n * covariant position.\n *\n * This relaxes the *bound* only. `T` is still inferred as the concrete\n * component, so the rendered element keeps checking its props and `preload()`\n * still resolves to the concrete module.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\ntype AnyComponent = ComponentType<any>;\n\nexport interface LazyWithRetryOptions {\n    /** Max attempts. Default: 3. */\n    retries?: number;\n    /** Initial delay (ms) before retrying. Default: 400. */\n    initialDelay?: number;\n    /**\n     * Reload the page after every retry fails. Helps when the stale chunk\n     * error is caused by an old `index.html` referencing deleted bundles.\n     * Default: true.\n     */\n    reloadOnFinalFailure?: boolean;\n}\n\n/** A lazy component that can also be fetched ahead of being rendered. */\nexport type PreloadableLazy<T extends AnyComponent> = ReturnType<typeof lazy<T>> & {\n    /**\n     * Start fetching the chunk now, before anything renders it.\n     *\n     * Call it on the interaction that makes the route likely — hovering the\n     * link, opening the menu that holds it, finishing the step before it — so\n     * the chunk is warm by the time the user commits and the suspense fallback\n     * never appears.\n     *\n     * Shares its work with the render path: whichever fires first performs the\n     * single fetch and the other awaits the same promise. Safe to call\n     * repeatedly.\n     *\n     * @returns The module, once loaded. Rejects when every retry failed; that\n     *   rejection is already handled internally, so a fire-and-forget call\n     *   never surfaces as an unhandled rejection.\n     */\n    preload: () => Promise<{ default: T }>;\n};\n\n/**\n * Wrap `React.lazy` with automatic retry and a `preload()` method.\n *\n * Common cause of failure: deployed-then-cached `index.html` references chunk\n * filenames that no longer exist. Retrying after a short delay typically picks\n * up the new bundle; a final `location.reload()` recovers from stale\n * `index.html`.\n *\n * The wrapped component keeps its own props: `T` is inferred from the module\n * the factory resolves to, so a page declaring required, optional or no props\n * all pass through and the rendered element is still checked against them. See\n * {@link AnyComponent} for why the constraint has to be written the way it is.\n *\n * @param factory Dynamic import of the module whose `default` is the component.\n * @param options Retry count, initial backoff and the final-failure reload.\n * @returns The lazy component, carrying an extra `preload()`.\n *\n * @example\n * const Settings = lazyWithRetry(() => import(\"./Settings\"));\n *\n * // Warm the chunk when the route becomes likely, not when it is needed.\n * <a href=\"/settings\" onMouseEnter={() => void Settings.preload()}>Settings</a>\n */\nexport function lazyWithRetry<T extends AnyComponent>(\n    factory: () => Promise<{ default: T }>,\n    options: LazyWithRetryOptions = {},\n): PreloadableLazy<T> {\n    const { retries = 3, initialDelay = 400, reloadOnFinalFailure = true } = options;\n\n    async function load(attempt = 1): Promise<{ default: T }> {\n        try {\n            return await factory();\n        } catch (error) {\n            if (attempt >= retries) {\n                if (reloadOnFinalFailure && typeof window !== \"undefined\") {\n                    window.location.reload();\n                }\n                throw error;\n            }\n            await new Promise((resolve) => setTimeout(resolve, initialDelay * 2 ** (attempt - 1)));\n            return load(attempt + 1);\n        }\n    }\n\n    let pending: Promise<{ default: T }> | null = null;\n\n    /**\n     * Run `load` at most once at a time, so preloading and rendering never\n     * fetch the same chunk twice.\n     *\n     * The internal `catch` does two jobs: it clears the memo, so a component\n     * that failed can be tried again once an error boundary resets, and it\n     * marks the promise as handled, so a `preload()` nobody awaited does not\n     * raise an unhandled rejection. Callers still get a promise that rejects.\n     */\n    function loadOnce(): Promise<{ default: T }> {\n        if (!pending) {\n            pending = load();\n            pending.catch(() => {\n                pending = null;\n            });\n        }\n        return pending;\n    }\n\n    const component = lazy(loadOnce) as PreloadableLazy<T>;\n    component.preload = loadOnce;\n    return component;\n}\n"],"mappings":"A,uBAiFA,SAAgBE,EACZ,EACA,EAAgC,CAAC,EACf,CAClB,GAAM,CAAE,UAAU,EAAG,eAAe,IAAK,uBAAuB,IAASC,EAEzE,eAAeC,EAAK,EAAU,EAA4B,CACtD,GAAI,CACA,OAAO,MAAMC,EAAQ,CACzB,OAASC,EAAO,CACZ,GAAIC,GAAWC,EAIX,MAHIC,GAAwB,OAAO,OAAW,KAC1C,OAAO,SAAS,OAAO,EAErBH,EAGV,OADA,MAAM,IAAI,QAAS,GAAY,WAAWI,EAASC,EAAe,IAAMJ,EAAU,EAAE,CAAC,EAC9EH,EAAKG,EAAU,CAAC,CAC3B,CACJ,CAEA,IAAIK,EAA0C,KAW9C,SAASC,GAAoC,CAOzC,OANKD,IACD,EAAUR,EAAK,EACfQ,EAAQ,UAAY,CAChB,EAAU,IACd,CAAC,GAEEA,CACX,CAEA,IAAME,GAAA,EAAYd,EAAAA,KAAAA,CAAKa,CAAQ,EAE/B,MADA,GAAU,QAAUA,EACbC,CACX,C"}

package/dist/auth/lazy-with-retry.js.map

@@ -1 +1 @@
-{"version":3,"file":"lazy-with-retry.js","names":[],"sources":["../../src/auth/lazy-with-retry.ts"],"sourcesContent":["import { lazy } from \"react\";\nimport type { ComponentType } from \"react\";\n\n/**\n * Any React component, whatever props it declares.\n *\n * Props sit in a *parameter* position, so a bound over them is contravariant:\n * `ComponentType<unknown>` reads as \"a component that accepts every possible\n * props object\", and only a component that declares no props at all satisfies\n * it. A page typed `({ mode }: Props) => …` is rejected, and so is one whose\n * props are entirely optional. `any` is the only bound that admits every\n * component — which is why React itself declares `lazy` and\n * `LazyExoticComponent` as `ComponentType<any>`. `ComponentType<never>` is not\n * an escape: it fails React's own bound through\n * `ComponentClass.getDerivedStateFromProps`, where the props land back in a\n * covariant position.\n *\n * This relaxes the *bound* only. `T` is still inferred as the concrete\n * component, so the rendered element keeps checking its props and `preload()`\n * still resolves to the concrete module.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\ntype AnyComponent = ComponentType<any>;\n\nexport interface LazyWithRetryOptions {\n    /** Max attempts. Default: 3. */\n    retries?: number;\n    /** Initial delay (ms) before retrying. Default: 400. */\n    initialDelay?: number;\n    /**\n     * Reload the page after every retry fails. Helps when the stale chunk\n     * error is caused by an old `index.html` referencing deleted bundles.\n     * Default: true.\n     */\n    reloadOnFinalFailure?: boolean;\n}\n\n/** A lazy component that can also be fetched ahead of being rendered. */\nexport type PreloadableLazy<T extends AnyComponent> = ReturnType<typeof lazy<T>> & {\n    /**\n     * Start fetching the chunk now, before anything renders it.\n     *\n     * Call it on the interaction that makes the route likely — hovering the\n     * link, opening the menu that holds it, finishing the step before it — so\n     * the chunk is warm by the time the user commits and the suspense fallback\n     * never appears.\n     *\n     * Shares its work with the render path: whichever fires first performs the\n     * single fetch and the other awaits the same promise. Safe to call\n     * repeatedly.\n     *\n     * @returns The module, once loaded. Rejects when every retry failed; that\n     *   rejection is already handled internally, so a fire-and-forget call\n     *   never surfaces as an unhandled rejection.\n     */\n    preload: () => Promise<{ default: T }>;\n};\n\n/**\n * Wrap `React.lazy` with automatic retry and a `preload()` method.\n *\n * Common cause of failure: deployed-then-cached `index.html` references chunk\n * filenames that no longer exist. Retrying after a short delay typically picks\n * up the new bundle; a final `location.reload()` recovers from stale\n * `index.html`.\n *\n * The wrapped component keeps its own props: `T` is inferred from the module\n * the factory resolves to, so a page declaring required, optional or no props\n * all pass through and the rendered element is still checked against them. See\n * {@link AnyComponent} for why the constraint has to be written the way it is.\n *\n * @param factory Dynamic import of the module whose `default` is the component.\n * @param options Retry count, initial backoff and the final-failure reload.\n * @returns The lazy component, carrying an extra `preload()`.\n *\n * @example\n * const Settings = lazyWithRetry(() => import(\"./Settings\"));\n *\n * // Warm the chunk when the route becomes likely, not when it is needed.\n * <a href=\"/settings\" onMouseEnter={() => void Settings.preload()}>Settings</a>\n */\nexport function lazyWithRetry<T extends AnyComponent>(\n    factory: () => Promise<{ default: T }>,\n    options: LazyWithRetryOptions = {},\n): PreloadableLazy<T> {\n    const { retries = 3, initialDelay = 400, reloadOnFinalFailure = true } = options;\n\n    async function load(attempt = 1): Promise<{ default: T }> {\n        try {\n            return await factory();\n        } catch (error) {\n            if (attempt >= retries) {\n                if (reloadOnFinalFailure && typeof window !== \"undefined\") {\n                    window.location.reload();\n                }\n                throw error;\n            }\n            await new Promise((resolve) => setTimeout(resolve, initialDelay * 2 ** (attempt - 1)));\n            return load(attempt + 1);\n        }\n    }\n\n    let pending: Promise<{ default: T }> | null = null;\n\n    /**\n     * Run `load` at most once at a time, so preloading and rendering never\n     * fetch the same chunk twice.\n     *\n     * The internal `catch` does two jobs: it clears the memo, so a component\n     * that failed can be tried again once an error boundary resets, and it\n     * marks the promise as handled, so a `preload()` nobody awaited does not\n     * raise an unhandled rejection. Callers still get a promise that rejects.\n     */\n    function loadOnce(): Promise<{ default: T }> {\n        if (!pending) {\n            pending = load();\n            pending.catch(() => {\n                pending = null;\n            });\n        }\n        return pending;\n    }\n\n    const component = lazy(loadOnce) as PreloadableLazy<T>;\n    component.preload = loadOnce;\n    return component;\n}\n"],"mappings":";;AAiFA,SAAgB,EACZ,GACA,IAAgC,CAAC,GACf;CAClB,IAAM,EAAE,aAAU,GAAG,kBAAe,KAAK,0BAAuB,OAAS;CAEzE,eAAe,EAAK,IAAU,GAA4B;EACtD,IAAI;GACA,OAAO,MAAM,EAAQ;EACzB,SAAS,GAAO;GACZ,IAAI,KAAW,GAIX,MAHI,KAAwB,OAAO,SAAW,OAC1C,OAAO,SAAS,OAAO,GAErB;GAGV,OADA,MAAM,IAAI,SAAS,MAAY,WAAW,GAAS,IAAe,MAAM,IAAU,EAAE,CAAC,GAC9E,EAAK,IAAU,CAAC;EAC3B;CACJ;CAEA,IAAI,IAA0C;CAW9C,SAAS,IAAoC;EAOzC,OANK,MACD,IAAU,EAAK,GACf,EAAQ,YAAY;GAChB,IAAU;EACd,CAAC,IAEE;CACX;CAEA,IAAM,IAAY,EAAK,CAAQ;CAE/B,OADA,EAAU,UAAU,GACb;AACX"}
+{"version":3,"file":"lazy-with-retry.js","names":["lazyWithRetry","options","load","factory","error","attempt","retries","reloadOnFinalFailure","resolve","initialDelay","pending","loadOnce","component","lazy"],"sources":["../../src/auth/lazy-with-retry.ts"],"sourcesContent":["import { lazy } from \"react\";\nimport type { ComponentType } from \"react\";\n\n/**\n * Any React component, whatever props it declares.\n *\n * Props sit in a *parameter* position, so a bound over them is contravariant:\n * `ComponentType<unknown>` reads as \"a component that accepts every possible\n * props object\", and only a component that declares no props at all satisfies\n * it. A page typed `({ mode }: Props) => …` is rejected, and so is one whose\n * props are entirely optional. `any` is the only bound that admits every\n * component — which is why React itself declares `lazy` and\n * `LazyExoticComponent` as `ComponentType<any>`. `ComponentType<never>` is not\n * an escape: it fails React's own bound through\n * `ComponentClass.getDerivedStateFromProps`, where the props land back in a\n * covariant position.\n *\n * This relaxes the *bound* only. `T` is still inferred as the concrete\n * component, so the rendered element keeps checking its props and `preload()`\n * still resolves to the concrete module.\n */\n// eslint-disable-next-line @typescript-eslint/no-explicit-any\ntype AnyComponent = ComponentType<any>;\n\nexport interface LazyWithRetryOptions {\n    /** Max attempts. Default: 3. */\n    retries?: number;\n    /** Initial delay (ms) before retrying. Default: 400. */\n    initialDelay?: number;\n    /**\n     * Reload the page after every retry fails. Helps when the stale chunk\n     * error is caused by an old `index.html` referencing deleted bundles.\n     * Default: true.\n     */\n    reloadOnFinalFailure?: boolean;\n}\n\n/** A lazy component that can also be fetched ahead of being rendered. */\nexport type PreloadableLazy<T extends AnyComponent> = ReturnType<typeof lazy<T>> & {\n    /**\n     * Start fetching the chunk now, before anything renders it.\n     *\n     * Call it on the interaction that makes the route likely — hovering the\n     * link, opening the menu that holds it, finishing the step before it — so\n     * the chunk is warm by the time the user commits and the suspense fallback\n     * never appears.\n     *\n     * Shares its work with the render path: whichever fires first performs the\n     * single fetch and the other awaits the same promise. Safe to call\n     * repeatedly.\n     *\n     * @returns The module, once loaded. Rejects when every retry failed; that\n     *   rejection is already handled internally, so a fire-and-forget call\n     *   never surfaces as an unhandled rejection.\n     */\n    preload: () => Promise<{ default: T }>;\n};\n\n/**\n * Wrap `React.lazy` with automatic retry and a `preload()` method.\n *\n * Common cause of failure: deployed-then-cached `index.html` references chunk\n * filenames that no longer exist. Retrying after a short delay typically picks\n * up the new bundle; a final `location.reload()` recovers from stale\n * `index.html`.\n *\n * The wrapped component keeps its own props: `T` is inferred from the module\n * the factory resolves to, so a page declaring required, optional or no props\n * all pass through and the rendered element is still checked against them. See\n * {@link AnyComponent} for why the constraint has to be written the way it is.\n *\n * @param factory Dynamic import of the module whose `default` is the component.\n * @param options Retry count, initial backoff and the final-failure reload.\n * @returns The lazy component, carrying an extra `preload()`.\n *\n * @example\n * const Settings = lazyWithRetry(() => import(\"./Settings\"));\n *\n * // Warm the chunk when the route becomes likely, not when it is needed.\n * <a href=\"/settings\" onMouseEnter={() => void Settings.preload()}>Settings</a>\n */\nexport function lazyWithRetry<T extends AnyComponent>(\n    factory: () => Promise<{ default: T }>,\n    options: LazyWithRetryOptions = {},\n): PreloadableLazy<T> {\n    const { retries = 3, initialDelay = 400, reloadOnFinalFailure = true } = options;\n\n    async function load(attempt = 1): Promise<{ default: T }> {\n        try {\n            return await factory();\n        } catch (error) {\n            if (attempt >= retries) {\n                if (reloadOnFinalFailure && typeof window !== \"undefined\") {\n                    window.location.reload();\n                }\n                throw error;\n            }\n            await new Promise((resolve) => setTimeout(resolve, initialDelay * 2 ** (attempt - 1)));\n            return load(attempt + 1);\n        }\n    }\n\n    let pending: Promise<{ default: T }> | null = null;\n\n    /**\n     * Run `load` at most once at a time, so preloading and rendering never\n     * fetch the same chunk twice.\n     *\n     * The internal `catch` does two jobs: it clears the memo, so a component\n     * that failed can be tried again once an error boundary resets, and it\n     * marks the promise as handled, so a `preload()` nobody awaited does not\n     * raise an unhandled rejection. Callers still get a promise that rejects.\n     */\n    function loadOnce(): Promise<{ default: T }> {\n        if (!pending) {\n            pending = load();\n            pending.catch(() => {\n                pending = null;\n            });\n        }\n        return pending;\n    }\n\n    const component = lazy(loadOnce) as PreloadableLazy<T>;\n    component.preload = loadOnce;\n    return component;\n}\n"],"mappings":";;AAiFA,SAAgBA,EACZ,GACA,IAAgC,CAAC,GACf;CAClB,IAAM,EAAE,aAAU,GAAG,kBAAe,KAAK,0BAAuB,OAASC;CAEzE,eAAeC,EAAK,IAAU,GAA4B;EACtD,IAAI;GACA,OAAO,MAAMC,EAAQ;EACzB,SAASC,GAAO;GACZ,IAAIC,KAAWC,GAIX,MAHIC,KAAwB,OAAO,SAAW,OAC1C,OAAO,SAAS,OAAO,GAErBH;GAGV,OADA,MAAM,IAAI,SAAS,MAAY,WAAWI,GAASC,IAAe,MAAMJ,IAAU,EAAE,CAAC,GAC9EH,EAAKG,IAAU,CAAC;EAC3B;CACJ;CAEA,IAAIK,IAA0C;CAW9C,SAASC,IAAoC;EAOzC,OANKD,MACD,IAAUR,EAAK,GACfQ,EAAQ,YAAY;GAChB,IAAU;EACd,CAAC,IAEEA;CACX;CAEA,IAAME,IAAYC,EAAKF,CAAQ;CAE/B,OADA,EAAU,UAAUA,GACbC;AACX"}

package/dist/auth/passkey.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"passkey.cjs","names":[],"sources":["../../src/auth/passkey.ts"],"sourcesContent":["/**\n * @tempest-limits file-lines, function-lines — the WebAuthn client half: the JSON\n * shapes both ceremonies exchange with a backend, base64url ↔ ArrayBuffer, the\n * capability probes and the error classifier. The two ceremonies are near-mirrors\n * that must not drift — register and authenticate encode the same credential fields\n * in the same order — and the file's docstring is also the specification of the four\n * backend routes it expects.\n */\n\nimport { base64ToBytes, bytesToBase64 } from \"@/utils/base64\";\n\n/**\n * Classified reason a passkey ceremony did not produce a credential.\n *\n * The kinds group the raw `DOMException.name` values the way a UI has to branch\n * on them, which is *not* how the spec groups them:\n *\n * - `\"cancelled\"` covers `NotAllowedError`, which the browser raises both when\n *   the user dismissed the sheet and when the ceremony timed out. They are\n *   indistinguishable **by design** — telling a site \"the user has no credential\n *   for you\" would leak account existence — so a UI must treat them as one thing.\n * - `\"already-registered\"` (`InvalidStateError`) is not really a failure: this\n *   device already holds a credential for this user. The correct reaction is\n *   \"you are already set up on this device\", never a red error.\n * - `\"rp-mismatch\"` (`SecurityError`) is the single most common integration bug:\n *   `rp.id` must equal the page's domain or a registrable parent of it.\n */\nexport type PasskeyErrorKind =\n    | \"unsupported\"\n    | \"insecure\"\n    | \"cancelled\"\n    | \"already-registered\"\n    | \"not-supported\"\n    | \"rp-mismatch\"\n    | \"invalid-options\"\n    | \"aborted\"\n    | \"unknown\";\n\n/** Which ceremony was running, so the message can name it. */\nexport type PasskeyCeremony = \"register\" | \"authenticate\";\n\n/**\n * A passkey failure carrying a stable {@link PasskeyErrorKind} plus an English\n * message safe to show a user.\n *\n * A class rather than the plain `{ kind, message }` object the media classifier\n * returns, because these surface by rejecting a promise: an `Error` subclass keeps\n * stack traces, `instanceof` checks and logging intact, and `kind` is what code\n * branches on.\n */\nexport class PasskeyError extends Error {\n    /** Stable, branchable classification. */\n    readonly kind: PasskeyErrorKind;\n\n    /**\n     * Build a classified passkey error.\n     *\n     * @param kind - The classification a UI branches on.\n     * @param message - English, user-safe explanation.\n     * @param cause - The original thrown value, when there was one.\n     */\n    constructor(kind: PasskeyErrorKind, message: string, cause?: unknown) {\n        super(message);\n        this.name = \"PasskeyError\";\n        this.kind = kind;\n        this.cause = cause;\n    }\n}\n\n/**\n * Minimal subset of `navigator.credentials` the passkey client touches.\n *\n * Declared here — the `<X>Like` pattern the SDK's adapters use — for two reasons:\n * jsdom has no `navigator.credentials` at all, so tests must inject a double; and\n * `mediation: \"conditional\"` is newer than some TypeScript DOM libs, which would\n * otherwise reject the call that makes autofill work.\n */\nexport interface CredentialsContainerLike {\n    /** Runs the registration ceremony. */\n    create(options: {\n        publicKey: PublicKeyCredentialCreationOptions;\n        signal?: AbortSignal;\n    }): Promise<Credential | null>;\n    /** Runs the authentication ceremony. */\n    get(options: {\n        publicKey: PublicKeyCredentialRequestOptions;\n        signal?: AbortSignal;\n        mediation?: string;\n    }): Promise<Credential | null>;\n}\n\n/** How the browser should surface the authentication ceremony. */\nexport type PasskeyMediation = \"optional\" | \"conditional\" | \"required\" | \"silent\";\n\n/**\n * Server-issued registration options, in the base64url JSON shape every WebAuthn\n * backend speaks (`PublicKeyCredentialCreationOptionsJSON` in the spec).\n *\n * `challenge`, `user.id` and every `excludeCredentials[].id` are **base64url**\n * strings here and `ArrayBuffer`s in the DOM API. Converting them is the plumbing\n * this client owns.\n */\nexport interface PasskeyCreationOptionsJSON {\n    /** Base64url server challenge. Single-use; the server must remember it. */\n    challenge: string;\n    /** Relying party. `id` defaults to the client's `rpId`, then to the origin. */\n    rp: { name: string; id?: string };\n    /** The account. `id` is base64url of an opaque, stable user handle. */\n    user: { id: string; name: string; displayName: string };\n    /** Allowed COSE algorithms. Defaults to {@link DEFAULT_PUB_KEY_CRED_PARAMS}. */\n    pubKeyCredParams?: { type: \"public-key\"; alg: number }[];\n    /** Ceremony timeout in ms. Defaults to the client's `timeoutMs`. */\n    timeout?: number;\n    /** Credentials this user already has, so the authenticator refuses a duplicate. */\n    excludeCredentials?: { id: string; type: \"public-key\"; transports?: string[] }[];\n    /** Resident-key / user-verification / attachment requirements. */\n    authenticatorSelection?: AuthenticatorSelectionCriteria;\n    /** Attestation conveyance. Leave unset (`\"none\"`) unless you verify it. */\n    attestation?: AttestationConveyancePreference;\n    /** Client extension inputs (`credProps`, `largeBlob`, …). */\n    extensions?: AuthenticationExtensionsClientInputs;\n}\n\n/** Server-issued authentication options, base64url JSON. */\nexport interface PasskeyRequestOptionsJSON {\n    /** Base64url server challenge. */\n    challenge: string;\n    /** Relying party id. Defaults to the client's `rpId`, then to the origin. */\n    rpId?: string;\n    /** Ceremony timeout in ms. Defaults to the client's `timeoutMs`. */\n    timeout?: number;\n    /** Restrict to these credentials. **Omit it** for usernameless / autofill flows. */\n    allowCredentials?: { id: string; type: \"public-key\"; transports?: string[] }[];\n    /** Whether the authenticator must verify the user (biometric / PIN). */\n    userVerification?: UserVerificationRequirement;\n    /** Client extension inputs. */\n    extensions?: AuthenticationExtensionsClientInputs;\n}\n\n/** What the client sends to the backend to finish registration. */\nexport interface PasskeyRegistrationJSON {\n    /** Base64url credential id. */\n    id: string;\n    /** Same bytes as `id`; both are sent because servers differ on which they read. */\n    rawId: string;\n    type: \"public-key\";\n    /** `\"platform\"` (this device) or `\"cross-platform\"` (a phone or key). */\n    authenticatorAttachment: string | null;\n    response: {\n        /** Base64url client data — the server re-checks challenge, origin and type. */\n        clientDataJSON: string;\n        /** Base64url attestation object, holding the new public key. */\n        attestationObject: string;\n        /** Transports the authenticator advertises, when the browser exposes them. */\n        transports?: string[];\n        /** COSE algorithm of the new key, when the browser exposes it. */\n        publicKeyAlgorithm?: number;\n        /** Base64url SPKI public key, when the browser exposes it. */\n        publicKey?: string;\n        /** Base64url authenticator data, when the browser exposes it. */\n        authenticatorData?: string;\n    };\n    /** Extension outputs — `credProps.rk` tells you whether it is discoverable. */\n    clientExtensionResults: AuthenticationExtensionsClientOutputs;\n}\n\n/** What the client sends to the backend to finish authentication. */\nexport interface PasskeyAuthenticationJSON {\n    /** Base64url credential id — the server looks up the stored public key by it. */\n    id: string;\n    /** Same bytes as `id`. */\n    rawId: string;\n    type: \"public-key\";\n    /** `\"platform\"` or `\"cross-platform\"`. */\n    authenticatorAttachment: string | null;\n    response: {\n        /** Base64url client data. */\n        clientDataJSON: string;\n        /** Base64url authenticator data, carrying the signature counter. */\n        authenticatorData: string;\n        /** Base64url signature over `authenticatorData || sha256(clientDataJSON)`. */\n        signature: string;\n        /** Base64url user handle — present on discoverable credentials, else null. */\n        userHandle: string | null;\n    };\n    /** Extension outputs. */\n    clientExtensionResults: AuthenticationExtensionsClientOutputs;\n}\n\n/** Per-call knobs for {@link PasskeyClient.register}. */\nexport interface PasskeyRegisterInit {\n    /** Cancel the ceremony (closes the browser sheet). */\n    signal?: AbortSignal;\n}\n\n/** Per-call knobs for {@link PasskeyClient.authenticate}. */\nexport interface PasskeyAuthenticateInit extends PasskeyRegisterInit {\n    /**\n     * `\"conditional\"` is the autofill flow: no modal, the browser offers passkeys\n     * inside a field marked `autocomplete=\"webauthn\"`. Requires a `signal`, and\n     * only one conditional request may be live per page.\n     */\n    mediation?: PasskeyMediation;\n}\n\n/** Framework-free WebAuthn client. Build one with {@link createPasskeyClient}. */\nexport interface PasskeyClient {\n    /** Run the registration ceremony and return the JSON your backend verifies. */\n    register(\n        options: PasskeyCreationOptionsJSON,\n        init?: PasskeyRegisterInit,\n    ): Promise<PasskeyRegistrationJSON>;\n    /** Run the authentication ceremony and return the JSON your backend verifies. */\n    authenticate(\n        options: PasskeyRequestOptionsJSON,\n        init?: PasskeyAuthenticateInit,\n    ): Promise<PasskeyAuthenticationJSON>;\n    /**\n     * Whether this client can run a ceremony at all — the WebAuthn API exists, or a\n     * `credentials` container was injected.\n     */\n    isSupported(): boolean;\n    /** Whether this device has a built-in authenticator (Face ID, Hello, …). */\n    isPlatformAuthenticatorAvailable(): Promise<boolean>;\n    /** Whether autofill-driven (`\"conditional\"`) requests are available. */\n    isConditionalMediationAvailable(): Promise<boolean>;\n}\n\n/** Options for {@link createPasskeyClient}. */\nexport interface CreatePasskeyClientOptions {\n    /**\n     * Default relying-party id, applied when the server options omit one. Must be\n     * the page's domain or a registrable parent of it (`app.acme.com` may use\n     * `acme.com`, never the other way round).\n     */\n    rpId?: string;\n    /** Default ceremony timeout in ms. Default `60_000`. */\n    timeoutMs?: number;\n    /** `navigator.credentials` replacement, for tests. */\n    credentials?: CredentialsContainerLike;\n}\n\n/**\n * COSE algorithms offered when the server sends no `pubKeyCredParams`, in\n * preference order.\n *\n * `-8` is Ed25519, which modern authenticators prefer and which produces the\n * smallest signatures. `-7` is ES256, the one algorithm every WebAuthn\n * authenticator supports. `-257` is RS256, needed for TPM-backed Windows Hello.\n * Offering all three is what avoids a `NotSupportedError` on some device you do\n * not own; a server that cannot verify one of them should send its own list.\n */\nexport const DEFAULT_PUB_KEY_CRED_PARAMS: { type: \"public-key\"; alg: number }[] = [\n    { type: \"public-key\", alg: -8 },\n    { type: \"public-key\", alg: -7 },\n    { type: \"public-key\", alg: -257 },\n];\n\n/** Static members of `PublicKeyCredential` that are not in every DOM lib yet. */\ninterface PublicKeyCredentialStatics {\n    isUserVerifyingPlatformAuthenticatorAvailable?: () => Promise<boolean>;\n    isConditionalMediationAvailable?: () => Promise<boolean>;\n}\n\n/** The browser-supplied extras on an attestation response, all optional. */\ninterface AttestationExtras {\n    getTransports?: () => string[];\n    getPublicKey?: () => ArrayBuffer | null;\n    getPublicKeyAlgorithm?: () => number;\n    getAuthenticatorData?: () => ArrayBuffer;\n}\n\nfunction publicKeyCredentialStatics(): PublicKeyCredentialStatics | undefined {\n    return (globalThis as { PublicKeyCredential?: PublicKeyCredentialStatics }).PublicKeyCredential;\n}\n\n/**\n * Decode a base64url string into bytes.\n *\n * WebAuthn transports every binary field as base64url (`-`/`_`, no padding)\n * because that is what survives JSON, while the DOM API insists on\n * `ArrayBuffer`. Getting this pair wrong — usually by feeding plain base64 to\n * `atob` and losing the last byte — is the classic broken-WebAuthn bug, which is\n * why the SDK owns it instead of leaving it to each app.\n *\n * This is the WebAuthn-facing name for {@link base64ToBytes}; the codec itself is\n * shared, so the padding rule has one implementation rather than three.\n *\n * @param value - Base64url text, with or without `=` padding.\n * @returns The decoded bytes.\n */\nexport function base64UrlToBytes(value: string): Uint8Array<ArrayBuffer> {\n    return base64ToBytes(value);\n}\n\n/**\n * Encode bytes as an unpadded base64url string.\n *\n * Normalises `ArrayBuffer` to a view — which is what the WebAuthn response\n * fields hand over — and delegates the encoding to {@link bytesToBase64}.\n *\n * @param value - Bytes to encode, as a view or a raw buffer.\n * @returns Base64url text, safe to put in JSON and in a URL.\n */\nexport function bytesToBase64Url(value: ArrayBuffer | Uint8Array): string {\n    const bytes = value instanceof Uint8Array ? value : new Uint8Array(value);\n    return bytesToBase64(bytes, { urlSafe: true });\n}\n\n/**\n * Whether this browser exposes WebAuthn at all.\n *\n * Note that \"supported\" is not \"usable\": WebAuthn also requires a secure context,\n * and a device may have no authenticator. Use\n * {@link isPlatformAuthenticatorAvailable} before offering a passkey button.\n */\nexport function isPasskeySupported(): boolean {\n    return (\n        typeof window !== \"undefined\" &&\n        typeof navigator !== \"undefined\" &&\n        navigator.credentials !== undefined &&\n        typeof navigator.credentials.create === \"function\" &&\n        publicKeyCredentialStatics() !== undefined\n    );\n}\n\n/**\n * Whether the device has a **built-in** authenticator — Face ID, Touch ID,\n * Windows Hello, an Android screen lock.\n *\n * This is the check that decides whether \"Entrar com passkey\" may be shown at\n * all. `isPasskeySupported()` is true on a desktop with no biometrics and no\n * security key, and offering a passkey there sends the user into a sheet that can\n * only be cancelled. A `false` here does not forbid passkeys — a phone can still\n * be used over hybrid/QR — it means the flow needs a second step, so present it\n * as \"usar meu celular\", not as one tap.\n *\n * @returns `false` when the API is missing, so a caller never has to null-check.\n */\nexport async function isPlatformAuthenticatorAvailable(): Promise<boolean> {\n    const statics = publicKeyCredentialStatics();\n    if (!statics?.isUserVerifyingPlatformAuthenticatorAvailable) return false;\n    try {\n        return await statics.isUserVerifyingPlatformAuthenticatorAvailable();\n    } catch {\n        return false;\n    }\n}\n\n/**\n * Whether autofill-driven passkeys (`mediation: \"conditional\"`) are available.\n *\n * @returns `false` when the API is missing or throws.\n */\nexport async function isConditionalMediationAvailable(): Promise<boolean> {\n    const statics = publicKeyCredentialStatics();\n    if (!statics?.isConditionalMediationAvailable) return false;\n    try {\n        return await statics.isConditionalMediationAvailable();\n    } catch {\n        return false;\n    }\n}\n\n/**\n * Map a thrown WebAuthn failure onto a {@link PasskeyError}.\n *\n * The secure-context check runs first for the same reason it does in the media\n * classifier: over plain HTTP the whole API is absent or refuses, and reporting\n * \"not supported\" sends a developer hunting for a polyfill for something an\n * `https://` URL fixes.\n *\n * @param error - Whatever `navigator.credentials` rejected with.\n * @param ceremony - Which ceremony was running, for the message.\n * @returns The classified error, ready to throw or to show.\n */\nexport function classifyPasskeyError(error: unknown, ceremony: PasskeyCeremony): PasskeyError {\n    if (error instanceof PasskeyError) return error;\n\n    if (typeof window !== \"undefined\" && !window.isSecureContext) {\n        return new PasskeyError(\"insecure\", \"Passkeys require a secure (HTTPS) connection.\", error);\n    }\n\n    if (error instanceof DOMException) {\n        switch (error.name) {\n            case \"NotAllowedError\":\n                return new PasskeyError(\n                    \"cancelled\",\n                    \"The passkey prompt was dismissed or timed out. The browser does not say which — it must not reveal whether a credential exists.\",\n                    error,\n                );\n            case \"InvalidStateError\":\n                return new PasskeyError(\n                    \"already-registered\",\n                    \"This device already has a passkey for this account. Sign in with it instead of creating another.\",\n                    error,\n                );\n            case \"NotSupportedError\":\n                return new PasskeyError(\n                    \"not-supported\",\n                    \"No authenticator here supports the requested algorithms. Check the server's pubKeyCredParams.\",\n                    error,\n                );\n            case \"SecurityError\":\n                return new PasskeyError(\n                    \"rp-mismatch\",\n                    \"The relying-party id does not match this origin. rp.id must be the page's domain or a registrable parent of it.\",\n                    error,\n                );\n            case \"AbortError\":\n                return new PasskeyError(\"aborted\", \"The passkey request was aborted.\", error);\n        }\n    }\n\n    if (error instanceof TypeError) {\n        return new PasskeyError(\n            \"invalid-options\",\n            `The ${ceremony} options the server sent are malformed. Check that challenge, user.id and credential ids are base64url.`,\n            error,\n        );\n    }\n\n    return new PasskeyError(\n        \"unknown\",\n        error instanceof Error\n            ? error.message\n            : `Unexpected error during the passkey ${ceremony} ceremony.`,\n        error,\n    );\n}\n\nfunction toDescriptors(\n    list: { id: string; type: \"public-key\"; transports?: string[] }[] | undefined,\n): PublicKeyCredentialDescriptor[] | undefined {\n    if (!list) return undefined;\n    return list.map((item) => ({\n        id: base64UrlToBytes(item.id),\n        type: item.type,\n        transports: item.transports as AuthenticatorTransport[] | undefined,\n    }));\n}\n\n/**\n * Build a WebAuthn client: the base64url ↔ `ArrayBuffer` plumbing, the two\n * ceremonies, and one classified error type.\n *\n * ## What your backend must do\n *\n * This is the **client half only**, and a WebAuthn client that documents only its\n * own half is unusable. Four routes are yours to implement:\n *\n * 1. `POST /webauthn/register/begin` → a {@link PasskeyCreationOptionsJSON}. Mint a\n *    random `challenge` (≥16 bytes), store it against the session, and list the\n *    user's existing credentials in `excludeCredentials`.\n * 2. `POST /webauthn/register/finish` ← a {@link PasskeyRegistrationJSON}. Verify\n *    the challenge, `origin` and `type` inside `clientDataJSON`, parse the\n *    attestation object, then store the credential id, public key and signature\n *    counter.\n * 3. `POST /webauthn/signin/begin` → a {@link PasskeyRequestOptionsJSON}. New\n *    challenge. Omit `allowCredentials` for a usernameless or autofill flow.\n * 4. `POST /webauthn/signin/finish` ← a {@link PasskeyAuthenticationJSON}. Look the\n *    credential up by `id`, verify the signature over\n *    `authenticatorData || sha256(clientDataJSON)`, and reject a signature counter\n *    that did not grow (a clone). Only then issue your session token.\n *\n * @param options - Defaults applied when the server options omit them.\n * @returns A client usable from anywhere — React, a plain form, a worker.\n *\n * @example\n * const passkeys = createPasskeyClient({ rpId: \"acme.com\" });\n *\n * const options = await api.post(\"/webauthn/register/begin\");\n * const credential = await passkeys.register(options);\n * await api.post(\"/webauthn/register/finish\", { body: credential });\n */\nexport function createPasskeyClient(options: CreatePasskeyClientOptions = {}): PasskeyClient {\n    const { rpId, timeoutMs = 60_000, credentials } = options;\n\n    function container(): CredentialsContainerLike {\n        if (credentials) return credentials;\n        if (!isPasskeySupported()) {\n            throw new PasskeyError(\n                \"unsupported\",\n                typeof window !== \"undefined\" && !window.isSecureContext\n                    ? \"Passkeys require a secure (HTTPS) connection.\"\n                    : \"This browser does not support passkeys (WebAuthn).\",\n            );\n        }\n        return navigator.credentials as unknown as CredentialsContainerLike;\n    }\n\n    async function register(\n        json: PasskeyCreationOptionsJSON,\n        init: PasskeyRegisterInit = {},\n    ): Promise<PasskeyRegistrationJSON> {\n        const api = container();\n        const publicKey: PublicKeyCredentialCreationOptions = {\n            challenge: base64UrlToBytes(json.challenge),\n            rp: { name: json.rp.name, id: json.rp.id ?? rpId },\n            user: {\n                id: base64UrlToBytes(json.user.id),\n                name: json.user.name,\n                displayName: json.user.displayName,\n            },\n            pubKeyCredParams: json.pubKeyCredParams ?? DEFAULT_PUB_KEY_CRED_PARAMS,\n            timeout: json.timeout ?? timeoutMs,\n            excludeCredentials: toDescriptors(json.excludeCredentials),\n            authenticatorSelection: json.authenticatorSelection,\n            attestation: json.attestation,\n            extensions: json.extensions,\n        };\n\n        let credential: Credential | null;\n        try {\n            credential = await api.create({ publicKey, signal: init.signal });\n        } catch (error) {\n            throw classifyPasskeyError(error, \"register\");\n        }\n        if (!credential) {\n            throw new PasskeyError(\"unknown\", \"The authenticator returned no credential.\");\n        }\n\n        const typed = credential as PublicKeyCredential;\n        const response = typed.response as AuthenticatorAttestationResponse & AttestationExtras;\n        const publicKeyBytes = response.getPublicKey?.();\n\n        return {\n            id: typed.id,\n            rawId: bytesToBase64Url(typed.rawId),\n            type: \"public-key\",\n            authenticatorAttachment: typed.authenticatorAttachment ?? null,\n            response: {\n                clientDataJSON: bytesToBase64Url(response.clientDataJSON),\n                attestationObject: bytesToBase64Url(response.attestationObject),\n                transports: response.getTransports?.(),\n                publicKeyAlgorithm: response.getPublicKeyAlgorithm?.(),\n                publicKey: publicKeyBytes ? bytesToBase64Url(publicKeyBytes) : undefined,\n                authenticatorData: response.getAuthenticatorData\n                    ? bytesToBase64Url(response.getAuthenticatorData())\n                    : undefined,\n            },\n            clientExtensionResults: typed.getClientExtensionResults(),\n        };\n    }\n\n    async function authenticate(\n        json: PasskeyRequestOptionsJSON,\n        init: PasskeyAuthenticateInit = {},\n    ): Promise<PasskeyAuthenticationJSON> {\n        const api = container();\n        const publicKey: PublicKeyCredentialRequestOptions = {\n            challenge: base64UrlToBytes(json.challenge),\n            rpId: json.rpId ?? rpId,\n            timeout: json.timeout ?? timeoutMs,\n            allowCredentials: toDescriptors(json.allowCredentials),\n            userVerification: json.userVerification,\n            extensions: json.extensions,\n        };\n\n        let credential: Credential | null;\n        try {\n            credential = await api.get({\n                publicKey,\n                signal: init.signal,\n                mediation: init.mediation,\n            });\n        } catch (error) {\n            throw classifyPasskeyError(error, \"authenticate\");\n        }\n        if (!credential) {\n            throw new PasskeyError(\"unknown\", \"The authenticator returned no credential.\");\n        }\n\n        const typed = credential as PublicKeyCredential;\n        const response = typed.response as AuthenticatorAssertionResponse;\n\n        return {\n            id: typed.id,\n            rawId: bytesToBase64Url(typed.rawId),\n            type: \"public-key\",\n            authenticatorAttachment: typed.authenticatorAttachment ?? null,\n            response: {\n                clientDataJSON: bytesToBase64Url(response.clientDataJSON),\n                authenticatorData: bytesToBase64Url(response.authenticatorData),\n                signature: bytesToBase64Url(response.signature),\n                userHandle: response.userHandle ? bytesToBase64Url(response.userHandle) : null,\n            },\n            clientExtensionResults: typed.getClientExtensionResults(),\n        };\n    }\n\n    return {\n        register,\n        authenticate,\n        isSupported: () => credentials !== undefined || isPasskeySupported(),\n        isPlatformAuthenticatorAvailable,\n        isConditionalMediationAvailable,\n    };\n}\n"],"mappings":"uCAkDA,IAAa,EAAb,cAAkC,KAAM,CAEpC,KASA,YAAY,EAAwB,EAAiB,EAAiB,CAClE,MAAM,CAAO,EACb,KAAK,KAAO,eACZ,KAAK,KAAO,EACZ,KAAK,MAAQ,CACjB,CACJ,EAyLa,EAAqE,CAC9E,CAAE,KAAM,aAAc,IAAK,EAAG,EAC9B,CAAE,KAAM,aAAc,IAAK,EAAG,EAC9B,CAAE,KAAM,aAAc,IAAK,IAAK,CACpC,EAgBA,SAAS,GAAqE,CAC1E,OAAQ,WAAoE,mBAChF,CAiBA,SAAgB,EAAiB,EAAwC,CACrE,OAAO,EAAA,cAAc,CAAK,CAC9B,CAWA,SAAgB,EAAiB,EAAyC,CACtE,IAAM,EAAQ,aAAiB,WAAa,EAAQ,IAAI,WAAW,CAAK,EACxE,OAAO,EAAA,cAAc,EAAO,CAAE,QAAS,EAAK,CAAC,CACjD,CASA,SAAgB,GAA8B,CAC1C,OACI,OAAO,OAAW,KAClB,OAAO,UAAc,KACrB,UAAU,cAAgB,IAAA,IAC1B,OAAO,UAAU,YAAY,QAAW,YACxC,EAA2B,IAAM,IAAA,EAEzC,CAeA,eAAsB,GAAqD,CACvE,IAAM,EAAU,EAA2B,EAC3C,GAAI,CAAC,GAAS,8CAA+C,MAAO,GACpE,GAAI,CACA,OAAO,MAAM,EAAQ,8CAA8C,CACvE,MAAQ,CACJ,MAAO,EACX,CACJ,CAOA,eAAsB,GAAoD,CACtE,IAAM,EAAU,EAA2B,EAC3C,GAAI,CAAC,GAAS,gCAAiC,MAAO,GACtD,GAAI,CACA,OAAO,MAAM,EAAQ,gCAAgC,CACzD,MAAQ,CACJ,MAAO,EACX,CACJ,CAcA,SAAgB,EAAqB,EAAgB,EAAyC,CAC1F,GAAI,aAAiB,EAAc,OAAO,EAE1C,GAAI,OAAO,OAAW,KAAe,CAAC,OAAO,gBACzC,OAAO,IAAI,EAAa,WAAY,gDAAiD,CAAK,EAG9F,GAAI,aAAiB,aACjB,OAAQ,EAAM,KAAd,CACI,IAAK,kBACD,OAAO,IAAI,EACP,YACA,kIACA,CACJ,EACJ,IAAK,oBACD,OAAO,IAAI,EACP,qBACA,mGACA,CACJ,EACJ,IAAK,oBACD,OAAO,IAAI,EACP,gBACA,gGACA,CACJ,EACJ,IAAK,gBACD,OAAO,IAAI,EACP,cACA,kHACA,CACJ,EACJ,IAAK,aACD,OAAO,IAAI,EAAa,UAAW,mCAAoC,CAAK,CACpF,CAWJ,OARI,aAAiB,UACV,IAAI,EACP,kBACA,OAAO,EAAS,yGAChB,CACJ,EAGG,IAAI,EACP,UACA,aAAiB,MACX,EAAM,QACN,uCAAuC,EAAS,YACtD,CACJ,CACJ,CAEA,SAAS,EACL,EAC2C,CACtC,KACL,OAAO,EAAK,IAAK,IAAU,CACvB,GAAI,EAAiB,EAAK,EAAE,EAC5B,KAAM,EAAK,KACX,WAAY,EAAK,UACrB,EAAE,CACN,CAmCA,SAAgB,EAAoB,EAAsC,CAAC,EAAkB,CACzF,GAAM,CAAE,OAAM,YAAY,IAAQ,eAAgB,EAElD,SAAS,GAAsC,CAC3C,GAAI,EAAa,OAAO,EACxB,GAAI,CAAC,EAAmB,EACpB,MAAM,IAAI,EACN,cACA,OAAO,OAAW,KAAe,CAAC,OAAO,gBACnC,gDACA,oDACV,EAEJ,OAAO,UAAU,WACrB,CAEA,eAAe,EACX,EACA,EAA4B,CAAC,EACG,CAChC,IAAM,EAAM,EAAU,EAChB,EAAgD,CAClD,UAAW,EAAiB,EAAK,SAAS,EAC1C,GAAI,CAAE,KAAM,EAAK,GAAG,KAAM,GAAI,EAAK,GAAG,IAAM,CAAK,EACjD,KAAM,CACF,GAAI,EAAiB,EAAK,KAAK,EAAE,EACjC,KAAM,EAAK,KAAK,KAChB,YAAa,EAAK,KAAK,WAC3B,EACA,iBAAkB,EAAK,kBAAoB,EAC3C,QAAS,EAAK,SAAW,EACzB,mBAAoB,EAAc,EAAK,kBAAkB,EACzD,uBAAwB,EAAK,uBAC7B,YAAa,EAAK,YAClB,WAAY,EAAK,UACrB,EAEI,EACJ,GAAI,CACA,EAAa,MAAM,EAAI,OAAO,CAAE,YAAW,OAAQ,EAAK,MAAO,CAAC,CACpE,OAAS,EAAO,CACZ,MAAM,EAAqB,EAAO,UAAU,CAChD,CACA,GAAI,CAAC,EACD,MAAM,IAAI,EAAa,UAAW,2CAA2C,EAGjF,IAAM,EAAQ,EACR,EAAW,EAAM,SACjB,EAAiB,EAAS,eAAe,EAE/C,MAAO,CACH,GAAI,EAAM,GACV,MAAO,EAAiB,EAAM,KAAK,EACnC,KAAM,aACN,wBAAyB,EAAM,yBAA2B,KAC1D,SAAU,CACN,eAAgB,EAAiB,EAAS,cAAc,EACxD,kBAAmB,EAAiB,EAAS,iBAAiB,EAC9D,WAAY,EAAS,gBAAgB,EACrC,mBAAoB,EAAS,wBAAwB,EACrD,UAAW,EAAiB,EAAiB,CAAc,EAAI,IAAA,GAC/D,kBAAmB,EAAS,qBACtB,EAAiB,EAAS,qBAAqB,CAAC,EAChD,IAAA,EACV,EACA,uBAAwB,EAAM,0BAA0B,CAC5D,CACJ,CAEA,eAAe,EACX,EACA,EAAgC,CAAC,EACC,CAClC,IAAM,EAAM,EAAU,EAChB,EAA+C,CACjD,UAAW,EAAiB,EAAK,SAAS,EAC1C,KAAM,EAAK,MAAQ,EACnB,QAAS,EAAK,SAAW,EACzB,iBAAkB,EAAc,EAAK,gBAAgB,EACrD,iBAAkB,EAAK,iBACvB,WAAY,EAAK,UACrB,EAEI,EACJ,GAAI,CACA,EAAa,MAAM,EAAI,IAAI,CACvB,YACA,OAAQ,EAAK,OACb,UAAW,EAAK,SACpB,CAAC,CACL,OAAS,EAAO,CACZ,MAAM,EAAqB,EAAO,cAAc,CACpD,CACA,GAAI,CAAC,EACD,MAAM,IAAI,EAAa,UAAW,2CAA2C,EAGjF,IAAM,EAAQ,EACR,EAAW,EAAM,SAEvB,MAAO,CACH,GAAI,EAAM,GACV,MAAO,EAAiB,EAAM,KAAK,EACnC,KAAM,aACN,wBAAyB,EAAM,yBAA2B,KAC1D,SAAU,CACN,eAAgB,EAAiB,EAAS,cAAc,EACxD,kBAAmB,EAAiB,EAAS,iBAAiB,EAC9D,UAAW,EAAiB,EAAS,SAAS,EAC9C,WAAY,EAAS,WAAa,EAAiB,EAAS,UAAU,EAAI,IAC9E,EACA,uBAAwB,EAAM,0BAA0B,CAC5D,CACJ,CAEA,MAAO,CACH,WACA,eACA,gBAAmB,IAAgB,IAAA,IAAa,EAAmB,EACnE,mCACA,iCACJ,CACJ"}
+{"version":3,"file":"passkey.cjs","names":["base64ToBytes","bytesToBase64","require_base64","PasskeyError","message","kind","cause","DEFAULT_PUB_KEY_CRED_PARAMS","publicKeyCredentialStatics","base64UrlToBytes","value","bytesToBase64Url","bytes","isPasskeySupported","isPlatformAuthenticatorAvailable","statics","isConditionalMediationAvailable","classifyPasskeyError","error","ceremony","toDescriptors","list","item","createPasskeyClient","options","container","credentials","register","api","publicKey","json","rpId","timeoutMs","credential","init","typed","response","publicKeyBytes","authenticate"],"sources":["../../src/auth/passkey.ts"],"sourcesContent":["/**\n * @tempest-limits file-lines, function-lines — the WebAuthn client half: the JSON\n * shapes both ceremonies exchange with a backend, base64url ↔ ArrayBuffer, the\n * capability probes and the error classifier. The two ceremonies are near-mirrors\n * that must not drift — register and authenticate encode the same credential fields\n * in the same order — and the file's docstring is also the specification of the four\n * backend routes it expects.\n */\n\nimport { base64ToBytes, bytesToBase64 } from \"@/utils/base64\";\n\n/**\n * Classified reason a passkey ceremony did not produce a credential.\n *\n * The kinds group the raw `DOMException.name` values the way a UI has to branch\n * on them, which is *not* how the spec groups them:\n *\n * - `\"cancelled\"` covers `NotAllowedError`, which the browser raises both when\n *   the user dismissed the sheet and when the ceremony timed out. They are\n *   indistinguishable **by design** — telling a site \"the user has no credential\n *   for you\" would leak account existence — so a UI must treat them as one thing.\n * - `\"already-registered\"` (`InvalidStateError`) is not really a failure: this\n *   device already holds a credential for this user. The correct reaction is\n *   \"you are already set up on this device\", never a red error.\n * - `\"rp-mismatch\"` (`SecurityError`) is the single most common integration bug:\n *   `rp.id` must equal the page's domain or a registrable parent of it.\n */\nexport type PasskeyErrorKind =\n    | \"unsupported\"\n    | \"insecure\"\n    | \"cancelled\"\n    | \"already-registered\"\n    | \"not-supported\"\n    | \"rp-mismatch\"\n    | \"invalid-options\"\n    | \"aborted\"\n    | \"unknown\";\n\n/** Which ceremony was running, so the message can name it. */\nexport type PasskeyCeremony = \"register\" | \"authenticate\";\n\n/**\n * A passkey failure carrying a stable {@link PasskeyErrorKind} plus an English\n * message safe to show a user.\n *\n * A class rather than the plain `{ kind, message }` object the media classifier\n * returns, because these surface by rejecting a promise: an `Error` subclass keeps\n * stack traces, `instanceof` checks and logging intact, and `kind` is what code\n * branches on.\n */\nexport class PasskeyError extends Error {\n    /** Stable, branchable classification. */\n    readonly kind: PasskeyErrorKind;\n\n    /**\n     * Build a classified passkey error.\n     *\n     * @param kind - The classification a UI branches on.\n     * @param message - English, user-safe explanation.\n     * @param cause - The original thrown value, when there was one.\n     */\n    constructor(kind: PasskeyErrorKind, message: string, cause?: unknown) {\n        super(message);\n        this.name = \"PasskeyError\";\n        this.kind = kind;\n        this.cause = cause;\n    }\n}\n\n/**\n * Minimal subset of `navigator.credentials` the passkey client touches.\n *\n * Declared here — the `<X>Like` pattern the SDK's adapters use — for two reasons:\n * jsdom has no `navigator.credentials` at all, so tests must inject a double; and\n * `mediation: \"conditional\"` is newer than some TypeScript DOM libs, which would\n * otherwise reject the call that makes autofill work.\n */\nexport interface CredentialsContainerLike {\n    /** Runs the registration ceremony. */\n    create(options: {\n        publicKey: PublicKeyCredentialCreationOptions;\n        signal?: AbortSignal;\n    }): Promise<Credential | null>;\n    /** Runs the authentication ceremony. */\n    get(options: {\n        publicKey: PublicKeyCredentialRequestOptions;\n        signal?: AbortSignal;\n        mediation?: string;\n    }): Promise<Credential | null>;\n}\n\n/** How the browser should surface the authentication ceremony. */\nexport type PasskeyMediation = \"optional\" | \"conditional\" | \"required\" | \"silent\";\n\n/**\n * Server-issued registration options, in the base64url JSON shape every WebAuthn\n * backend speaks (`PublicKeyCredentialCreationOptionsJSON` in the spec).\n *\n * `challenge`, `user.id` and every `excludeCredentials[].id` are **base64url**\n * strings here and `ArrayBuffer`s in the DOM API. Converting them is the plumbing\n * this client owns.\n */\nexport interface PasskeyCreationOptionsJSON {\n    /** Base64url server challenge. Single-use; the server must remember it. */\n    challenge: string;\n    /** Relying party. `id` defaults to the client's `rpId`, then to the origin. */\n    rp: { name: string; id?: string };\n    /** The account. `id` is base64url of an opaque, stable user handle. */\n    user: { id: string; name: string; displayName: string };\n    /** Allowed COSE algorithms. Defaults to {@link DEFAULT_PUB_KEY_CRED_PARAMS}. */\n    pubKeyCredParams?: { type: \"public-key\"; alg: number }[];\n    /** Ceremony timeout in ms. Defaults to the client's `timeoutMs`. */\n    timeout?: number;\n    /** Credentials this user already has, so the authenticator refuses a duplicate. */\n    excludeCredentials?: { id: string; type: \"public-key\"; transports?: string[] }[];\n    /** Resident-key / user-verification / attachment requirements. */\n    authenticatorSelection?: AuthenticatorSelectionCriteria;\n    /** Attestation conveyance. Leave unset (`\"none\"`) unless you verify it. */\n    attestation?: AttestationConveyancePreference;\n    /** Client extension inputs (`credProps`, `largeBlob`, …). */\n    extensions?: AuthenticationExtensionsClientInputs;\n}\n\n/** Server-issued authentication options, base64url JSON. */\nexport interface PasskeyRequestOptionsJSON {\n    /** Base64url server challenge. */\n    challenge: string;\n    /** Relying party id. Defaults to the client's `rpId`, then to the origin. */\n    rpId?: string;\n    /** Ceremony timeout in ms. Defaults to the client's `timeoutMs`. */\n    timeout?: number;\n    /** Restrict to these credentials. **Omit it** for usernameless / autofill flows. */\n    allowCredentials?: { id: string; type: \"public-key\"; transports?: string[] }[];\n    /** Whether the authenticator must verify the user (biometric / PIN). */\n    userVerification?: UserVerificationRequirement;\n    /** Client extension inputs. */\n    extensions?: AuthenticationExtensionsClientInputs;\n}\n\n/** What the client sends to the backend to finish registration. */\nexport interface PasskeyRegistrationJSON {\n    /** Base64url credential id. */\n    id: string;\n    /** Same bytes as `id`; both are sent because servers differ on which they read. */\n    rawId: string;\n    type: \"public-key\";\n    /** `\"platform\"` (this device) or `\"cross-platform\"` (a phone or key). */\n    authenticatorAttachment: string | null;\n    response: {\n        /** Base64url client data — the server re-checks challenge, origin and type. */\n        clientDataJSON: string;\n        /** Base64url attestation object, holding the new public key. */\n        attestationObject: string;\n        /** Transports the authenticator advertises, when the browser exposes them. */\n        transports?: string[];\n        /** COSE algorithm of the new key, when the browser exposes it. */\n        publicKeyAlgorithm?: number;\n        /** Base64url SPKI public key, when the browser exposes it. */\n        publicKey?: string;\n        /** Base64url authenticator data, when the browser exposes it. */\n        authenticatorData?: string;\n    };\n    /** Extension outputs — `credProps.rk` tells you whether it is discoverable. */\n    clientExtensionResults: AuthenticationExtensionsClientOutputs;\n}\n\n/** What the client sends to the backend to finish authentication. */\nexport interface PasskeyAuthenticationJSON {\n    /** Base64url credential id — the server looks up the stored public key by it. */\n    id: string;\n    /** Same bytes as `id`. */\n    rawId: string;\n    type: \"public-key\";\n    /** `\"platform\"` or `\"cross-platform\"`. */\n    authenticatorAttachment: string | null;\n    response: {\n        /** Base64url client data. */\n        clientDataJSON: string;\n        /** Base64url authenticator data, carrying the signature counter. */\n        authenticatorData: string;\n        /** Base64url signature over `authenticatorData || sha256(clientDataJSON)`. */\n        signature: string;\n        /** Base64url user handle — present on discoverable credentials, else null. */\n        userHandle: string | null;\n    };\n    /** Extension outputs. */\n    clientExtensionResults: AuthenticationExtensionsClientOutputs;\n}\n\n/** Per-call knobs for {@link PasskeyClient.register}. */\nexport interface PasskeyRegisterInit {\n    /** Cancel the ceremony (closes the browser sheet). */\n    signal?: AbortSignal;\n}\n\n/** Per-call knobs for {@link PasskeyClient.authenticate}. */\nexport interface PasskeyAuthenticateInit extends PasskeyRegisterInit {\n    /**\n     * `\"conditional\"` is the autofill flow: no modal, the browser offers passkeys\n     * inside a field marked `autocomplete=\"webauthn\"`. Requires a `signal`, and\n     * only one conditional request may be live per page.\n     */\n    mediation?: PasskeyMediation;\n}\n\n/** Framework-free WebAuthn client. Build one with {@link createPasskeyClient}. */\nexport interface PasskeyClient {\n    /** Run the registration ceremony and return the JSON your backend verifies. */\n    register(\n        options: PasskeyCreationOptionsJSON,\n        init?: PasskeyRegisterInit,\n    ): Promise<PasskeyRegistrationJSON>;\n    /** Run the authentication ceremony and return the JSON your backend verifies. */\n    authenticate(\n        options: PasskeyRequestOptionsJSON,\n        init?: PasskeyAuthenticateInit,\n    ): Promise<PasskeyAuthenticationJSON>;\n    /**\n     * Whether this client can run a ceremony at all — the WebAuthn API exists, or a\n     * `credentials` container was injected.\n     */\n    isSupported(): boolean;\n    /** Whether this device has a built-in authenticator (Face ID, Hello, …). */\n    isPlatformAuthenticatorAvailable(): Promise<boolean>;\n    /** Whether autofill-driven (`\"conditional\"`) requests are available. */\n    isConditionalMediationAvailable(): Promise<boolean>;\n}\n\n/** Options for {@link createPasskeyClient}. */\nexport interface CreatePasskeyClientOptions {\n    /**\n     * Default relying-party id, applied when the server options omit one. Must be\n     * the page's domain or a registrable parent of it (`app.acme.com` may use\n     * `acme.com`, never the other way round).\n     */\n    rpId?: string;\n    /** Default ceremony timeout in ms. Default `60_000`. */\n    timeoutMs?: number;\n    /** `navigator.credentials` replacement, for tests. */\n    credentials?: CredentialsContainerLike;\n}\n\n/**\n * COSE algorithms offered when the server sends no `pubKeyCredParams`, in\n * preference order.\n *\n * `-8` is Ed25519, which modern authenticators prefer and which produces the\n * smallest signatures. `-7` is ES256, the one algorithm every WebAuthn\n * authenticator supports. `-257` is RS256, needed for TPM-backed Windows Hello.\n * Offering all three is what avoids a `NotSupportedError` on some device you do\n * not own; a server that cannot verify one of them should send its own list.\n */\nexport const DEFAULT_PUB_KEY_CRED_PARAMS: { type: \"public-key\"; alg: number }[] = [\n    { type: \"public-key\", alg: -8 },\n    { type: \"public-key\", alg: -7 },\n    { type: \"public-key\", alg: -257 },\n];\n\n/** Static members of `PublicKeyCredential` that are not in every DOM lib yet. */\ninterface PublicKeyCredentialStatics {\n    isUserVerifyingPlatformAuthenticatorAvailable?: () => Promise<boolean>;\n    isConditionalMediationAvailable?: () => Promise<boolean>;\n}\n\n/** The browser-supplied extras on an attestation response, all optional. */\ninterface AttestationExtras {\n    getTransports?: () => string[];\n    getPublicKey?: () => ArrayBuffer | null;\n    getPublicKeyAlgorithm?: () => number;\n    getAuthenticatorData?: () => ArrayBuffer;\n}\n\nfunction publicKeyCredentialStatics(): PublicKeyCredentialStatics | undefined {\n    return (globalThis as { PublicKeyCredential?: PublicKeyCredentialStatics }).PublicKeyCredential;\n}\n\n/**\n * Decode a base64url string into bytes.\n *\n * WebAuthn transports every binary field as base64url (`-`/`_`, no padding)\n * because that is what survives JSON, while the DOM API insists on\n * `ArrayBuffer`. Getting this pair wrong — usually by feeding plain base64 to\n * `atob` and losing the last byte — is the classic broken-WebAuthn bug, which is\n * why the SDK owns it instead of leaving it to each app.\n *\n * This is the WebAuthn-facing name for {@link base64ToBytes}; the codec itself is\n * shared, so the padding rule has one implementation rather than three.\n *\n * @param value - Base64url text, with or without `=` padding.\n * @returns The decoded bytes.\n */\nexport function base64UrlToBytes(value: string): Uint8Array<ArrayBuffer> {\n    return base64ToBytes(value);\n}\n\n/**\n * Encode bytes as an unpadded base64url string.\n *\n * Normalises `ArrayBuffer` to a view — which is what the WebAuthn response\n * fields hand over — and delegates the encoding to {@link bytesToBase64}.\n *\n * @param value - Bytes to encode, as a view or a raw buffer.\n * @returns Base64url text, safe to put in JSON and in a URL.\n */\nexport function bytesToBase64Url(value: ArrayBuffer | Uint8Array): string {\n    const bytes = value instanceof Uint8Array ? value : new Uint8Array(value);\n    return bytesToBase64(bytes, { urlSafe: true });\n}\n\n/**\n * Whether this browser exposes WebAuthn at all.\n *\n * Note that \"supported\" is not \"usable\": WebAuthn also requires a secure context,\n * and a device may have no authenticator. Use\n * {@link isPlatformAuthenticatorAvailable} before offering a passkey button.\n */\nexport function isPasskeySupported(): boolean {\n    return (\n        typeof window !== \"undefined\" &&\n        typeof navigator !== \"undefined\" &&\n        navigator.credentials !== undefined &&\n        typeof navigator.credentials.create === \"function\" &&\n        publicKeyCredentialStatics() !== undefined\n    );\n}\n\n/**\n * Whether the device has a **built-in** authenticator — Face ID, Touch ID,\n * Windows Hello, an Android screen lock.\n *\n * This is the check that decides whether \"Entrar com passkey\" may be shown at\n * all. `isPasskeySupported()` is true on a desktop with no biometrics and no\n * security key, and offering a passkey there sends the user into a sheet that can\n * only be cancelled. A `false` here does not forbid passkeys — a phone can still\n * be used over hybrid/QR — it means the flow needs a second step, so present it\n * as \"usar meu celular\", not as one tap.\n *\n * @returns `false` when the API is missing, so a caller never has to null-check.\n */\nexport async function isPlatformAuthenticatorAvailable(): Promise<boolean> {\n    const statics = publicKeyCredentialStatics();\n    if (!statics?.isUserVerifyingPlatformAuthenticatorAvailable) return false;\n    try {\n        return await statics.isUserVerifyingPlatformAuthenticatorAvailable();\n    } catch {\n        return false;\n    }\n}\n\n/**\n * Whether autofill-driven passkeys (`mediation: \"conditional\"`) are available.\n *\n * @returns `false` when the API is missing or throws.\n */\nexport async function isConditionalMediationAvailable(): Promise<boolean> {\n    const statics = publicKeyCredentialStatics();\n    if (!statics?.isConditionalMediationAvailable) return false;\n    try {\n        return await statics.isConditionalMediationAvailable();\n    } catch {\n        return false;\n    }\n}\n\n/**\n * Map a thrown WebAuthn failure onto a {@link PasskeyError}.\n *\n * The secure-context check runs first for the same reason it does in the media\n * classifier: over plain HTTP the whole API is absent or refuses, and reporting\n * \"not supported\" sends a developer hunting for a polyfill for something an\n * `https://` URL fixes.\n *\n * @param error - Whatever `navigator.credentials` rejected with.\n * @param ceremony - Which ceremony was running, for the message.\n * @returns The classified error, ready to throw or to show.\n */\nexport function classifyPasskeyError(error: unknown, ceremony: PasskeyCeremony): PasskeyError {\n    if (error instanceof PasskeyError) return error;\n\n    if (typeof window !== \"undefined\" && !window.isSecureContext) {\n        return new PasskeyError(\"insecure\", \"Passkeys require a secure (HTTPS) connection.\", error);\n    }\n\n    if (error instanceof DOMException) {\n        switch (error.name) {\n            case \"NotAllowedError\":\n                return new PasskeyError(\n                    \"cancelled\",\n                    \"The passkey prompt was dismissed or timed out. The browser does not say which — it must not reveal whether a credential exists.\",\n                    error,\n                );\n            case \"InvalidStateError\":\n                return new PasskeyError(\n                    \"already-registered\",\n                    \"This device already has a passkey for this account. Sign in with it instead of creating another.\",\n                    error,\n                );\n            case \"NotSupportedError\":\n                return new PasskeyError(\n                    \"not-supported\",\n                    \"No authenticator here supports the requested algorithms. Check the server's pubKeyCredParams.\",\n                    error,\n                );\n            case \"SecurityError\":\n                return new PasskeyError(\n                    \"rp-mismatch\",\n                    \"The relying-party id does not match this origin. rp.id must be the page's domain or a registrable parent of it.\",\n                    error,\n                );\n            case \"AbortError\":\n                return new PasskeyError(\"aborted\", \"The passkey request was aborted.\", error);\n        }\n    }\n\n    if (error instanceof TypeError) {\n        return new PasskeyError(\n            \"invalid-options\",\n            `The ${ceremony} options the server sent are malformed. Check that challenge, user.id and credential ids are base64url.`,\n            error,\n        );\n    }\n\n    return new PasskeyError(\n        \"unknown\",\n        error instanceof Error\n            ? error.message\n            : `Unexpected error during the passkey ${ceremony} ceremony.`,\n        error,\n    );\n}\n\nfunction toDescriptors(\n    list: { id: string; type: \"public-key\"; transports?: string[] }[] | undefined,\n): PublicKeyCredentialDescriptor[] | undefined {\n    if (!list) return undefined;\n    return list.map((item) => ({\n        id: base64UrlToBytes(item.id),\n        type: item.type,\n        transports: item.transports as AuthenticatorTransport[] | undefined,\n    }));\n}\n\n/**\n * Build a WebAuthn client: the base64url ↔ `ArrayBuffer` plumbing, the two\n * ceremonies, and one classified error type.\n *\n * ## What your backend must do\n *\n * This is the **client half only**, and a WebAuthn client that documents only its\n * own half is unusable. Four routes are yours to implement:\n *\n * 1. `POST /webauthn/register/begin` → a {@link PasskeyCreationOptionsJSON}. Mint a\n *    random `challenge` (≥16 bytes), store it against the session, and list the\n *    user's existing credentials in `excludeCredentials`.\n * 2. `POST /webauthn/register/finish` ← a {@link PasskeyRegistrationJSON}. Verify\n *    the challenge, `origin` and `type` inside `clientDataJSON`, parse the\n *    attestation object, then store the credential id, public key and signature\n *    counter.\n * 3. `POST /webauthn/signin/begin` → a {@link PasskeyRequestOptionsJSON}. New\n *    challenge. Omit `allowCredentials` for a usernameless or autofill flow.\n * 4. `POST /webauthn/signin/finish` ← a {@link PasskeyAuthenticationJSON}. Look the\n *    credential up by `id`, verify the signature over\n *    `authenticatorData || sha256(clientDataJSON)`, and reject a signature counter\n *    that did not grow (a clone). Only then issue your session token.\n *\n * @param options - Defaults applied when the server options omit them.\n * @returns A client usable from anywhere — React, a plain form, a worker.\n *\n * @example\n * const passkeys = createPasskeyClient({ rpId: \"acme.com\" });\n *\n * const options = await api.post(\"/webauthn/register/begin\");\n * const credential = await passkeys.register(options);\n * await api.post(\"/webauthn/register/finish\", { body: credential });\n */\nexport function createPasskeyClient(options: CreatePasskeyClientOptions = {}): PasskeyClient {\n    const { rpId, timeoutMs = 60_000, credentials } = options;\n\n    function container(): CredentialsContainerLike {\n        if (credentials) return credentials;\n        if (!isPasskeySupported()) {\n            throw new PasskeyError(\n                \"unsupported\",\n                typeof window !== \"undefined\" && !window.isSecureContext\n                    ? \"Passkeys require a secure (HTTPS) connection.\"\n                    : \"This browser does not support passkeys (WebAuthn).\",\n            );\n        }\n        return navigator.credentials as unknown as CredentialsContainerLike;\n    }\n\n    async function register(\n        json: PasskeyCreationOptionsJSON,\n        init: PasskeyRegisterInit = {},\n    ): Promise<PasskeyRegistrationJSON> {\n        const api = container();\n        const publicKey: PublicKeyCredentialCreationOptions = {\n            challenge: base64UrlToBytes(json.challenge),\n            rp: { name: json.rp.name, id: json.rp.id ?? rpId },\n            user: {\n                id: base64UrlToBytes(json.user.id),\n                name: json.user.name,\n                displayName: json.user.displayName,\n            },\n            pubKeyCredParams: json.pubKeyCredParams ?? DEFAULT_PUB_KEY_CRED_PARAMS,\n            timeout: json.timeout ?? timeoutMs,\n            excludeCredentials: toDescriptors(json.excludeCredentials),\n            authenticatorSelection: json.authenticatorSelection,\n            attestation: json.attestation,\n            extensions: json.extensions,\n        };\n\n        let credential: Credential | null;\n        try {\n            credential = await api.create({ publicKey, signal: init.signal });\n        } catch (error) {\n            throw classifyPasskeyError(error, \"register\");\n        }\n        if (!credential) {\n            throw new PasskeyError(\"unknown\", \"The authenticator returned no credential.\");\n        }\n\n        const typed = credential as PublicKeyCredential;\n        const response = typed.response as AuthenticatorAttestationResponse & AttestationExtras;\n        const publicKeyBytes = response.getPublicKey?.();\n\n        return {\n            id: typed.id,\n            rawId: bytesToBase64Url(typed.rawId),\n            type: \"public-key\",\n            authenticatorAttachment: typed.authenticatorAttachment ?? null,\n            response: {\n                clientDataJSON: bytesToBase64Url(response.clientDataJSON),\n                attestationObject: bytesToBase64Url(response.attestationObject),\n                transports: response.getTransports?.(),\n                publicKeyAlgorithm: response.getPublicKeyAlgorithm?.(),\n                publicKey: publicKeyBytes ? bytesToBase64Url(publicKeyBytes) : undefined,\n                authenticatorData: response.getAuthenticatorData\n                    ? bytesToBase64Url(response.getAuthenticatorData())\n                    : undefined,\n            },\n            clientExtensionResults: typed.getClientExtensionResults(),\n        };\n    }\n\n    async function authenticate(\n        json: PasskeyRequestOptionsJSON,\n        init: PasskeyAuthenticateInit = {},\n    ): Promise<PasskeyAuthenticationJSON> {\n        const api = container();\n        const publicKey: PublicKeyCredentialRequestOptions = {\n            challenge: base64UrlToBytes(json.challenge),\n            rpId: json.rpId ?? rpId,\n            timeout: json.timeout ?? timeoutMs,\n            allowCredentials: toDescriptors(json.allowCredentials),\n            userVerification: json.userVerification,\n            extensions: json.extensions,\n        };\n\n        let credential: Credential | null;\n        try {\n            credential = await api.get({\n                publicKey,\n                signal: init.signal,\n                mediation: init.mediation,\n            });\n        } catch (error) {\n            throw classifyPasskeyError(error, \"authenticate\");\n        }\n        if (!credential) {\n            throw new PasskeyError(\"unknown\", \"The authenticator returned no credential.\");\n        }\n\n        const typed = credential as PublicKeyCredential;\n        const response = typed.response as AuthenticatorAssertionResponse;\n\n        return {\n            id: typed.id,\n            rawId: bytesToBase64Url(typed.rawId),\n            type: \"public-key\",\n            authenticatorAttachment: typed.authenticatorAttachment ?? null,\n            response: {\n                clientDataJSON: bytesToBase64Url(response.clientDataJSON),\n                authenticatorData: bytesToBase64Url(response.authenticatorData),\n                signature: bytesToBase64Url(response.signature),\n                userHandle: response.userHandle ? bytesToBase64Url(response.userHandle) : null,\n            },\n            clientExtensionResults: typed.getClientExtensionResults(),\n        };\n    }\n\n    return {\n        register,\n        authenticate,\n        isSupported: () => credentials !== undefined || isPasskeySupported(),\n        isPlatformAuthenticatorAvailable,\n        isConditionalMediationAvailable,\n    };\n}\n"],"mappings":"A,uCAkDA,IAAaG,EAAb,cAAkC,KAAM,CAEpC,KASA,YAAY,EAAwB,EAAiB,EAAiB,CAClE,MAAMC,CAAO,EACb,KAAK,KAAO,eACZ,KAAK,KAAOC,EACZ,KAAK,MAAQC,CACjB,CACJ,EAyLaC,EAAqE,CAC9E,CAAE,KAAM,aAAc,IAAK,EAAG,EAC9B,CAAE,KAAM,aAAc,IAAK,EAAG,EAC9B,CAAE,KAAM,aAAc,IAAK,IAAK,CACpC,EAgBA,SAASC,GAAqE,CAC1E,OAAQ,WAAoE,mBAChF,CAiBA,SAAgBC,EAAiB,EAAwC,CACrE,OAAOT,EAAAA,cAAcU,CAAK,CAC9B,CAWA,SAAgBC,EAAiB,EAAyC,CACtE,IAAMC,EAAQF,aAAiB,WAAaA,EAAQ,IAAI,WAAWA,CAAK,EACxE,OAAOT,EAAAA,cAAcW,EAAO,CAAE,QAAS,EAAK,CAAC,CACjD,CASA,SAAgBC,GAA8B,CAC1C,OACI,OAAO,OAAW,KAClB,OAAO,UAAc,KACrB,UAAU,cAAgB,IAAA,IAC1B,OAAO,UAAU,YAAY,QAAW,YACxCL,EAA2B,IAAM,IAAA,EAEzC,CAeA,eAAsBM,GAAqD,CACvE,IAAMC,EAAUP,EAA2B,EAC3C,GAAI,CAACO,GAAS,8CAA+C,MAAO,GACpE,GAAI,CACA,OAAO,MAAMA,EAAQ,8CAA8C,CACvE,MAAQ,CACJ,MAAO,EACX,CACJ,CAOA,eAAsBC,GAAoD,CACtE,IAAMD,EAAUP,EAA2B,EAC3C,GAAI,CAACO,GAAS,gCAAiC,MAAO,GACtD,GAAI,CACA,OAAO,MAAMA,EAAQ,gCAAgC,CACzD,MAAQ,CACJ,MAAO,EACX,CACJ,CAcA,SAAgBE,EAAqB,EAAgB,EAAyC,CAC1F,GAAIC,aAAiBf,EAAc,OAAOe,EAE1C,GAAI,OAAO,OAAW,KAAe,CAAC,OAAO,gBACzC,OAAO,IAAIf,EAAa,WAAY,gDAAiDe,CAAK,EAG9F,GAAIA,aAAiB,aACjB,OAAQA,EAAM,KAAd,CACI,IAAK,kBACD,OAAO,IAAIf,EACP,YACA,kIACAe,CACJ,EACJ,IAAK,oBACD,OAAO,IAAIf,EACP,qBACA,mGACAe,CACJ,EACJ,IAAK,oBACD,OAAO,IAAIf,EACP,gBACA,gGACAe,CACJ,EACJ,IAAK,gBACD,OAAO,IAAIf,EACP,cACA,kHACAe,CACJ,EACJ,IAAK,aACD,OAAO,IAAIf,EAAa,UAAW,mCAAoCe,CAAK,CACpF,CAWJ,OARIA,aAAiB,UACV,IAAIf,EACP,kBACA,OAAOgB,EAAS,yGAChBD,CACJ,EAGG,IAAIf,EACP,UACAe,aAAiB,MACXA,EAAM,QACN,uCAAuCC,EAAS,YACtDD,CACJ,CACJ,CAEA,SAASE,EACL,EAC2C,CAC3C,GAAKC,EACL,OAAOA,EAAK,IAAK,IAAU,CACvB,GAAIZ,EAAiBa,EAAK,EAAE,EAC5B,KAAMA,EAAK,KACX,WAAYA,EAAK,UACrB,EAAE,CACN,CAmCA,SAAgBC,EAAoB,EAAsC,CAAC,EAAkB,CACzF,GAAM,CAAE,OAAM,YAAY,IAAQ,eAAgBC,EAElD,SAASC,GAAsC,CAC3C,GAAIC,EAAa,OAAOA,EACxB,GAAI,CAACb,EAAmB,EACpB,MAAM,IAAIV,EACN,cACA,OAAO,OAAW,KAAe,CAAC,OAAO,gBACnC,gDACA,oDACV,EAEJ,OAAO,UAAU,WACrB,CAEA,eAAewB,EACX,EACA,EAA4B,CAAC,EACG,CAChC,IAAMC,EAAMH,EAAU,EAChBI,EAAgD,CAClD,UAAWpB,EAAiBqB,EAAK,SAAS,EAC1C,GAAI,CAAE,KAAMA,EAAK,GAAG,KAAM,GAAIA,EAAK,GAAG,IAAMC,CAAK,EACjD,KAAM,CACF,GAAItB,EAAiBqB,EAAK,KAAK,EAAE,EACjC,KAAMA,EAAK,KAAK,KAChB,YAAaA,EAAK,KAAK,WAC3B,EACA,iBAAkBA,EAAK,kBAAoBvB,EAC3C,QAASuB,EAAK,SAAWE,EACzB,mBAAoBZ,EAAcU,EAAK,kBAAkB,EACzD,uBAAwBA,EAAK,uBAC7B,YAAaA,EAAK,YAClB,WAAYA,EAAK,UACrB,EAEIG,EACJ,GAAI,CACA,EAAa,MAAML,EAAI,OAAO,CAAE,YAAW,OAAQM,EAAK,MAAO,CAAC,CACpE,OAAShB,EAAO,CACZ,MAAMD,EAAqBC,EAAO,UAAU,CAChD,CACA,GAAI,CAACe,EACD,MAAM,IAAI9B,EAAa,UAAW,2CAA2C,EAGjF,IAAMgC,EAAQF,EACRG,EAAWD,EAAM,SACjBE,EAAiBD,EAAS,eAAe,EAE/C,MAAO,CACH,GAAID,EAAM,GACV,MAAOxB,EAAiBwB,EAAM,KAAK,EACnC,KAAM,aACN,wBAAyBA,EAAM,yBAA2B,KAC1D,SAAU,CACN,eAAgBxB,EAAiByB,EAAS,cAAc,EACxD,kBAAmBzB,EAAiByB,EAAS,iBAAiB,EAC9D,WAAYA,EAAS,gBAAgB,EACrC,mBAAoBA,EAAS,wBAAwB,EACrD,UAAWC,EAAiB1B,EAAiB0B,CAAc,EAAI,IAAA,GAC/D,kBAAmBD,EAAS,qBACtBzB,EAAiByB,EAAS,qBAAqB,CAAC,EAChD,IAAA,EACV,EACA,uBAAwBD,EAAM,0BAA0B,CAC5D,CACJ,CAEA,eAAeG,EACX,EACA,EAAgC,CAAC,EACC,CAClC,IAAMV,EAAMH,EAAU,EAChBI,EAA+C,CACjD,UAAWpB,EAAiBqB,EAAK,SAAS,EAC1C,KAAMA,EAAK,MAAQC,EACnB,QAASD,EAAK,SAAWE,EACzB,iBAAkBZ,EAAcU,EAAK,gBAAgB,EACrD,iBAAkBA,EAAK,iBACvB,WAAYA,EAAK,UACrB,EAEIG,EACJ,GAAI,CACA,EAAa,MAAML,EAAI,IAAI,CACvB,YACA,OAAQM,EAAK,OACb,UAAWA,EAAK,SACpB,CAAC,CACL,OAAShB,EAAO,CACZ,MAAMD,EAAqBC,EAAO,cAAc,CACpD,CACA,GAAI,CAACe,EACD,MAAM,IAAI9B,EAAa,UAAW,2CAA2C,EAGjF,IAAMgC,EAAQF,EACRG,EAAWD,EAAM,SAEvB,MAAO,CACH,GAAIA,EAAM,GACV,MAAOxB,EAAiBwB,EAAM,KAAK,EACnC,KAAM,aACN,wBAAyBA,EAAM,yBAA2B,KAC1D,SAAU,CACN,eAAgBxB,EAAiByB,EAAS,cAAc,EACxD,kBAAmBzB,EAAiByB,EAAS,iBAAiB,EAC9D,UAAWzB,EAAiByB,EAAS,SAAS,EAC9C,WAAYA,EAAS,WAAazB,EAAiByB,EAAS,UAAU,EAAI,IAC9E,EACA,uBAAwBD,EAAM,0BAA0B,CAC5D,CACJ,CAEA,MAAO,CACH,WACA,eACA,gBAAmBT,IAAgB,IAAA,IAAab,EAAmB,EACnE,mCACA,iCACJ,CACJ,C"}