@burdenoff/microfe-auth 2026.510.127

package/dist/auth/store/authStore.js

@@ -0,0 +1,314 @@
+import { create as e } from "zustand";
+import { persist as t } from "zustand/middleware";
+import { createProfileScopedStorage as n } from "@burdenoff/fe-libs/shared/utils";
+//#region src/auth/store/authStore.ts
+var r = "bf-p", i = "bf-profiles", a = "bf-active-profile", o = "auth-storage", s = "bf-auth-state-cleared";
+function c() {
+	return sessionStorage.getItem(a);
+}
+function l(e, t) {
+	return `${r}-${e}-${t}`;
+}
+function u(e) {
+	localStorage.removeItem(o), e && localStorage.removeItem(l(e, o));
+	for (let e of Object.keys(localStorage)) e.startsWith(`${r}-`) && e.endsWith(`-${o}`) && localStorage.removeItem(e);
+}
+function d() {
+	typeof window < "u" && window.dispatchEvent(new Event("bf-profile-storage-change"));
+}
+function f(e) {
+	if (typeof window > "u") return;
+	let t = c();
+	if (!t && !e.user && !e.clear) return;
+	let n = e.user?.id ?? t;
+	if (!(!n && !e.clear)) {
+		if (e.clear) {
+			if (u(n), !n) {
+				localStorage.removeItem(i), sessionStorage.removeItem(a);
+				return;
+			}
+			localStorage.removeItem(l(n, "user")), localStorage.removeItem(l(n, "tokens")), localStorage.removeItem(l(n, "workspace-token"));
+			try {
+				let e = localStorage.getItem(i), t = (e ? JSON.parse(e) : []).filter((e) => e.id !== n);
+				localStorage.setItem(i, JSON.stringify(t));
+			} catch {}
+			sessionStorage.removeItem(a);
+			return;
+		}
+		if (n) {
+			if (e.user) {
+				localStorage.setItem(l(n, "user"), JSON.stringify(e.user));
+				try {
+					let t = localStorage.getItem(i), r = (t ? JSON.parse(t) : []).filter((e) => e.id !== n);
+					r.push({
+						id: n,
+						email: e.user.email ?? "",
+						name: e.user.name ?? `${e.user.firstName ?? ""} ${e.user.lastName ?? ""}`.trim(),
+						avatar: e.user.avatar,
+						lastLogin: (/* @__PURE__ */ new Date()).toISOString()
+					}), localStorage.setItem(i, JSON.stringify(r));
+				} catch {}
+				sessionStorage.setItem(a, n);
+			}
+			if (e.accessToken !== void 0 || e.refreshToken !== void 0) {
+				let t = localStorage.getItem(l(n, "tokens")), r = t ? JSON.parse(t) : {}, i = r.expiresAt ?? Date.now() + 3600 * 1e3, a = e.accessToken ?? r.accessToken;
+				if (a) try {
+					let e = a.split(".")[1].replace(/-/g, "+").replace(/_/g, "/"), t = e.padEnd(Math.ceil(e.length / 4) * 4, "="), n = JSON.parse(atob(t));
+					typeof n.exp == "number" && (i = n.exp * 1e3);
+				} catch {}
+				let o = {
+					...r,
+					...e.accessToken === void 0 ? {} : { accessToken: e.accessToken },
+					...e.refreshToken === void 0 ? {} : { refreshToken: e.refreshToken },
+					expiresAt: i
+				};
+				o.accessToken ? localStorage.setItem(l(n, "tokens"), JSON.stringify(o)) : localStorage.removeItem(l(n, "tokens"));
+			}
+			e.workspaceToken !== void 0 && (e.workspaceToken ? localStorage.setItem(l(n, "workspace-token"), e.workspaceToken) : localStorage.removeItem(l(n, "workspace-token"))), d();
+			try {
+				let t = window.location.hostname, r = t.endsWith(".local.burdenoff.com") ? ".local.burdenoff.com" : void 0, i = `${r ? `; domain=${r}` : ""}; path=/; samesite=lax${window.location.protocol === "https:" ? "; secure" : ""}`;
+				if (e.accessToken && n) {
+					let e = JSON.stringify({
+						id: n,
+						origin: window.location.origin
+					});
+					document.cookie = `bf-sso=${encodeURIComponent(e)}${i}; max-age=86400`, document.cookie = `bf-sso-profile=${encodeURIComponent(e)}${i}; max-age=86400`;
+				}
+				e.clear && (document.cookie = "bf-sso=; path=/; max-age=0", document.cookie = "bf-sso-profile=; path=/; max-age=0", r && (document.cookie = `bf-sso=; path=/; domain=${r}; max-age=0`, document.cookie = `bf-sso-profile=; path=/; domain=${r}; max-age=0`), t && !["localhost", "127.0.0.1"].includes(t) && (document.cookie = `bf-sso=; path=/; domain=${t}; max-age=0`, document.cookie = `bf-sso-profile=; path=/; domain=${t}; max-age=0`));
+			} catch {}
+		}
+	}
+}
+var p = e()(t((e) => ({
+	user: null,
+	accessToken: null,
+	refreshToken: null,
+	isAuthenticated: !1,
+	organizations: [],
+	currentOrganizationId: null,
+	isLoadingOrganizations: !1,
+	workspaces: [],
+	currentWorkspaceId: null,
+	workspaceToken: null,
+	isLoadingWorkspaces: !1,
+	projects: [],
+	currentProjectId: null,
+	isLoadingProjects: !1,
+	mfaRequired: !1,
+	mfaChallengeId: null,
+	mfaDevices: [],
+	activeSessions: [],
+	currentSessionId: null,
+	linkedAccounts: [],
+	trustedDevices: [],
+	securityEvents: [],
+	apiKeys: [],
+	apps: [],
+	currentApp: null,
+	delegations: [],
+	grantedDelegations: [],
+	isLoading: !1,
+	error: null,
+	errorCode: null,
+	setUser: (t) => {
+		e({ user: t }), f({ user: t });
+	},
+	setAccessToken: (t) => {
+		e({ accessToken: t }), f({ accessToken: t });
+	},
+	setAuthTokens: (t, n) => {
+		if (p.getState().user) e({
+			accessToken: t,
+			refreshToken: n
+		}), f({
+			accessToken: t,
+			refreshToken: n
+		});
+		else try {
+			let r = t.split(".")[1].replace(/-/g, "+").replace(/_/g, "/"), i = r.padEnd(Math.ceil(r.length / 4) * 4, "="), a = JSON.parse(atob(i)), o = {
+				id: a.sub,
+				email: a.email,
+				username: a.username,
+				role: a.role,
+				status: "ACTIVE",
+				emailVerified: !0,
+				mfaEnabled: !1,
+				createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+				updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+			};
+			e({
+				accessToken: t,
+				refreshToken: n,
+				user: o
+			}), f({
+				accessToken: t,
+				refreshToken: n,
+				user: o
+			});
+		} catch (r) {
+			console.error("[AuthStore] Failed to decode JWT:", r), e({
+				accessToken: t,
+				refreshToken: n
+			}), f({
+				accessToken: t,
+				refreshToken: n
+			});
+		}
+	},
+	setAuthenticated: (t) => e({ isAuthenticated: t }),
+	clearAuth: () => {
+		e({
+			user: null,
+			accessToken: null,
+			refreshToken: null,
+			isAuthenticated: !1,
+			mfaRequired: !1,
+			mfaChallengeId: null,
+			activeSessions: [],
+			currentSessionId: null,
+			organizations: [],
+			currentOrganizationId: null,
+			isLoadingOrganizations: !1,
+			workspaces: [],
+			workspaceToken: null,
+			currentWorkspaceId: null,
+			isLoadingWorkspaces: !1,
+			projects: [],
+			currentProjectId: null,
+			isLoadingProjects: !1
+		}), f({ clear: !0 });
+	},
+	setOrganizations: (t) => e({ organizations: t }),
+	setCurrentOrganizationId: (t) => e((e) => e.currentOrganizationId === t ? e : { currentOrganizationId: t }),
+	setLoadingOrganizations: (t) => e({ isLoadingOrganizations: t }),
+	setWorkspaces: (t) => e({ workspaces: t }),
+	setCurrentWorkspaceId: (t) => e((e) => e.currentWorkspaceId === t ? e : { currentWorkspaceId: t }),
+	setWorkspaceToken: (t) => {
+		e({ workspaceToken: t }), f({ workspaceToken: t });
+	},
+	setLoadingWorkspaces: (t) => e({ isLoadingWorkspaces: t }),
+	clearWorkspace: () => e({
+		currentWorkspaceId: null,
+		workspaceToken: null,
+		workspaces: []
+	}),
+	setProjects: (t) => e({ projects: t }),
+	setCurrentProjectId: (t) => e((e) => e.currentProjectId === t ? e : { currentProjectId: t }),
+	setLoadingProjects: (t) => e({ isLoadingProjects: t }),
+	clearProject: () => e({
+		currentProjectId: null,
+		projects: []
+	}),
+	clearContext: () => e({
+		organizations: [],
+		currentOrganizationId: null,
+		isLoadingOrganizations: !1,
+		workspaces: [],
+		currentWorkspaceId: null,
+		workspaceToken: null,
+		isLoadingWorkspaces: !1,
+		projects: [],
+		currentProjectId: null,
+		isLoadingProjects: !1
+	}),
+	loadFromProfile: (t) => {
+		let n = null, r = null, i = null, a = null;
+		try {
+			let e = localStorage.getItem(l(t, "user"));
+			e && (n = JSON.parse(e));
+		} catch {}
+		try {
+			let e = localStorage.getItem(l(t, "tokens"));
+			if (e) {
+				let t = JSON.parse(e);
+				r = t.accessToken ?? null, i = t.refreshToken ?? null;
+			}
+		} catch {}
+		a = localStorage.getItem(l(t, "workspace-token")), e({
+			user: n,
+			accessToken: r,
+			refreshToken: i,
+			isAuthenticated: !!r && !!n,
+			workspaceToken: a,
+			organizations: [],
+			currentOrganizationId: null,
+			isLoadingOrganizations: !1,
+			workspaces: [],
+			currentWorkspaceId: null,
+			isLoadingWorkspaces: !1,
+			projects: [],
+			currentProjectId: null,
+			isLoadingProjects: !1,
+			mfaRequired: !1,
+			mfaChallengeId: null
+		}), d();
+	},
+	setMfaRequired: (t, n) => e({
+		mfaRequired: t,
+		mfaChallengeId: n || null
+	}),
+	setMfaDevices: (t) => e({ mfaDevices: t }),
+	removeMfaDevice: (t) => e((e) => ({ mfaDevices: e.mfaDevices.filter((e) => e.id !== t) })),
+	setActiveSessions: (t) => e({ activeSessions: t }),
+	removeSession: (t) => e((e) => ({ activeSessions: e.activeSessions.filter((e) => e.id !== t) })),
+	setLinkedAccounts: (t) => e({ linkedAccounts: t }),
+	removeLinkedAccount: (t) => e((e) => ({ linkedAccounts: e.linkedAccounts.filter((e) => e.id !== t) })),
+	setTrustedDevices: (t) => e({ trustedDevices: t }),
+	removeTrustedDevice: (t) => e((e) => ({ trustedDevices: e.trustedDevices.filter((e) => e.id !== t) })),
+	setSecurityEvents: (t) => e({ securityEvents: t }),
+	setApiKeys: (t) => e({ apiKeys: t }),
+	removeApiKey: (t) => e((e) => ({ apiKeys: e.apiKeys.filter((e) => e.id !== t) })),
+	setApps: (t) => e({ apps: t }),
+	setCurrentApp: (t) => e({ currentApp: t }),
+	addApp: (t) => e((e) => ({ apps: [...e.apps, t] })),
+	updateApp: (t) => e((e) => ({
+		apps: e.apps.map((e) => e.id === t.id ? t : e),
+		currentApp: e.currentApp?.id === t.id ? t : e.currentApp
+	})),
+	removeApp: (t) => e((e) => ({
+		apps: e.apps.filter((e) => e.id !== t),
+		currentApp: e.currentApp?.id === t ? null : e.currentApp
+	})),
+	setDelegations: (t) => e({ delegations: t }),
+	setGrantedDelegations: (t) => e({ grantedDelegations: t }),
+	addDelegation: (t) => e((e) => ({ delegations: [...e.delegations, t] })),
+	removeDelegation: (t) => e((e) => ({
+		delegations: e.delegations.filter((e) => e.id !== t),
+		grantedDelegations: e.grantedDelegations.filter((e) => e.id !== t)
+	})),
+	setLoading: (t) => e({ isLoading: t }),
+	setError: (t, n) => e({
+		error: t,
+		errorCode: n ?? null
+	})
+}), {
+	name: "auth-storage",
+	storage: n(),
+	partialize: (e) => ({
+		accessToken: e.accessToken,
+		refreshToken: e.refreshToken,
+		user: e.user,
+		isAuthenticated: e.isAuthenticated,
+		currentOrganizationId: e.currentOrganizationId,
+		currentWorkspaceId: e.currentWorkspaceId,
+		currentProjectId: e.currentProjectId,
+		workspaceToken: e.workspaceToken,
+		mfaRequired: e.mfaRequired,
+		mfaChallengeId: e.mfaChallengeId
+	})
+}));
+if (typeof window < "u") {
+	let e = window;
+	e.__bfAuthClearListenerInstalled || (e.__bfAuthClearListenerInstalled = !0, window.addEventListener(s, () => {
+		let e = p.getState();
+		if (e.isAuthenticated || e.accessToken || e.refreshToken || e.user) {
+			e.clearAuth();
+			return;
+		}
+		u(sessionStorage.getItem(a));
+	}));
+}
+//#endregion
+export { p as useAuthStore };
+
+//# sourceMappingURL=authStore.js.map

package/dist/auth/store/authStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authStore.js","names":[],"sources":["../../../src/auth/store/authStore.ts"],"sourcesContent":["import { create } from \"zustand\";\nimport { persist } from \"zustand/middleware\";\nimport { createProfileScopedStorage } from \"@burdenoff/fe-libs/shared/utils\";\nimport type {\n  User,\n  Session,\n  MfaDevice,\n  OAuthAccount,\n  TrustedDevice,\n  SecurityAudit,\n  ApiKey,\n  App,\n  AppUserDelegation,\n  Workspace,\n  Organization,\n  Project,\n} from \"../types\";\n\n/**\n * Sync auth state to profile-scoped storage (ProfileStorageManager keys).\n * The active profile ID comes from sessionStorage (\"bf-active-profile\").\n * Data is stored under localStorage keys: bf-p-{profileId}-user, bf-p-{profileId}-tokens, etc.\n */\nconst BF_PREFIX = \"bf-p\";\nconst BF_PROFILES = \"bf-profiles\";\nconst BF_ACTIVE = \"bf-active-profile\";\nconst AUTH_STORAGE_KEY = \"auth-storage\";\nconst AUTH_STATE_CLEARED_EVENT = \"bf-auth-state-cleared\";\n\nfunction getActiveProfileForSync(): string | null {\n  return sessionStorage.getItem(BF_ACTIVE);\n}\n\nfunction pfKey(profileId: string, suffix: string): string {\n  return `${BF_PREFIX}-${profileId}-${suffix}`;\n}\n\nfunction clearPersistedAuthStorage(profileId?: string | null): void {\n  localStorage.removeItem(AUTH_STORAGE_KEY);\n  if (profileId) {\n    localStorage.removeItem(pfKey(profileId, AUTH_STORAGE_KEY));\n  }\n  for (const key of Object.keys(localStorage)) {\n    if (\n      key.startsWith(`${BF_PREFIX}-`) &&\n      key.endsWith(`-${AUTH_STORAGE_KEY}`)\n    ) {\n      localStorage.removeItem(key);\n    }\n  }\n}\n\ninterface ProfileMeta {\n  id: string;\n  email: string;\n  name: string;\n  avatar?: string;\n  lastLogin: string;\n}\n\n/** Dispatch custom event to notify fe-libs AuthProvider of storage changes (same-tab). */\nfunction notifyProfileStorageChange(): void {\n  if (typeof window !== \"undefined\") {\n    window.dispatchEvent(new Event(\"bf-profile-storage-change\"));\n  }\n}\n\nfunction syncToProfileStorage(data: {\n  user?: User | null;\n  accessToken?: string | null;\n  refreshToken?: string | null;\n  workspaceToken?: string | null;\n  clear?: boolean;\n}) {\n  if (typeof window === \"undefined\") return;\n\n  const profileId = getActiveProfileForSync();\n  if (!profileId && !data.user && !data.clear) return;\n\n  // For login/signup: prefer the user's own ID as the target profile.\n  // This prevents overwriting an existing active profile when a NEW user\n  // signs up or logs in (multi-account scenario).\n  const targetId = data.user?.id ?? profileId;\n  if (!targetId && !data.clear) return;\n\n  if (data.clear) {\n    clearPersistedAuthStorage(targetId);\n    if (!targetId) {\n      localStorage.removeItem(BF_PROFILES);\n      sessionStorage.removeItem(BF_ACTIVE);\n      return;\n    }\n    // Remove profile data keys\n    localStorage.removeItem(pfKey(targetId, \"user\"));\n    localStorage.removeItem(pfKey(targetId, \"tokens\"));\n    localStorage.removeItem(pfKey(targetId, \"workspace-token\"));\n    // Remove from profiles list\n    try {\n      const profilesRaw = localStorage.getItem(BF_PROFILES);\n      const profiles: ProfileMeta[] = profilesRaw\n        ? JSON.parse(profilesRaw)\n        : [];\n      const filtered = profiles.filter((p) => p.id !== targetId);\n      localStorage.setItem(BF_PROFILES, JSON.stringify(filtered));\n    } catch {\n      /* ignore */\n    }\n    sessionStorage.removeItem(BF_ACTIVE);\n    return;\n  }\n\n  if (!targetId) return;\n\n  if (data.user) {\n    localStorage.setItem(pfKey(targetId, \"user\"), JSON.stringify(data.user));\n    // Update profiles list\n    try {\n      const profilesRaw = localStorage.getItem(BF_PROFILES);\n      const profiles: ProfileMeta[] = profilesRaw\n        ? JSON.parse(profilesRaw)\n        : [];\n      const existing = profiles.filter((p) => p.id !== targetId);\n      existing.push({\n        id: targetId,\n        email: data.user.email ?? \"\",\n        name:\n          data.user.name ??\n          `${data.user.firstName ?? \"\"} ${data.user.lastName ?? \"\"}`.trim(),\n        avatar: data.user.avatar,\n        lastLogin: new Date().toISOString(),\n      });\n      localStorage.setItem(BF_PROFILES, JSON.stringify(existing));\n    } catch {\n      /* ignore */\n    }\n    // Set as active profile in this tab\n    sessionStorage.setItem(BF_ACTIVE, targetId);\n  }\n\n  if (data.accessToken !== undefined || data.refreshToken !== undefined) {\n    const existingRaw = localStorage.getItem(pfKey(targetId, \"tokens\"));\n    const existing = existingRaw ? JSON.parse(existingRaw) : {};\n    // Compute expiresAt from the actual JWT exp claim if a new access token is provided\n    let expiresAt = existing.expiresAt ?? Date.now() + 60 * 60 * 1000;\n    const tokenToCheck = data.accessToken ?? existing.accessToken;\n    if (tokenToCheck) {\n      try {\n        const raw = tokenToCheck\n          .split(\".\")[1]\n          .replace(/-/g, \"+\")\n          .replace(/_/g, \"/\");\n        const padded = raw.padEnd(Math.ceil(raw.length / 4) * 4, \"=\");\n        const payload = JSON.parse(atob(padded));\n        if (typeof payload.exp === \"number\") {\n          expiresAt = payload.exp * 1000; // JWT exp is in seconds → ms\n        }\n      } catch {\n        // Fallback: keep existing or default 1h\n      }\n    }\n    const merged = {\n      ...existing,\n      ...(data.accessToken !== undefined\n        ? { accessToken: data.accessToken }\n        : {}),\n      ...(data.refreshToken !== undefined\n        ? { refreshToken: data.refreshToken }\n        : {}),\n      expiresAt,\n    };\n    if (merged.accessToken) {\n      localStorage.setItem(pfKey(targetId, \"tokens\"), JSON.stringify(merged));\n    } else {\n      localStorage.removeItem(pfKey(targetId, \"tokens\"));\n    }\n  }\n\n  if (data.workspaceToken !== undefined) {\n    if (data.workspaceToken) {\n      localStorage.setItem(\n        pfKey(targetId, \"workspace-token\"),\n        data.workspaceToken,\n      );\n    } else {\n      localStorage.removeItem(pfKey(targetId, \"workspace-token\"));\n    }\n  }\n\n  // Notify fe-libs AuthProvider of the change (same-tab custom event)\n  notifyProfileStorageChange();\n\n  // Set SSO cookie for cross-domain session sharing (works in all envs)\n  // Stores profile ID + the origin where the user logged in.\n  // Other shells use the origin to redirect to /auth/sso-relay for token relay.\n  try {\n    const hostname = window.location.hostname;\n    // For local dev, set cookie on shared .local.burdenoff.com domain\n    // For production, set cookie on current domain only (relay handles cross-domain)\n    const isSharedDomain = hostname.endsWith(\".local.burdenoff.com\");\n    const domain = isSharedDomain ? \".local.burdenoff.com\" : undefined;\n    const domainPart = domain ? `; domain=${domain}` : \"\";\n    const securePart = window.location.protocol === \"https:\" ? \"; secure\" : \"\";\n    const cookieOpts = `${domainPart}; path=/; samesite=lax${securePart}`;\n\n    if (data.accessToken && targetId) {\n      // Store profile ID + login origin for SSO relay\n      const ssoValue = JSON.stringify({\n        id: targetId,\n        origin: window.location.origin,\n      });\n      document.cookie = `bf-sso=${encodeURIComponent(ssoValue)}${cookieOpts}; max-age=86400`;\n      document.cookie = `bf-sso-profile=${encodeURIComponent(ssoValue)}${cookieOpts}; max-age=86400`;\n    }\n\n    if (data.clear) {\n      document.cookie = \"bf-sso=; path=/; max-age=0\";\n      document.cookie = \"bf-sso-profile=; path=/; max-age=0\";\n      if (domain) {\n        document.cookie = `bf-sso=; path=/; domain=${domain}; max-age=0`;\n        document.cookie = `bf-sso-profile=; path=/; domain=${domain}; max-age=0`;\n      }\n      if (hostname && ![\"localhost\", \"127.0.0.1\"].includes(hostname)) {\n        document.cookie = `bf-sso=; path=/; domain=${hostname}; max-age=0`;\n        document.cookie = `bf-sso-profile=; path=/; domain=${hostname}; max-age=0`;\n      }\n    }\n  } catch {\n    /* ignore */\n  }\n}\n\ninterface AuthState {\n  // Auth state\n  user: User | null;\n  accessToken: string | null;\n  refreshToken: string | null;\n  isAuthenticated: boolean;\n\n  // Organization state\n  organizations: Organization[];\n  currentOrganizationId: string | null;\n  isLoadingOrganizations: boolean;\n\n  // Workspace state\n  workspaces: Workspace[];\n  currentWorkspaceId: string | null;\n  workspaceToken: string | null;\n  isLoadingWorkspaces: boolean;\n\n  // Project state\n  projects: Project[];\n  currentProjectId: string | null;\n  isLoadingProjects: boolean;\n\n  // MFA state\n  mfaRequired: boolean;\n  mfaChallengeId: string | null;\n  mfaDevices: MfaDevice[];\n\n  // Session state\n  activeSessions: Session[];\n  currentSessionId: string | null;\n\n  // OAuth state\n  linkedAccounts: OAuthAccount[];\n\n  // Security state\n  trustedDevices: TrustedDevice[];\n  securityEvents: SecurityAudit[];\n\n  // API Keys state\n  apiKeys: ApiKey[];\n\n  // Apps state\n  apps: App[];\n  currentApp: App | null;\n\n  // Delegations state\n  delegations: AppUserDelegation[];\n  grantedDelegations: AppUserDelegation[];\n\n  // UI state\n  isLoading: boolean;\n  error: string | null;\n  errorCode: string | null;\n\n  // Actions - Auth\n  setUser: (user: User | null) => void;\n  setAccessToken: (token: string | null) => void;\n  setAuthTokens: (accessToken: string, refreshToken: string) => void;\n  setAuthenticated: (isAuthenticated: boolean) => void;\n  clearAuth: () => void;\n\n  // Actions - Organization\n  setOrganizations: (organizations: Organization[]) => void;\n  setCurrentOrganizationId: (orgId: string | null) => void;\n  setLoadingOrganizations: (loading: boolean) => void;\n\n  // Actions - Workspace\n  setWorkspaces: (workspaces: Workspace[]) => void;\n  setCurrentWorkspaceId: (workspaceId: string | null) => void;\n  setWorkspaceToken: (token: string | null) => void;\n  setLoadingWorkspaces: (loading: boolean) => void;\n  clearWorkspace: () => void;\n\n  // Actions - Project\n  setProjects: (projects: Project[]) => void;\n  setCurrentProjectId: (projectId: string | null) => void;\n  setLoadingProjects: (loading: boolean) => void;\n  clearProject: () => void;\n\n  // Actions - Context (clears org, workspace, project)\n  clearContext: () => void;\n\n  // Actions - Profile Switch (load from profile storage without syncing back)\n  loadFromProfile: (profileId: string) => void;\n\n  // Actions - MFA\n  setMfaRequired: (required: boolean, challengeId?: string) => void;\n  setMfaDevices: (devices: MfaDevice[]) => void;\n  removeMfaDevice: (deviceId: string) => void;\n\n  // Actions - Sessions\n  setActiveSessions: (sessions: Session[]) => void;\n  removeSession: (sessionId: string) => void;\n\n  // Actions - OAuth\n  setLinkedAccounts: (accounts: OAuthAccount[]) => void;\n  removeLinkedAccount: (accountId: string) => void;\n\n  // Actions - Security\n  setTrustedDevices: (devices: TrustedDevice[]) => void;\n  removeTrustedDevice: (deviceId: string) => void;\n  setSecurityEvents: (events: SecurityAudit[]) => void;\n\n  // Actions - API Keys\n  setApiKeys: (keys: ApiKey[]) => void;\n  removeApiKey: (keyId: string) => void;\n\n  // Actions - Apps\n  setApps: (apps: App[]) => void;\n  setCurrentApp: (app: App | null) => void;\n  addApp: (app: App) => void;\n  updateApp: (app: App) => void;\n  removeApp: (appId: string) => void;\n\n  // Actions - Delegations\n  setDelegations: (delegations: AppUserDelegation[]) => void;\n  setGrantedDelegations: (delegations: AppUserDelegation[]) => void;\n  addDelegation: (delegation: AppUserDelegation) => void;\n  removeDelegation: (delegationId: string) => void;\n\n  // Actions - UI\n  setLoading: (loading: boolean) => void;\n  setError: (error: string | null, errorCode?: string | null) => void;\n}\n\nexport const useAuthStore = create<AuthState>()(\n  persist(\n    (set) => ({\n      // Initial state\n      user: null,\n      accessToken: null,\n      refreshToken: null,\n      isAuthenticated: false,\n      organizations: [],\n      currentOrganizationId: null,\n      isLoadingOrganizations: false,\n      workspaces: [],\n      currentWorkspaceId: null,\n      workspaceToken: null,\n      isLoadingWorkspaces: false,\n      projects: [],\n      currentProjectId: null,\n      isLoadingProjects: false,\n      mfaRequired: false,\n      mfaChallengeId: null,\n      mfaDevices: [],\n      activeSessions: [],\n      currentSessionId: null,\n      linkedAccounts: [],\n      trustedDevices: [],\n      securityEvents: [],\n      apiKeys: [],\n      apps: [],\n      currentApp: null,\n      delegations: [],\n      grantedDelegations: [],\n      isLoading: false,\n      error: null,\n      errorCode: null,\n\n      // Actions - Auth (with profile storage sync)\n      setUser: (user) => {\n        set({ user });\n        syncToProfileStorage({ user });\n      },\n\n      setAccessToken: (token) => {\n        set({ accessToken: token });\n        syncToProfileStorage({ accessToken: token });\n      },\n\n      setAuthTokens: (accessToken, refreshToken) => {\n        // Only set tokens here. Do NOT overwrite user — setUser() handles that\n        // with the full user object from the GraphQL response (firstName, lastName, etc.).\n        // Fall back to JWT-decoded user ONLY if no user is currently in the store.\n        const currentState = useAuthStore.getState();\n        if (currentState.user) {\n          // User already set (from setUser call) — just update tokens\n          set({ accessToken, refreshToken });\n          syncToProfileStorage({ accessToken, refreshToken });\n        } else {\n          // No user yet — decode JWT as fallback\n          try {\n            const b64 = accessToken\n              .split(\".\")[1]\n              .replace(/-/g, \"+\")\n              .replace(/_/g, \"/\");\n            const padded = b64.padEnd(Math.ceil(b64.length / 4) * 4, \"=\");\n            const payload = JSON.parse(atob(padded));\n            const user: User = {\n              id: payload.sub,\n              email: payload.email,\n              username: payload.username,\n              role: payload.role,\n              status: \"ACTIVE\",\n              emailVerified: true,\n              mfaEnabled: false,\n              createdAt: new Date().toISOString(),\n              updatedAt: new Date().toISOString(),\n            };\n            set({ accessToken, refreshToken, user });\n            syncToProfileStorage({ accessToken, refreshToken, user });\n          } catch (error) {\n            console.error(\"[AuthStore] Failed to decode JWT:\", error);\n            set({ accessToken, refreshToken });\n            syncToProfileStorage({ accessToken, refreshToken });\n          }\n        }\n      },\n\n      setAuthenticated: (isAuthenticated) => set({ isAuthenticated }),\n\n      clearAuth: () => {\n        set({\n          user: null,\n          accessToken: null,\n          refreshToken: null,\n          isAuthenticated: false,\n          mfaRequired: false,\n          mfaChallengeId: null,\n          activeSessions: [],\n          currentSessionId: null,\n          organizations: [],\n          currentOrganizationId: null,\n          isLoadingOrganizations: false,\n          workspaces: [],\n          workspaceToken: null,\n          currentWorkspaceId: null,\n          isLoadingWorkspaces: false,\n          projects: [],\n          currentProjectId: null,\n          isLoadingProjects: false,\n        });\n        syncToProfileStorage({ clear: true });\n      },\n\n      // Actions - Organization\n      setOrganizations: (organizations) => set({ organizations }),\n\n      setCurrentOrganizationId: (orgId) =>\n        set((state) =>\n          state.currentOrganizationId === orgId\n            ? state\n            : { currentOrganizationId: orgId },\n        ),\n\n      setLoadingOrganizations: (loading) =>\n        set({ isLoadingOrganizations: loading }),\n\n      // Actions - Workspace\n      setWorkspaces: (workspaces) => set({ workspaces }),\n\n      setCurrentWorkspaceId: (workspaceId) =>\n        set((state) =>\n          state.currentWorkspaceId === workspaceId\n            ? state\n            : { currentWorkspaceId: workspaceId },\n        ),\n\n      setWorkspaceToken: (token) => {\n        set({ workspaceToken: token });\n        syncToProfileStorage({ workspaceToken: token });\n      },\n\n      setLoadingWorkspaces: (loading) => set({ isLoadingWorkspaces: loading }),\n\n      clearWorkspace: () =>\n        set({ currentWorkspaceId: null, workspaceToken: null, workspaces: [] }),\n\n      // Actions - Project\n      setProjects: (projects) => set({ projects }),\n\n      setCurrentProjectId: (projectId) =>\n        set((state) =>\n          state.currentProjectId === projectId\n            ? state\n            : { currentProjectId: projectId },\n        ),\n\n      setLoadingProjects: (loading) => set({ isLoadingProjects: loading }),\n\n      clearProject: () => set({ currentProjectId: null, projects: [] }),\n\n      // Actions - Context (clears org, workspace, project)\n      clearContext: () =>\n        set({\n          organizations: [],\n          currentOrganizationId: null,\n          isLoadingOrganizations: false,\n          workspaces: [],\n          currentWorkspaceId: null,\n          workspaceToken: null,\n          isLoadingWorkspaces: false,\n          projects: [],\n          currentProjectId: null,\n          isLoadingProjects: false,\n        }),\n\n      // Actions - Profile Switch\n      // Loads user/tokens from profile-scoped localStorage WITHOUT syncing back.\n      // Used during account switching to align zustand with the new active profile.\n      loadFromProfile: (profileId: string) => {\n        let user: User | null = null;\n        let accessToken: string | null = null;\n        let refreshToken: string | null = null;\n        let workspaceToken: string | null = null;\n\n        try {\n          const userRaw = localStorage.getItem(pfKey(profileId, \"user\"));\n          if (userRaw) user = JSON.parse(userRaw);\n        } catch {\n          /* ignore */\n        }\n\n        try {\n          const tokensRaw = localStorage.getItem(pfKey(profileId, \"tokens\"));\n          if (tokensRaw) {\n            const tokens = JSON.parse(tokensRaw);\n            accessToken = tokens.accessToken ?? null;\n            refreshToken = tokens.refreshToken ?? null;\n          }\n        } catch {\n          /* ignore */\n        }\n\n        workspaceToken = localStorage.getItem(\n          pfKey(profileId, \"workspace-token\"),\n        );\n\n        // Set everything in one batch — clears context data so it will be re-fetched\n        set({\n          user,\n          accessToken,\n          refreshToken,\n          isAuthenticated: !!accessToken && !!user,\n          workspaceToken,\n          // Clear all context — will be re-fetched for the new user\n          organizations: [],\n          currentOrganizationId: null,\n          isLoadingOrganizations: false,\n          workspaces: [],\n          currentWorkspaceId: null,\n          isLoadingWorkspaces: false,\n          projects: [],\n          currentProjectId: null,\n          isLoadingProjects: false,\n          // Clear MFA state\n          mfaRequired: false,\n          mfaChallengeId: null,\n        });\n\n        // Notify listeners (e.g., AuthTokenProvider) without writing back to storage\n        notifyProfileStorageChange();\n      },\n\n      // Actions - MFA\n      setMfaRequired: (required, challengeId) =>\n        set({ mfaRequired: required, mfaChallengeId: challengeId || null }),\n\n      setMfaDevices: (devices) => set({ mfaDevices: devices }),\n\n      removeMfaDevice: (deviceId) =>\n        set((state) => ({\n          mfaDevices: state.mfaDevices.filter((d) => d.id !== deviceId),\n        })),\n\n      // Actions - Sessions\n      setActiveSessions: (sessions) => set({ activeSessions: sessions }),\n\n      removeSession: (sessionId) =>\n        set((state) => ({\n          activeSessions: state.activeSessions.filter(\n            (s) => s.id !== sessionId,\n          ),\n        })),\n\n      // Actions - OAuth\n      setLinkedAccounts: (accounts) => set({ linkedAccounts: accounts }),\n\n      removeLinkedAccount: (accountId) =>\n        set((state) => ({\n          linkedAccounts: state.linkedAccounts.filter(\n            (a) => a.id !== accountId,\n          ),\n        })),\n\n      // Actions - Security\n      setTrustedDevices: (devices) => set({ trustedDevices: devices }),\n\n      removeTrustedDevice: (deviceId) =>\n        set((state) => ({\n          trustedDevices: state.trustedDevices.filter((d) => d.id !== deviceId),\n        })),\n\n      setSecurityEvents: (events) => set({ securityEvents: events }),\n\n      // Actions - API Keys\n      setApiKeys: (keys) => set({ apiKeys: keys }),\n\n      removeApiKey: (keyId) =>\n        set((state) => ({\n          apiKeys: state.apiKeys.filter((k) => k.id !== keyId),\n        })),\n\n      // Actions - Apps\n      setApps: (apps) => set({ apps }),\n\n      setCurrentApp: (app) => set({ currentApp: app }),\n\n      addApp: (app) =>\n        set((state) => ({\n          apps: [...state.apps, app],\n        })),\n\n      updateApp: (app) =>\n        set((state) => ({\n          apps: state.apps.map((a) => (a.id === app.id ? app : a)),\n          currentApp: state.currentApp?.id === app.id ? app : state.currentApp,\n        })),\n\n      removeApp: (appId) =>\n        set((state) => ({\n          apps: state.apps.filter((a) => a.id !== appId),\n          currentApp: state.currentApp?.id === appId ? null : state.currentApp,\n        })),\n\n      // Actions - Delegations\n      setDelegations: (delegations) => set({ delegations }),\n\n      setGrantedDelegations: (delegations) =>\n        set({ grantedDelegations: delegations }),\n\n      addDelegation: (delegation) =>\n        set((state) => ({\n          delegations: [...state.delegations, delegation],\n        })),\n\n      removeDelegation: (delegationId) =>\n        set((state) => ({\n          delegations: state.delegations.filter((d) => d.id !== delegationId),\n          grantedDelegations: state.grantedDelegations.filter(\n            (d) => d.id !== delegationId,\n          ),\n        })),\n\n      // Actions - UI\n      setLoading: (loading) => set({ isLoading: loading }),\n\n      setError: (error, errorCode) =>\n        set({ error, errorCode: errorCode ?? null }),\n    }),\n    {\n      name: \"auth-storage\",\n      storage: createProfileScopedStorage(),\n      partialize: (state) => ({\n        accessToken: state.accessToken,\n        refreshToken: state.refreshToken,\n        user: state.user,\n        isAuthenticated: state.isAuthenticated,\n        // Context state\n        currentOrganizationId: state.currentOrganizationId,\n        currentWorkspaceId: state.currentWorkspaceId,\n        currentProjectId: state.currentProjectId,\n        workspaceToken: state.workspaceToken,\n        // MFA state must be persisted for login verification flow\n        mfaRequired: state.mfaRequired,\n        mfaChallengeId: state.mfaChallengeId,\n      }),\n    },\n  ),\n);\n\ntype AuthClearWindow = Window & { __bfAuthClearListenerInstalled?: boolean };\n\nif (typeof window !== \"undefined\") {\n  const authWindow = window as AuthClearWindow;\n  if (!authWindow.__bfAuthClearListenerInstalled) {\n    authWindow.__bfAuthClearListenerInstalled = true;\n    window.addEventListener(AUTH_STATE_CLEARED_EVENT, () => {\n      const state = useAuthStore.getState();\n      if (\n        state.isAuthenticated ||\n        state.accessToken ||\n        state.refreshToken ||\n        state.user\n      ) {\n        state.clearAuth();\n        return;\n      }\n      clearPersistedAuthStorage(sessionStorage.getItem(BF_ACTIVE));\n    });\n  }\n}\n"],"mappings":";;;;AAuBA,IAAM,IAAY,QACZ,IAAc,eACd,IAAY,qBACZ,IAAmB,gBACnB,IAA2B;AAEjC,SAAS,IAAyC;AAChD,QAAO,eAAe,QAAQ,EAAU;;AAG1C,SAAS,EAAM,GAAmB,GAAwB;AACxD,QAAO,GAAG,EAAU,GAAG,EAAU,GAAG;;AAGtC,SAAS,EAA0B,GAAiC;AAElE,CADA,aAAa,WAAW,EAAiB,EACrC,KACF,aAAa,WAAW,EAAM,GAAW,EAAiB,CAAC;AAE7D,MAAK,IAAM,KAAO,OAAO,KAAK,aAAa,CACzC,CACE,EAAI,WAAW,GAAG,EAAU,GAAG,IAC/B,EAAI,SAAS,IAAI,IAAmB,IAEpC,aAAa,WAAW,EAAI;;AAclC,SAAS,IAAmC;AAC1C,CAAI,OAAO,SAAW,OACpB,OAAO,cAAc,IAAI,MAAM,4BAA4B,CAAC;;AAIhE,SAAS,EAAqB,GAM3B;AACD,KAAI,OAAO,SAAW,IAAa;CAEnC,IAAM,IAAY,GAAyB;AAC3C,KAAI,CAAC,KAAa,CAAC,EAAK,QAAQ,CAAC,EAAK,MAAO;CAK7C,IAAM,IAAW,EAAK,MAAM,MAAM;AAC9B,QAAC,KAAY,CAAC,EAAK,QAEvB;MAAI,EAAK,OAAO;AAEd,OADA,EAA0B,EAAS,EAC/B,CAAC,GAAU;AAEb,IADA,aAAa,WAAW,EAAY,EACpC,eAAe,WAAW,EAAU;AACpC;;AAKF,GAFA,aAAa,WAAW,EAAM,GAAU,OAAO,CAAC,EAChD,aAAa,WAAW,EAAM,GAAU,SAAS,CAAC,EAClD,aAAa,WAAW,EAAM,GAAU,kBAAkB,CAAC;AAE3D,OAAI;IACF,IAAM,IAAc,aAAa,QAAQ,EAAY,EAI/C,KAH0B,IAC5B,KAAK,MAAM,EAAY,GACvB,EAAE,EACoB,QAAQ,MAAM,EAAE,OAAO,EAAS;AAC1D,iBAAa,QAAQ,GAAa,KAAK,UAAU,EAAS,CAAC;WACrD;AAGR,kBAAe,WAAW,EAAU;AACpC;;AAGG,SAEL;OAAI,EAAK,MAAM;AACb,iBAAa,QAAQ,EAAM,GAAU,OAAO,EAAE,KAAK,UAAU,EAAK,KAAK,CAAC;AAExE,QAAI;KACF,IAAM,IAAc,aAAa,QAAQ,EAAY,EAI/C,KAH0B,IAC5B,KAAK,MAAM,EAAY,GACvB,EAAE,EACoB,QAAQ,MAAM,EAAE,OAAO,EAAS;AAU1D,KATA,EAAS,KAAK;MACZ,IAAI;MACJ,OAAO,EAAK,KAAK,SAAS;MAC1B,MACE,EAAK,KAAK,QACV,GAAG,EAAK,KAAK,aAAa,GAAG,GAAG,EAAK,KAAK,YAAY,KAAK,MAAM;MACnE,QAAQ,EAAK,KAAK;MAClB,4BAAW,IAAI,MAAM,EAAC,aAAa;MACpC,CAAC,EACF,aAAa,QAAQ,GAAa,KAAK,UAAU,EAAS,CAAC;YACrD;AAIR,mBAAe,QAAQ,GAAW,EAAS;;AAG7C,OAAI,EAAK,gBAAgB,KAAA,KAAa,EAAK,iBAAiB,KAAA,GAAW;IACrE,IAAM,IAAc,aAAa,QAAQ,EAAM,GAAU,SAAS,CAAC,EAC7D,IAAW,IAAc,KAAK,MAAM,EAAY,GAAG,EAAE,EAEvD,IAAY,EAAS,aAAa,KAAK,KAAK,GAAG,OAAU,KACvD,IAAe,EAAK,eAAe,EAAS;AAClD,QAAI,EACF,KAAI;KACF,IAAM,IAAM,EACT,MAAM,IAAI,CAAC,GACX,QAAQ,MAAM,IAAI,CAClB,QAAQ,MAAM,IAAI,EACf,IAAS,EAAI,OAAO,KAAK,KAAK,EAAI,SAAS,EAAE,GAAG,GAAG,IAAI,EACvD,IAAU,KAAK,MAAM,KAAK,EAAO,CAAC;AACxC,KAAI,OAAO,EAAQ,OAAQ,aACzB,IAAY,EAAQ,MAAM;YAEtB;IAIV,IAAM,IAAS;KACb,GAAG;KACH,GAAI,EAAK,gBAAgB,KAAA,IAErB,EAAE,GADF,EAAE,aAAa,EAAK,aAAa;KAErC,GAAI,EAAK,iBAAiB,KAAA,IAEtB,EAAE,GADF,EAAE,cAAc,EAAK,cAAc;KAEvC;KACD;AACD,IAAI,EAAO,cACT,aAAa,QAAQ,EAAM,GAAU,SAAS,EAAE,KAAK,UAAU,EAAO,CAAC,GAEvE,aAAa,WAAW,EAAM,GAAU,SAAS,CAAC;;AAgBtD,GAZI,EAAK,mBAAmB,KAAA,MACtB,EAAK,iBACP,aAAa,QACX,EAAM,GAAU,kBAAkB,EAClC,EAAK,eACN,GAED,aAAa,WAAW,EAAM,GAAU,kBAAkB,CAAC,GAK/D,GAA4B;AAK5B,OAAI;IACF,IAAM,IAAW,OAAO,SAAS,UAI3B,IADiB,EAAS,SAAS,uBAAuB,GAChC,yBAAyB,KAAA,GAGnD,IAAa,GAFA,IAAS,YAAY,MAAW,GAElB,wBADd,OAAO,SAAS,aAAa,WAAW,aAAa;AAGxE,QAAI,EAAK,eAAe,GAAU;KAEhC,IAAM,IAAW,KAAK,UAAU;MAC9B,IAAI;MACJ,QAAQ,OAAO,SAAS;MACzB,CAAC;AAEF,KADA,SAAS,SAAS,UAAU,mBAAmB,EAAS,GAAG,EAAW,kBACtE,SAAS,SAAS,kBAAkB,mBAAmB,EAAS,GAAG,EAAW;;AAGhF,IAAI,EAAK,UACP,SAAS,SAAS,8BAClB,SAAS,SAAS,sCACd,MACF,SAAS,SAAS,2BAA2B,EAAO,cACpD,SAAS,SAAS,mCAAmC,EAAO,eAE1D,KAAY,CAAC,CAAC,aAAa,YAAY,CAAC,SAAS,EAAS,KAC5D,SAAS,SAAS,2BAA2B,EAAS,cACtD,SAAS,SAAS,mCAAmC,EAAS;WAG5D;;;;AAmIV,IAAa,IAAe,GAAmB,CAC7C,GACG,OAAS;CAER,MAAM;CACN,aAAa;CACb,cAAc;CACd,iBAAiB;CACjB,eAAe,EAAE;CACjB,uBAAuB;CACvB,wBAAwB;CACxB,YAAY,EAAE;CACd,oBAAoB;CACpB,gBAAgB;CAChB,qBAAqB;CACrB,UAAU,EAAE;CACZ,kBAAkB;CAClB,mBAAmB;CACnB,aAAa;CACb,gBAAgB;CAChB,YAAY,EAAE;CACd,gBAAgB,EAAE;CAClB,kBAAkB;CAClB,gBAAgB,EAAE;CAClB,gBAAgB,EAAE;CAClB,gBAAgB,EAAE;CAClB,SAAS,EAAE;CACX,MAAM,EAAE;CACR,YAAY;CACZ,aAAa,EAAE;CACf,oBAAoB,EAAE;CACtB,WAAW;CACX,OAAO;CACP,WAAW;CAGX,UAAU,MAAS;AAEjB,EADA,EAAI,EAAE,SAAM,CAAC,EACb,EAAqB,EAAE,SAAM,CAAC;;CAGhC,iBAAiB,MAAU;AAEzB,EADA,EAAI,EAAE,aAAa,GAAO,CAAC,EAC3B,EAAqB,EAAE,aAAa,GAAO,CAAC;;CAG9C,gBAAgB,GAAa,MAAiB;AAK5C,MADqB,EAAa,UAAU,CAC3B,KAGf,CADA,EAAI;GAAE;GAAa;GAAc,CAAC,EAClC,EAAqB;GAAE;GAAa;GAAc,CAAC;MAGnD,KAAI;GACF,IAAM,IAAM,EACT,MAAM,IAAI,CAAC,GACX,QAAQ,MAAM,IAAI,CAClB,QAAQ,MAAM,IAAI,EACf,IAAS,EAAI,OAAO,KAAK,KAAK,EAAI,SAAS,EAAE,GAAG,GAAG,IAAI,EACvD,IAAU,KAAK,MAAM,KAAK,EAAO,CAAC,EAClC,IAAa;IACjB,IAAI,EAAQ;IACZ,OAAO,EAAQ;IACf,UAAU,EAAQ;IAClB,MAAM,EAAQ;IACd,QAAQ;IACR,eAAe;IACf,YAAY;IACZ,4BAAW,IAAI,MAAM,EAAC,aAAa;IACnC,4BAAW,IAAI,MAAM,EAAC,aAAa;IACpC;AAED,GADA,EAAI;IAAE;IAAa;IAAc;IAAM,CAAC,EACxC,EAAqB;IAAE;IAAa;IAAc;IAAM,CAAC;WAClD,GAAO;AAGd,GAFA,QAAQ,MAAM,qCAAqC,EAAM,EACzD,EAAI;IAAE;IAAa;IAAc,CAAC,EAClC,EAAqB;IAAE;IAAa;IAAc,CAAC;;;CAKzD,mBAAmB,MAAoB,EAAI,EAAE,oBAAiB,CAAC;CAE/D,iBAAiB;AAqBf,EApBA,EAAI;GACF,MAAM;GACN,aAAa;GACb,cAAc;GACd,iBAAiB;GACjB,aAAa;GACb,gBAAgB;GAChB,gBAAgB,EAAE;GAClB,kBAAkB;GAClB,eAAe,EAAE;GACjB,uBAAuB;GACvB,wBAAwB;GACxB,YAAY,EAAE;GACd,gBAAgB;GAChB,oBAAoB;GACpB,qBAAqB;GACrB,UAAU,EAAE;GACZ,kBAAkB;GAClB,mBAAmB;GACpB,CAAC,EACF,EAAqB,EAAE,OAAO,IAAM,CAAC;;CAIvC,mBAAmB,MAAkB,EAAI,EAAE,kBAAe,CAAC;CAE3D,2BAA2B,MACzB,GAAK,MACH,EAAM,0BAA0B,IAC5B,IACA,EAAE,uBAAuB,GAAO,CACrC;CAEH,0BAA0B,MACxB,EAAI,EAAE,wBAAwB,GAAS,CAAC;CAG1C,gBAAgB,MAAe,EAAI,EAAE,eAAY,CAAC;CAElD,wBAAwB,MACtB,GAAK,MACH,EAAM,uBAAuB,IACzB,IACA,EAAE,oBAAoB,GAAa,CACxC;CAEH,oBAAoB,MAAU;AAE5B,EADA,EAAI,EAAE,gBAAgB,GAAO,CAAC,EAC9B,EAAqB,EAAE,gBAAgB,GAAO,CAAC;;CAGjD,uBAAuB,MAAY,EAAI,EAAE,qBAAqB,GAAS,CAAC;CAExE,sBACE,EAAI;EAAE,oBAAoB;EAAM,gBAAgB;EAAM,YAAY,EAAE;EAAE,CAAC;CAGzE,cAAc,MAAa,EAAI,EAAE,aAAU,CAAC;CAE5C,sBAAsB,MACpB,GAAK,MACH,EAAM,qBAAqB,IACvB,IACA,EAAE,kBAAkB,GAAW,CACpC;CAEH,qBAAqB,MAAY,EAAI,EAAE,mBAAmB,GAAS,CAAC;CAEpE,oBAAoB,EAAI;EAAE,kBAAkB;EAAM,UAAU,EAAE;EAAE,CAAC;CAGjE,oBACE,EAAI;EACF,eAAe,EAAE;EACjB,uBAAuB;EACvB,wBAAwB;EACxB,YAAY,EAAE;EACd,oBAAoB;EACpB,gBAAgB;EAChB,qBAAqB;EACrB,UAAU,EAAE;EACZ,kBAAkB;EAClB,mBAAmB;EACpB,CAAC;CAKJ,kBAAkB,MAAsB;EACtC,IAAI,IAAoB,MACpB,IAA6B,MAC7B,IAA8B,MAC9B,IAAgC;AAEpC,MAAI;GACF,IAAM,IAAU,aAAa,QAAQ,EAAM,GAAW,OAAO,CAAC;AAC9D,GAAI,MAAS,IAAO,KAAK,MAAM,EAAQ;UACjC;AAIR,MAAI;GACF,IAAM,IAAY,aAAa,QAAQ,EAAM,GAAW,SAAS,CAAC;AAClE,OAAI,GAAW;IACb,IAAM,IAAS,KAAK,MAAM,EAAU;AAEpC,IADA,IAAc,EAAO,eAAe,MACpC,IAAe,EAAO,gBAAgB;;UAElC;AA+BR,EA3BA,IAAiB,aAAa,QAC5B,EAAM,GAAW,kBAAkB,CACpC,EAGD,EAAI;GACF;GACA;GACA;GACA,iBAAiB,CAAC,CAAC,KAAe,CAAC,CAAC;GACpC;GAEA,eAAe,EAAE;GACjB,uBAAuB;GACvB,wBAAwB;GACxB,YAAY,EAAE;GACd,oBAAoB;GACpB,qBAAqB;GACrB,UAAU,EAAE;GACZ,kBAAkB;GAClB,mBAAmB;GAEnB,aAAa;GACb,gBAAgB;GACjB,CAAC,EAGF,GAA4B;;CAI9B,iBAAiB,GAAU,MACzB,EAAI;EAAE,aAAa;EAAU,gBAAgB,KAAe;EAAM,CAAC;CAErE,gBAAgB,MAAY,EAAI,EAAE,YAAY,GAAS,CAAC;CAExD,kBAAkB,MAChB,GAAK,OAAW,EACd,YAAY,EAAM,WAAW,QAAQ,MAAM,EAAE,OAAO,EAAS,EAC9D,EAAE;CAGL,oBAAoB,MAAa,EAAI,EAAE,gBAAgB,GAAU,CAAC;CAElE,gBAAgB,MACd,GAAK,OAAW,EACd,gBAAgB,EAAM,eAAe,QAClC,MAAM,EAAE,OAAO,EACjB,EACF,EAAE;CAGL,oBAAoB,MAAa,EAAI,EAAE,gBAAgB,GAAU,CAAC;CAElE,sBAAsB,MACpB,GAAK,OAAW,EACd,gBAAgB,EAAM,eAAe,QAClC,MAAM,EAAE,OAAO,EACjB,EACF,EAAE;CAGL,oBAAoB,MAAY,EAAI,EAAE,gBAAgB,GAAS,CAAC;CAEhE,sBAAsB,MACpB,GAAK,OAAW,EACd,gBAAgB,EAAM,eAAe,QAAQ,MAAM,EAAE,OAAO,EAAS,EACtE,EAAE;CAEL,oBAAoB,MAAW,EAAI,EAAE,gBAAgB,GAAQ,CAAC;CAG9D,aAAa,MAAS,EAAI,EAAE,SAAS,GAAM,CAAC;CAE5C,eAAe,MACb,GAAK,OAAW,EACd,SAAS,EAAM,QAAQ,QAAQ,MAAM,EAAE,OAAO,EAAM,EACrD,EAAE;CAGL,UAAU,MAAS,EAAI,EAAE,SAAM,CAAC;CAEhC,gBAAgB,MAAQ,EAAI,EAAE,YAAY,GAAK,CAAC;CAEhD,SAAS,MACP,GAAK,OAAW,EACd,MAAM,CAAC,GAAG,EAAM,MAAM,EAAI,EAC3B,EAAE;CAEL,YAAY,MACV,GAAK,OAAW;EACd,MAAM,EAAM,KAAK,KAAK,MAAO,EAAE,OAAO,EAAI,KAAK,IAAM,EAAG;EACxD,YAAY,EAAM,YAAY,OAAO,EAAI,KAAK,IAAM,EAAM;EAC3D,EAAE;CAEL,YAAY,MACV,GAAK,OAAW;EACd,MAAM,EAAM,KAAK,QAAQ,MAAM,EAAE,OAAO,EAAM;EAC9C,YAAY,EAAM,YAAY,OAAO,IAAQ,OAAO,EAAM;EAC3D,EAAE;CAGL,iBAAiB,MAAgB,EAAI,EAAE,gBAAa,CAAC;CAErD,wBAAwB,MACtB,EAAI,EAAE,oBAAoB,GAAa,CAAC;CAE1C,gBAAgB,MACd,GAAK,OAAW,EACd,aAAa,CAAC,GAAG,EAAM,aAAa,EAAW,EAChD,EAAE;CAEL,mBAAmB,MACjB,GAAK,OAAW;EACd,aAAa,EAAM,YAAY,QAAQ,MAAM,EAAE,OAAO,EAAa;EACnE,oBAAoB,EAAM,mBAAmB,QAC1C,MAAM,EAAE,OAAO,EACjB;EACF,EAAE;CAGL,aAAa,MAAY,EAAI,EAAE,WAAW,GAAS,CAAC;CAEpD,WAAW,GAAO,MAChB,EAAI;EAAE;EAAO,WAAW,KAAa;EAAM,CAAC;CAC/C,GACD;CACE,MAAM;CACN,SAAS,GAA4B;CACrC,aAAa,OAAW;EACtB,aAAa,EAAM;EACnB,cAAc,EAAM;EACpB,MAAM,EAAM;EACZ,iBAAiB,EAAM;EAEvB,uBAAuB,EAAM;EAC7B,oBAAoB,EAAM;EAC1B,kBAAkB,EAAM;EACxB,gBAAgB,EAAM;EAEtB,aAAa,EAAM;EACnB,gBAAgB,EAAM;EACvB;CACF,CACF,CACF;AAID,IAAI,OAAO,SAAW,KAAa;CACjC,IAAM,IAAa;AACnB,CAAK,EAAW,mCACd,EAAW,iCAAiC,IAC5C,OAAO,iBAAiB,SAAgC;EACtD,IAAM,IAAQ,EAAa,UAAU;AACrC,MACE,EAAM,mBACN,EAAM,eACN,EAAM,gBACN,EAAM,MACN;AACA,KAAM,WAAW;AACjB;;AAEF,IAA0B,eAAe,QAAQ,EAAU,CAAC;GAC5D"}