@apteva/web-sdk 0.10.1 → 0.12.0

package/CHANGELOG.md

@@ -1,3 +1,22 @@
+## 0.11.0 — 2026-10-01
+
+- Retain session identity during offline, retryable and uncertain refresh failures
+  in both memory and local persistence modes. Never replay an uncertain rotation.
+- Add public `AuthState.reason` and `recovery` fields to distinguish temporary
+  uncertainty, confirmed invalid sessions, explicit logout and explicit revocation.
+  Block fresh credentials during uncertainty; retain already-valid access tokens.
+- Add sanitized diagnostic triggers for offline, timeout, HTTP, network,
+  persistence and unresolved refresh markers, with optional HTTP status.
+- Process refresh failures under Web Locks; prevent older attempts overwriting
+  a newer login, and recover when a sibling saves a newer valid revision.
+- Suppress `onUnauthorized` during refresh recovery. Keep subscriptions available
+  for retry instead of closing them merely because refresh is uncertain.
+- Add failure, timeout, concurrent-tab and recovery regression coverage including
+  real Chromium, localStorage and native Web Locks.
+- Apps own active-call behavior and call-ID recovery after re-login. Existing
+  Auth retry-safe errors require v0.12.1; no Auth/Telephony release is part of this
+  SDK fix. Explicit revocation state requires an explicit Auth response signal.
+
 ## 0.10.1
 
 - Keep an active managed Auth session after Auth explicitly reports a retryable

package/README.md

@@ -640,15 +640,17 @@ login and opaque-token APIs retain their original behavior.
 A temporary mint failure preserves the normal Auth session and blocks only
 platform-credential requests. Credential types never switch after an error. An
 explicit `refresh_unavailable` response keeps an active session and permits a
-later refresh attempt; an `invalid_grant` response clears it. An uncertain
-refresh outcome cannot safely reuse a single-use credential. Local logout clears
+later refresh attempt; `401 invalid_grant` clears it. An uncertain refresh
+outcome retains identity and requires login before acquiring fresh credentials.
+The SDK never reuses a refresh token whose rotation may have committed. Local logout clears
 credentials and streams immediately; a failed network logout still throws so the
 host can report that server-side revocation could not be confirmed. A late
 renewal cannot restore a logged-out session. HTTP writes are never automatically
 replayed after a 401; successful renewal prepares subsequent calls. Unlike legacy
 transport mode, a successfully recovered 401 does not trigger the
 `onUnauthorized` callback in managed Auth mode, although the original call still
-rejects. Reconcile a write's outcome before retrying it.
+rejects. Retryable or uncertain refresh failures also suppress this callback;
+use `onStateChange` to present recovery. Reconcile a write's outcome before retrying it.
 
 
 ### Mixed-app integration check
@@ -693,16 +695,45 @@ const conversations = client.app("conversations", { credential: "platform" });
 
 `auth.getState()` reports `status` (`idle`, `restoring`, `authenticated`,
 `unauthenticated`, or `error`), effective `persistence` (`memory`, `local`, or
-`unavailable`) and optional credential-free error metadata. Render loading for
-`idle`/`restoring`, rather than briefly displaying the login screen. Concurrent
-`restore()` calls share one promise. Protected requests await pending restoration
-and can start initial restoration themselves. After a restoration error, retry
-explicitly with `restore()` or log in; requests do not repeatedly retry it.
-`onDiagnostic` receives credential-free refresh outcomes (`succeeded`,
-`retryable`, `uncertain`, `invalid`) and session-clear reason codes. It never
-receives tokens, server response text or user details. An already authenticated
-tab stays authenticated after Auth explicitly returns `refresh_unavailable`;
-the failed request rejects, and the next request can try refresh again.
+`unavailable`), and optional credential-free `reason`, `recovery` and error
+metadata. These fields work in memory mode too. Render loading for
+`idle`/`restoring`. **`authenticated` means identity is retained; check `reason`
+and `recovery` before treating the session as fully operational.**
+
+| `reason` | `recovery` | Meaning |
+| --- | --- | --- |
+| absent | absent | Normal session or no pending recovery. |
+| `refresh_retryable` | `retry` | Offline before sending, or Auth explicitly guaranteed rotation did not commit. Retry with `auth.restore()` or a later request. |
+| `refresh_uncertain` | `login` | Timeout, lost/malformed response, generic HTTP failure, or unresolved refresh marker. Identity remains; fresh credentials are blocked. |
+| `storage_error` | `login` | Shared credentials cannot be read/coordinated safely. Identity remains; fresh credentials are blocked. |
+| `invalid_session` | `login` | Auth definitively rejected the session; credentials and identity are cleared. |
+| `revoked` | `login` | Auth explicitly reported `401 session_revoked`; credentials and identity are cleared. |
+| `logout` | absent | Explicit local or shared logout. |
+| `session_changed` | absent | Account replacement, disposal, or shared session removal. |
+
+Current Auth returns `invalid_grant` for both invalid and revoked sessions, so
+those responses produce `invalid_session`. The SDK reports `revoked` only when
+Auth supplies the explicit signal; it does not infer revocation from a generic 401.
+
+Concurrent `restore()` calls share one promise. Protected requests wait for
+pending restoration/refresh. Already-valid access credentials can remain usable
+until expiry; fresh platform mints and refresh-token reuse are blocked during
+uncertainty. A same-origin tab that safely saves a newer active revision can
+unblock recovery. Unknown rotation is never automatically replayed. Transparent
+recovery after an uncertain commit requires an Auth protocol enhancement.
+
+`onDiagnostic` receives fixed refresh outcomes (`succeeded`, `retryable`,
+`uncertain`, `invalid`, `revoked`, `blocked`), triggers (`offline`, `timeout`,
+`http`, `network`, `persistence`, `unresolved_marker`), optional HTTP status, and
+session-clear reasons. It never receives tokens, URLs, server text or identity.
+An uncertain refresh does not emit `session_clear` or close all session-bound
+streams. Streams report errors and wait for recovery; genuine logout/login,
+invalid session and revocation close the old session's streams.
+
+The SDK manages authentication state. The consuming app decides whether to pause
+an active call, show a retry/login action, or end it. Preserve the call ID in app
+state before a genuine re-login, then reconcile and resume using the app's API.
+Publishing this SDK does not update an app's bundled dependency or call UI.
 
 Only the refresh credential, format version, configuration scope and locally
 generated session/revision identifiers are persisted in localStorage. Normal Auth
@@ -745,9 +776,9 @@ Restoration failure handling:
 | Result | SDK behavior |
 | --- | --- |
 | Auth rejects an invalid/revoked refresh with `401 invalid_grant` | Clear the saved and local session; login is required. |
-| Browser is already offline before sending | Preserve the saved credential; retry restoration when connected. |
+| Browser is already offline before sending | Retain identity and the saved credential; report `refresh_retryable` and retry when connected. |
 | Auth returns `refresh_unavailable` with 503 | Auth confirms rotation did not commit; preserve an active session and its credential for retry. |
-| Network failure, generic proxy 5xx/401, malformed response, or `refresh_uncertain` | Preserve an uncertain marker; do not reuse the old credential. If no replacement was saved, require login. |
+| Network failure, generic proxy 5xx/401, malformed response, or `refresh_uncertain` | Retain identity and an uncertain marker; block fresh credentials, report `refresh_uncertain`, and require login if no replacement was saved. |
 | Platform mint denied | Restore the Auth session; platform-protected access remains blocked. |
 | Unsupported or malformed storage format | Fail closed; login or logout replaces the record. |
 

package/dist/auth-session.d.ts

@@ -26,21 +26,30 @@ export interface AuthSessionInfo {
     expiresAt: string;
     platformExpiresAt?: string;
 }
+export type AuthStateReason = "refresh_retryable" | "refresh_uncertain" | "invalid_session" | "logout" | "revoked" | "storage_error" | "session_changed";
+export type AuthDiagnosticTrigger = "offline" | "timeout" | "http" | "network" | "persistence" | "unresolved_marker";
 export interface AuthState {
     status: "idle" | "restoring" | "authenticated" | "unauthenticated" | "error";
     persistence: "memory" | "local" | "unavailable";
+    /** Authenticated can retain identity while fresh credentials are blocked. */
+    reason?: AuthStateReason;
+    recovery?: "retry" | "login";
     error?: {
         code: string;
         message: string;
+        trigger?: AuthDiagnosticTrigger;
+        httpStatus?: number;
     };
 }
 /** Credential-free lifecycle events suitable for client telemetry. */
 export type AuthDiagnostic = {
     type: "refresh";
-    outcome: "succeeded" | "retryable" | "uncertain" | "invalid";
+    outcome: "succeeded" | "retryable" | "uncertain" | "invalid" | "revoked" | "blocked";
+    trigger?: AuthDiagnosticTrigger;
+    httpStatus?: number;
 } | {
     type: "session_clear";
-    reason: "login" | "logout" | "dispose" | "shared_change" | "invalid_refresh" | "refresh_uncertain" | "storage_error";
+    reason: "login" | "logout" | "dispose" | "shared_change" | "invalid_refresh" | "revoked" | "refresh_uncertain" | "storage_error";
 };
 export interface AppAuthOptions {
     /** Public Auth app OAuth client identifier; never a private client secret. */
@@ -82,6 +91,8 @@ export declare class AuthSession {
     private platformRevision;
     private pending?;
     private pendingAuth?;
+    private refreshBlock?;
+    private recoveryFailure?;
     private controllers;
     private listeners;
     constructor(baseURL: string, projectId: string, options: AppAuthOptions, fetchImpl: typeof fetch, changed: (token: string | undefined) => void, environment?: PersistenceEnvironment);
@@ -89,6 +100,7 @@ export declare class AuthSession {
     private diagnostic;
     private emitState;
     private status;
+    private failedRefresh;
     private synchronize;
     private ready;
     restore(): Promise<AuthSessionInfo | undefined>;

package/dist/auth-session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-session.d.ts","sourceRoot":"","sources":["../src/auth-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4D,KAAK,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACjI,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,WAAW,cAAc;IAAG,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AACnE,MAAM,WAAW,eAAgB,SAAQ,cAAc;IAAG,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE;AAChF,MAAM,WAAW,QAAS,SAAQ,IAAI;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AACD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AACD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,QAAQ,CAAC;IACf,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AACD,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,eAAe,GAAG,iBAAiB,GAAG,OAAO,CAAC;IAC7E,WAAW,EAAE,QAAQ,GAAG,OAAO,GAAG,aAAa,CAAC;IAChD,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AACD,sEAAsE;AACtE,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,SAAS,CAAA;CAAE,GACjF;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,eAAe,GAAG,iBAAiB,GAAG,mBAAmB,GAAG,eAAe,CAAA;CAAE,CAAC;AACpJ,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,WAAW,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IACjC,qEAAqE;IACrE,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;IAC3C,yDAAyD;IACzD,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,eAAe,GAAG,SAAS,KAAK,IAAI,CAAC;IACjE,iFAAiF;IACjF,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;CAChD;AAYD,MAAM,WAAW,iBAAiB;IAAG,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AASvG,kFAAkF;AAClF,qBAAa,WAAW;IAepB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAlB1B,OAAO,CAAC,KAAK,CAAC,CAAQ;IACtB,OAAO,CAAC,WAAW,CAAC,CAAqB;IACzC,OAAO,CAAC,MAAM,CAAC,CAAgB;IAC/B,OAAO,CAAC,WAAW,CAAC,CAAuC;IAC3D,OAAO,CAAC,SAAS,CAAmE;IACpF,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,OAAO,CAAC,CAAkB;IAClC,OAAO,CAAC,WAAW,CAAC,CAAgB;IACpC,OAAO,CAAC,WAAW,CAA8B;IACjD,OAAO,CAAC,SAAS,CAAyB;gBAEvB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,OAAO,KAAK,EACvB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,IAAI,EAC7D,WAAW,CAAC,EAAE,sBAAsB;IAatC,QAAQ,IAAI,SAAS;IACrB,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,MAAM;IAMd,OAAO,CAAC,WAAW;YAgBL,KAAK;IAOnB,OAAO,IAAI,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;YAajC,YAAY;IAc1B,OAAO,IAAI,IAAI;IACf,IAAI,IAAI,eAAe,GAAG,SAAS;IAMnC,OAAO,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IACzC,OAAO,CAAC,MAAM;IAGd,KAAK,CAAC,MAAM,GAAE,OAAO,CAAC,cAAc,EAAE;QAAE,IAAI,EAAE,eAAe,CAAA;KAAE,CAAC,CAAC,QAAQ,CAAmB,GAAG,IAAI;IAenG,OAAO,CAAC,WAAW;YAGL,IAAI;IAyBlB,OAAO,CAAC,KAAK;IAGb,OAAO,CAAC,QAAQ;IAShB,OAAO,CAAC,gBAAgB;IAGxB,OAAO,CAAC,MAAM;YAeA,SAAS;IA8BjB,KAAK,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,qBAAqB,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAI9F,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;YA0Bf,YAAY;YAoCZ,WAAW;YAMX,kBAAkB;YAsClB,KAAK;IA+Bb,KAAK,CAAC,KAAK,UAAQ,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBrC,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC;IAoBvB,UAAU,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAmB3D,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;CAS9E"}
+{"version":3,"file":"auth-session.d.ts","sourceRoot":"","sources":["../src/auth-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4D,KAAK,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AACjI,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAEvC,MAAM,WAAW,cAAc;IAAG,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AACnE,MAAM,WAAW,eAAgB,SAAQ,cAAc;IAAG,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE;AAChF,MAAM,WAAW,QAAS,SAAQ,IAAI;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AACD,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AACD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,QAAQ,CAAC;IACf,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AACD,MAAM,MAAM,eAAe,GAAG,mBAAmB,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,QAAQ,GAAG,SAAS,GAAG,eAAe,GAAG,iBAAiB,CAAC;AACzJ,MAAM,MAAM,qBAAqB,GAAG,SAAS,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,GAAG,aAAa,GAAG,mBAAmB,CAAC;AACrH,MAAM,WAAW,SAAS;IACxB,MAAM,EAAE,MAAM,GAAG,WAAW,GAAG,eAAe,GAAG,iBAAiB,GAAG,OAAO,CAAC;IAC7E,WAAW,EAAE,QAAQ,GAAG,OAAO,GAAG,aAAa,CAAC;IAChD,6EAA6E;IAC7E,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IAC7B,KAAK,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACjG;AACD,sEAAsE;AACtE,MAAM,MAAM,cAAc,GACtB;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,SAAS,GAAG,SAAS,GAAG,SAAS,CAAC;IAAC,OAAO,CAAC,EAAE,qBAAqB,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/J;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,eAAe,GAAG,iBAAiB,GAAG,SAAS,GAAG,mBAAmB,GAAG,eAAe,CAAA;CAAE,CAAC;AAChK,MAAM,WAAW,cAAc;IAC7B,8EAA8E;IAC9E,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,iFAAiF;IACjF,WAAW,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IACjC,qEAAqE;IACrE,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;IAC3C,yDAAyD;IACzD,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,eAAe,GAAG,SAAS,KAAK,IAAI,CAAC;IACjE,iFAAiF;IACjF,YAAY,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;CAChD;AAYD,MAAM,WAAW,iBAAiB;IAAG,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE;AAUvG,kFAAkF;AAClF,qBAAa,WAAW;IAiBpB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IApB1B,OAAO,CAAC,KAAK,CAAC,CAAQ;IACtB,OAAO,CAAC,WAAW,CAAC,CAAqB;IACzC,OAAO,CAAC,MAAM,CAAC,CAAgB;IAC/B,OAAO,CAAC,WAAW,CAAC,CAAuC;IAC3D,OAAO,CAAC,SAAS,CAAmE;IACpF,OAAO,CAAC,QAAQ,CAAS;IACzB,OAAO,CAAC,KAAK,CAAK;IAClB,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,OAAO,CAAC,CAAkB;IAClC,OAAO,CAAC,WAAW,CAAC,CAAgB;IACpC,OAAO,CAAC,YAAY,CAAC,CAAoC;IACzD,OAAO,CAAC,eAAe,CAAC,CAAoC;IAC5D,OAAO,CAAC,WAAW,CAA8B;IACjD,OAAO,CAAC,SAAS,CAAyB;gBAEvB,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,cAAc,EACvB,SAAS,EAAE,OAAO,KAAK,EACvB,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,KAAK,IAAI,EAC7D,WAAW,CAAC,EAAE,sBAAsB;IAatC,QAAQ,IAAI,SAAS;IACrB,OAAO,CAAC,UAAU;IAClB,OAAO,CAAC,SAAS;IACjB,OAAO,CAAC,MAAM;IAQd,OAAO,CAAC,aAAa;IAgBrB,OAAO,CAAC,WAAW;YA2BL,KAAK;IAOnB,OAAO,IAAI,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC;YAkBjC,YAAY;IAwB1B,OAAO,IAAI,IAAI;IACf,IAAI,IAAI,eAAe,GAAG,SAAS;IAMnC,OAAO,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI;IACzC,OAAO,CAAC,MAAM;IAGd,KAAK,CAAC,MAAM,GAAE,OAAO,CAAC,cAAc,EAAE;QAAE,IAAI,EAAE,eAAe,CAAA;KAAE,CAAC,CAAC,QAAQ,CAAmB,GAAG,IAAI;IAiBnG,OAAO,CAAC,WAAW;YAGL,IAAI;IAmClB,OAAO,CAAC,KAAK;IAGb,OAAO,CAAC,QAAQ;IAShB,OAAO,CAAC,gBAAgB;IAGxB,OAAO,CAAC,MAAM;YAgBA,SAAS;IA8BjB,KAAK,CAAC,KAAK,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,qBAAqB,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAI9F,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;YA0Bf,YAAY;YA4DZ,WAAW;YAMX,kBAAkB;YA0ClB,KAAK;IAiCb,KAAK,CAAC,KAAK,UAAQ,GAAG,OAAO,CAAC,MAAM,CAAC;IAkBrC,EAAE,IAAI,OAAO,CAAC,QAAQ,CAAC;IAoBvB,UAAU,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAmB3D,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC;CAS9E"}