@albertomarturelo/sii-core 0.9.0 → 0.11.0

package/dist/auth/auth.js

@@ -1,22 +1,50 @@
-import { HOSTS, KEYRING_SERVICE, LOGIN_HOST, LOGOUT_URL } from '../config/index.js';
-import { CredentialNotFoundError, LoginFailedError, NotAuthenticatedError, } from '../errors/index.js';
+import { HOSTS, KEYRING_SERVICE, LOGIN_HOST, LOGOUT_URL, WWW2_APP_CARPETA, WWW2_SESSION_CLOSE_URL, } from '../config/index.js';
+import { CredentialNotFoundError, LoginBlockedError, LoginFailedError, NotAuthenticatedError, ValidationError, } from '../errors/index.js';
 import { Rut } from '../rut/index.js';
 import { recordAudit } from '../audit/index.js';
 import { clearOperateState, initOperateState } from '../identity/index.js';
 import { fetchEmpresasAutorizadas } from '../portal/representacion.js';
-import { deleteSession, readSession, withSession, writeSession } from './session.js';
+import { deleteSession, readSession, requireBrowser, withSession, writeSession, } from './session.js';
+import { parseDatosCntrNow } from './datos-cntr.js';
+import { clearLoginBlock, listLoginBlocks, readLoginBlock, reasonForCodigo, siiJudgedClave, tripLoginBlock, } from './login-block.js';
+import { mergeStorageState, waitForWww2Session, www2ExpiresAt } from './www2-login.js';
+import { readWww2Session } from '../portal/www2-session.js';
+import { Www2SessionError } from '../errors/index.js';
 const DEFAULT_LOGIN_TIMEOUT_MS = 180_000;
 // Console login submits machine-fast (no human typing in the browser) and fails
 // fast on a rejected Clave, so it needs a far smaller budget than the headed flow.
 const CONSOLE_LOGIN_TIMEOUT_MS = 60_000;
-// The Mi-SII landing serves this inline JS object with the contribuyente snapshot.
-const DATOS_EXPR = "typeof DatosCntrNow !== 'undefined' ? DatosCntrNow : null";
-/** Pure local read — NO portal call (sii-py "local-only" labelling). */
-export async function localStatus(store) {
+/** Read the Mi SII identity. The landing serves `DatosCntrNow` as an inline JS literal, so we
+ *  fetch the HTML and parse it (ADR-027) — engine-agnostic (works over the HTTP driver and the
+ *  browser one), replacing the old `session.evaluate`. `null` ⇒ not present (dead session). */
+async function readDatos(session) {
+    const { body } = await session.requestText(HOSTS.miSii, { method: 'GET' });
+    return parseDatosCntrNow(body);
+}
+/** A human typed the Clave: a fresh login from one of these lifts the rejection latch. */
+const INTERACTIVE_SOURCES = ['browser', 'console'];
+const NO_WWW2 = { authenticated: false, expiresAt: null };
+function www2StatusOf(session, now) {
+    const layer = session?.www2;
+    if (!layer)
+        return NO_WWW2;
+    const alive = layer.expiresAt === null || new Date(layer.expiresAt).getTime() > now.getTime();
+    return { authenticated: alive, expiresAt: layer.expiresAt };
+}
+/** Pure local read — NO portal call (sii-py "local-only" labelling). `now` decides whether the
+ *  stored www2 layer is still within its cookie's own expiry. */
+export async function localStatus(store, now) {
     const session = await readSession(store);
+    const loginBlocked = await listLoginBlocks(store);
     return session
-        ? { authenticated: true, rut: session.rut, sessionSource: 'cached' }
-        : { authenticated: false, rut: null, sessionSource: 'none' };
+        ? {
+            authenticated: true,
+            rut: session.rut,
+            sessionSource: 'cached',
+            www2: www2StatusOf(session, now),
+            loginBlocked,
+        }
+        : { authenticated: false, rut: null, sessionSource: 'none', www2: NO_WWW2, loginBlocked };
 }
 function identityFromDatos(datos) {
     const c = datos?.contribuyente;
@@ -43,20 +71,23 @@ async function liveSessionRut(runtime) {
         return null;
     }
 }
-/** If a cached session is still live, return `already_authenticated` (no mint).
- *  Shared by both login paths so neither re-mints over a warm session. */
-async function reuseLiveSession(runtime) {
+/** If a cached session is still live, the `already_authenticated` result (no mint) — WITHOUT
+ *  auditing it. The receipt is written by the caller that actually RETURNS this outcome: a
+ *  `--www2` login can find the classic session warm and still need the browser (for the www2
+ *  layer), and the audit must record what happened, not what was probed (ADR-004). */
+async function liveSessionResult(runtime) {
     const rut = await liveSessionRut(runtime);
-    if (rut) {
-        recordAudit(runtime, {
-            action: 'auth_login',
-            result: 'ok',
-            rut,
-            reason: 'already_authenticated',
-        });
-        return { authenticated: true, rut, reason: 'already_authenticated' };
-    }
-    return null;
+    return rut ? { authenticated: true, rut, reason: 'already_authenticated' } : null;
+}
+/** The receipt for a login that ENDED as "already authenticated". */
+function auditAlreadyAuthenticated(runtime, warm, source) {
+    recordAudit(runtime, {
+        action: 'auth_login',
+        result: 'ok',
+        rut: warm.rut,
+        reason: warm.reason,
+        source,
+    });
 }
 /** Best-effort operable-set fetch on login (ADR-005). Persona accounts ask SII for
  *  the empresas they can operate (getDcvEmpresasAutorizadas); empresa accounts have
@@ -98,12 +129,13 @@ async function resolveOperable(runtime, session, identity) {
 /** Turn a freshly-minted PortalSession into a persisted cookies-only session:
  *  confirm we landed off the login host, read identity, persist cookies (NO
  *  secret), default operate to self. Shared by the browser + console paths. */
-async function finalizeFreshSession(runtime, session, reason, start) {
+async function finalizeFreshSession(runtime, session, source, start) {
+    const reason = `${source}_login`;
     const landed = await session.goto(HOSTS.miSii);
     if (landedOnLoginHost(landed)) {
         throw new LoginFailedError('Login no completado (seguimos en la página de autenticación).');
     }
-    const datos = await session.evaluate(DATOS_EXPR);
+    const datos = await readDatos(session);
     const identity = identityFromDatos(datos);
     const cookies = await session.storageState();
     await writeSession(runtime.store, {
@@ -118,33 +150,98 @@ async function finalizeFreshSession(runtime, session, reason, start) {
         accountType: identity.accountType,
         operable,
     });
+    // A human just proved a working Clave, which is the reset ADR-028 names for the latch.
+    if (INTERACTIVE_SOURCES.includes(source))
+        await clearLoginBlock(runtime.store, identity.rut);
     recordAudit(runtime, {
         action: 'auth_login',
         result: 'ok',
         rut: identity.rut,
         reason,
+        source,
         durationMs: runtime.clock.now().getTime() - start,
     });
     return { authenticated: true, rut: identity.rut, reason };
 }
+/** Is the stored www2 layer live on the server? One cheap read via a headless restore; never
+ *  throws (the login path needs "is it warm?", not an error). */
+async function liveWww2(runtime) {
+    try {
+        await withSession(runtime, async (s) => readWww2Session(s, WWW2_APP_CARPETA));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/** The www2 step (ADR-026), run on the still-open headed `session` AFTER the classic login has
+ *  been persisted: snapshot the classic jar, let the user log in at SII's OAuth page, then store
+ *  classic + www2 cookies together with the layer's own expiry. On timeout the classic session
+ *  stays saved and `LoginFailedError` says so. */
+async function mintWww2Layer(runtime, session) {
+    const stored = await readSession(runtime.store);
+    if (!stored)
+        throw new NotAuthenticatedError('No hay sesión. Ejecuta `sii auth login`.');
+    const start = runtime.clock.now().getTime();
+    try {
+        const classicJar = await session.storageState();
+        await waitForWww2Session(runtime, session);
+        const www2Jar = await session.storageState();
+        const expiresAt = www2ExpiresAt(www2Jar);
+        const savedAt = runtime.clock.now().toISOString();
+        await writeSession(runtime.store, {
+            ...stored,
+            cookies: mergeStorageState(classicJar, www2Jar),
+            www2: { savedAt, expiresAt },
+        });
+        recordAudit(runtime, {
+            action: 'auth_login_www2',
+            result: 'ok',
+            rut: stored.rut,
+            durationMs: runtime.clock.now().getTime() - start,
+        });
+        return { authenticated: true, expiresAt };
+    }
+    catch (err) {
+        recordAudit(runtime, { action: 'auth_login_www2', result: 'failed', rut: stored.rut });
+        throw err;
+    }
+}
 /** Browser cookies-only login (ADR-006). Only this + `consoleLogin` mint a session
  *  (ADR-019 lineage). Idempotent: a live cached session returns
- *  `already_authenticated` without opening a window. */
-export async function login(runtime) {
+ *  `already_authenticated` without opening a window. With `www2`, both layers must be live
+ *  for that shortcut; otherwise the headed flow runs in full (classic login, then the www2
+ *  step in the same browser — the classic page is what carries the user into SII). */
+export async function login(runtime, options = {}) {
     const start = runtime.clock.now().getTime();
-    const warm = await reuseLiveSession(runtime);
-    if (warm)
-        return warm;
+    const warm = await liveSessionResult(runtime);
+    if (warm && (!options.www2 || (await liveWww2(runtime)))) {
+        auditAlreadyAuthenticated(runtime, warm, 'browser');
+        if (!options.www2)
+            return warm;
+        const stored = await readSession(runtime.store);
+        return { ...warm, www2: www2StatusOf(stored, runtime.clock.now()) };
+    }
     let session = null;
     try {
-        session = await runtime.portal.interactiveLogin({
+        // The headed login is the browser engine's job (ADR-027): the CLI's default is the HTTP
+        // console login, so only the MCP (which wires the browser) reaches this.
+        session = await requireBrowser(runtime).interactiveLogin({
             destination: HOSTS.miSii,
             timeoutMs: DEFAULT_LOGIN_TIMEOUT_MS,
         });
-        return await finalizeFreshSession(runtime, session, 'browser_login', start);
+        const result = await finalizeFreshSession(runtime, session, 'browser', start);
+        if (!options.www2)
+            return result;
+        return { ...result, www2: await mintWww2Layer(runtime, session) };
     }
     catch (err) {
-        recordAudit(runtime, { action: 'auth_login', result: 'failed', reason: 'browser_login' });
+        recordAudit(runtime, {
+            action: 'auth_login',
+            result: 'failed',
+            reason: 'browser_login',
+            source: 'browser',
+        });
         throw err;
     }
     finally {
@@ -156,32 +253,78 @@ export async function login(runtime) {
  *  stored, exactly like the browser path. ONE attempt, never retried (ADR-004).
  *  The Clave never reaches MCP (this task is CLI-only) nor the audit log. */
 export async function consoleLogin(runtime, credentials) {
-    return credentialLoginFlow(runtime, () => Promise.resolve(credentials), 'console_login');
+    return credentialLoginFlow(runtime, Rut.parse(credentials.rut), () => Promise.resolve(credentials.clave), 'console');
+}
+/** CLI-only non-interactive login (ADR-028): the SURFACE read the Clave from an environment
+ *  variable it was told to read (`--clave-env <VAR>`) or from piped stdin (`--clave-stdin`),
+ *  and `source` records which. Everything else matches `consoleLogin`, plus the rejection
+ *  latch: no one is at the keyboard to notice a stale Clave, so a latched RUT is refused
+ *  without contacting SII. */
+export async function suppliedClaveLogin(runtime, args) {
+    return credentialLoginFlow(runtime, Rut.parse(args.rut), () => Promise.resolve(args.clave), args.source);
+}
+/** The live session's principal if it is `rut`; `null` if there is no live session. A live
+ *  session for ANOTHER RUT is an error: answering "already authenticated" would hand the
+ *  caller the wrong account, and switching stays an explicit logout→login (ADR-005). */
+async function liveSessionFor(runtime, rut) {
+    const warm = await liveSessionResult(runtime);
+    if (warm && Rut.parse(warm.rut).canonical !== rut.canonical) {
+        throw new ValidationError(`Hay una sesión activa como ${warm.rut}, no como ${rut.canonical}. Para cambiar de ` +
+            'cuenta: `sii auth logout` y luego `sii auth login`.');
+    }
+    return warm;
 }
-/** The headless fill-and-submit shared by the console (ADR-010) and keyring (ADR-025)
- *  paths — they differ ONLY in where the Clave came from, so the attempt policy lives
- *  in one place: ONE attempt, never retried (ADR-004), Clave discarded with the frame.
- *  The credentials arrive as a THUNK so the Clave is fetched only once the live-session
- *  probe has missed: an already-authenticated user must not trigger a keyring-unlock
- *  prompt for a value nobody will use (review of #101). */
-async function credentialLoginFlow(runtime, getCredentials, reason) {
+/** The headless fill-and-submit shared by every Clave source (ADR-010 / ADR-025 / ADR-028) —
+ *  they differ ONLY in where the Clave came from, so the attempt policy lives in one place:
+ *  ONE attempt, never retried (ADR-004), Clave discarded with the frame.
+ *  The Clave arrives as a THUNK so it is fetched only once the live-session probe has missed:
+ *  an already-authenticated user must not trigger a keyring-unlock prompt for a value nobody
+ *  will use (review of #101). The probe runs BEFORE the latch on purpose: a cron whose session
+ *  is still alive keeps working while latched, since nothing is submitted. */
+async function credentialLoginFlow(runtime, rut, getClave, source) {
     const start = runtime.clock.now().getTime();
-    const warm = await reuseLiveSession(runtime);
-    if (warm)
+    const warm = await liveSessionFor(runtime, rut);
+    if (warm) {
+        auditAlreadyAuthenticated(runtime, warm, source);
         return warm;
-    const credentials = await getCredentials();
+    }
+    if (!INTERACTIVE_SOURCES.includes(source)) {
+        const block = await readLoginBlock(runtime.store, rut.canonical);
+        if (block) {
+            recordAudit(runtime, {
+                action: 'auth_login',
+                result: 'blocked',
+                rut: rut.canonical,
+                source,
+            });
+            throw new LoginBlockedError(`Login desatendido bloqueado para ${rut.canonical}: el SII rechazó la Clave el ` +
+                `${block.at}${block.codigo ? ` (código ${block.codigo})` : ''}. No se contactó al ` +
+                'SII. Corrige la Clave y ejecuta `sii auth login --console` (o `sii auth unblock`).', { reason: reasonForCodigo(block.codigo), codigo: block.codigo });
+        }
+    }
+    const clave = await getClave();
     let session = null;
     try {
         session = await runtime.portal.credentialLogin({
-            rut: credentials.rut,
-            clave: credentials.clave,
+            rut: rut.canonical,
+            clave,
             destination: HOSTS.miSii,
             timeoutMs: CONSOLE_LOGIN_TIMEOUT_MS,
         });
-        return await finalizeFreshSession(runtime, session, reason, start);
+        return await finalizeFreshSession(runtime, session, source, start);
     }
     catch (err) {
-        recordAudit(runtime, { action: 'auth_login', result: 'failed', reason });
+        // SII's verbatim rejection is what the user must see (ADR-004), so a failing latch write
+        // must not replace it with a disk error.
+        if (siiJudgedClave(err)) {
+            await tripLoginBlock(runtime, rut.canonical, err.codigo).catch(() => undefined);
+        }
+        recordAudit(runtime, {
+            action: 'auth_login',
+            result: 'failed',
+            reason: `${source}_login`,
+            source,
+        });
         throw err;
     }
     finally {
@@ -207,30 +350,51 @@ export async function keyringLogin(runtime, args) {
     if (!secrets) {
         throw new CredentialNotFoundError('Este runtime no tiene acceso al llavero (SecretStore). Usa `sii auth login --console`.');
     }
-    return credentialLoginFlow(runtime, async () => {
+    return credentialLoginFlow(runtime, rut, async () => {
         const accounts = keyringAccounts(rut);
         for (const account of accounts) {
             const clave = await secrets.get(account);
             if (clave)
-                return { rut: rut.canonical, clave };
+                return clave;
         }
         throw new CredentialNotFoundError(`No hay Clave en el llavero para ${rut.canonical} (servicio "${KEYRING_SERVICE}"). ` +
             `Guárdala con:\n` +
             `  Linux:  secret-tool store --label='SII' service ${KEYRING_SERVICE} username ${rut.canonical}\n` +
             `  macOS:  security add-generic-password -s ${KEYRING_SERVICE} -a ${rut.canonical} -w`);
-    }, 'keyring_login');
+    }, 'keyring');
+}
+/** Lift the rejection latch (ADR-028) for one RUT, or for all when none is given. A local
+ *  wipe: nothing is sent to SII. Returns the RUTs that were latched. */
+export async function unblockLogin(runtime, args = {}) {
+    const rut = args.rut === undefined ? undefined : Rut.parse(args.rut).canonical;
+    const lifted = await clearLoginBlock(runtime.store, rut);
+    recordAudit(runtime, { action: 'auth_unblock', result: 'ok', count: lifted.length });
+    return lifted;
 }
 /** Server-side close (best-effort) + wipe local session + operate context. */
 export async function logout(runtime) {
     const session = await readSession(runtime.store);
     if (!session) {
         recordAudit(runtime, { action: 'logout', result: 'ok', serverClosed: false });
-        return { loggedOut: false, serverClosed: false };
+        return { loggedOut: false, serverClosed: false, www2Closed: false };
     }
     let serverClosed = false;
+    let www2Closed = false;
     let s = null;
     try {
         s = await runtime.portal.restore(session.cookies);
+        if (session.www2) {
+            // The www2 layer first (ADR-026): its close is the SPA's own `$logout` URL; "closed" =
+            // we came back off that path. Best-effort like the classic one.
+            try {
+                const url = `${WWW2_SESSION_CLOSE_URL}?originalUrl=${encodeURIComponent(WWW2_APP_CARPETA)}`;
+                const landed = await s.goto(url);
+                www2Closed = new URL(landed).pathname !== new URL(WWW2_SESSION_CLOSE_URL).pathname;
+            }
+            catch {
+                // best-effort
+            }
+        }
         const landed = await s.goto(LOGOUT_URL);
         serverClosed = new URL(landed).pathname !== new URL(LOGOUT_URL).pathname;
     }
@@ -242,8 +406,14 @@ export async function logout(runtime) {
     }
     await deleteSession(runtime.store);
     await clearOperateState(runtime.store);
-    recordAudit(runtime, { action: 'logout', result: 'ok', rut: session.rut, serverClosed });
-    return { loggedOut: true, serverClosed };
+    recordAudit(runtime, {
+        action: 'logout',
+        result: 'ok',
+        rut: session.rut,
+        serverClosed,
+        ...(session.www2 ? { www2Closed } : {}),
+    });
+    return { loggedOut: true, serverClosed, www2Closed };
 }
 /** Curated identity readback from the portal. Requires a live session (no implicit
  *  login) — acquired via `withSession`; here an expired jar is an explicit
@@ -253,9 +423,21 @@ export async function statusRefresh(runtime) {
         if (landedOnLoginHost(await s.goto(HOSTS.miSii))) {
             throw new NotAuthenticatedError('La sesión expiró. Ejecuta `sii auth login`.');
         }
-        const identity = identityFromDatos(await s.evaluate(DATOS_EXPR));
+        const identity = identityFromDatos(await readDatos(s));
+        // The www2 layer, read live: a missing one is a plain `false` here, not an error — the
+        // classic identity is the job; the layer is reported (ADR-026).
+        let www2 = NO_WWW2;
+        try {
+            await readWww2Session(s, WWW2_APP_CARPETA);
+            const stored = await readSession(runtime.store);
+            www2 = { authenticated: true, expiresAt: stored?.www2?.expiresAt ?? null };
+        }
+        catch (e) {
+            if (!(e instanceof Www2SessionError))
+                throw e;
+        }
         recordAudit(runtime, { action: 'auth_status_refresh', result: 'ok', rut: identity.rut });
-        return identity;
+        return { ...identity, www2 };
     });
 }
 /** whoami — the session PRINCIPAL's own razón social/nombre + email, read live from
@@ -268,7 +450,7 @@ export async function whoami(runtime) {
         if (landedOnLoginHost(await s.goto(HOSTS.miSii))) {
             throw new NotAuthenticatedError('La sesión expiró. Ejecuta `sii auth login`.');
         }
-        const datos = await s.evaluate(DATOS_EXPR);
+        const datos = await readDatos(s);
         const identity = identityFromDatos(datos);
         const email = (datos?.contribuyente?.eMail ?? '').trim() || null;
         recordAudit(runtime, { action: 'whoami', result: 'ok', rut: identity.rut });

package/dist/auth/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACpF,OAAO,EACL,uBAAuB,EACvB,gBAAgB,EAChB,qBAAqB,GACtB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAGvE,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAErF,MAAM,wBAAwB,GAAG,OAAO,CAAC;AACzC,gFAAgF;AAChF,mFAAmF;AACnF,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,mFAAmF;AACnF,MAAM,UAAU,GAAG,2DAA2D,CAAC;AAkD/E,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAuB;IACvD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IACzC,OAAO,OAAO;QACZ,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE;QACpE,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;AACjE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAuB;IAChD,MAAM,CAAC,GAAG,KAAK,EAAE,aAAa,CAAC;IAC/B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,IAAI,gBAAgB,CAAC,iEAAiE,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC;IACpD,MAAM,WAAW,GAAgB,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAClG,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;IACjD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;AACjD,CAAC;AAED;;0FAE0F;AAC1F,KAAK,UAAU,cAAc,CAAC,OAAgB;IAC5C,IAAI,CAAC;QACH,OAAO,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CACjD,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CACrE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;0EAC0E;AAC1E,KAAK,UAAU,gBAAgB,CAAC,OAAgB;IAC9C,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,GAAG,EAAE,CAAC;QACR,WAAW,CAAC,OAAO,EAAE;YACnB,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,IAAI;YACZ,GAAG;YACH,MAAM,EAAE,uBAAuB;SAChC,CAAC,CAAC;QACH,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IACvE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;gCAIgC;AAChC,KAAK,UAAU,eAAe,CAC5B,OAAgB,EAChB,OAAsB,EACtB,QAAsB;IAEtB,MAAM,IAAI,GAAkB;QAC1B,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,WAAW,EAAE,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG;QAC5C,MAAM,EAAE,IAAI;KACb,CAAC;IACF,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAoB,QAAQ;aACtC,MAAM,CAAC,CAAC,CAAC,EAA4C,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC;aACvE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG;YACnC,MAAM,EAAE,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG;SAC/B,CAAC,CAAC,CAAC;QACN,gFAAgF;QAChF,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,CAAC;QAC9E,WAAW,CAAC,OAAO,EAAE;YACnB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,IAAI;YACZ,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,KAAK,EAAE,QAAQ,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QACxF,OAAO,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;+EAE+E;AAC/E,KAAK,UAAU,oBAAoB,CACjC,OAAgB,EAChB,OAAsB,EACtB,MAA2D,EAC3D,KAAa;IAEb,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,gBAAgB,CAAC,+DAA+D,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,QAAQ,CAAmB,UAAU,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;IAC7C,MAAM,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE;QAChC,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;KAC3C,CAAC,CAAC;IAEH,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnE,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE;QACpC,OAAO,EAAE,QAAQ,CAAC,GAAG;QACrB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,QAAQ;KACT,CAAC,CAAC;IAEH,WAAW,CAAC,OAAO,EAAE;QACnB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,IAAI;QACZ,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,MAAM;QACN,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK;KAClD,CAAC,CAAC;IACH,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC;AAC5D,CAAC;AAED;;wDAEwD;AACxD,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAAgB;IAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAEtB,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC;YAC9C,WAAW,EAAE,KAAK,CAAC,KAAK;YACxB,SAAS,EAAE,wBAAwB;SACpC,CAAC,CAAC;QACH,OAAO,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,KAAK,CAAC,CAAC;IAC9E,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1F,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;6EAG6E;AAC7E,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,WAA2C;IAE3C,OAAO,mBAAmB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,eAAe,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;2DAK2D;AAC3D,KAAK,UAAU,mBAAmB,CAChC,OAAgB,EAChB,cAA6D,EAC7D,MAAyC;IAEzC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,IAAI;QAAE,OAAO,IAAI,CAAC;IAEtB,MAAM,WAAW,GAAG,MAAM,cAAc,EAAE,CAAC;IAC3C,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;YAC7C,GAAG,EAAE,WAAW,CAAC,GAAG;YACpB,KAAK,EAAE,WAAW,CAAC,KAAK;YACxB,WAAW,EAAE,KAAK,CAAC,KAAK;YACxB,SAAS,EAAE,wBAAwB;SACpC,CAAC,CAAC;QACH,OAAO,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACzE,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;wDAGwD;AACxD,MAAM,UAAU,eAAe,CAAC,GAAQ;IACtC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;uFAGuF;AACvF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,IAAqB;IAErB,sFAAsF;IACtF,4DAA4D;IAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,uBAAuB,CAC/B,wFAAwF,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,mBAAmB,CACxB,OAAO,EACP,KAAK,IAAI,EAAE;QACT,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,KAAK;gBAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;QAClD,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,mCAAmC,GAAG,CAAC,SAAS,eAAe,eAAe,MAAM;YAClF,iBAAiB;YACjB,qDAAqD,eAAe,aAAa,GAAG,CAAC,SAAS,IAAI;YAClG,8CAA8C,eAAe,OAAO,GAAG,CAAC,SAAS,KAAK,CACzF,CAAC;IACJ,CAAC,EACD,eAAe,CAChB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAgB;IAC3C,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC;IACnD,CAAC;IAED,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,CAAC,GAAyB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvC,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,CAAC,CAAC;IACzF,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAC3C,CAAC;AAED;;mFAEmF;AACnF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAgB;IAClD,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,qBAAqB,CAAC,6CAA6C,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAmB,UAAU,CAAC,CAAC,CAAC;QACnF,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QACzF,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;uFAIuF;AACvF,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAgB;IAC3C,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,qBAAqB,CAAC,6CAA6C,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAmB,UAAU,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QACjE,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5E,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IAClG,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/auth/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,eAAe,EACf,UAAU,EACV,UAAU,EACV,gBAAgB,EAChB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,eAAe,GAChB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE3E,OAAO,EAAE,wBAAwB,EAAE,MAAM,6BAA6B,CAAC;AAGvE,OAAO,EACL,aAAa,EACb,WAAW,EACX,cAAc,EACd,WAAW,EACX,YAAY,GACb,MAAM,cAAc,CAAC;AAEtB,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAGpD,OAAO,EACL,eAAe,EACf,eAAe,EACf,cAAc,EACd,eAAe,EACf,cAAc,EACd,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACvF,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,MAAM,wBAAwB,GAAG,OAAO,CAAC;AACzC,gFAAgF;AAChF,mFAAmF;AACnF,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAExC;;+FAE+F;AAC/F,KAAK,UAAU,SAAS,CAAC,OAAsB;IAC7C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3E,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;AACjC,CAAC;AAiDD,0FAA0F;AAC1F,MAAM,mBAAmB,GAA2B,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAiB3E,MAAM,OAAO,GAAmB,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAE1E,SAAS,YAAY,CAAC,OAA6B,EAAE,GAAS;IAC5D,MAAM,KAAK,GAAG,OAAO,EAAE,IAAI,CAAC;IAC5B,IAAI,CAAC,KAAK;QAAE,OAAO,OAAO,CAAC;IAC3B,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;IAC9F,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;AAC9D,CAAC;AAED;iEACiE;AACjE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAAuB,EAAE,GAAS;IAClE,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,YAAY,GAAG,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,OAAO;QACZ,CAAC,CAAC;YACE,aAAa,EAAE,IAAI;YACnB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,aAAa,EAAE,QAAQ;YACvB,IAAI,EAAE,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC;YAChC,YAAY;SACb;QACH,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;AAC9F,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAuB;IAChD,MAAM,CAAC,GAAG,KAAK,EAAE,aAAa,CAAC;IAC/B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;QACpD,MAAM,IAAI,gBAAgB,CAAC,iEAAiE,CAAC,CAAC;IAChG,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC;IACpD,MAAM,WAAW,GAAgB,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACvE,MAAM,MAAM,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,eAAe,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IAClG,MAAM,MAAM,GAAG,CAAC,CAAC,WAAW,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC;IACjD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC;AACjD,CAAC;AAED;;0FAE0F;AAC1F,KAAK,UAAU,cAAc,CAAC,OAAgB;IAC5C,IAAI,CAAC;QACH,OAAO,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,CACjD,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CACrE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;sFAGsF;AACtF,KAAK,UAAU,iBAAiB,CAAC,OAAgB;IAC/C,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAC1C,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACpF,CAAC;AAED,qEAAqE;AACrE,SAAS,yBAAyB,CAChC,OAAgB,EAChB,IAAqB,EACrB,MAAmB;IAEnB,WAAW,CAAC,OAAO,EAAE;QACnB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,IAAI;QACZ,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,MAAM;KACP,CAAC,CAAC;AACL,CAAC;AAED;;;;gCAIgC;AAChC,KAAK,UAAU,eAAe,CAC5B,OAAgB,EAChB,OAAsB,EACtB,QAAsB;IAEtB,MAAM,IAAI,GAAkB;QAC1B,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,WAAW,EAAE,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG;QAC5C,MAAM,EAAE,IAAI;KACb,CAAC;IACF,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3E,MAAM,OAAO,GAAoB,QAAQ;aACtC,MAAM,CAAC,CAAC,CAAC,EAA4C,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC;aACvE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACX,GAAG,EAAE,CAAC,CAAC,GAAG;YACV,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG;YACnC,MAAM,EAAE,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,GAAG;SAC/B,CAAC,CAAC,CAAC;QACN,gFAAgF;QAChF,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,CAAC;QAC9E,WAAW,CAAC,OAAO,EAAE;YACnB,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,IAAI;YACZ,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,KAAK,EAAE,QAAQ,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QACxF,OAAO,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC;AACH,CAAC;AAED;;+EAE+E;AAC/E,KAAK,UAAU,oBAAoB,CACjC,OAAgB,EAChB,OAAsB,EACtB,MAAmB,EACnB,KAAa;IAEb,MAAM,MAAM,GAAqB,GAAG,MAAM,QAAQ,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,iBAAiB,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,gBAAgB,CAAC,+DAA+D,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;IAC7C,MAAM,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE;QAChC,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,OAAO;QACP,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;KAC3C,CAAC,CAAC;IAEH,+EAA+E;IAC/E,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC;IACnE,MAAM,gBAAgB,CAAC,OAAO,CAAC,KAAK,EAAE;QACpC,OAAO,EAAE,QAAQ,CAAC,GAAG;QACrB,WAAW,EAAE,QAAQ,CAAC,WAAW;QACjC,QAAQ;KACT,CAAC,CAAC;IAEH,uFAAuF;IACvF,IAAI,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,MAAM,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;IAE7F,WAAW,CAAC,OAAO,EAAE;QACnB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,IAAI;QACZ,GAAG,EAAE,QAAQ,CAAC,GAAG;QACjB,MAAM;QACN,MAAM;QACN,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK;KAClD,CAAC,CAAC;IACH,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC;AAC5D,CAAC;AAQD;iEACiE;AACjE,KAAK,UAAU,QAAQ,CAAC,OAAgB;IACtC,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;kDAGkD;AAClD,KAAK,UAAU,aAAa,CAAC,OAAgB,EAAE,OAAsB;IACnE,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,qBAAqB,CAAC,0CAA0C,CAAC,CAAC;IACzF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;QAChD,MAAM,kBAAkB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;QAClD,MAAM,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE;YAChC,GAAG,MAAM;YACT,OAAO,EAAE,iBAAiB,CAAC,UAAU,EAAE,OAAO,CAAC;YAC/C,IAAI,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE;SAC7B,CAAC,CAAC;QACH,WAAW,CAAC,OAAO,EAAE;YACnB,MAAM,EAAE,iBAAiB;YACzB,MAAM,EAAE,IAAI;YACZ,GAAG,EAAE,MAAM,CAAC,GAAG;YACf,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,KAAK;SAClD,CAAC,CAAC;QACH,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACvF,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;;sFAIsF;AACtF,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,OAAgB,EAChB,UAAwB,EAAE;IAE1B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,MAAM,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,yBAAyB,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,OAAO,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAChD,OAAO,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC;IACtE,CAAC;IAED,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,wFAAwF;QACxF,yEAAyE;QACzE,OAAO,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC,gBAAgB,CAAC;YACvD,WAAW,EAAE,KAAK,CAAC,KAAK;YACxB,SAAS,EAAE,wBAAwB;SACpC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAC9E,IAAI,CAAC,OAAO,CAAC,IAAI;YAAE,OAAO,MAAM,CAAC;QACjC,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,EAAE;YACnB,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,eAAe;YACvB,MAAM,EAAE,SAAS;SAClB,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;6EAG6E;AAC7E,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,WAA2C;IAE3C,OAAO,mBAAmB,CACxB,OAAO,EACP,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,EAC1B,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,EACxC,SAAS,CACV,CAAC;AACJ,CAAC;AAED;;;;8BAI8B;AAC9B,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAgB,EAChB,IAA6D;IAE7D,OAAO,mBAAmB,CACxB,OAAO,EACP,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EACnB,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EACjC,IAAI,CAAC,MAAM,CACZ,CAAC;AACJ,CAAC;AAED;;wFAEwF;AACxF,KAAK,UAAU,cAAc,CAAC,OAAgB,EAAE,GAAQ;IACtD,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,SAAS,EAAE,CAAC;QAC5D,MAAM,IAAI,eAAe,CACvB,8BAA8B,IAAI,CAAC,GAAG,aAAa,GAAG,CAAC,SAAS,oBAAoB;YAClF,qDAAqD,CACxD,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;8EAM8E;AAC9E,KAAK,UAAU,mBAAmB,CAChC,OAAgB,EAChB,GAAQ,EACR,QAA+B,EAC/B,MAAuC;IAEvC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAChD,IAAI,IAAI,EAAE,CAAC;QACT,yBAAyB,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACjD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QACjE,IAAI,KAAK,EAAE,CAAC;YACV,WAAW,CAAC,OAAO,EAAE;gBACnB,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,SAAS;gBACjB,GAAG,EAAE,GAAG,CAAC,SAAS;gBAClB,MAAM;aACP,CAAC,CAAC;YACH,MAAM,IAAI,iBAAiB,CACzB,oCAAoC,GAAG,CAAC,SAAS,+BAA+B;gBAC9E,GAAG,KAAK,CAAC,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,sBAAsB;gBACnF,oFAAoF,EACtF,EAAE,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAChE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC/B,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC;YAC7C,GAAG,EAAE,GAAG,CAAC,SAAS;YAClB,KAAK;YACL,WAAW,EAAE,KAAK,CAAC,KAAK;YACxB,SAAS,EAAE,wBAAwB;SACpC,CAAC,CAAC;QACH,OAAO,MAAM,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,yFAAyF;QACzF,yCAAyC;QACzC,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,cAAc,CAAC,OAAO,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAClF,CAAC;QACD,WAAW,CAAC,OAAO,EAAE;YACnB,MAAM,EAAE,YAAY;YACpB,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,GAAG,MAAM,QAAQ;YACzB,MAAM;SACP,CAAC,CAAC;QACH,MAAM,GAAG,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,MAAM,OAAO,EAAE,KAAK,EAAE,CAAC;IACzB,CAAC;AACH,CAAC;AAED;;;wDAGwD;AACxD,MAAM,UAAU,eAAe,CAAC,GAAQ;IACtC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;;uFAGuF;AACvF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,IAAqB;IAErB,sFAAsF;IACtF,4DAA4D;IAC5D,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,uBAAuB,CAC/B,wFAAwF,CACzF,CAAC;IACJ,CAAC;IACD,OAAO,mBAAmB,CACxB,OAAO,EACP,GAAG,EACH,KAAK,IAAI,EAAE;QACT,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;QACtC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;QAC1B,CAAC;QACD,MAAM,IAAI,uBAAuB,CAC/B,mCAAmC,GAAG,CAAC,SAAS,eAAe,eAAe,MAAM;YAClF,iBAAiB;YACjB,qDAAqD,eAAe,aAAa,GAAG,CAAC,SAAS,IAAI;YAClG,8CAA8C,eAAe,OAAO,GAAG,CAAC,SAAS,KAAK,CACzF,CAAC;IACJ,CAAC,EACD,SAAS,CACV,CAAC;AACJ,CAAC;AAED;wEACwE;AACxE,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,OAAgB,EAChB,OAAyB,EAAE;IAE3B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;IAC/E,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACzD,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACrF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAgB;IAC3C,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IACtE,CAAC;IAED,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,CAAC,GAAyB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,uFAAuF;YACvF,gEAAgE;YAChE,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,GAAG,sBAAsB,gBAAgB,kBAAkB,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBAC5F,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACjC,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,IAAI,GAAG,CAAC,sBAAsB,CAAC,CAAC,QAAQ,CAAC;YACrF,CAAC;YAAC,MAAM,CAAC;gBACP,cAAc;YAChB,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACxC,YAAY,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,sDAAsD;IACxD,CAAC;YAAS,CAAC;QACT,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,MAAM,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvC,WAAW,CAAC,OAAO,EAAE;QACnB,MAAM,EAAE,QAAQ;QAChB,MAAM,EAAE,IAAI;QACZ,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,YAAY;QACZ,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC,CAAC;IACH,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AACvD,CAAC;AAED;;mFAEmF;AACnF,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAgB;IAClD,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,qBAAqB,CAAC,6CAA6C,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,QAAQ,GAAG,iBAAiB,CAAC,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QACvD,uFAAuF;QACvF,gEAAgE;QAChE,IAAI,IAAI,GAAmB,OAAO,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAChD,IAAI,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,IAAI,IAAI,EAAE,CAAC;QAC7E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,CAAC,CAAC,YAAY,gBAAgB,CAAC;gBAAE,MAAM,CAAC,CAAC;QAChD,CAAC;QACD,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,qBAAqB,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QACzF,OAAO,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;uFAIuF;AACvF,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,OAAgB;IAC3C,OAAO,WAAW,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,IAAI,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,qBAAqB,CAAC,6CAA6C,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,CAAC,KAAK,EAAE,aAAa,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QACjE,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC;QAC5E,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,GAAG,EAAE,WAAW,EAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IAClG,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/datos-cntr.d.ts

@@ -0,0 +1,23 @@
+import { z } from 'zod';
+/** The curated subset of `DatosCntrNow.contribuyente` the auth flows read (identity + email).
+ *  Validated with zod at this boundary (ADR-011); unobserved fields pass through. */
+declare const DatosCntr: z.ZodObject<{
+    contribuyente: z.ZodOptional<z.ZodObject<{
+        rut: z.ZodOptional<z.ZodUnion<readonly [z.ZodNumber, z.ZodString]>>;
+        dv: z.ZodOptional<z.ZodString>;
+        razonSocial: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        nombres: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        apellidoPaterno: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        apellidoMaterno: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        eMail: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    }, z.core.$loose>>;
+}, z.core.$loose>;
+export type DatosCntr = z.infer<typeof DatosCntr>;
+/** Extract, parse and validate the `DatosCntrNow` object from the Mi SII HTML, or `null` when
+ *  it is absent / unparseable (a dead session bounced to the login page has no such object —
+ *  the caller treats `null` as "not authenticated", mirroring the old `evaluate` returning
+ *  null). The object is located by its name, then the first `{` after the `=` is matched to its
+ *  balanced `}` (string-aware), so trailing page script never confuses the boundary. */
+export declare function parseDatosCntrNow(html: string): DatosCntr | null;
+export {};
+//# sourceMappingURL=datos-cntr.d.ts.map

package/dist/auth/datos-cntr.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"datos-cntr.d.ts","sourceRoot":"","sources":["../../src/auth/datos-cntr.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;qFACqF;AACrF,QAAA,MAAM,SAAS;;;;;;;;;;iBAeL,CAAC;AAEX,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,SAAS,CAAC,CAAC;AAIlD;;;;wFAIwF;AACxF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAWhE"}

package/dist/auth/datos-cntr.js

@@ -0,0 +1,81 @@
+// Pure parser for the Mi SII landing's inline `DatosCntrNow` object (ADR-027). The HTTP
+// PortalDriver cannot run page JS, so the identity read moves off `session.evaluate` to an
+// extract-and-parse over the raw HTML — the object ships as an inline JS literal, which a
+// plain `fetch` already receives (observed 2026-10-17; CONVENTIONS "prefer inline structured
+// data over DOM scraping"). DOM-free so it is unit-testable in Node.
+import { z } from 'zod';
+/** The curated subset of `DatosCntrNow.contribuyente` the auth flows read (identity + email).
+ *  Validated with zod at this boundary (ADR-011); unobserved fields pass through. */
+const DatosCntr = z
+    .object({
+    contribuyente: z
+        .object({
+        rut: z.union([z.number(), z.string()]).optional(),
+        dv: z.string().optional(),
+        razonSocial: z.string().nullish(),
+        nombres: z.string().nullish(),
+        apellidoPaterno: z.string().nullish(),
+        apellidoMaterno: z.string().nullish(),
+        eMail: z.string().nullish(),
+    })
+        .loose()
+        .optional(),
+})
+    .loose();
+const MARKER = 'DatosCntrNow';
+/** Extract, parse and validate the `DatosCntrNow` object from the Mi SII HTML, or `null` when
+ *  it is absent / unparseable (a dead session bounced to the login page has no such object —
+ *  the caller treats `null` as "not authenticated", mirroring the old `evaluate` returning
+ *  null). The object is located by its name, then the first `{` after the `=` is matched to its
+ *  balanced `}` (string-aware), so trailing page script never confuses the boundary. */
+export function parseDatosCntrNow(html) {
+    const literal = extractObjectLiteral(html, MARKER);
+    if (literal === null)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(literal);
+    }
+    catch {
+        return null;
+    }
+    const result = DatosCntr.safeParse(parsed);
+    return result.success ? result.data : null;
+}
+/** From the first occurrence of `<name>` followed by `=`, return the balanced `{…}` object
+ *  literal that follows (string- and escape-aware), or null. Only `"`-delimited strings occur
+ *  in SII's JSON-shaped literal; braces inside them are ignored. */
+function extractObjectLiteral(source, name) {
+    const nameAt = source.indexOf(name);
+    if (nameAt < 0)
+        return null;
+    const eq = source.indexOf('=', nameAt + name.length);
+    if (eq < 0)
+        return null;
+    const open = source.indexOf('{', eq);
+    if (open < 0)
+        return null;
+    let depth = 0;
+    let inString = false;
+    for (let i = open; i < source.length; i++) {
+        const ch = source[i];
+        if (inString) {
+            if (ch === '\\')
+                i++; // skip the escaped char
+            else if (ch === '"')
+                inString = false;
+            continue;
+        }
+        if (ch === '"')
+            inString = true;
+        else if (ch === '{')
+            depth++;
+        else if (ch === '}') {
+            depth--;
+            if (depth === 0)
+                return source.slice(open, i + 1);
+        }
+    }
+    return null; // unbalanced — treat as absent
+}
+//# sourceMappingURL=datos-cntr.js.map

package/dist/auth/datos-cntr.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"datos-cntr.js","sourceRoot":"","sources":["../../src/auth/datos-cntr.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,2FAA2F;AAC3F,0FAA0F;AAC1F,6FAA6F;AAC7F,qEAAqE;AACrE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;qFACqF;AACrF,MAAM,SAAS,GAAG,CAAC;KAChB,MAAM,CAAC;IACN,aAAa,EAAE,CAAC;SACb,MAAM,CAAC;QACN,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE;QACjD,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QACzB,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;QACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;QAC7B,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;QACrC,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;QACrC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,EAAE;KAC5B,CAAC;SACD,KAAK,EAAE;SACP,QAAQ,EAAE;CACd,CAAC;KACD,KAAK,EAAE,CAAC;AAIX,MAAM,MAAM,GAAG,cAAc,CAAC;AAE9B;;;;wFAIwF;AACxF,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,OAAO,GAAG,oBAAoB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7C,CAAC;AAED;;oEAEoE;AACpE,SAAS,oBAAoB,CAAC,MAAc,EAAE,IAAY;IACxD,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5B,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACrC,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,EAAE,KAAK,IAAI;gBACb,CAAC,EAAE,CAAC,CAAC,wBAAwB;iBAC1B,IAAI,EAAE,KAAK,GAAG;gBAAE,QAAQ,GAAG,KAAK,CAAC;YACtC,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG;YAAE,QAAQ,GAAG,IAAI,CAAC;aAC3B,IAAI,EAAE,KAAK,GAAG;YAAE,KAAK,EAAE,CAAC;aACxB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACpB,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,CAAC,+BAA+B;AAC9C,CAAC"}

package/dist/auth/index.d.ts

@@ -1,3 +1,4 @@
 export * from './auth.js';
 export * from './session.js';
+export type { LoginBlockEntry } from './login-block.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,YAAY,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/auth/login-block.d.ts

@@ -0,0 +1,23 @@
+import { LoginFailedError } from '../errors/index.js';
+import type { LoginFailureReason } from '../errors/index.js';
+import type { KeyValueStore, Runtime } from '../seams/index.js';
+export interface LoginBlockEntry {
+    readonly rut: string;
+    readonly at: string;
+    readonly codigo: string | null;
+}
+/** Every latched RUT — what `auth status` reports, so a caller sees the block BEFORE it
+ *  decides to log in, instead of discovering it as a refusal. */
+export declare function listLoginBlocks(store: KeyValueStore): Promise<readonly LoginBlockEntry[]>;
+export declare function readLoginBlock(store: KeyValueStore, rut: string): Promise<LoginBlockEntry | null>;
+/** Did SII actually judge the Clave? Only then may the latch trip. SII's error page is the
+ *  one that prints a código (`parseSiiLoginErrorDetail`), so a código is the signal — not
+ *  `reason === 'wrong-clave'` alone: the locked-account página has its own, still unobserved
+ *  código (login-error.ts), and locking out a locked account is the safe direction. Queue-it,
+ *  a WAF refusal, a timeout or a network error carry no código: SII never saw the Clave. */
+export declare function siiJudgedClave(err: unknown): err is LoginFailedError;
+export declare function tripLoginBlock(runtime: Runtime, rut: string, codigo: string | null): Promise<void>;
+/** Lift the latch for one RUT, or for every RUT when none is given. Returns the RUTs lifted. */
+export declare function clearLoginBlock(store: KeyValueStore, rut?: string): Promise<string[]>;
+export declare function reasonForCodigo(codigo: string | null): LoginFailureReason;
+//# sourceMappingURL=login-block.d.ts.map

package/dist/auth/login-block.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-block.d.ts","sourceRoot":"","sources":["../../src/auth/login-block.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,gBAAgB,EAAoB,MAAM,oBAAoB,CAAC;AACxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAKhE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAiBD;iEACiE;AACjE,wBAAsB,eAAe,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC,CAE/F;AAED,wBAAsB,cAAc,CAClC,KAAK,EAAE,aAAa,EACpB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAEjC;AAED;;;;4FAI4F;AAC5F,wBAAgB,cAAc,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,gBAAgB,CAEpE;AAED,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,EAChB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,GAAG,IAAI,GACpB,OAAO,CAAC,IAAI,CAAC,CAMf;AAED,gGAAgG;AAChG,wBAAsB,eAAe,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAU3F;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,kBAAkB,CAEzE"}