@coderoftime/fints 0.0.0-stage → 0.2.0

package/dist/session/login-guard.d.ts

@@ -0,0 +1,78 @@
+import { FinTsLoginRefusedError, type FinTsBankError } from '../core/errors.js';
+import { type FinTsFeedback } from '../core/feedback.js';
+import type { TanMethod } from '../tan/tan-models.js';
+import type { PinGuard } from '../v3/protocol.js';
+/**
+ * The kind of request a bank response answers, which decides what its errors mean for the login (`LoginGuard.judge`)
+ * and whether they can reject a TAN:
+ * - `login`: the login that opens a dialog, which carries no order;
+ * - `order`: an order in a dialog the bank has opened;
+ * - `approval`: a message that completes an approval, the TAN or the question whether the user approved in the app.
+ */
+export type RequestKind = 'login' | 'order' | 'approval';
+/**
+ * A reason for a refused login that the session can take care of by itself, after which it logs in once more: the user
+ * may not use the TAN method the login was signed with, or the bank no longer accepts the customer system ID.
+ */
+export type RefusalReason = 'tanMethodNotAllowed' | 'systemIdRejected';
+/** What the saved state keeps of the guard: the return codes of the bank's refusal, and `unreadLogins`. */
+export interface LoginGuardState {
+    readonly refusal: readonly FinTsFeedback[] | undefined;
+    readonly unreadLogins: number;
+}
+/**
+ * Holds the PIN and hands it out only while no login is refused (`pin`), so that a retrying app cannot lock the user's
+ * access. `FinTsLoginRefusedError` tells which logins count as refused; `judge` decides it for each answer.
+ *
+ * A refusal counts at once and fails closed: only `remedied` lifts it, within the call that met it (`runCall`), once
+ * the session has taken care of a reason it names, each reason once per call, so that a call sends at most three
+ * logins the bank refuses. A refusal that outlasts the call is final, and the guard forgets the PIN; only a PIN the
+ * user enters anew lifts it (`replacePin`), unless it brings new login data.
+ */
+export declare class LoginGuard implements PinGuard {
+    #private;
+    private refusalValue;
+    /** The TAN method of the login `refusalValue` refused, which a restored refusal does not tell. */
+    private refusedMethod;
+    /** Logins sent since the bank last took the PIN whose answer the client has not read. */
+    private unreadLogins;
+    /** The refusal of `maxUnreadLogins` unread logins, kept so that `check` throws the same error each time. */
+    private unreadLoginsRefusal;
+    /** The reasons `remedied` has lifted a refusal for in the running call. */
+    private readonly pardonedReasons;
+    constructor(pin: string);
+    /** The PIN to sign a message with; throws the refusal instead (`check`), and `FinTsStateError` once closed. */
+    get pin(): string;
+    /** Throws the refusal, if there is one. */
+    check(): void;
+    /** The bank's refusal, else that of `maxUnreadLogins` unread logins; `undefined` while there is none. */
+    get refusal(): FinTsLoginRefusedError | undefined;
+    /** Counts a login signed with the PIN as unread until `judge` reads its answer. */
+    loginSent(): void;
+    /**
+     * Judges `error`, if the answer to a request of `kind` in a dialog signed with `method` has one: returns the refusal
+     * of the login it amounts to, and records it unless the guard holds one already. Any error refuses a login; after the
+     * login only one that refuses it itself, a rejected PIN or new login data, since the bank checked the PIN before.
+     */
+    judge(error: FinTsBankError | undefined, kind: RequestKind, method: TanMethod): FinTsLoginRefusedError | undefined;
+    /** Runs `call`, one call of the client; a refusal that outlasts it is final, and the next call remedies anew. */
+    runCall<T>(call: () => Promise<T>): Promise<T>;
+    /**
+     * Runs `attempt`, which may log in, and runs it once more each time `remedy` takes care of a reason the refusal it
+     * failed with names; `remedy` gets the reason and the TAN method of the refused login, and returns whether it could.
+     */
+    remedied<T>(attempt: () => Promise<T>, remedy: (reason: RefusalReason, rejected: TanMethod) => Promise<boolean>): Promise<T>;
+    /**
+     * Signs with `pin` from now on, a PIN the user has entered anew and the protocol can send, and lifts the refusal.
+     * Throws the refusal instead where it brings new login data, which end the old ones for good.
+     */
+    replacePin(pin: string): void;
+    /** Forgets the PIN; the client calls it once it is closed. */
+    close(): void;
+    saveState(): LoginGuardState;
+    /** Restores what `saveState` returned; a restored refusal is final. */
+    restoreState(saved: LoginGuardState): void;
+    private liftRefusal;
+    private forgetPinIfRefused;
+}
+//# sourceMappingURL=login-guard.d.ts.map

package/dist/session/login-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-guard.d.ts","sourceRoot":"","sources":["../../src/session/login-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,sBAAsB,EAGtB,KAAK,cAAc,EACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAA+C,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACtG,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAElD;;;;;;GAMG;AACH,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,OAAO,GAAG,UAAU,CAAC;AAEzD;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,qBAAqB,GAAG,kBAAkB,CAAC;AAEvE,2GAA2G;AAC3G,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,SAAS,CAAC;IACvD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAQD;;;;;;;;GAQG;AACH,qBAAa,UAAW,YAAW,QAAQ;;IAIzC,OAAO,CAAC,YAAY,CAAqC;IAEzD,kGAAkG;IAClG,OAAO,CAAC,aAAa,CAAwB;IAE7C,yFAAyF;IACzF,OAAO,CAAC,YAAY,CAAK;IAEzB,4GAA4G;IAC5G,OAAO,CAAC,mBAAmB,CAAqC;IAEhE,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA4B;gBAEhD,GAAG,EAAE,MAAM;IAIvB,+GAA+G;IAC/G,IAAI,GAAG,IAAI,MAAM,CAIhB;IAED,2CAA2C;IAC3C,KAAK,IAAI,IAAI;IAKb,yGAAyG;IACzG,IAAI,OAAO,IAAI,sBAAsB,GAAG,SAAS,CAQhD;IAED,mFAAmF;IACnF,SAAS,IAAI,IAAI;IAIjB;;;;OAIG;IACH,KAAK,CAAC,KAAK,EAAE,cAAc,GAAG,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,GAAG,sBAAsB,GAAG,SAAS;IAYlH,iHAAiH;IAC3G,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IASpD;;;OAGG;IACG,QAAQ,CAAC,CAAC,EACd,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,EACzB,MAAM,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,SAAS,KAAK,OAAO,CAAC,OAAO,CAAC,GACvE,OAAO,CAAC,CAAC,CAAC;IAoBb;;;OAGG;IACH,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;IAQ7B,8DAA8D;IAC9D,KAAK,IAAI,IAAI;IAIb,SAAS,IAAI,eAAe;IAI5B,uEAAuE;IACvE,YAAY,CAAC,KAAK,EAAE,eAAe,GAAG,IAAI;IAM1C,OAAO,CAAC,WAAW;IAKnB,OAAO,CAAC,kBAAkB;CAG3B"}

package/dist/session/login-guard.js

@@ -0,0 +1,181 @@
+import { clientClosedError, FinTsLoginDataChangedError, FinTsLoginRefusedError, FinTsPinError, loginRefusalFor, } from '../core/errors.js';
+import { allowedTanMethodsIn, FeedbackCodes, hasCode } from '../core/feedback.js';
+/**
+ * Logins in a row whose answer the client could not read, after which it sends the PIN no more: one may be a glitch of
+ * the connection, but with two the client would not learn of a wrong PIN before the bank locks the access.
+ */
+const maxUnreadLogins = 2;
+/**
+ * Holds the PIN and hands it out only while no login is refused (`pin`), so that a retrying app cannot lock the user's
+ * access. `FinTsLoginRefusedError` tells which logins count as refused; `judge` decides it for each answer.
+ *
+ * A refusal counts at once and fails closed: only `remedied` lifts it, within the call that met it (`runCall`), once
+ * the session has taken care of a reason it names, each reason once per call, so that a call sends at most three
+ * logins the bank refuses. A refusal that outlasts the call is final, and the guard forgets the PIN; only a PIN the
+ * user enters anew lifts it (`replacePin`), unless it brings new login data.
+ */
+export class LoginGuard {
+    // ECMAScript private, so that neither `util.inspect` nor `JSON.stringify` of the client reaches it.
+    #pin;
+    refusalValue;
+    /** The TAN method of the login `refusalValue` refused, which a restored refusal does not tell. */
+    refusedMethod;
+    /** Logins sent since the bank last took the PIN whose answer the client has not read. */
+    unreadLogins = 0;
+    /** The refusal of `maxUnreadLogins` unread logins, kept so that `check` throws the same error each time. */
+    unreadLoginsRefusal;
+    /** The reasons `remedied` has lifted a refusal for in the running call. */
+    pardonedReasons = new Set();
+    constructor(pin) {
+        this.#pin = pin;
+    }
+    /** The PIN to sign a message with; throws the refusal instead (`check`), and `FinTsStateError` once closed. */
+    get pin() {
+        this.check();
+        if (this.#pin === undefined)
+            throw clientClosedError();
+        return this.#pin;
+    }
+    /** Throws the refusal, if there is one. */
+    check() {
+        const refusal = this.refusal;
+        if (refusal !== undefined)
+            throw refusal;
+    }
+    /** The bank's refusal, else that of `maxUnreadLogins` unread logins; `undefined` while there is none. */
+    get refusal() {
+        if (this.refusalValue !== undefined || this.unreadLogins < maxUnreadLogins)
+            return this.refusalValue;
+        this.unreadLoginsRefusal ??= new FinTsLoginRefusedError([], `The answers to the last ${maxUnreadLogins} logins were lost or unreadable, and the bank may have counted them ` +
+            'as failed attempts');
+        return this.unreadLoginsRefusal;
+    }
+    /** Counts a login signed with the PIN as unread until `judge` reads its answer. */
+    loginSent() {
+        this.unreadLogins++;
+    }
+    /**
+     * Judges `error`, if the answer to a request of `kind` in a dialog signed with `method` has one: returns the refusal
+     * of the login it amounts to, and records it unless the guard holds one already. Any error refuses a login; after the
+     * login only one that refuses it itself, a rejected PIN or new login data, since the bank checked the PIN before.
+     */
+    judge(error, kind, method) {
+        const refused = error instanceof FinTsLoginRefusedError || (error !== undefined && kind === 'login');
+        if (kind === 'login')
+            this.unreadLogins = refused ? Math.max(0, this.unreadLogins - 1) : 0;
+        if (!refused)
+            return undefined;
+        const refusal = loginRefusalFor(error.feedback);
+        if (this.refusalValue === undefined) {
+            this.refusalValue = refusal;
+            this.refusedMethod = method;
+        }
+        return refusal;
+    }
+    /** Runs `call`, one call of the client; a refusal that outlasts it is final, and the next call remedies anew. */
+    async runCall(call) {
+        try {
+            return await call();
+        }
+        finally {
+            this.pardonedReasons.clear();
+            this.forgetPinIfRefused();
+        }
+    }
+    /**
+     * Runs `attempt`, which may log in, and runs it once more each time `remedy` takes care of a reason the refusal it
+     * failed with names; `remedy` gets the reason and the TAN method of the refused login, and returns whether it could.
+     */
+    async remedied(attempt, remedy) {
+        // A refusal of an earlier call stops the attempt before it sends the PIN; there is nothing to remedy.
+        if (this.refusal !== undefined)
+            return attempt();
+        for (;;) {
+            try {
+                return await attempt();
+            }
+            catch (error) {
+                const refusal = this.refusalValue;
+                const rejected = this.refusedMethod;
+                // Only the bank's refusal the guard holds names reasons; any other error, a second refusal too, fails the call.
+                if (refusal === undefined || error !== refusal || rejected === undefined)
+                    throw error;
+                const reason = remediableReasons(refusal, rejected).find((r) => !this.pardonedReasons.has(r));
+                if (reason === undefined || !(await remedy(reason, rejected)))
+                    throw error;
+                this.pardonedReasons.add(reason);
+                // A closed client keeps the refusal.
+                if (this.#pin !== undefined)
+                    this.liftRefusal();
+            }
+        }
+    }
+    /**
+     * Signs with `pin` from now on, a PIN the user has entered anew and the protocol can send, and lifts the refusal.
+     * Throws the refusal instead where it brings new login data, which end the old ones for good.
+     */
+    replacePin(pin) {
+        if (this.refusalValue instanceof FinTsLoginDataChangedError)
+            throw this.refusalValue;
+        this.#pin = pin;
+        this.liftRefusal();
+        this.unreadLogins = 0;
+        this.unreadLoginsRefusal = undefined;
+    }
+    /** Forgets the PIN; the client calls it once it is closed. */
+    close() {
+        this.#pin = undefined;
+    }
+    saveState() {
+        return { refusal: this.refusalValue?.feedback, unreadLogins: this.unreadLogins };
+    }
+    /** Restores what `saveState` returned; a restored refusal is final. */
+    restoreState(saved) {
+        if (saved.refusal !== undefined)
+            this.refusalValue = loginRefusalFor(saved.refusal);
+        this.unreadLogins = Math.max(0, saved.unreadLogins);
+        this.forgetPinIfRefused();
+    }
+    liftRefusal() {
+        this.refusalValue = undefined;
+        this.refusedMethod = undefined;
+    }
+    forgetPinIfRefused() {
+        if (this.refusal !== undefined)
+            this.#pin = undefined;
+    }
+}
+/**
+ * The reasons `refusal`, of a login signed with `method`, names that the session can take care of: a TAN method the
+ * refusal names as not allowed (`refusesMethod`), and 9391. None for a rejected PIN or new login data.
+ */
+function remediableReasons(refusal, method) {
+    if (refusal instanceof FinTsPinError || refusal instanceof FinTsLoginDataChangedError)
+        return [];
+    const reasons = [];
+    if (refusesMethod(refusal.feedback, method))
+        reasons.push('tanMethodNotAllowed');
+    if (hasCode(refusal.feedback, FeedbackCodes.newSystemIdRequired))
+        reasons.push('systemIdRejected');
+    return reasons;
+}
+/** Error codes that only say that the message failed, not why: 9050 (the message contains errors) and 9800. */
+const unspecificErrors = new Set(['9050', FeedbackCodes.dialogAborted]);
+/**
+ * Whether `feedback`, which refuses a login signed with `method`, names the method as the reason: a 3920 that lists the
+ * methods the user may use without it, or 9075 after the one-step method.
+ *
+ * Only the return codes of the refusal itself count: TAN methods listed earlier say nothing about this login. Banks
+ * list two-step methods only, so a 3920 always leaves the one-step method out, also where the login succeeds. After
+ * the one-step method a 3920 counts only where the bank names no other error than an unspecific one: any other, such
+ * as "Anmeldung fehlgeschlagen", may be about the PIN.
+ */
+function refusesMethod(feedback, method) {
+    if (method.isOneStep && hasCode(feedback, FeedbackCodes.scaRequired))
+        return true;
+    const allowed = allowedTanMethodsIn(feedback);
+    if (allowed.length === 0 || allowed.includes(method.securityFunction))
+        return false;
+    return !method.isOneStep || feedback.every((f) => !f.isError || unspecificErrors.has(f.code));
+}
+//# sourceMappingURL=login-guard.js.map

package/dist/session/login-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login-guard.js","sourceRoot":"","sources":["../../src/session/login-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,sBAAsB,EACtB,aAAa,EACb,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAE,aAAa,EAAE,OAAO,EAAsB,MAAM,qBAAqB,CAAC;AAyBtG;;;GAGG;AACH,MAAM,eAAe,GAAG,CAAC,CAAC;AAE1B;;;;;;;;GAQG;AACH,MAAM,OAAO,UAAU;IACrB,oGAAoG;IACpG,IAAI,CAAqB;IAEjB,YAAY,CAAqC;IAEzD,kGAAkG;IAC1F,aAAa,CAAwB;IAE7C,yFAAyF;IACjF,YAAY,GAAG,CAAC,CAAC;IAEzB,4GAA4G;IACpG,mBAAmB,CAAqC;IAEhE,2EAA2E;IAC1D,eAAe,GAAG,IAAI,GAAG,EAAiB,CAAC;IAE5D,YAAY,GAAW;QACrB,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;IAClB,CAAC;IAED,+GAA+G;IAC/G,IAAI,GAAG;QACL,IAAI,CAAC,KAAK,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,iBAAiB,EAAE,CAAC;QACvD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,2CAA2C;IAC3C,KAAK;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;QAC7B,IAAI,OAAO,KAAK,SAAS;YAAE,MAAM,OAAO,CAAC;IAC3C,CAAC;IAED,yGAAyG;IACzG,IAAI,OAAO;QACT,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,GAAG,eAAe;YAAE,OAAO,IAAI,CAAC,YAAY,CAAC;QACrG,IAAI,CAAC,mBAAmB,KAAK,IAAI,sBAAsB,CACrD,EAAE,EACF,2BAA2B,eAAe,sEAAsE;YAC9G,oBAAoB,CACvB,CAAC;QACF,OAAO,IAAI,CAAC,mBAAmB,CAAC;IAClC,CAAC;IAED,mFAAmF;IACnF,SAAS;QACP,IAAI,CAAC,YAAY,EAAE,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAiC,EAAE,IAAiB,EAAE,MAAiB;QAC3E,MAAM,OAAO,GAAG,KAAK,YAAY,sBAAsB,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC;QACrG,IAAI,IAAI,KAAK,OAAO;YAAE,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3F,IAAI,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC/B,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACpC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC;YAC5B,IAAI,CAAC,aAAa,GAAG,MAAM,CAAC;QAC9B,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,iHAAiH;IACjH,KAAK,CAAC,OAAO,CAAI,IAAsB;QACrC,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,EAAE,CAAC;QACtB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;YAC7B,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CACZ,OAAyB,EACzB,MAAwE;QAExE,sGAAsG;QACtG,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,OAAO,EAAE,CAAC;QACjD,SAAS,CAAC;YACR,IAAI,CAAC;gBACH,OAAO,MAAM,OAAO,EAAE,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC;gBAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,CAAC;gBACpC,gHAAgH;gBAChH,IAAI,OAAO,KAAK,SAAS,IAAI,KAAK,KAAK,OAAO,IAAI,QAAQ,KAAK,SAAS;oBAAE,MAAM,KAAK,CAAC;gBACtF,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC9F,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;oBAAE,MAAM,KAAK,CAAC;gBAC3E,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBACjC,qCAAqC;gBACrC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;oBAAE,IAAI,CAAC,WAAW,EAAE,CAAC;YAClD,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,GAAW;QACpB,IAAI,IAAI,CAAC,YAAY,YAAY,0BAA0B;YAAE,MAAM,IAAI,CAAC,YAAY,CAAC;QACrF,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,IAAI,CAAC,WAAW,EAAE,CAAC;QACnB,IAAI,CAAC,YAAY,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,mBAAmB,GAAG,SAAS,CAAC;IACvC,CAAC;IAED,8DAA8D;IAC9D,KAAK;QACH,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;IACxB,CAAC;IAED,SAAS;QACP,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;IACnF,CAAC;IAED,uEAAuE;IACvE,YAAY,CAAC,KAAsB;QACjC,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACpF,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAC5B,CAAC;IAEO,WAAW;QACjB,IAAI,CAAC,YAAY,GAAG,SAAS,CAAC;QAC9B,IAAI,CAAC,aAAa,GAAG,SAAS,CAAC;IACjC,CAAC;IAEO,kBAAkB;QACxB,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;IACxD,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,iBAAiB,CAAC,OAA+B,EAAE,MAAiB;IAC3E,IAAI,OAAO,YAAY,aAAa,IAAI,OAAO,YAAY,0BAA0B;QAAE,OAAO,EAAE,CAAC;IACjG,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,IAAI,aAAa,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,mBAAmB,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnG,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+GAA+G;AAC/G,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC;AAExE;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,QAAkC,EAAE,MAAiB;IAC1E,IAAI,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,QAAQ,EAAE,aAAa,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAClF,MAAM,OAAO,GAAG,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IAC9C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAAE,OAAO,KAAK,CAAC;IACpF,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAChG,CAAC"}

package/dist/session/sepa-accounts.d.ts

@@ -0,0 +1,40 @@
+import { Account } from '../core/account.js';
+import type { ParameterStore } from '../v3/parameter-store.js';
+import type { DialogRunner } from './dialog-runner.js';
+import type { SessionState } from './session-state.js';
+/**
+ * IBAN and BIC of the user's accounts, from the bank's SEPA account list where the user parameter data lack them
+ * (Formals F.3.4), and the accounts the app passes completed from both.
+ *
+ * The list is read once per version of the user parameter data and kept in the saved state. Under version 0, which
+ * holds for one dialog only (Formals E.2), without user parameter data, or where the bank rejects the list, also by
+ * ending the dialog, or names no account in it, it is kept for this client only: an empty list completes nothing, and
+ * saved it would outlast a fault of a single answer until the bank changes its user parameter data.
+ */
+export declare class SepaAccounts {
+    private readonly parameters;
+    private readonly state;
+    private readonly dialogs;
+    /**
+     * The list this client keeps unsaved, with the version of the user parameter data it was read under; empty where the
+     * bank rejected it or named no account.
+     */
+    private unsaved;
+    constructor(parameters: ParameterStore, state: SessionState, dialogs: DialogRunner);
+    /** The accounts of the user parameter data completed with IBAN and BIC, then the accounts only the list names. */
+    completedAccounts(): Promise<Account[]>;
+    /**
+     * `account` as the bank knows it: the one of `completedAccounts` it matches, with what the bank states of it first,
+     * so that an account the app has built itself, such as from an IBAN alone, goes out with the account number, the
+     * sub-account and the BIC the bank's orders take, and the currency of its statements. Where the bank names none it
+     * matches, only what identifies `account`, and its currency: the rest, such as the transactions it permits, only the
+     * bank can state.
+     *
+     * Throws `FinTsUnsupportedError` for such an account where the user parameter data list all permitted transactions:
+     * they permit nothing for an account they leave out, and the client cannot tell it from a mistyped one.
+     */
+    complete(account: Account): Promise<Account>;
+    /** The list, read in the session's dialog, whose start delivers the user parameter data it is cached for. */
+    private list;
+}
+//# sourceMappingURL=sepa-accounts.d.ts.map

package/dist/session/sepa-accounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sepa-accounts.d.ts","sourceRoot":"","sources":["../../src/session/sepa-accounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAgB,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE/D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;;;;;;;GAQG;AACH,qBAAa,YAAY;IAQrB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAT1B;;;OAGG;IACH,OAAO,CAAC,OAAO,CAA+E;gBAG3E,UAAU,EAAE,cAAc,EAC1B,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,YAAY;IAGxC,kHAAkH;IAC5G,iBAAiB,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;IAW7C;;;;;;;;;OASG;IACG,QAAQ,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IA2BlD,6GAA6G;YAC/F,IAAI;CA0BnB"}

package/dist/session/sepa-accounts.js

@@ -0,0 +1,112 @@
+import { Account, AccountIndex } from '../core/account.js';
+import { FinTsUnsupportedError, tryLookUp } from '../core/errors.js';
+import { sepaAccountsQuery } from '../v3/queries.js';
+/**
+ * IBAN and BIC of the user's accounts, from the bank's SEPA account list where the user parameter data lack them
+ * (Formals F.3.4), and the accounts the app passes completed from both.
+ *
+ * The list is read once per version of the user parameter data and kept in the saved state. Under version 0, which
+ * holds for one dialog only (Formals E.2), without user parameter data, or where the bank rejects the list, also by
+ * ending the dialog, or names no account in it, it is kept for this client only: an empty list completes nothing, and
+ * saved it would outlast a fault of a single answer until the bank changes its user parameter data.
+ */
+export class SepaAccounts {
+    parameters;
+    state;
+    dialogs;
+    /**
+     * The list this client keeps unsaved, with the version of the user parameter data it was read under; empty where the
+     * bank rejected it or named no account.
+     */
+    unsaved;
+    constructor(parameters, state, dialogs) {
+        this.parameters = parameters;
+        this.state = state;
+        this.dialogs = dialogs;
+    }
+    /** The accounts of the user parameter data completed with IBAN and BIC, then the accounts only the list names. */
+    async completedAccounts() {
+        const sepa = await this.list();
+        const accounts = this.parameters.userParameters?.accounts ?? [];
+        const listed = new AccountIndex(sepa);
+        const known = new AccountIndex(accounts);
+        return [
+            ...accounts.map((account) => withSepaDetails(account, listed.find(account))),
+            ...sepa.filter((s) => known.find(s) === undefined),
+        ];
+    }
+    /**
+     * `account` as the bank knows it: the one of `completedAccounts` it matches, with what the bank states of it first,
+     * so that an account the app has built itself, such as from an IBAN alone, goes out with the account number, the
+     * sub-account and the BIC the bank's orders take, and the currency of its statements. Where the bank names none it
+     * matches, only what identifies `account`, and its currency: the rest, such as the transactions it permits, only the
+     * bank can state.
+     *
+     * Throws `FinTsUnsupportedError` for such an account where the user parameter data list all permitted transactions:
+     * they permit nothing for an account they leave out, and the client cannot tell it from a mistyped one.
+     */
+    async complete(account) {
+        const known = (await this.completedAccounts()).find((a) => account.matches(a));
+        if (known !== undefined) {
+            // A sub-account belongs to the account number it comes with.
+            const national = known.accountNumber === undefined ? account : known;
+            return known.copyWith({
+                accountNumber: national.accountNumber,
+                subAccount: national.subAccount,
+                iban: known.iban ?? account.iban,
+                bic: known.bic ?? account.bic,
+                currency: known.currency ?? account.currency,
+            });
+        }
+        if (this.parameters.userParameters?.listsAllTransactions === true) {
+            throw new FinTsUnsupportedError("The bank does not name this account among the user's, and so permits nothing");
+        }
+        return new Account({
+            accountNumber: account.accountNumber,
+            subAccount: account.subAccount,
+            bankCode: account.bankCode,
+            countryCode: account.countryCode,
+            iban: account.iban,
+            bic: account.bic,
+            currency: account.currency,
+        });
+    }
+    /** The list, read in the session's dialog, whose start delivers the user parameter data it is cached for. */
+    async list() {
+        await this.dialogs.open();
+        const upd = this.parameters.userParameters;
+        if (upd !== undefined &&
+            upd.accounts.length > 0 &&
+            upd.accounts.every((a) => a.iban !== undefined && a.bic !== undefined)) {
+            return [];
+        }
+        const updVersion = upd?.version;
+        const saved = this.state.sepaAccounts(updVersion);
+        if (saved !== undefined)
+            return saved;
+        if (this.unsaved !== undefined && this.unsaved.updVersion === updVersion)
+            return this.unsaved.accounts;
+        const query = sepaAccountsQuery(this.parameters);
+        if (query === undefined)
+            return [];
+        // Where the bank rejects the list, also by ending the dialog, the accounts stay as the user parameter data state
+        // them: asked again, a bank that ends the dialog in answer would cost each call a login.
+        const accounts = await tryLookUp(() => this.dialogs.query(() => query));
+        if (accounts !== undefined && accounts.length > 0 && updVersion !== undefined && updVersion > 0) {
+            this.state.cacheSepaAccounts(accounts, updVersion);
+        }
+        else {
+            this.unsaved = { updVersion, accounts: accounts ?? [] };
+        }
+        return accounts ?? [];
+    }
+}
+/**
+ * A copy of `account`, which shares no date with the user parameter data, with the IBAN and BIC of `match`, its entry
+ * in the SEPA account list, if any.
+ */
+function withSepaDetails(account, match) {
+    // A BIC of the list takes precedence over the one of the user parameter data (Formals E.3.1.1, "BIC").
+    return account.copyWith({ iban: account.iban ?? match?.iban, bic: match?.bic ?? account.bic });
+}
+//# sourceMappingURL=sepa-accounts.js.map

package/dist/session/sepa-accounts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sepa-accounts.js","sourceRoot":"","sources":["../../src/session/sepa-accounts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,qBAAqB,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAErE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAIrD;;;;;;;;GAQG;AACH,MAAM,OAAO,YAAY;IAQJ;IACA;IACA;IATnB;;;OAGG;IACK,OAAO,CAA+E;IAE9F,YACmB,UAA0B,EAC1B,KAAmB,EACnB,OAAqB;QAFrB,eAAU,GAAV,UAAU,CAAgB;QAC1B,UAAK,GAAL,KAAK,CAAc;QACnB,YAAO,GAAP,OAAO,CAAc;IACrC,CAAC;IAEJ,kHAAkH;IAClH,KAAK,CAAC,iBAAiB;QACrB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,QAAQ,IAAI,EAAE,CAAC;QAChE,MAAM,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,QAAQ,CAAC,CAAC;QACzC,OAAO;YACL,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5E,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC;SACnD,CAAC;IACJ,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,QAAQ,CAAC,OAAgB;QAC7B,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/E,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,6DAA6D;YAC7D,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;YACrE,OAAO,KAAK,CAAC,QAAQ,CAAC;gBACpB,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,UAAU,EAAE,QAAQ,CAAC,UAAU;gBAC/B,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI;gBAChC,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;gBAC7B,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ;aAC7C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,EAAE,oBAAoB,KAAK,IAAI,EAAE,CAAC;YAClE,MAAM,IAAI,qBAAqB,CAAC,8EAA8E,CAAC,CAAC;QAClH,CAAC;QACD,OAAO,IAAI,OAAO,CAAC;YACjB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,6GAA6G;IACrG,KAAK,CAAC,IAAI;QAChB,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC;QAC3C,IACE,GAAG,KAAK,SAAS;YACjB,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YACvB,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,EACtE,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,MAAM,UAAU,GAAG,GAAG,EAAE,OAAO,CAAC;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QACtC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QACvG,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACnC,iHAAiH;QACjH,yFAAyF;QACzF,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;QACxE,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YAChG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,OAAO,GAAG,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC1D,CAAC;QACD,OAAO,QAAQ,IAAI,EAAE,CAAC;IACxB,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,OAAgB,EAAE,KAA0B;IACnE,uGAAuG;IACvG,OAAO,OAAO,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;AACjG,CAAC"}

package/dist/session/session-setup.d.ts

@@ -0,0 +1,80 @@
+import type { BankInfo } from '../core/bank-info.js';
+import type { TanMedium, TanMethod } from '../tan/tan-models.js';
+import type { FinTs3Protocol } from '../v3/protocol.js';
+import { SignedDialog, type SessionParts } from './signed-dialog.js';
+import type { TanSelection } from './tan-selection.js';
+/**
+ * What has to be settled before a login: the bank parameter data, the synchronization, and through `TanSelection` the
+ * TAN method and medium. Each of the dialogs this takes serves one purpose only.
+ *
+ * Where the bank refuses a login for a reason the session can take care of, `remedied` does so and logs in again.
+ */
+export declare class SessionSetup {
+    private readonly session;
+    private readonly protocol;
+    private readonly tans;
+    constructor(session: SessionParts, protocol: FinTs3Protocol, tans: TanSelection);
+    /**
+     * The bank's general information: from an anonymous dialog where the bank answers one, else from the synchronization.
+     * No TAN method or medium is chosen for it.
+     */
+    bankInfo(): Promise<BankInfo>;
+    /** The TAN methods the bank allows for this user, which the synchronization reports. */
+    methods(): Promise<TanMethod[]>;
+    /**
+     * Settles what is still open: the bank parameter data, the synchronization, the TAN method and medium. Returns the TAN
+     * media it looked up to choose the medium; `undefined` where it looked up none, or the bank listed none.
+     */
+    prepare(): Promise<TanMedium[] | undefined>;
+    /** A new dialog signed with the TAN method and medium in use, once `prepare` has settled them. */
+    newDialog(): Promise<SignedDialog>;
+    /** Runs `attempt`, which may log in, once more after each refused login `remedy` takes care of. */
+    remedied<T>(attempt: () => Promise<T>): Promise<T>;
+    /**
+     * Takes care of `reason`, given for refusing a login signed with `rejected`, with another TAN method or a new
+     * synchronization; returns whether it could.
+     */
+    private remedy;
+    /**
+     * Loads the bank parameter data if they are missing, then synchronizes if that is due.
+     *
+     * The bank parameter data come first, from an anonymous dialog: the dialogs signed with the PIN need them for the
+     * dialog language, the PIN length and the TAN methods (PIN/TAN B.4.3.1, Formals C.3.1.3). A bank that does not answer
+     * anonymously delivers them with the synchronization.
+     *
+     * After a refused login it throws the refusal right away, before the user is asked for a TAN method or medium.
+     */
+    private loadParameters;
+    /**
+     * Asks for the bank parameter data without logging in, keeps them where there are none from a dialog signed with the
+     * PIN (`ParameterStore.keepAnonymous`), and passes the bank's messages on: all an anonymous dialog tells, since the
+     * TAN methods it lists are not those of a user. A bank that does not answer anonymously is no error, but a failed
+     * connection is: the synchronization would only wait for the same server again.
+     */
+    private fetchBankParametersAnonymously;
+    /**
+     * Asks for the bank parameter data in an anonymous dialog that announces strong customer authentication; a bank that
+     * rejects the announcement, with a return code or by failing on it, is asked again without it.
+     *
+     * A timeout or a broken connection is not a reason to ask again: it would only double the wait.
+     */
+    private requestBankParametersAnonymously;
+    private anonymousDialog;
+    /**
+     * Runs the synchronization, a login in a dialog of its own, while there is no customer system ID, without which no
+     * regular dialog starts. It runs before the TAN method and medium are settled (`TanSelection.synchronizationDialog`
+     * tells which method signs it).
+     */
+    private synchronizeIfDue;
+    /**
+     * The TAN media of the method in use; `undefined` if the bank does not list them or rejects the list, after which the
+     * client reports a missing medium before the login.
+     *
+     * The lookup runs in a dialog of its own, whose start asks for the list, since the regular dialog start needs the
+     * medium the list tells (PIN/TAN B.4.3.1.3).
+     */
+    private lookUpTanMedia;
+    /** Runs `use` in `dialog`, a dialog of its own, and ends it afterwards, however `use` ends. */
+    private once;
+}
+//# sourceMappingURL=session-setup.d.ts.map

package/dist/session/session-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-setup.d.ts","sourceRoot":"","sources":["../../src/session/session-setup.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGrD,OAAO,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAIjE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAGxD,OAAO,EAAE,YAAY,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;;;;GAKG;AACH,qBAAa,YAAY;IAErB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAFJ,OAAO,EAAE,YAAY,EACrB,QAAQ,EAAE,cAAc,EACxB,IAAI,EAAE,YAAY;IAGrC;;;OAGG;IACG,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IAMnC,wFAAwF;IAClF,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;IAKrC;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,GAAG,SAAS,CAAC;IASjD,kGAAkG;IAC5F,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC;IAKxC,mGAAmG;IACnG,QAAQ,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAIlD;;;OAGG;YACW,MAAM;IAYpB;;;;;;;;OAQG;YACW,cAAc;IAM5B;;;;;OAKG;YACW,8BAA8B;IAW5C;;;;;OAKG;YACW,gCAAgC;YAahC,eAAe;IAS7B;;;;OAIG;YACW,gBAAgB;IAS9B;;;;;;OAMG;YACW,cAAc;IAW5B,+FAA+F;YACjF,IAAI;CAQnB"}