@dreadkn1ght123/auth-express 0.2.0

package/README.md

@@ -0,0 +1,102 @@
+# @dreadkn1ght123/auth-express
+
+Express adapter for `@dreadkn1ght123/auth-core`. Mount `auth.router`, then mount
+`auth.authenticate` before protected application routes. Authorization behavior
+is explicit: pass `{ mode: "html" }` for login redirects or `{ mode: "api" }`
+for JSON 401/403 responses.
+
+The logger retains stable event names, including `vvp.auth.login.started`,
+`vvp.auth.callback.succeeded`, `vvp.auth.callback.rejected`,
+`vvp.auth.logout.succeeded`, `vvp.auth.logout.rejected`,
+`vvp.auth.session.refresh_failed`, and `vvp.auth.access.denied`. Rejections add
+stable `stage`, `reason`, error/cause codes, and correlation ID where known.
+Startup emits `vvp.auth.ready` only after configuration, discovery, and
+store checks succeed. Unexpected adapter errors use `vvp.auth.internal_error`.
+These events are diagnostic metadata, never an audit record of provider logout
+completion.
+
+Production requires shared implementations of `SessionStore` and
+`AuthTransactionStore`; transaction `consume` must be atomic.
+`MemorySessionStore` and `MemoryAuthTransactionStore` are process-local
+development/test utilities and are rejected by this adapter in production.
+
+`AuthTransactionStore.consume(id, expectedState)` must compare the expected
+state and atomically return `{ outcome: "consumed", transaction }` or a safe
+failure outcome while deleting only a matching, unexpired record. A mismatch
+must not consume a valid transaction. Distributed stores may return
+`ambiguous` when they cannot safely distinguish a missing record from an
+already-consumed record; never infer or log transaction IDs or state values.
+
+## SDK-owned browser flow
+
+The adapter owns the complete single-provider UX. Applications must not render
+an SSO chooser, local login form, callback error page, or logout landing page.
+
+| Default route | Method | Purpose |
+|---|---:|---|
+| `/auth/start` | GET | Safe normal entry; preserves validated `returnTo` and provides iframe fallback |
+| `/auth/login` | GET | Internal transaction creation and redirect to IAM; retained for compatibility |
+| `/auth/callback` | GET | Validates callback, creates session, then returns or redirects to SDK error UI |
+| `/auth/logout` | POST | Deletes local session and starts provider logout |
+| `/auth/signed-out` | GET | Non-automatic signed-out page with explicit “sign in again” action |
+| `/auth/error` | GET | Allowlisted safe error and retry page |
+| `/auth/me` | GET | Token-free public session or 401 |
+
+`requireAuth({ mode: "html" })` sends an unauthenticated browser to
+`/auth/start`, not directly to `/auth/login`. `/auth/login` remains the internal
+transaction endpoint; consumers must not hardcode it as their normal entry.
+API mode still returns JSON 401/403.
+
+Override routes centrally when needed:
+
+```ts
+const auth = await createVvpAuth({
+  config,
+  sessionStore,
+  transactionStore,
+  routes: {
+    basePath: "/identity",
+    start: "start",
+    login: "login",
+    callback: "complete",
+    logout: "logout",
+    signedOut: "signed-out",
+    error: "error",
+  },
+});
+```
+
+Production `config.publicOrigin` derives exact callback and post-logout
+redirects from these routes. Register both resulting URIs in Keycloak. The
+transaction-cookie path follows `basePath`; an explicit cookie path must
+contain login and callback routes or startup fails with `CONFIG_INVALID`.
+
+For server-rendered navigation use `auth.createLoginUrl(returnTo)` or
+`auth.createLoginLink(returnTo)`: both target the SDK start route.
+`createLoginLink` supplies `target: "_top"` and safe `rel`. Login must be a
+browser navigation, never `fetch`/XHR. Invalid external `returnTo` values are
+rejected or normalized by SDK policy; never concatenate one manually.
+
+Instance role helpers use configured `clientId`, avoiding a stale hardcoded ID
+after a rename. Prefer `auth.hasClientRole(actor, role)` and
+`auth.requireClientRole(role, behavior)` without `behavior.clientId`;
+module-level helpers and the optional `clientId` behavior field remain
+available for intentional cross-client policies.
+
+SDK pages are Russian by default with English locale support, responsive,
+keyboard accessible, independent of app CSS/JavaScript, and protected by a
+strict CSP. Optional `ui` branding (`productName`, local `logoUrl`,
+`supportText`, allowlisted text overrides) is escaped and must contain no HTML
+or remote script dependency. Error pages accept only public allowlisted reasons,
+contain a safe retry to `/auth/start` and optional correlation ID, and never
+expose provider/exception text. The signed-out page never automatically starts
+SSO, preventing an immediate logout/login loop.
+
+Public error reasons are limited to `transaction_missing`,
+`transaction_expired`, `transaction_already_used`, `provider_denied`,
+`token_validation_failed`, `provider_unavailable`, `session_failed`,
+`configuration_error`, and `unknown`. They select user text only; detailed
+callback stage/reason remains in safe structured logs and is never copied into
+the browser URL.
+See the workspace [`UPGRADE.md`](../../UPGRADE.md) and
+[`docs/sdk-usage.md`](../../docs/sdk-usage.md) for the `0.2.0` migration.

package/dist/index.d.ts

@@ -0,0 +1,165 @@
+import { type AuthorizationOptions, type AuthConfig, type AuthConfigInput, type AuthLogger, type AuthStoreCapabilities, type Actor, type ServerSession, type SessionStore, type RuntimeEnvironment, type TransactionConsumeOutcome } from "@dreadkn1ght123/auth-core";
+import { Router, type Request, type RequestHandler } from "express";
+declare global {
+    namespace Express {
+        interface Request {
+            vvpActor?: Actor;
+            vvpCorrelationId?: string;
+        }
+    }
+}
+export declare const AUTH_EXPRESS_EVENTS: {
+    readonly ready: "vvp.auth.ready";
+    readonly loginStarted: "vvp.auth.login.started";
+    readonly callbackSucceeded: "vvp.auth.callback.succeeded";
+    readonly callbackRejected: "vvp.auth.callback.rejected";
+    readonly logoutSucceeded: "vvp.auth.logout.succeeded";
+    readonly logoutRejected: "vvp.auth.logout.rejected";
+    readonly logoutLocalSessionDeleted: "vvp.auth.logout.local_session_deleted";
+    readonly logoutRedirectCreated: "vvp.auth.logout.redirect_created";
+    readonly logoutProviderRejected: "vvp.auth.logout.provider_rejected";
+    readonly logoutInvalidRedirect: "vvp.auth.logout.invalid_redirect";
+    readonly sessionRefreshFailed: "vvp.auth.session.refresh_failed";
+    readonly accessDenied: "vvp.auth.access.denied";
+    readonly internalError: "vvp.auth.internal_error";
+};
+export interface AuthTransaction {
+    id: string;
+    state: string;
+    nonce: string;
+    codeVerifier: string;
+    returnTo: string;
+    expiresAt: number;
+}
+export type AuthTransactionConsumeOutcome = TransactionConsumeOutcome<AuthTransaction>;
+/** This operation must be implemented as one atomic compare-and-delete. */
+export interface AuthTransactionStore {
+    readonly capabilities?: AuthStoreCapabilities;
+    set(transaction: AuthTransaction, ttlSeconds: number): Promise<void>;
+    consume(id: string, expectedState: string): Promise<AuthTransactionConsumeOutcome>;
+}
+export declare class MemoryAuthTransactionStore implements AuthTransactionStore {
+    #private;
+    constructor(environment: RuntimeEnvironment, options?: {
+        now?: () => number;
+    });
+    set(transaction: AuthTransaction, ttlSeconds: number): Promise<void>;
+    consume(id: string, expectedState: string): Promise<AuthTransactionConsumeOutcome>;
+}
+export interface VvpOidcOperations {
+    createAuthorizationRequest(options?: AuthorizationOptions): Promise<{
+        authorizationUrl: URL;
+        state: string;
+        nonce: string;
+        codeVerifier: string;
+        correlationId?: string;
+    }>;
+    handleCallback(input: {
+        callbackUrl: URL;
+        state: string;
+        nonce: string;
+        codeVerifier: string;
+    }): Promise<ServerSession>;
+    refreshSession(sessionId: string): Promise<ServerSession>;
+    logout(sessionId: string): Promise<URL>;
+}
+export interface AccessBehavior {
+    /** html redirects unauthenticated users; api returns JSON 401/403. */
+    mode: "html" | "api";
+}
+export interface CreateVvpAuthOptions {
+    config: AuthConfigInput;
+    sessionStore?: SessionStore;
+    transactionStore?: AuthTransactionStore;
+    logger?: AuthLogger;
+    oidcClient?: VvpOidcOperations;
+    cookieName?: string;
+    transactionCookieName?: string;
+    transactionTtlSeconds?: number;
+    refreshBeforeExpirySeconds?: number;
+    routes?: AuthRouteOptions;
+    /** Safe, optional branding for the SDK-owned browser pages. */
+    ui?: AuthUiOptions;
+    /** Path for the session cookie. Defaults to /. */
+    cookiePath?: string;
+    /** Path for the short-lived transaction cookie. Defaults to basePath. */
+    transactionCookiePath?: string;
+    now?: () => number;
+}
+export interface AuthRouteOptions {
+    basePath?: string;
+    start?: string;
+    login?: string;
+    callback?: string;
+    logout?: string;
+    session?: string;
+    signedOut?: string;
+    error?: string;
+    /** Names accepted by AuthConfigInput.routes; preferred for new integrations. */
+    startPath?: string;
+    loginPath?: string;
+    callbackPath?: string;
+    logoutPath?: string;
+    sessionPath?: string;
+    signedOutPath?: string;
+    errorPath?: string;
+    cookiePath?: string;
+}
+export interface NormalizedAuthRoutes {
+    basePath: string;
+    start: string;
+    login: string;
+    callback: string;
+    logout: string;
+    session: string;
+    signedOut: string;
+    error: string;
+}
+export interface AuthUiOptions {
+    locale?: "ru" | "en";
+    productName?: string;
+    logoUrl?: string;
+    supportText?: string;
+    text?: Partial<{
+        continueLogin: string;
+        startTitle: string;
+        startBody: string;
+        signedOutTitle: string;
+        signedOutBody: string;
+        signInAgain: string;
+        errorTitle: string;
+        tryAgain: string;
+        reference: string;
+    }>;
+}
+export interface BrowserLoginLink {
+    href: string;
+    /** Always escapes a containing iframe during browser navigation. */
+    target: "_top";
+    rel: "noopener noreferrer";
+}
+export interface VvpAuth {
+    config: AuthConfig;
+    router: Router;
+    authenticate: RequestHandler;
+    requireAuth(options: AccessBehavior): RequestHandler;
+    requireRealmRole(role: string, options: AccessBehavior): RequestHandler[];
+    requireClientRole(role: string, options: AccessBehavior & {
+        clientId?: string;
+    }): RequestHandler[];
+    requireAnyClientRole(roles: readonly string[], options: AccessBehavior & {
+        clientId?: string;
+    }): RequestHandler[];
+    createLoginUrl(returnTo?: string): string;
+    createLoginLink(returnTo?: string): BrowserLoginLink;
+    hasClientRole(actor: Actor | undefined, role: string): boolean;
+    hasAnyClientRole(actor: Actor | undefined, roles: readonly string[]): boolean;
+    routes: NormalizedAuthRoutes;
+}
+export declare function getActor(req: Request): Actor | undefined;
+export declare function isAuthenticated(req: Request): boolean;
+export declare function hasRealmRole(actor: Actor | undefined, role: string): boolean;
+export declare function hasClientRole(actor: Actor | undefined, role: string, clientId: string): boolean;
+export declare function hasAnyClientRole(actor: Actor | undefined, roles: readonly string[], clientId: string): boolean;
+export declare function createVvpAuth(options: CreateVvpAuthOptions): Promise<VvpAuth>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAUL,KAAK,oBAAoB,EACzB,KAAK,UAAU,EACf,KAAK,eAAe,EACpB,KAAK,UAAU,EACf,KAAK,qBAAqB,EAC1B,KAAK,KAAK,EACV,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,yBAAyB,EAC/B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,MAAM,EAGN,KAAK,OAAO,EACZ,KAAK,cAAc,EAEpB,MAAM,SAAS,CAAC;AAEjB,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,OAAO,CAAC;QAChB,UAAU,OAAO;YACf,QAAQ,CAAC,EAAE,KAAK,CAAC;YACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;SAC3B;KACF;CACF;AAED,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;CActB,CAAC;AAEX,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,6BAA6B,GACvC,yBAAyB,CAAC,eAAe,CAAC,CAAC;AAE7C,2EAA2E;AAC3E,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,YAAY,CAAC,EAAE,qBAAqB,CAAC;IAC9C,GAAG,CAAC,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,OAAO,CACL,EAAE,EAAE,MAAM,EACV,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,6BAA6B,CAAC,CAAC;CAC3C;AAED,qBAAa,0BAA2B,YAAW,oBAAoB;;gBAMnE,WAAW,EAAE,kBAAkB,EAC/B,OAAO,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;KAAO;IAWhC,GAAG,CACP,WAAW,EAAE,eAAe,EAC5B,UAAU,EAAE,MAAM,GACjB,OAAO,CAAC,IAAI,CAAC;IAUV,OAAO,CACX,EAAE,EAAE,MAAM,EACV,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,6BAA6B,CAAC;CAqB1C;AAED,MAAM,WAAW,iBAAiB;IAChC,0BAA0B,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,OAAO,CAAC;QAClE,gBAAgB,EAAE,GAAG,CAAC;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB,CAAC,CAAC;IACH,cAAc,CAAC,KAAK,EAAE;QACpB,WAAW,EAAE,GAAG,CAAC;QACjB,KAAK,EAAE,MAAM,CAAC;QACd,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,MAAM,CAAC;KACtB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC3B,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1D,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,cAAc;IAC7B,sEAAsE;IACtE,IAAI,EAAE,MAAM,GAAG,KAAK,CAAC;CACtB;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,eAAe,CAAC;IACxB,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC,MAAM,CAAC,EAAE,UAAU,CAAC;IACpB,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,+DAA+D;IAC/D,EAAE,CAAC,EAAE,aAAa,CAAC;IACnB,kDAAkD;IAClD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,CAAC;QACb,aAAa,EAAE,MAAM,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,cAAc,EAAE,MAAM,CAAC;QACvB,aAAa,EAAE,MAAM,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC,CAAC;CACJ;AAoBD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,oEAAoE;IACpE,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,qBAAqB,CAAC;CAC5B;AAED,MAAM,WAAW,OAAO;IACtB,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,cAAc,CAAC;IAC7B,WAAW,CAAC,OAAO,EAAE,cAAc,GAAG,cAAc,CAAC;IACrD,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,cAAc,GAAG,cAAc,EAAE,CAAC;IAC1E,iBAAiB,CACf,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,cAAc,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9C,cAAc,EAAE,CAAC;IACpB,oBAAoB,CAClB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,OAAO,EAAE,cAAc,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9C,cAAc,EAAE,CAAC;IACpB,cAAc,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1C,eAAe,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAAC;IACrD,aAAa,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/D,gBAAgB,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC;IAC9E,MAAM,EAAE,oBAAoB,CAAC;CAC9B;AAsPD,wBAAgB,QAAQ,CAAC,GAAG,EAAE,OAAO,GAAG,KAAK,GAAG,SAAS,CAExD;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAErD;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5E;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,KAAK,GAAG,SAAS,EACxB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAET;AAED,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,KAAK,GAAG,SAAS,EACxB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,QAAQ,EAAE,MAAM,GACf,OAAO,CAET;AAED,wBAAsB,aAAa,CACjC,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,OAAO,CAAC,CAusBlB"}

package/dist/index.js

@@ -0,0 +1,883 @@
+import { randomBytes, randomUUID, timingSafeEqual } from "node:crypto";
+import { MemorySessionStore, AuthError, classifyAuthError, VvpOidcClient, safeReturnTo, toPublicSession, validateConfig, assertProductionSafeStore, transactionConsumeError, } from "@dreadkn1ght123/auth-core";
+import { Router, } from "express";
+export const AUTH_EXPRESS_EVENTS = {
+    ready: "vvp.auth.ready",
+    loginStarted: "vvp.auth.login.started",
+    callbackSucceeded: "vvp.auth.callback.succeeded",
+    callbackRejected: "vvp.auth.callback.rejected",
+    logoutSucceeded: "vvp.auth.logout.succeeded",
+    logoutRejected: "vvp.auth.logout.rejected",
+    logoutLocalSessionDeleted: "vvp.auth.logout.local_session_deleted",
+    logoutRedirectCreated: "vvp.auth.logout.redirect_created",
+    logoutProviderRejected: "vvp.auth.logout.provider_rejected",
+    logoutInvalidRedirect: "vvp.auth.logout.invalid_redirect",
+    sessionRefreshFailed: "vvp.auth.session.refresh_failed",
+    accessDenied: "vvp.auth.access.denied",
+    internalError: "vvp.auth.internal_error",
+};
+export class MemoryAuthTransactionStore {
+    #entries = new Map();
+    #consumed = new Map();
+    #now;
+    constructor(environment, options = {}) {
+        if (environment === "production") {
+            throw new AuthError("SESSION_STORE_UNSAFE", "MemoryAuthTransactionStore must not be used in production");
+        }
+        this.#now = options.now ?? Date.now;
+    }
+    async set(transaction, ttlSeconds) {
+        this.#entries.set(transaction.id, {
+            ...structuredClone(transaction),
+            expiresAt: Math.min(transaction.expiresAt, this.#now() + ttlSeconds * 1_000),
+        });
+    }
+    async consume(id, expectedState) {
+        for (const [consumedId, expiresAt] of this.#consumed) {
+            if (expiresAt <= this.#now())
+                this.#consumed.delete(consumedId);
+        }
+        const transaction = this.#entries.get(id);
+        if (!transaction) {
+            return {
+                status: this.#consumed.has(id) ? "already_consumed" : "not_found",
+            };
+        }
+        if (transaction.expiresAt <= this.#now()) {
+            this.#entries.delete(id);
+            return { status: "expired" };
+        }
+        if (!constantTimeEqual(transaction.state, expectedState)) {
+            return { status: "state_mismatch" };
+        }
+        this.#entries.delete(id);
+        this.#consumed.set(id, transaction.expiresAt);
+        return { status: "ok", transaction: structuredClone(transaction) };
+    }
+}
+const NOOP_LOGGER = {
+    debug() { },
+    info() { },
+    warn() { },
+    error() { },
+};
+const ID_PATTERN = /^[A-Za-z0-9_-]{32,128}$/;
+const CORRELATION_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
+function escapeHtml(value) {
+    return value.replace(/[&<>"']/g, (character) => ({
+        "&": "&amp;",
+        "<": "&lt;",
+        ">": "&gt;",
+        '"': "&quot;",
+        "'": "&#39;",
+    })[character]);
+}
+const PUBLIC_ERROR_REASONS = new Set([
+    "transaction_missing", "transaction_expired", "transaction_already_used",
+    "provider_denied", "token_validation_failed", "provider_unavailable",
+    "session_failed", "configuration_error", "unknown",
+]);
+const ERROR_MESSAGES = {
+    ru: {
+        transaction_missing: "Не удалось найти попытку входа. Начните авторизацию заново.",
+        transaction_expired: "Время попытки входа истекло. Начните авторизацию заново.",
+        transaction_already_used: "Эта ссылка входа уже была использована. Начните новую авторизацию.",
+        provider_denied: "Вход был отменён или отклонён системой авторизации.",
+        token_validation_failed: "Не удалось проверить данные авторизации. Обратитесь к администратору.",
+        provider_unavailable: "Система авторизации временно недоступна. Попробуйте позже.",
+        session_failed: "Не удалось создать сеанс приложения. Попробуйте снова.",
+        configuration_error: "Сервис входа настроен неверно. Обратитесь к администратору.",
+        unknown: "Не удалось завершить вход.",
+    },
+    en: {
+        transaction_missing: "The sign-in attempt could not be found. Start again.",
+        transaction_expired: "The sign-in attempt expired. Start again.",
+        transaction_already_used: "This sign-in link was already used. Start a new sign-in.",
+        provider_denied: "Sign-in was cancelled or denied by the identity provider.",
+        token_validation_failed: "The sign-in data could not be verified. Contact an administrator.",
+        provider_unavailable: "The identity provider is temporarily unavailable. Try again later.",
+        session_failed: "The application session could not be created. Try again.",
+        configuration_error: "The sign-in service is misconfigured. Contact an administrator.",
+        unknown: "Sign-in could not be completed.",
+    },
+};
+function validateUi(options) {
+    const locale = options?.locale ?? "ru";
+    const defaults = locale === "en" ? {
+        continueLogin: "Continue sign-in", startTitle: "Sign in",
+        startBody: "Continue to the corporate sign-in service.",
+        signedOutTitle: "You have signed out", signedOutBody: "Your session has ended.",
+        signInAgain: "Sign in again", errorTitle: "Sign-in error",
+        tryAgain: "Try again", reference: "Reference",
+    } : {
+        continueLogin: "Продолжить вход", startTitle: "Вход в систему",
+        startBody: "Продолжите вход через корпоративную систему авторизации.",
+        signedOutTitle: "Вы вышли из системы", signedOutBody: "Сеанс работы завершён.",
+        signInAgain: "Войти снова", errorTitle: "Ошибка входа",
+        tryAgain: "Попробовать снова", reference: "Код обращения",
+    };
+    let logoUrl;
+    if (options?.logoUrl !== undefined) {
+        try {
+            const parsed = new URL(options.logoUrl, "https://sdk.invalid");
+            if (parsed.origin !== "https://sdk.invalid" || !options.logoUrl.startsWith("/") ||
+                options.logoUrl.startsWith("//") || parsed.username || parsed.password ||
+                parsed.search || parsed.hash)
+                throw new Error();
+            logoUrl = parsed.pathname;
+        }
+        catch {
+            throw new AuthError("CONFIG_INVALID", "ui.logoUrl must be a local absolute URL without query or fragment");
+        }
+    }
+    return {
+        locale,
+        productName: options?.productName ?? "VVP",
+        supportText: options?.supportText ?? "",
+        text: { ...defaults, ...options?.text },
+        ...(logoUrl ? { logoUrl } : {}),
+    };
+}
+function page(input) {
+    const { ui } = input;
+    const logo = ui.logoUrl
+        ? `<img class="logo" src="${escapeHtml(ui.logoUrl)}" alt="">`
+        : "";
+    const support = ui.supportText
+        ? `<p class="support">${escapeHtml(ui.supportText)}</p>`
+        : "";
+    const reference = input.correlationId
+        ? `<p class="reference"><small>${escapeHtml(ui.text.reference)}: <code>${escapeHtml(input.correlationId)}</code></small></p>`
+        : "";
+    const script = input.autoNavigate
+        ? `<script nonce="${input.nonce}">try{window.top.location.assign(${JSON.stringify(input.actionHref).replace(/</g, "\\u003c")})}catch(e){}</script>`
+        : "";
+    return `<!doctype html>
+<html lang="${ui.locale}"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>${escapeHtml(input.title)}</title><style nonce="${input.nonce}">
+*{box-sizing:border-box}body{margin:0;background:#f5f6f8;color:#17202a;font:16px/1.5 system-ui,-apple-system,sans-serif}
+main{width:min(92%,32rem);margin:12vh auto;background:#fff;border:1px solid #dfe3e8;border-radius:12px;padding:2rem;box-shadow:0 8px 28px #17202a12}
+.brand{display:flex;align-items:center;gap:.75rem;font-weight:700}.logo{max-width:8rem;max-height:3rem}h1{font-size:1.6rem;margin:1.5rem 0 .5rem}
+.button{display:inline-block;margin-top:1rem;padding:.7rem 1rem;border-radius:6px;background:#175cd3;color:#fff;text-decoration:none;font-weight:650}
+.button:focus{outline:3px solid #84adff;outline-offset:3px}.support,.reference{color:#59636e;margin-top:1.25rem}code{overflow-wrap:anywhere}
+</style></head><body><main>
+<div class="brand">${logo}<span>${escapeHtml(ui.productName)}</span></div>
+<h1 tabindex="-1">${escapeHtml(input.title)}</h1><p>${escapeHtml(input.body)}</p>
+<a class="button" href="${escapeHtml(input.actionHref)}" target="_top" rel="noopener noreferrer">${escapeHtml(input.actionText)}</a>
+${support}${reference}</main>${script}</body></html>`;
+}
+function opaqueId() {
+    return randomBytes(32).toString("base64url");
+}
+function parseCookies(header) {
+    const result = {};
+    for (const item of header?.split(";") ?? []) {
+        const separator = item.indexOf("=");
+        if (separator < 1)
+            continue;
+        const name = item.slice(0, separator).trim();
+        try {
+            result[name] = decodeURIComponent(item.slice(separator + 1).trim());
+        }
+        catch {
+            // Malformed cookies are ignored.
+        }
+    }
+    return result;
+}
+function constantTimeEqual(left, right) {
+    const a = Buffer.from(left);
+    const b = Buffer.from(right);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+function normalizePath(value, field) {
+    if (!value.startsWith("/") || value.includes("?") || value.includes("#") ||
+        value.includes("\\") || value.includes("//")) {
+        throw new AuthError("CONFIG_INVALID", `${field} must be a normalized absolute path`);
+    }
+    const normalized = value.length > 1 ? value.replace(/\/+$/, "") : value;
+    if (normalized.split("/").some((segment) => segment === "." || segment === "..")) {
+        throw new AuthError("CONFIG_INVALID", `${field} must not contain dot segments`);
+    }
+    return normalized;
+}
+function joinRoute(basePath, route, fallback) {
+    const value = route ?? fallback;
+    return normalizePath(value.startsWith("/") ? value : `${basePath}/${value}`, "auth route");
+}
+function normalizeRoutes(input = {}) {
+    const basePath = normalizePath(input.basePath ?? "/auth", "routes.basePath");
+    const routes = {
+        basePath,
+        start: joinRoute(basePath, input.startPath ?? input.start, "start"),
+        login: joinRoute(basePath, input.loginPath ?? input.login, "login"),
+        callback: joinRoute(basePath, input.callbackPath ?? input.callback, "callback"),
+        logout: joinRoute(basePath, input.logoutPath ?? input.logout, "logout"),
+        session: joinRoute(basePath, input.sessionPath ?? input.session, "me"),
+        signedOut: joinRoute(basePath, input.signedOutPath ?? input.signedOut, "signed-out"),
+        error: joinRoute(basePath, input.errorPath ?? input.error, "error"),
+    };
+    const paths = [
+        routes.start, routes.login, routes.callback, routes.logout, routes.session,
+        routes.signedOut, routes.error,
+    ];
+    if (new Set(paths).size !== paths.length) {
+        throw new AuthError("CONFIG_INVALID", "Authentication routes must be unique");
+    }
+    return routes;
+}
+function pathContains(cookiePath, requestPath) {
+    return cookiePath === "/" || requestPath === cookiePath ||
+        requestPath.startsWith(`${cookiePath}/`);
+}
+function requestLanguage(req) {
+    const header = req.get("accept-language")?.trim().toLowerCase();
+    return header?.startsWith("en") ? "en" : "ru";
+}
+function publicCallbackReason(error) {
+    const diagnostic = classifyAuthError(error);
+    const value = `${error instanceof AuthError ? error.code : ""} ${diagnostic.reason}`.toLowerCase();
+    if (value.includes("denied") || value.includes("access_denied") || value.includes("cancel")) {
+        return "provider_denied";
+    }
+    if (value.includes("config") || value.includes("invalid_client")) {
+        return "configuration_error";
+    }
+    if (value.includes("token") || value.includes("nonce") || value.includes("issuer") ||
+        value.includes("audience") || value.includes("signature") || value.includes("claim") ||
+        value.includes("subject") || value.includes("azp")) {
+        return "token_validation_failed";
+    }
+    if (value.includes("unavailable") || value.includes("network") ||
+        value.includes("timeout") || value.includes("endpoint")) {
+        return "provider_unavailable";
+    }
+    if (value.includes("session") || value.includes("store"))
+        return "session_failed";
+    return "unknown";
+}
+function asyncHandler(handler) {
+    return (req, res, next) => void handler(req, res, next).catch(next);
+}
+export function getActor(req) {
+    return req.vvpActor;
+}
+export function isAuthenticated(req) {
+    return Boolean(req.vvpActor);
+}
+export function hasRealmRole(actor, role) {
+    return actor?.realmRoles.includes(role.toLowerCase()) ?? false;
+}
+export function hasClientRole(actor, role, clientId) {
+    return actor?.clientRoles[clientId]?.includes(role.toLowerCase()) ?? false;
+}
+export function hasAnyClientRole(actor, roles, clientId) {
+    return roles.some((role) => hasClientRole(actor, role, clientId));
+}
+export async function createVvpAuth(options) {
+    // `routes` was originally documented as an Express option. Normalize that
+    // shape into the core contract before validation so production receives the
+    // same callback/cookie checks as every other configuration source.
+    const legacyRoutes = options.routes;
+    const configInput = legacyRoutes
+        ? {
+            ...options.config,
+            routes: {
+                ...options.config.routes,
+                ...(legacyRoutes.basePath !== undefined
+                    ? { basePath: legacyRoutes.basePath } : {}),
+                ...(legacyRoutes.startPath ?? legacyRoutes.start
+                    ? { startPath: legacyRoutes.startPath ?? legacyRoutes.start } : {}),
+                ...(legacyRoutes.loginPath ?? legacyRoutes.login
+                    ? { loginPath: legacyRoutes.loginPath ?? legacyRoutes.login } : {}),
+                ...(legacyRoutes.callbackPath ?? legacyRoutes.callback
+                    ? { callbackPath: legacyRoutes.callbackPath ?? legacyRoutes.callback } : {}),
+                ...(legacyRoutes.logoutPath ?? legacyRoutes.logout
+                    ? { logoutPath: legacyRoutes.logoutPath ?? legacyRoutes.logout } : {}),
+                ...(legacyRoutes.sessionPath ?? legacyRoutes.session
+                    ? { sessionPath: legacyRoutes.sessionPath ?? legacyRoutes.session } : {}),
+                ...(legacyRoutes.signedOutPath ?? legacyRoutes.signedOut
+                    ? {
+                        signedOutPath: legacyRoutes.signedOutPath ?? legacyRoutes.signedOut,
+                    } : {}),
+                ...(legacyRoutes.errorPath ?? legacyRoutes.error
+                    ? { errorPath: legacyRoutes.errorPath ?? legacyRoutes.error } : {}),
+                ...(legacyRoutes.cookiePath !== undefined
+                    ? { cookiePath: legacyRoutes.cookiePath } : {}),
+            },
+        }
+        : options.config;
+    const config = validateConfig(configInput);
+    const returnToOptions = {
+        baseOrigin: config.publicOrigin?.origin ?? config.redirectUri.origin,
+        allowedOrigins: config.allowedReturnToOrigins,
+    };
+    const ui = validateUi({
+        locale: config.ui.locale,
+        productName: config.ui.productName,
+        supportText: config.ui.supportText,
+        ...(config.ui.logoUrl ? { logoUrl: config.ui.logoUrl } : {}),
+        ...options.ui,
+    });
+    const now = options.now ?? Date.now;
+    const logger = options.logger ?? NOOP_LOGGER;
+    const coreRoutes = config.routes;
+    const normalizedExtras = normalizeRoutes(legacyRoutes ?? {
+        basePath: coreRoutes.basePath,
+        startPath: coreRoutes.startPath,
+        loginPath: coreRoutes.loginPath,
+        callbackPath: coreRoutes.callbackPath,
+        logoutPath: coreRoutes.logoutPath,
+        sessionPath: coreRoutes.sessionPath,
+        signedOutPath: coreRoutes.signedOutPath,
+        errorPath: coreRoutes.errorPath,
+    });
+    const routes = normalizedExtras;
+    const cookiePath = normalizePath(options.cookiePath ?? "/", "cookiePath");
+    const transactionCookiePath = normalizePath(options.transactionCookiePath ??
+        config.routes.cookiePath, "transactionCookiePath");
+    if (config.redirectUri.pathname !== routes.callback) {
+        throw new AuthError("CONFIG_INVALID", "redirectUri pathname must match the configured callback route");
+    }
+    if (!pathContains(transactionCookiePath, routes.login) ||
+        !pathContains(transactionCookiePath, routes.callback)) {
+        throw new AuthError("CONFIG_INVALID", "transactionCookiePath must include the login and callback routes");
+    }
+    if (config.environment === "production" && !options.sessionStore) {
+        throw new AuthError("SESSION_STORE_UNSAFE", "A persistent sessionStore is required in production");
+    }
+    if (config.environment === "production" && !options.transactionStore) {
+        throw new AuthError("SESSION_STORE_UNSAFE", "A shared atomic transactionStore is required in production");
+    }
+    assertProductionSafeStore(options.sessionStore, config.environment, {
+        purpose: "session",
+    });
+    assertProductionSafeStore(options.transactionStore, config.environment, {
+        purpose: "transaction",
+        requireAtomicConsume: true,
+    });
+    const sessionStore = options.sessionStore ?? new MemorySessionStore(config.environment, { now });
+    const transactions = options.transactionStore ??
+        new MemoryAuthTransactionStore(config.environment, { now });
+    const oidc = options.oidcClient ??
+        (await VvpOidcClient.discover(config, sessionStore, { logger, now }));
+    const cookieName = options.cookieName ?? "vvp_session";
+    const transactionCookieName = options.transactionCookieName ?? "vvp_auth_transaction";
+    const transactionTtlSeconds = options.transactionTtlSeconds ?? 300;
+    if (!Number.isSafeInteger(transactionTtlSeconds) ||
+        transactionTtlSeconds < 30 ||
+        transactionTtlSeconds > 600) {
+        throw new AuthError("CONFIG_INVALID", "transactionTtlSeconds must be between 30 and 600");
+    }
+    const refreshBeforeExpirySeconds = options.refreshBeforeExpirySeconds ?? 60;
+    if (!Number.isSafeInteger(refreshBeforeExpirySeconds) ||
+        refreshBeforeExpirySeconds < 0 ||
+        refreshBeforeExpirySeconds > 600) {
+        throw new AuthError("CONFIG_INVALID", "refreshBeforeExpirySeconds must be between 0 and 600");
+    }
+    const secure = config.environment === "production";
+    const sessionCookie = {
+        httpOnly: true,
+        secure,
+        sameSite: "lax",
+        path: cookiePath,
+        maxAge: Math.min(config.sessionTtlSeconds, 7 * 24 * 60 * 60) * 1_000,
+    };
+    const transactionCookie = {
+        httpOnly: true,
+        secure,
+        sameSite: "lax",
+        path: transactionCookiePath,
+        maxAge: transactionTtlSeconds * 1_000,
+    };
+    const clearCookieOptions = {
+        httpOnly: true,
+        secure,
+        sameSite: "lax",
+        path: cookiePath,
+    };
+    const clearSession = (res) => res.clearCookie(cookieName, clearCookieOptions);
+    const clearTransaction = (res) => res.clearCookie(transactionCookieName, {
+        ...clearCookieOptions,
+        path: transactionCookiePath,
+    });
+    logger.info(AUTH_EXPRESS_EVENTS.ready, {
+        environment: config.environment,
+        secureCookies: secure,
+        basePath: routes.basePath,
+        callbackPath: routes.callback,
+        signedOutPath: routes.signedOut,
+        cookiePath,
+        transactionCookiePath,
+    });
+    const correlate = (req, res, next) => {
+        const supplied = req.get("x-correlation-id");
+        req.vvpCorrelationId =
+            supplied && CORRELATION_PATTERN.test(supplied) ? supplied : randomUUID();
+        res.set("x-correlation-id", req.vvpCorrelationId);
+        next();
+    };
+    const authenticate = asyncHandler(async (req, res, next) => {
+        try {
+            const id = parseCookies(req.headers.cookie)[cookieName];
+            if (!id || !ID_PATTERN.test(id)) {
+                next();
+                return;
+            }
+            let session = await sessionStore.get(id);
+            if (!session) {
+                clearSession(res);
+                next();
+                return;
+            }
+            if (session.tokens.expiresAt !== undefined &&
+                session.tokens.expiresAt <=
+                    now() + refreshBeforeExpirySeconds * 1_000) {
+                try {
+                    session = await oidc.refreshSession(id);
+                }
+                catch {
+                    await sessionStore.delete(id);
+                    clearSession(res);
+                    logger.warn(AUTH_EXPRESS_EVENTS.sessionRefreshFailed, {
+                        correlationId: req.vvpCorrelationId,
+                    });
+                    next();
+                    return;
+                }
+            }
+            req.vvpActor = session.actor;
+            next();
+        }
+        catch {
+            clearSession(res);
+            logger.error(AUTH_EXPRESS_EVENTS.internalError, {
+                correlationId: req.vvpCorrelationId,
+                operation: "authenticate",
+            });
+            if (!res.headersSent) {
+                res.status(503).json({
+                    error: "authentication_unavailable",
+                    correlationId: req.vvpCorrelationId,
+                });
+            }
+        }
+    });
+    const unauthenticated = (req, res, behavior) => {
+        logger.info(AUTH_EXPRESS_EVENTS.accessDenied, {
+            correlationId: req.vvpCorrelationId,
+            reason: "unauthenticated",
+            mode: behavior.mode,
+        });
+        if (behavior.mode === "html") {
+            const returnTo = safeReturnTo(req.originalUrl, returnToOptions);
+            res.redirect(302, `${routes.start}?returnTo=${encodeURIComponent(returnTo)}`);
+        }
+        else {
+            res.status(401).json({
+                error: "authentication_required",
+                correlationId: req.vvpCorrelationId,
+            });
+        }
+    };
+    const requireAuth = (behavior) => (req, res, next) => {
+        if (req.vvpActor)
+            next();
+        else
+            unauthenticated(req, res, behavior);
+    };
+    const authorize = (predicate, behavior) => (req, res, next) => {
+        if (!req.vvpActor) {
+            unauthenticated(req, res, behavior);
+            return;
+        }
+        if (predicate(req.vvpActor)) {
+            next();
+            return;
+        }
+        logger.info(AUTH_EXPRESS_EVENTS.accessDenied, {
+            correlationId: req.vvpCorrelationId,
+            reason: "forbidden",
+            mode: behavior.mode,
+        });
+        if (behavior.mode === "html") {
+            res.status(403).type("text").send("Forbidden");
+        }
+        else {
+            res.status(403).json({
+                error: "forbidden",
+                correlationId: req.vvpCorrelationId,
+            });
+        }
+    };
+    const router = Router();
+    router.use(correlate);
+    const sendPage = (res, html, nonce) => {
+        res
+            .set("Cache-Control", "no-store")
+            .set("Pragma", "no-cache")
+            .set("Content-Security-Policy", `default-src 'none'; base-uri 'none'; frame-ancestors *; form-action 'self'; img-src 'self'; style-src 'nonce-${nonce}'; script-src 'nonce-${nonce}'`)
+            .set("Referrer-Policy", "no-referrer")
+            .set("X-Content-Type-Options", "nosniff")
+            .type("html")
+            .send(html);
+    };
+    const localSignedOutUrl = (() => {
+        const configuredPublicOrigin = config.publicOrigin;
+        return new URL(routes.signedOut, configuredPublicOrigin ?? config.redirectUri).href;
+    })();
+    const errorRedirect = (res, reason, correlationId) => {
+        const query = new URLSearchParams({ reason, correlationId });
+        res.redirect(302, `${routes.error}?${query.toString()}`);
+    };
+    router.get(routes.start, (req, res) => {
+        const returnTo = safeReturnTo(typeof req.query["returnTo"] === "string" ? req.query["returnTo"] : undefined, returnToOptions);
+        const href = returnTo === "/"
+            ? routes.login
+            : `${routes.login}?returnTo=${encodeURIComponent(returnTo)}`;
+        const nonce = randomBytes(18).toString("base64url");
+        sendPage(res, page({
+            ui,
+            title: ui.text.startTitle,
+            body: ui.text.startBody,
+            actionHref: href,
+            actionText: ui.text.continueLogin,
+            nonce,
+            autoNavigate: true,
+        }), nonce);
+    });
+    router.get(routes.login, asyncHandler(async (req, res) => {
+        const returnTo = safeReturnTo(typeof req.query["returnTo"] === "string"
+            ? req.query["returnTo"]
+            : undefined, returnToOptions);
+        const authorization = await oidc.createAuthorizationRequest();
+        const id = opaqueId();
+        await transactions.set({
+            id,
+            state: authorization.state,
+            nonce: authorization.nonce,
+            codeVerifier: authorization.codeVerifier,
+            returnTo,
+            expiresAt: now() + transactionTtlSeconds * 1_000,
+        }, transactionTtlSeconds);
+        res.cookie(transactionCookieName, id, transactionCookie);
+        logger.info(AUTH_EXPRESS_EVENTS.loginStarted, {
+            correlationId: req.vvpCorrelationId,
+        });
+        res.redirect(302, authorization.authorizationUrl.href);
+    }));
+    router.get(routes.callback, asyncHandler(async (req, res) => {
+        const state = typeof req.query["state"] === "string" ? req.query["state"] : "";
+        const id = parseCookies(req.headers.cookie)[transactionCookieName];
+        const transactionValidationReason = !id
+            ? "transaction_cookie_missing"
+            : !ID_PATTERN.test(id)
+                ? "transaction_cookie_malformed"
+                : !state
+                    ? "state_missing"
+                    : undefined;
+        const hasWellFormedTransactionReference = Boolean(id && state && ID_PATTERN.test(id));
+        let consumeResult;
+        try {
+            consumeResult = hasWellFormedTransactionReference
+                ? await transactions.consume(id, state)
+                : { status: "not_found" };
+        }
+        catch {
+            clearTransaction(res);
+            const consumeError = transactionConsumeError({
+                status: "ambiguous",
+            });
+            logger.error(AUTH_EXPRESS_EVENTS.callbackRejected, {
+                correlationId: req.vvpCorrelationId,
+                stage: consumeError.stage,
+                reason: consumeError.reason,
+                code: consumeError.code,
+            });
+            errorRedirect(res, "session_failed", req.vvpCorrelationId);
+            return;
+        }
+        if (consumeResult.status !== "ok") {
+            if (!hasWellFormedTransactionReference ||
+                consumeResult.status === "expired" ||
+                consumeResult.status === "already_consumed" ||
+                consumeResult.status === "ambiguous") {
+                clearTransaction(res);
+            }
+            const consumeError = transactionConsumeError(consumeResult);
+            logger.warn(AUTH_EXPRESS_EVENTS.callbackRejected, {
+                correlationId: req.vvpCorrelationId,
+                stage: "transaction_validation",
+                reason: transactionValidationReason ?? consumeError.reason,
+                code: consumeError.code,
+            });
+            const publicReason = consumeResult.status === "expired" ? "transaction_expired"
+                : consumeResult.status === "already_consumed"
+                    ? "transaction_already_used"
+                    : consumeResult.status === "ambiguous"
+                        ? "session_failed"
+                        : "transaction_missing";
+            errorRedirect(res, publicReason, req.vvpCorrelationId);
+            return;
+        }
+        const transaction = consumeResult.transaction;
+        clearTransaction(res);
+        try {
+            const callbackUrl = new URL(config.redirectUri.href);
+            callbackUrl.search = req.originalUrl.includes("?")
+                ? req.originalUrl.slice(req.originalUrl.indexOf("?"))
+                : "";
+            const session = await oidc.handleCallback({
+                callbackUrl,
+                state: transaction.state,
+                nonce: transaction.nonce,
+                codeVerifier: transaction.codeVerifier,
+                ...(req.vvpCorrelationId
+                    ? { correlationId: req.vvpCorrelationId }
+                    : {}),
+            });
+            res.cookie(cookieName, session.id, sessionCookie);
+            logger.info(AUTH_EXPRESS_EVENTS.callbackSucceeded, {
+                correlationId: req.vvpCorrelationId,
+                stage: "session",
+                reason: "created",
+            });
+            res.redirect(302, transaction.returnTo);
+        }
+        catch (error) {
+            clearSession(res);
+            const code = error instanceof AuthError ? error.code : "AUTHORIZATION_FAILED";
+            const diagnostic = classifyAuthError(error);
+            logger.warn(AUTH_EXPRESS_EVENTS.callbackRejected, {
+                correlationId: req.vvpCorrelationId,
+                stage: error instanceof AuthError ? error.stage : "callback",
+                reason: diagnostic.reason,
+                code,
+                ...(diagnostic.details.library
+                    ? { library: diagnostic.details.library }
+                    : {}),
+                ...(diagnostic.details.libraryCode
+                    ? { libraryCode: diagnostic.details.libraryCode }
+                    : {}),
+                ...(diagnostic.details.httpStatus
+                    ? { httpStatus: diagnostic.details.httpStatus }
+                    : {}),
+                ...(diagnostic.details.claim
+                    ? { claim: diagnostic.details.claim }
+                    : {}),
+            });
+            errorRedirect(res, publicCallbackReason(error), req.vvpCorrelationId);
+        }
+    }));
+    router.get(routes.signedOut, (_req, res) => {
+        const nonce = randomBytes(18).toString("base64url");
+        sendPage(res, page({
+            ui,
+            title: ui.text.signedOutTitle,
+            body: ui.text.signedOutBody,
+            actionHref: routes.start,
+            actionText: ui.text.signInAgain,
+            nonce,
+        }), nonce);
+    });
+    router.get(routes.error, (req, res) => {
+        const suppliedReason = typeof req.query["reason"] === "string" ? req.query["reason"] : "unknown";
+        const reason = PUBLIC_ERROR_REASONS.has(suppliedReason)
+            ? suppliedReason
+            : "unknown";
+        const suppliedCorrelationId = typeof req.query["correlationId"] === "string"
+            ? req.query["correlationId"]
+            : req.vvpCorrelationId;
+        const correlationId = CORRELATION_PATTERN.test(suppliedCorrelationId)
+            ? suppliedCorrelationId
+            : req.vvpCorrelationId;
+        const locale = ui.locale ?? requestLanguage(req);
+        const nonce = randomBytes(18).toString("base64url");
+        sendPage(res, page({
+            ui,
+            title: ui.text.errorTitle,
+            body: ERROR_MESSAGES[locale][reason],
+            actionHref: routes.start,
+            actionText: ui.text.tryAgain,
+            correlationId,
+            nonce,
+        }), nonce);
+    });
+    router.post(routes.logout, asyncHandler(async (req, res) => {
+        const origin = req.get("origin");
+        const referer = req.get("referer");
+        let sourceOrigin;
+        try {
+            sourceOrigin = origin ? new URL(origin).origin : referer
+                ? new URL(referer).origin
+                : undefined;
+        }
+        catch {
+            sourceOrigin = undefined;
+        }
+        if (sourceOrigin !== config.redirectUri.origin) {
+            logger.warn(AUTH_EXPRESS_EVENTS.logoutRejected, {
+                correlationId: req.vvpCorrelationId,
+                stage: "request_validation",
+                reason: "cross_origin",
+            });
+            res.status(403).type("text").send("Logout request was rejected.");
+            return;
+        }
+        const id = parseCookies(req.headers.cookie)[cookieName];
+        clearSession(res);
+        clearTransaction(res);
+        if (!id || !ID_PATTERN.test(id)) {
+            logger.info(AUTH_EXPRESS_EVENTS.logoutLocalSessionDeleted, {
+                correlationId: req.vvpCorrelationId,
+                hadSession: false,
+            });
+            logger.info(AUTH_EXPRESS_EVENTS.logoutSucceeded, {
+                correlationId: req.vvpCorrelationId,
+                hadSession: false,
+                stage: "local",
+            });
+            const localRedirect = localSignedOutUrl;
+            logger.info(AUTH_EXPRESS_EVENTS.logoutRedirectCreated, {
+                correlationId: req.vvpCorrelationId,
+                destination: "signed_out",
+            });
+            res.redirect(303, localRedirect);
+            return;
+        }
+        try {
+            const logoutUrl = await oidc.logout(id);
+            logger.info(AUTH_EXPRESS_EVENTS.logoutLocalSessionDeleted, {
+                correlationId: req.vvpCorrelationId,
+                hadSession: true,
+            });
+            if ((logoutUrl.protocol !== "https:" && logoutUrl.protocol !== "http:") ||
+                (logoutUrl.protocol !== "https:" && config.environment === "production")) {
+                logger.warn(AUTH_EXPRESS_EVENTS.logoutInvalidRedirect, {
+                    correlationId: req.vvpCorrelationId,
+                    stage: "redirect_validation",
+                    reason: "insecure_provider_redirect",
+                });
+                logger.info(AUTH_EXPRESS_EVENTS.logoutRedirectCreated, {
+                    correlationId: req.vvpCorrelationId,
+                    destination: "local_recovery",
+                });
+                res.redirect(303, localSignedOutUrl);
+                return;
+            }
+            logger.info(AUTH_EXPRESS_EVENTS.logoutRedirectCreated, {
+                correlationId: req.vvpCorrelationId,
+                destination: "provider",
+            });
+            logger.info(AUTH_EXPRESS_EVENTS.logoutSucceeded, {
+                correlationId: req.vvpCorrelationId,
+                hadSession: true,
+                stage: "local_and_redirect",
+            });
+            res.redirect(303, logoutUrl.href);
+        }
+        catch {
+            await sessionStore.delete(id);
+            logger.info(AUTH_EXPRESS_EVENTS.logoutLocalSessionDeleted, {
+                correlationId: req.vvpCorrelationId,
+                hadSession: true,
+            });
+            logger.warn(AUTH_EXPRESS_EVENTS.logoutProviderRejected, {
+                correlationId: req.vvpCorrelationId,
+                stage: "provider_redirect",
+                reason: "redirect_creation_failed",
+            });
+            logger.info(AUTH_EXPRESS_EVENTS.logoutRedirectCreated, {
+                correlationId: req.vvpCorrelationId,
+                destination: "local_recovery",
+            });
+            res.redirect(303, localSignedOutUrl);
+        }
+    }));
+    router.get(routes.session, (_req, res, next) => {
+        res.set("cache-control", "no-store");
+        res.set("pragma", "no-cache");
+        next();
+    }, authenticate, asyncHandler(async (req, res) => {
+        if (!req.vvpActor) {
+            res.status(401).json({
+                error: "authentication_required",
+                correlationId: req.vvpCorrelationId,
+            });
+            return;
+        }
+        const id = parseCookies(req.headers.cookie)[cookieName];
+        const session = id ? await sessionStore.get(id) : null;
+        if (!session) {
+            res.status(401).json({
+                error: "authentication_required",
+                correlationId: req.vvpCorrelationId,
+            });
+            return;
+        }
+        res.json(toPublicSession(session));
+    }));
+    const safeAuthError = (_error, req, res, _next) => {
+        logger.error(AUTH_EXPRESS_EVENTS.internalError, {
+            correlationId: req.vvpCorrelationId,
+            operation: "auth_route",
+        });
+        if (!res.headersSent) {
+            if (req.method === "GET" && req.path !== routes.session) {
+                errorRedirect(res, req.path === routes.callback ? "unknown" : "provider_unavailable", req.vvpCorrelationId);
+            }
+            else {
+                res.status(500).json({
+                    error: "authentication_unavailable",
+                    correlationId: req.vvpCorrelationId,
+                });
+            }
+        }
+    };
+    router.use(safeAuthError);
+    const applicationAuthenticate = (req, res, next) => {
+        correlate(req, res, (error) => {
+            if (error) {
+                next(error);
+                return;
+            }
+            authenticate(req, res, next);
+        });
+    };
+    return {
+        config,
+        router,
+        authenticate: applicationAuthenticate,
+        requireAuth,
+        requireRealmRole: (role, behavior) => [
+            requireAuth(behavior),
+            authorize((actor) => hasRealmRole(actor, role), behavior),
+        ],
+        requireClientRole: (role, behavior) => [
+            requireAuth(behavior),
+            authorize((actor) => hasClientRole(actor, role, behavior.clientId ?? config.clientId), behavior),
+        ],
+        requireAnyClientRole: (roles, behavior) => [
+            requireAuth(behavior),
+            authorize((actor) => hasAnyClientRole(actor, roles, behavior.clientId ?? config.clientId), behavior),
+        ],
+        createLoginUrl: (returnTo) => {
+            const safe = safeReturnTo(returnTo, returnToOptions);
+            return safe === "/" ? routes.start :
+                `${routes.start}?returnTo=${encodeURIComponent(safe)}`;
+        },
+        createLoginLink: (returnTo) => ({
+            href: (() => {
+                const safe = safeReturnTo(returnTo, returnToOptions);
+                return safe === "/" ? routes.start :
+                    `${routes.start}?returnTo=${encodeURIComponent(safe)}`;
+            })(),
+            target: "_top",
+            rel: "noopener noreferrer",
+        }),
+        hasClientRole: (actor, role) => hasClientRole(actor, role, config.clientId),
+        hasAnyClientRole: (actor, roles) => hasAnyClientRole(actor, roles, config.clientId),
+        routes,
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACvE,OAAO,EACL,kBAAkB,EAClB,SAAS,EACT,iBAAiB,EACjB,aAAa,EACb,YAAY,EACZ,eAAe,EACf,cAAc,EACd,yBAAyB,EACzB,uBAAuB,GAWxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,MAAM,GAMP,MAAM,SAAS,CAAC;AAWjB,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,KAAK,EAAE,gBAAgB;IACvB,YAAY,EAAE,wBAAwB;IACtC,iBAAiB,EAAE,6BAA6B;IAChD,gBAAgB,EAAE,4BAA4B;IAC9C,eAAe,EAAE,2BAA2B;IAC5C,cAAc,EAAE,0BAA0B;IAC1C,yBAAyB,EAAE,uCAAuC;IAClE,qBAAqB,EAAE,kCAAkC;IACzD,sBAAsB,EAAE,mCAAmC;IAC3D,qBAAqB,EAAE,kCAAkC;IACzD,oBAAoB,EAAE,iCAAiC;IACvD,YAAY,EAAE,wBAAwB;IACtC,aAAa,EAAE,yBAAyB;CAChC,CAAC;AAwBX,MAAM,OAAO,0BAA0B;IAC5B,QAAQ,GAAG,IAAI,GAAG,EAA2B,CAAC;IAC9C,SAAS,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,IAAI,CAAe;IAE5B,YACE,WAA+B,EAC/B,UAAkC,EAAE;QAEpC,IAAI,WAAW,KAAK,YAAY,EAAE,CAAC;YACjC,MAAM,IAAI,SAAS,CACjB,sBAAsB,EACtB,2DAA2D,CAC5D,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACtC,CAAC;IAED,KAAK,CAAC,GAAG,CACP,WAA4B,EAC5B,UAAkB;QAElB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,EAAE;YAChC,GAAG,eAAe,CAAC,WAAW,CAAC;YAC/B,SAAS,EAAE,IAAI,CAAC,GAAG,CACjB,WAAW,CAAC,SAAS,EACrB,IAAI,CAAC,IAAI,EAAE,GAAG,UAAU,GAAG,KAAK,CACjC;SACF,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO,CACX,EAAU,EACV,aAAqB;QAErB,KAAK,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACrD,IAAI,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE;gBAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO;gBACL,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,WAAW;aAClE,CAAC;QACJ,CAAC;QACD,IAAI,WAAW,CAAC,SAAS,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;YACzC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACzB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,KAAK,EAAE,aAAa,CAAC,EAAE,CAAC;YACzD,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;QACtC,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACzB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,CAAC,SAAS,CAAC,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,eAAe,CAAC,WAAW,CAAC,EAAE,CAAC;IACrE,CAAC;CACF;AA4ID,MAAM,WAAW,GAAe;IAC9B,KAAK,KAAI,CAAC;IACV,IAAI,KAAI,CAAC;IACT,IAAI,KAAI,CAAC;IACT,KAAK,KAAI,CAAC;CACX,CAAC;AACF,MAAM,UAAU,GAAG,yBAAyB,CAAC;AAC7C,MAAM,mBAAmB,GAAG,0BAA0B,CAAC;AAEvD,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAClB,UAAU,EACV,CAAC,SAAS,EAAE,EAAE,CACZ,CAAC;QACC,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,QAAQ;QACb,GAAG,EAAE,OAAO;KACb,CAAC,CAAC,SAAS,CAAE,CACjB,CAAC;AACJ,CAAC;AAOD,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAoB;IACtD,qBAAqB,EAAE,qBAAqB,EAAE,0BAA0B;IACxE,iBAAiB,EAAE,yBAAyB,EAAE,sBAAsB;IACpE,gBAAgB,EAAE,qBAAqB,EAAE,SAAS;CACnD,CAAC,CAAC;AAEH,MAAM,cAAc,GAA2D;IAC7E,EAAE,EAAE;QACF,mBAAmB,EAAE,6DAA6D;QAClF,mBAAmB,EAAE,0DAA0D;QAC/E,wBAAwB,EAAE,oEAAoE;QAC9F,eAAe,EAAE,qDAAqD;QACtE,uBAAuB,EAAE,uEAAuE;QAChG,oBAAoB,EAAE,4DAA4D;QAClF,cAAc,EAAE,wDAAwD;QACxE,mBAAmB,EAAE,6DAA6D;QAClF,OAAO,EAAE,4BAA4B;KACtC;IACD,EAAE,EAAE;QACF,mBAAmB,EAAE,sDAAsD;QAC3E,mBAAmB,EAAE,2CAA2C;QAChE,wBAAwB,EAAE,0DAA0D;QACpF,eAAe,EAAE,2DAA2D;QAC5E,uBAAuB,EAAE,mEAAmE;QAC5F,oBAAoB,EAAE,oEAAoE;QAC1F,cAAc,EAAE,0DAA0D;QAC1E,mBAAmB,EAAE,iEAAiE;QACtF,OAAO,EAAE,iCAAiC;KAC3C;CACF,CAAC;AAEF,SAAS,UAAU,CAAC,OAAkC;IACpD,MAAM,MAAM,GAAG,OAAO,EAAE,MAAM,IAAI,IAAI,CAAC;IACvC,MAAM,QAAQ,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC;QACjC,aAAa,EAAE,kBAAkB,EAAE,UAAU,EAAE,SAAS;QACxD,SAAS,EAAE,4CAA4C;QACvD,cAAc,EAAE,qBAAqB,EAAE,aAAa,EAAE,yBAAyB;QAC/E,WAAW,EAAE,eAAe,EAAE,UAAU,EAAE,eAAe;QACzD,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW;KAC9C,CAAC,CAAC,CAAC;QACF,aAAa,EAAE,iBAAiB,EAAE,UAAU,EAAE,gBAAgB;QAC9D,SAAS,EAAE,0DAA0D;QACrE,cAAc,EAAE,qBAAqB,EAAE,aAAa,EAAE,wBAAwB;QAC9E,WAAW,EAAE,aAAa,EAAE,UAAU,EAAE,cAAc;QACtD,QAAQ,EAAE,mBAAmB,EAAE,SAAS,EAAE,eAAe;KAC1D,CAAC;IACF,IAAI,OAA2B,CAAC;IAChC,IAAI,OAAO,EAAE,OAAO,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;YAC/D,IACE,MAAM,CAAC,MAAM,KAAK,qBAAqB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;gBAC3E,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ;gBACtE,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI;gBAC5B,MAAM,IAAI,KAAK,EAAE,CAAC;YACpB,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,mEAAmE,CAAC,CAAC;QAC7G,CAAC;IACH,CAAC;IACD,OAAO;QACL,MAAM;QACN,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,KAAK;QAC1C,WAAW,EAAE,OAAO,EAAE,WAAW,IAAI,EAAE;QACvC,IAAI,EAAE,EAAE,GAAG,QAAQ,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE;QACvC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChC,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,KASb;IACC,MAAM,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;IACrB,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO;QACrB,CAAC,CAAC,0BAA0B,UAAU,CAAC,EAAE,CAAC,OAAO,CAAC,WAAW;QAC7D,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW;QAC5B,CAAC,CAAC,sBAAsB,UAAU,CAAC,EAAE,CAAC,WAAW,CAAC,MAAM;QACxD,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,SAAS,GAAG,KAAK,CAAC,aAAa;QACnC,CAAC,CAAC,+BAA+B,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,UAAU,CAAC,KAAK,CAAC,aAAa,CAAC,qBAAqB;QAC7H,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,MAAM,GAAG,KAAK,CAAC,YAAY;QAC/B,CAAC,CAAC,kBAAkB,KAAK,CAAC,KAAK,oCAAoC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,uBAAuB;QACnJ,CAAC,CAAC,EAAE,CAAC;IACP,OAAO;cACK,EAAE,CAAC,MAAM;SACd,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,yBAAyB,KAAK,CAAC,KAAK;;;;;;;qBAO/C,IAAI,SAAS,UAAU,CAAC,EAAE,CAAC,WAAW,CAAC;oBACxC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,WAAW,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC;0BAClD,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,6CAA6C,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC;EAC7H,OAAO,GAAG,SAAS,UAAU,MAAM,gBAAgB,CAAC;AACtD,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,YAAY,CAAC,MAA0B;IAC9C,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,GAAG,CAAC;YAAE,SAAS;QAC5B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;QACnC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY,EAAE,KAAa;IACpD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,SAAS,aAAa,CAAC,KAAa,EAAE,KAAa;IACjD,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QACpE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACjD,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,GAAG,KAAK,qCAAqC,CAAC,CAAC;IACvF,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACxE,IAAI,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,EAAE,CAAC;QACjF,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,GAAG,KAAK,gCAAgC,CAAC,CAAC;IAClF,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB,EAAE,KAAyB,EAAE,QAAgB;IAC9E,MAAM,KAAK,GAAG,KAAK,IAAI,QAAQ,CAAC;IAChC,OAAO,aAAa,CAClB,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,KAAK,EAAE,EACtD,YAAY,CACb,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAA0B,EAAE;IACnD,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,IAAI,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAC7E,MAAM,MAAM,GAAG;QACb,QAAQ;QACR,KAAK,EAAE,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC;QACnE,KAAK,EAAE,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC;QACnE,QAAQ,EAAE,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,YAAY,IAAI,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC/E,MAAM,EAAE,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC;QACvE,OAAO,EAAE,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC;QACtE,SAAS,EAAE,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,aAAa,IAAI,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC;QACpF,KAAK,EAAE,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC;KACpE,CAAC;IACF,MAAM,KAAK,GAAG;QACZ,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO;QAC1E,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,KAAK;KAC/B,CAAC;IACF,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACzC,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,sCAAsC,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,UAAkB,EAAE,WAAmB;IAC3D,OAAO,UAAU,KAAK,GAAG,IAAI,WAAW,KAAK,UAAU;QACrD,WAAW,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,eAAe,CAAC,GAAY;IACnC,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAChE,OAAO,MAAM,EAAE,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC1C,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,GAAG,KAAK,YAAY,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC,WAAW,EAAE,CAAC;IACnG,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5F,OAAO,iBAAiB,CAAC;IAC3B,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QACjE,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,IACE,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC9E,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QACpF,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,EAClD,CAAC;QACD,OAAO,yBAAyB,CAAC;IACnC,CAAC;IACD,IACE,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC1D,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,EACvD,CAAC;QACD,OAAO,sBAAsB,CAAC;IAChC,CAAC;IACD,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAClF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,YAAY,CACnB,OAA2E;IAE3E,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACtE,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,GAAY;IACnC,OAAO,GAAG,CAAC,QAAQ,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAY;IAC1C,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAwB,EAAE,IAAY;IACjE,OAAO,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK,CAAC;AACjE,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,KAAwB,EACxB,IAAY,EACZ,QAAgB;IAEhB,OAAO,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,KAAwB,EACxB,KAAwB,EACxB,QAAgB;IAEhB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAA6B;IAE7B,0EAA0E;IAC1E,4EAA4E;IAC5E,mEAAmE;IACnE,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;IACpC,MAAM,WAAW,GAAoB,YAAY;QAC/C,CAAC,CAAC;YACE,GAAG,OAAO,CAAC,MAAM;YACjB,MAAM,EAAE;gBACN,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM;gBACxB,GAAG,CAAC,YAAY,CAAC,QAAQ,KAAK,SAAS;oBACrC,CAAC,CAAC,EAAE,QAAQ,EAAE,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7C,GAAG,CAAC,YAAY,CAAC,SAAS,IAAI,YAAY,CAAC,KAAK;oBAC9C,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,YAAY,CAAC,SAAS,IAAI,YAAY,CAAC,KAAK;oBAC9C,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,YAAY,CAAC,YAAY,IAAI,YAAY,CAAC,QAAQ;oBACpD,CAAC,CAAC,EAAE,YAAY,EAAE,YAAY,CAAC,YAAY,IAAI,YAAY,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9E,GAAG,CAAC,YAAY,CAAC,UAAU,IAAI,YAAY,CAAC,MAAM;oBAChD,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,IAAI,YAAY,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxE,GAAG,CAAC,YAAY,CAAC,WAAW,IAAI,YAAY,CAAC,OAAO;oBAClD,CAAC,CAAC,EAAE,WAAW,EAAE,YAAY,CAAC,WAAW,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3E,GAAG,CAAC,YAAY,CAAC,aAAa,IAAI,YAAY,CAAC,SAAS;oBACtD,CAAC,CAAC;wBACE,aAAa,EACX,YAAY,CAAC,aAAa,IAAI,YAAY,CAAC,SAAS;qBACvD,CAAC,CAAC,CAAC,EAAE,CAAC;gBACX,GAAG,CAAC,YAAY,CAAC,SAAS,IAAI,YAAY,CAAC,KAAK;oBAC9C,CAAC,CAAC,EAAE,SAAS,EAAE,YAAY,CAAC,SAAS,IAAI,YAAY,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrE,GAAG,CAAC,YAAY,CAAC,UAAU,KAAK,SAAS;oBACvC,CAAC,CAAC,EAAE,UAAU,EAAE,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClD;SACF;QACH,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACnB,MAAM,MAAM,GAAG,cAAc,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,eAAe,GAAG;QACtB,UAAU,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM;QACpE,cAAc,EAAE,MAAM,CAAC,sBAAsB;KAC9C,CAAC;IACF,MAAM,EAAE,GAAG,UAAU,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,MAAM;QACxB,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,WAAW;QAClC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC,WAAW;QAClC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,OAAO,CAAC,EAAE;KACd,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,WAAW,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,MAIzB,CAAC;IACF,MAAM,gBAAgB,GAAG,eAAe,CAAC,YAAY,IAAI;QACvD,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,SAAS,EAAE,UAAU,CAAC,SAAS;QAC/B,YAAY,EAAE,UAAU,CAAC,YAAY;QACrC,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,aAAa,EAAE,UAAU,CAAC,aAAa;QACvC,SAAS,EAAE,UAAU,CAAC,SAAS;KAChC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,gBAAgB,CAAC;IAChC,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,UAAU,IAAI,GAAG,EAAE,YAAY,CAAC,CAAC;IAC1E,MAAM,qBAAqB,GAAG,aAAa,CACzC,OAAO,CAAC,qBAAqB;QAC3B,MAAM,CAAC,MAAM,CAAC,UAAU,EAC1B,uBAAuB,CACxB,CAAC;IACF,IAAI,MAAM,CAAC,WAAW,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,SAAS,CACjB,gBAAgB,EAChB,+DAA+D,CAChE,CAAC;IACJ,CAAC;IACD,IACE,CAAC,YAAY,CAAC,qBAAqB,EAAE,MAAM,CAAC,KAAK,CAAC;QAClD,CAAC,YAAY,CAAC,qBAAqB,EAAE,MAAM,CAAC,QAAQ,CAAC,EACrD,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,gBAAgB,EAChB,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,KAAK,YAAY,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QACjE,MAAM,IAAI,SAAS,CACjB,sBAAsB,EACtB,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,KAAK,YAAY,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACrE,MAAM,IAAI,SAAS,CACjB,sBAAsB,EACtB,4DAA4D,CAC7D,CAAC;IACJ,CAAC;IACD,yBAAyB,CAAC,OAAO,CAAC,YAAa,EAAE,MAAM,CAAC,WAAW,EAAE;QACnE,OAAO,EAAE,SAAS;KACnB,CAAC,CAAC;IACH,yBAAyB,CAAC,OAAO,CAAC,gBAAiB,EAAE,MAAM,CAAC,WAAW,EAAE;QACvE,OAAO,EAAE,aAAa;QACtB,oBAAoB,EAAE,IAAI;KAC3B,CAAC,CAAC;IACH,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY,IAAI,IAAI,kBAAkB,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9E,MAAM,YAAY,GAChB,OAAO,CAAC,gBAAgB;QACxB,IAAI,0BAA0B,CAAC,MAAM,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9D,MAAM,IAAI,GACR,OAAO,CAAC,UAAU;QAClB,CAAC,MAAM,aAAa,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,aAAa,CAAC;IACvD,MAAM,qBAAqB,GACzB,OAAO,CAAC,qBAAqB,IAAI,sBAAsB,CAAC;IAC1D,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,GAAG,CAAC;IACnE,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC;QAC5C,qBAAqB,GAAG,EAAE;QAC1B,qBAAqB,GAAG,GAAG,EAC3B,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,gBAAgB,EAChB,kDAAkD,CACnD,CAAC;IACJ,CAAC;IACD,MAAM,0BAA0B,GAC9B,OAAO,CAAC,0BAA0B,IAAI,EAAE,CAAC;IAC3C,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,0BAA0B,CAAC;QACjD,0BAA0B,GAAG,CAAC;QAC9B,0BAA0B,GAAG,GAAG,EAChC,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,gBAAgB,EAChB,sDAAsD,CACvD,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,KAAK,YAAY,CAAC;IACnD,MAAM,aAAa,GAAG;QACpB,QAAQ,EAAE,IAAI;QACd,MAAM;QACN,QAAQ,EAAE,KAAc;QACxB,IAAI,EAAE,UAAU;QAChB,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,GAAG,KAAK;KACrE,CAAC;IACF,MAAM,iBAAiB,GAAG;QACxB,QAAQ,EAAE,IAAI;QACd,MAAM;QACN,QAAQ,EAAE,KAAc;QACxB,IAAI,EAAE,qBAAqB;QAC3B,MAAM,EAAE,qBAAqB,GAAG,KAAK;KACtC,CAAC;IACF,MAAM,kBAAkB,GAAG;QACzB,QAAQ,EAAE,IAAI;QACd,MAAM;QACN,QAAQ,EAAE,KAAc;QACxB,IAAI,EAAE,UAAU;KACjB,CAAC;IACF,MAAM,YAAY,GAAG,CAAC,GAAa,EAAE,EAAE,CACrC,GAAG,CAAC,WAAW,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;IAClD,MAAM,gBAAgB,GAAG,CAAC,GAAa,EAAE,EAAE,CACzC,GAAG,CAAC,WAAW,CAAC,qBAAqB,EAAE;QACrC,GAAG,kBAAkB;QACrB,IAAI,EAAE,qBAAqB;KAC5B,CAAC,CAAC;IAEL,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,KAAK,EAAE;QACrC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,aAAa,EAAE,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,MAAM,CAAC,QAAQ;QAC7B,aAAa,EAAE,MAAM,CAAC,SAAS;QAC/B,UAAU;QACV,qBAAqB;KACtB,CAAC,CAAC;IAEH,MAAM,SAAS,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACnD,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAC7C,GAAG,CAAC,gBAAgB;YAClB,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC;QAC3E,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAClD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACzD,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;YACxD,IAAI,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;gBAChC,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YACD,IAAI,OAAO,GAAG,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACzC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACb,YAAY,CAAC,GAAG,CAAC,CAAC;gBAClB,IAAI,EAAE,CAAC;gBACP,OAAO;YACT,CAAC;YACD,IACE,OAAO,CAAC,MAAM,CAAC,SAAS,KAAK,SAAS;gBACtC,OAAO,CAAC,MAAM,CAAC,SAAS;oBACtB,GAAG,EAAE,GAAG,0BAA0B,GAAG,KAAK,EAC5C,CAAC;gBACD,IAAI,CAAC;oBACH,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;gBAC1C,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBAC9B,YAAY,CAAC,GAAG,CAAC,CAAC;oBAClB,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,oBAAoB,EAAE;wBACpD,aAAa,EAAE,GAAG,CAAC,gBAAgB;qBACpC,CAAC,CAAC;oBACH,IAAI,EAAE,CAAC;oBACP,OAAO;gBACT,CAAC;YACH,CAAC;YACD,GAAG,CAAC,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC;YAC7B,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,CAAC,GAAG,CAAC,CAAC;YAClB,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,aAAa,EAAE;gBAC9C,aAAa,EAAE,GAAG,CAAC,gBAAgB;gBACnC,SAAS,EAAE,cAAc;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;gBACrB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,4BAA4B;oBACnC,aAAa,EAAE,GAAG,CAAC,gBAAgB;iBACpC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,eAAe,GAAG,CACtB,GAAY,EACZ,GAAa,EACb,QAAwB,EACxB,EAAE;QACF,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE;YAC5C,aAAa,EAAE,GAAG,CAAC,gBAAgB;YACnC,MAAM,EAAE,iBAAiB;YACzB,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,eAAe,CAAC,CAAC;YAChE,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,aAAa,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,yBAAyB;gBAChC,aAAa,EAAE,GAAG,CAAC,gBAAgB;aACpC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,WAAW,GAAG,CAAC,QAAwB,EAAkB,EAAE,CAC/D,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACjB,IAAI,GAAG,CAAC,QAAQ;YAAE,IAAI,EAAE,CAAC;;YACpB,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC3C,CAAC,CAAC;IAEJ,MAAM,SAAS,GAAG,CAChB,SAAoC,EACpC,QAAwB,EACR,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACtC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClB,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QACD,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE;YAC5C,aAAa,EAAE,GAAG,CAAC,gBAAgB;YACnC,MAAM,EAAE,WAAW;YACnB,IAAI,EAAE,QAAQ,CAAC,IAAI;SACpB,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC7B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,WAAW;gBAClB,aAAa,EAAE,GAAG,CAAC,gBAAgB;aACpC,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtB,MAAM,QAAQ,GAAG,CAAC,GAAa,EAAE,IAAY,EAAE,KAAa,EAAE,EAAE;QAC9D,GAAG;aACA,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC;aAChC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC;aACzB,GAAG,CACF,yBAAyB,EACzB,gHAAgH,KAAK,wBAAwB,KAAK,GAAG,CACtJ;aACA,GAAG,CAAC,iBAAiB,EAAE,aAAa,CAAC;aACrC,GAAG,CAAC,wBAAwB,EAAE,SAAS,CAAC;aACxC,IAAI,CAAC,MAAM,CAAC;aACZ,IAAI,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC;IACF,MAAM,iBAAiB,GAAG,CAAC,GAAG,EAAE;QAC9B,MAAM,sBAAsB,GAAI,MAA8C,CAAC,YAAY,CAAC;QAC5F,OAAO,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,sBAAsB,IAAI,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC;IACtF,CAAC,CAAC,EAAE,CAAC;IACL,MAAM,aAAa,GAAG,CACpB,GAAa,EACb,MAAyB,EACzB,aAAqB,EACrB,EAAE;QACF,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;QAC7D,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC3D,CAAC,CAAC;IAEF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACpC,MAAM,QAAQ,GAAG,YAAY,CAC3B,OAAO,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,EAC7E,eAAe,CAChB,CAAC;QACF,MAAM,IAAI,GAAG,QAAQ,KAAK,GAAG;YAC3B,CAAC,CAAC,MAAM,CAAC,KAAK;YACd,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,aAAa,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/D,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;YACjB,EAAE;YACF,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU;YACzB,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS;YACvB,UAAU,EAAE,IAAI;YAChB,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa;YACjC,KAAK;YACL,YAAY,EAAE,IAAI;SACnB,CAAC,EAAE,KAAK,CAAC,CAAC;IACb,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CACR,MAAM,CAAC,KAAK,EACZ,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9B,MAAM,QAAQ,GAAG,YAAY,CAC3B,OAAO,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,QAAQ;YACvC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC;YACvB,CAAC,CAAC,SAAS,EACb,eAAe,CAChB,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC;QAC9D,MAAM,EAAE,GAAG,QAAQ,EAAE,CAAC;QACtB,MAAM,YAAY,CAAC,GAAG,CACpB;YACE,EAAE;YACF,KAAK,EAAE,aAAa,CAAC,KAAK;YAC1B,KAAK,EAAE,aAAa,CAAC,KAAK;YAC1B,YAAY,EAAE,aAAa,CAAC,YAAY;YACxC,QAAQ;YACR,SAAS,EAAE,GAAG,EAAE,GAAG,qBAAqB,GAAG,KAAK;SACjD,EACD,qBAAqB,CACtB,CAAC;QACF,GAAG,CAAC,MAAM,CAAC,qBAAqB,EAAE,EAAE,EAAE,iBAAiB,CAAC,CAAC;QACzD,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,YAAY,EAAE;YAC5C,aAAa,EAAE,GAAG,CAAC,gBAAgB;SACpC,CAAC,CAAC;QACH,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACzD,CAAC,CAAC,CACH,CAAC;IACF,MAAM,CAAC,GAAG,CACR,MAAM,CAAC,QAAQ,EACf,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9B,MAAM,KAAK,GACT,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC;QACnE,MAAM,2BAA2B,GAAG,CAAC,EAAE;YACrC,CAAC,CAAC,4BAA4B;YAC9B,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpB,CAAC,CAAC,8BAA8B;gBAChC,CAAC,CAAC,CAAC,KAAK;oBACN,CAAC,CAAC,eAAe;oBACjB,CAAC,CAAC,SAAS,CAAC;QAClB,MAAM,iCAAiC,GAAG,OAAO,CAC/C,EAAE,IAAI,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CACnC,CAAC;QACF,IAAI,aAA4C,CAAC;QACjD,IAAI,CAAC;YACH,aAAa,GAAG,iCAAiC;gBAC/C,CAAC,CAAC,MAAM,YAAY,CAAC,OAAO,CAAC,EAAG,EAAE,KAAK,CAAC;gBACxC,CAAC,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACtB,MAAM,YAAY,GAAG,uBAAuB,CAAkB;gBAC5D,MAAM,EAAE,WAAW;aACpB,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,gBAAgB,EAAE;gBACjD,aAAa,EAAE,GAAG,CAAC,gBAAgB;gBACnC,KAAK,EAAE,YAAY,CAAC,KAAK;gBACzB,MAAM,EAAE,YAAY,CAAC,MAAM;gBAC3B,IAAI,EAAE,YAAY,CAAC,IAAI;aACxB,CAAC,CAAC;YACH,aAAa,CAAC,GAAG,EAAE,gBAAgB,EAAE,GAAG,CAAC,gBAAiB,CAAC,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAClC,IACE,CAAC,iCAAiC;gBAClC,aAAa,CAAC,MAAM,KAAK,SAAS;gBAClC,aAAa,CAAC,MAAM,KAAK,kBAAkB;gBAC3C,aAAa,CAAC,MAAM,KAAK,WAAW,EACpC,CAAC;gBACD,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACxB,CAAC;YACD,MAAM,YAAY,GAAG,uBAAuB,CAAC,aAAa,CAAC,CAAC;YAC5D,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,gBAAgB,EAAE;gBAChD,aAAa,EAAE,GAAG,CAAC,gBAAgB;gBACnC,KAAK,EAAE,wBAAwB;gBAC/B,MAAM,EAAE,2BAA2B,IAAI,YAAY,CAAC,MAAM;gBAC1D,IAAI,EAAE,YAAY,CAAC,IAAI;aACxB,CAAC,CAAC;YACH,MAAM,YAAY,GAChB,aAAa,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB;gBACxD,CAAC,CAAC,aAAa,CAAC,MAAM,KAAK,kBAAkB;oBAC3C,CAAC,CAAC,0BAA0B;oBAC5B,CAAC,CAAC,aAAa,CAAC,MAAM,KAAK,WAAW;wBACpC,CAAC,CAAC,gBAAgB;wBAClB,CAAC,CAAC,qBAAqB,CAAC;YAChC,aAAa,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,CAAC,gBAAiB,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,MAAM,WAAW,GAAG,aAAa,CAAC,WAAW,CAAC;QAC9C,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;YACrD,WAAW,CAAC,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAChD,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACrD,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC;gBACxC,WAAW;gBACX,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,KAAK,EAAE,WAAW,CAAC,KAAK;gBACxB,YAAY,EAAE,WAAW,CAAC,YAAY;gBACtC,GAAG,CAAC,GAAG,CAAC,gBAAgB;oBACtB,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,gBAAgB,EAAE;oBACzC,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;YAClD,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,iBAAiB,EAAE;gBACjD,aAAa,EAAE,GAAG,CAAC,gBAAgB;gBACnC,KAAK,EAAE,SAAS;gBAChB,MAAM,EAAE,SAAS;aAClB,CAAC,CAAC;YACH,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,YAAY,CAAC,GAAG,CAAC,CAAC;YAClB,MAAM,IAAI,GACR,KAAK,YAAY,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,sBAAsB,CAAC;YACnE,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,gBAAgB,EAAE;gBAChD,aAAa,EAAE,GAAG,CAAC,gBAAgB;gBACnC,KAAK,EAAE,KAAK,YAAY,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU;gBAC5D,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,IAAI;gBACJ,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO;oBAC5B,CAAC,CAAC,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE;oBACzC,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,WAAW;oBAChC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE;oBACjD,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,UAAU;oBAC/B,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,OAAO,CAAC,UAAU,EAAE;oBAC/C,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK;oBAC1B,CAAC,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE;oBACrC,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;YACH,aAAa,CACX,GAAG,EACH,oBAAoB,CAAC,KAAK,CAAC,EAC3B,GAAG,CAAC,gBAAiB,CACtB,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;QACzC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;YACjB,EAAE;YACF,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc;YAC7B,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa;YAC3B,UAAU,EAAE,MAAM,CAAC,KAAK;YACxB,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW;YAC/B,KAAK;SACN,CAAC,EAAE,KAAK,CAAC,CAAC;IACb,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACpC,MAAM,cAAc,GAClB,OAAO,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5E,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC,cAAmC,CAAC;YAC1E,CAAC,CAAC,cAAmC;YACrC,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,qBAAqB,GACzB,OAAO,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,QAAQ;YAC5C,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC;YAC5B,CAAC,CAAC,GAAG,CAAC,gBAAiB,CAAC;QAC5B,MAAM,aAAa,GAAG,mBAAmB,CAAC,IAAI,CAAC,qBAAqB,CAAC;YACnE,CAAC,CAAC,qBAAqB;YACvB,CAAC,CAAC,GAAG,CAAC,gBAAiB,CAAC;QAC1B,MAAM,MAAM,GAAG,EAAE,CAAC,MAAM,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACpD,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;YACjB,EAAE;YACF,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU;YACzB,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;YACpC,UAAU,EAAE,MAAM,CAAC,KAAK;YACxB,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ;YAC5B,aAAa;YACb,KAAK;SACN,CAAC,EAAE,KAAK,CAAC,CAAC;IACb,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,MAAM,EACb,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACjC,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACnC,IAAI,YAAgC,CAAC;QACrC,IAAI,CAAC;YACH,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;gBACtD,CAAC,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,MAAM;gBACzB,CAAC,CAAC,SAAS,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACP,YAAY,GAAG,SAAS,CAAC;QAC3B,CAAC;QACD,IAAI,YAAY,KAAK,MAAM,CAAC,WAAW,CAAC,MAAM,EAAE,CAAC;YAC/C,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,cAAc,EAAE;gBAC9C,aAAa,EAAE,GAAG,CAAC,gBAAgB;gBACnC,KAAK,EAAE,oBAAoB;gBAC3B,MAAM,EAAE,cAAc;aACvB,CAAC,CAAC;YACH,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QACD,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;QACxD,YAAY,CAAC,GAAG,CAAC,CAAC;QAClB,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,IAAI,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,yBAAyB,EAAE;gBACzD,aAAa,EAAE,GAAG,CAAC,gBAAgB;gBACnC,UAAU,EAAE,KAAK;aAClB,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,eAAe,EAAE;gBAC/C,aAAa,EAAE,GAAG,CAAC,gBAAgB;gBACnC,UAAU,EAAE,KAAK;gBACjB,KAAK,EAAE,OAAO;aACf,CAAC,CAAC;YACH,MAAM,aAAa,GAAG,iBAAiB,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,qBAAqB,EAAE;gBACrD,aAAa,EAAE,GAAG,CAAC,gBAAgB;gBACnC,WAAW,EAAE,YAAY;aAC1B,CAAC,CAAC;YACH,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QACD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACxC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,yBAAyB,EAAE;gBACzD,aAAa,EAAE,GAAG,CAAC,gBAAgB;gBACnC,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;YACH,IACE,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,SAAS,CAAC,QAAQ,KAAK,OAAO,CAAC;gBACnE,CAAC,SAAS,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,WAAW,KAAK,YAAY,CAAC,EACxE,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,qBAAqB,EAAE;oBACrD,aAAa,EAAE,GAAG,CAAC,gBAAgB;oBACnC,KAAK,EAAE,qBAAqB;oBAC5B,MAAM,EAAE,4BAA4B;iBACrC,CAAC,CAAC;gBACH,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,qBAAqB,EAAE;oBACrD,aAAa,EAAE,GAAG,CAAC,gBAAgB;oBACnC,WAAW,EAAE,gBAAgB;iBAC9B,CAAC,CAAC;gBACH,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;gBACrC,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,qBAAqB,EAAE;gBACrD,aAAa,EAAE,GAAG,CAAC,gBAAgB;gBACnC,WAAW,EAAE,UAAU;aACxB,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,eAAe,EAAE;gBAC/C,aAAa,EAAE,GAAG,CAAC,gBAAgB;gBACnC,UAAU,EAAE,IAAI;gBAChB,KAAK,EAAE,oBAAoB;aAC5B,CAAC,CAAC;YACH,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAC9B,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,yBAAyB,EAAE;gBACzD,aAAa,EAAE,GAAG,CAAC,gBAAgB;gBACnC,UAAU,EAAE,IAAI;aACjB,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,sBAAsB,EAAE;gBACtD,aAAa,EAAE,GAAG,CAAC,gBAAgB;gBACnC,KAAK,EAAE,mBAAmB;gBAC1B,MAAM,EAAE,0BAA0B;aACnC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,qBAAqB,EAAE;gBACrD,aAAa,EAAE,GAAG,CAAC,gBAAgB;gBACnC,WAAW,EAAE,gBAAgB;aAC9B,CAAC,CAAC;YACH,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CACH,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC7C,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACrC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC9B,IAAI,EAAE,CAAC;IACT,CAAC,EAAE,YAAY,EAAE,YAAY,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QAC/C,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,yBAAyB;gBAChC,aAAa,EAAE,GAAG,CAAC,gBAAgB;aACpC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACvD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBACnB,KAAK,EAAE,yBAAyB;gBAChC,aAAa,EAAE,GAAG,CAAC,gBAAgB;aACpC,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC,CAAC;IACJ,MAAM,aAAa,GAAwB,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE;QACrE,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,aAAa,EAAE;YAC9C,aAAa,EAAE,GAAG,CAAC,gBAAgB;YACnC,SAAS,EAAE,YAAY;SACxB,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;YACrB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;gBACxD,aAAa,CACX,GAAG,EACH,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,sBAAsB,EACjE,GAAG,CAAC,gBAAiB,CACtB,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBACnB,KAAK,EAAE,4BAA4B;oBACnC,aAAa,EAAE,GAAG,CAAC,gBAAgB;iBACpC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC,CAAC;IACF,MAAM,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAE1B,MAAM,uBAAuB,GAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QACjE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,KAAe,EAAE,EAAE;YACtC,IAAI,KAAK,EAAE,CAAC;gBACV,IAAI,CAAC,KAAK,CAAC,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,OAAO;QACL,MAAM;QACN,MAAM;QACN,YAAY,EAAE,uBAAuB;QACrC,WAAW;QACX,gBAAgB,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;YACpC,WAAW,CAAC,QAAQ,CAAC;YACrB,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;SAC1D;QACD,iBAAiB,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;YACrC,WAAW,CAAC,QAAQ,CAAC;YACrB,SAAS,CACP,CAAC,KAAK,EAAE,EAAE,CACR,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,EAClE,QAAQ,CACT;SACF;QACD,oBAAoB,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC;YACzC,WAAW,CAAC,QAAQ,CAAC;YACrB,SAAS,CACP,CAAC,KAAK,EAAE,EAAE,CACR,gBAAgB,CACd,KAAK,EACL,KAAK,EACL,QAAQ,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CACrC,EACH,QAAQ,CACT;SACF;QACD,cAAc,EAAE,CAAC,QAAQ,EAAE,EAAE;YAC3B,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;YACrD,OAAO,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAClC,GAAG,MAAM,CAAC,KAAK,aAAa,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,CAAC;QACD,eAAe,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YAC9B,IAAI,EAAE,CAAC,GAAG,EAAE;gBACV,MAAM,IAAI,GAAG,YAAY,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC;gBACrD,OAAO,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;oBAClC,GAAG,MAAM,CAAC,KAAK,aAAa,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,CAAC,CAAC,EAAE;YACJ,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,qBAAqB;SAC3B,CAAC;QACF,aAAa,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,CAAC;QAC3E,gBAAgB,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACjC,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC;QACjD,MAAM;KACP,CAAC;AACJ,CAAC"}

package/package.json

@@ -0,0 +1,41 @@
+{
+  "name": "@dreadkn1ght123/auth-express",
+  "version": "0.2.0",
+  "description": "Secure Express integration for VVP authentication",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {
+    "express": "^5.1.0",
+    "@dreadkn1ght123/auth-types": "^0.2.0",
+    "@dreadkn1ght123/auth-core": "^0.2.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "devDependencies": {
+    "@types/express": "^5.0.3",
+    "@types/node": "^22.15.0",
+    "@types/supertest": "^6.0.3",
+    "supertest": "^7.1.4"
+  },
+  "scripts": {
+    "build": "tsc -b",
+    "typecheck": "tsc -b --pretty false && tsc -p tsconfig.test.json --noEmit --pretty false",
+    "test": "vitest run"
+  }
+}