@flytedesk/app-kit 0.8.0 → 1.0.0

package/dist/auth/plugin.js

@@ -4,7 +4,7 @@ import fastifyCookie from "@fastify/cookie";
 import { AuthStoreError, IdpAccessRevokedError, classifyIdpError } from "./errors.js";
 import { createOidcClient } from "./oidc-client.js";
 import { generatePkce, randomState } from "./pkce.js";
-import { AUTH_ROUTE_PREFIX, authRoutePath } from "./shared-types.js";
+import { AUTH_REQUEST_DEADLINE_MS, AUTH_ROUTE_PREFIX, authRoutePath, SILENT_AUTH_MESSAGE_SOURCE, } from "./shared-types.js";
 import { generateRefreshToken, hashRefreshToken, signAccessToken, verifyAccessToken } from "./tokens.js";
 const DEFAULT_ACCESS_TOKEN_TTL_SECONDS = 900;
 const DEFAULT_REFRESH_TOKEN_TTL_SECONDS = 2_592_000;
@@ -42,6 +42,15 @@ const flytedeskAuthPlugin = async (fastify, options) => {
     const accessTokenTtlSeconds = options.accessTokenTtlSeconds ?? DEFAULT_ACCESS_TOKEN_TTL_SECONDS;
     const refreshTokenTtlSeconds = options.refreshTokenTtlSeconds ?? DEFAULT_REFRESH_TOKEN_TTL_SECONDS;
     const loginAttemptTtlSeconds = options.loginAttemptTtlSeconds ?? DEFAULT_LOGIN_ATTEMPT_TTL_SECONDS;
+    // See FlytedeskAuthOptions.refreshReuseGraceMs's doc comment (AK-14, gap 3; MP-127)
+    // for why 2x the client's own request deadline is the right default.
+    const refreshReuseGraceMs = options.refreshReuseGraceMs ?? 2 * AUTH_REQUEST_DEADLINE_MS;
+    // The origin a silent (`prompt=none`) callback's postMessage targets — see
+    // sendSilentResult below. Reuses postLoginRedirect's origin (the SPA a hidden iframe's
+    // parent page is running) rather than a new, redundant option: every consumer of the
+    // silent flow already has to set postLoginRedirect to that same origin for the
+    // interactive flow to land anywhere sensible.
+    const silentAuthTargetOrigin = new URL(options.postLoginRedirect).origin;
     const store = options.store;
     if (options.authorizationCacheTtlMs) {
         fastify.log.warn({ authorizationCacheTtlMs: options.authorizationCacheTtlMs }, "@flytedesk/app-kit/auth: authorizationCacheTtlMs is set — flytedesk-id authorization " +
@@ -53,6 +62,8 @@ const flytedeskAuthPlugin = async (fastify, options) => {
         clientId: options.clientId,
         clientSecret: options.clientSecret,
         redirectUri: options.redirectUri,
+        scopes: options.scopes,
+        tokenRequestTimeoutMs: options.tokenRequestTimeoutMs,
     });
     await fastify.register(fastifyCookie, { secret: options.cookieSecret });
     fastify.decorateRequest("authUser", undefined);
@@ -83,6 +94,27 @@ const flytedeskAuthPlugin = async (fastify, options) => {
             maxAge: maxAgeSeconds,
         };
     }
+    /**
+     * The postMessage contract a silent (`prompt=none`) `{routePrefix}/callback` answers
+     * with (AK-14, gap 2) — read by `./client/silentAuth.ts`'s hidden-iframe listener.
+     * Never rendered by a top-level navigation: only ever loaded inside the hidden iframe
+     * `attemptSilentResume()` creates, so this is safe to keep unauthenticated/undecorated
+     * HTML — generalized from media-planner's `routes/auth.ts`'s `sendSilentResult`.
+     */
+    function sendSilentResult(reply, status, detail) {
+        const message = {
+            source: SILENT_AUTH_MESSAGE_SOURCE,
+            status,
+            detail: detail ?? null,
+        };
+        return reply
+            .type("text/html")
+            .send(`<!doctype html><html><body><script>` +
+            `if (window.parent && window.parent !== window) {` +
+            `window.parent.postMessage(${JSON.stringify(message)}, ${JSON.stringify(silentAuthTargetOrigin)});` +
+            `}` +
+            `</script></body></html>`);
+    }
     const authorizationCache = new Map();
     const EXPIRY_SKEW_MS = 5_000;
     /**
@@ -177,7 +209,7 @@ const flytedeskAuthPlugin = async (fastify, options) => {
         // never collide across apps in its catalog — strip the prefix so the consuming
         // app's own permission checks don't have to know about it.
         const prefix = `${options.appId}:`;
-        return {
+        const user = {
             id: session.subject,
             email: session.email,
             name: session.name,
@@ -185,6 +217,26 @@ const flytedeskAuthPlugin = async (fastify, options) => {
             roles: authorization.roles,
             permissions: authorization.permissions.map((p) => (p.startsWith(prefix) ? p.slice(prefix.length) : p)),
         };
+        // AK-14, gap 4: the one extension point a consumer has to reject or enrich an
+        // otherwise-valid, still-IdP-authorized session on every request (e.g. media-planner's
+        // own local suspension flag) — see FlytedeskAuthOptions.onAuthorizeUser's doc comment.
+        // A throwing/rejecting hook is treated exactly like a `null` return: fail loudly
+        // (logged with context, AK-16) but never a 500 — a hook error must never be
+        // indistinguishable from "authenticated".
+        if (options.onAuthorizeUser) {
+            let authorized;
+            try {
+                authorized = await options.onAuthorizeUser(user, request);
+            }
+            catch (err) {
+                request.log.error({ err, sid: claims.sid }, "@flytedesk/app-kit/auth: onAuthorizeUser threw — treating the session as rejected");
+                return undefined;
+            }
+            if (!authorized)
+                return undefined;
+            return authorized;
+        }
+        return user;
     }
     // onRequest, not preHandler: this needs to run before any route-level preHandler
     // (requireAuth/requirePermission included) so request.authUser is already resolved
@@ -215,6 +267,8 @@ const flytedeskAuthPlugin = async (fastify, options) => {
             idpSessionId,
             userAgent: request.headers["user-agent"] ?? null,
             ip: request.ip,
+            // The first token of a fresh login — nothing precedes it in the family.
+            replacesId: null,
         });
         const { token: accessToken, expiresAt: accessExpiresAt } = await signAccessToken(options.accessTokenSecret, accessTokenTtlSeconds, userId, idpSessionId);
         reply.setCookie(refreshCookieName, refreshToken, refreshCookieOptions(refreshTokenTtlSeconds));
@@ -222,15 +276,28 @@ const flytedeskAuthPlugin = async (fastify, options) => {
     }
     /**
      * GET {routePrefix}/login — starts the flytedesk-id sign-in. A plain redirect meant
-     * to be hit via full-page navigation, not fetch/XHR. Generates a PKCE verifier/
-     * challenge (S256 — flytedesk-id makes PKCE mandatory) and a CSRF `state`, stashes
-     * both in a short-lived signed cookie tied to this browser, then redirects to
-     * flytedesk-id's own /auth endpoint.
+     * to be hit via full-page navigation, not fetch/XHR (except for the `?prompt=none`
+     * silent case below, which is driven from a hidden iframe — same route, same
+     * redirect, just never shown). Generates a PKCE verifier/challenge (S256 —
+     * flytedesk-id makes PKCE mandatory) and a CSRF `state`, stashes both (plus whether
+     * this attempt is silent) in a short-lived signed cookie tied to this browser, then
+     * redirects to flytedesk-id's own /auth endpoint.
+     *
+     * `?prompt=none` (AK-14, gap 2; OIDC Core 3.1.2.1) is the silent-resume flow
+     * `./client/silentAuth.ts` drives from a hidden iframe: `prompt` is passed straight
+     * through to flytedesk-id, which answers from its own existing end-user session
+     * cookie with no visible UI at all — a fresh `code` if that session is live,
+     * `error=login_required` back to redirect_uri if it's not. Everything else about this
+     * route is identical to an interactive sign-in; only the stashed `silent` flag (which
+     * routes the callback's response — see GET {routePrefix}/callback below) and the
+     * `prompt` passed to buildAuthorizeUrl differ.
      */
     fastify.get(authRoutePath(routePrefix, "login"), async (request, reply) => {
         const { verifier, challenge } = generatePkce();
         const state = randomState();
-        reply.setCookie(loginCookieName, JSON.stringify({ verifier, state }), {
+        const prompt = request.query.prompt;
+        const silent = prompt === "none";
+        reply.setCookie(loginCookieName, JSON.stringify({ verifier, state, silent }), {
             httpOnly: true,
             sameSite: "lax",
             secure: options.secureCookies,
@@ -238,7 +305,7 @@ const flytedeskAuthPlugin = async (fastify, options) => {
             maxAge: loginAttemptTtlSeconds,
             signed: true,
         });
-        return reply.redirect(oidc.buildAuthorizeUrl({ state, challenge }));
+        return reply.redirect(oidc.buildAuthorizeUrl({ state, challenge, prompt }));
     });
     /**
      * GET {routePrefix}/callback — flytedesk-id's redirect_uri for this client. Validates
@@ -251,33 +318,41 @@ const flytedeskAuthPlugin = async (fastify, options) => {
         const { code, state, error } = request.query;
         const raw = request.cookies[loginCookieName];
         reply.clearCookie(loginCookieName, { path: cookiePath });
-        if (error) {
-            return reply
-                .code(400)
-                .send({ error: `flytedesk-id sign-in failed: ${error}`, code: "idp_error" });
+        // Recover `silent` before any failure branch below runs, including ones that
+        // never get as far as validating the rest of the stash — a `prompt=none` attempt
+        // that fails (e.g. `error=login_required`, the expected outcome when the
+        // IdP-side session is genuinely gone too) still needs to answer through
+        // sendSilentResult, or the hidden iframe's listener would wait out its full
+        // timeout for a postMessage that was never going to arrive (AK-14, gap 2).
+        let stash;
+        if (raw) {
+            const unsigned = request.unsignCookie(raw);
+            if (unsigned.valid && unsigned.value) {
+                try {
+                    stash = JSON.parse(unsigned.value);
+                }
+                catch {
+                    stash = undefined;
+                }
+            }
         }
-        if (!code || !state || !raw) {
-            return reply.code(400).send({
-                error: "Missing code/state, or the login attempt expired",
-                code: "invalid_callback",
-            });
+        const silent = stash?.silent === true;
+        function fail(status, code, message) {
+            if (silent)
+                return sendSilentResult(reply, "error", code);
+            return reply.code(status).send({ error: message, code });
         }
-        const unsigned = request.unsignCookie(raw);
-        if (!unsigned.valid || !unsigned.value) {
-            return reply.code(400).send({
-                error: "Login attempt cookie failed verification",
-                code: "invalid_login_cookie",
-            });
+        if (error) {
+            return fail(400, error, `flytedesk-id sign-in failed: ${error}`);
         }
-        let stash;
-        try {
-            stash = JSON.parse(unsigned.value);
+        if (!code || !state || !raw) {
+            return fail(400, "invalid_callback", "Missing code/state, or the login attempt expired");
         }
-        catch {
-            return reply.code(400).send({ error: "Corrupt login attempt", code: "invalid_login_cookie" });
+        if (!stash) {
+            return fail(400, "invalid_login_cookie", "Login attempt cookie failed verification");
         }
         if (stash.state !== state) {
-            return reply.code(400).send({ error: "State mismatch", code: "invalid_state" });
+            return fail(400, "invalid_state", "State mismatch");
         }
         try {
             const tokens = await oidc.exchangeCodeForTokens(code, stash.verifier);
@@ -286,16 +361,10 @@ const flytedeskAuthPlugin = async (fastify, options) => {
             const idToken = await oidc.verifyIdToken(tokens.id_token);
             const profile = await oidc.fetchUserinfo(tokens.access_token);
             if (profile.sub !== idToken.sub) {
-                return reply.code(401).send({
-                    error: "flytedesk-id id_token/userinfo subject mismatch",
-                    code: "subject_mismatch",
-                });
+                return fail(401, "subject_mismatch", "flytedesk-id id_token/userinfo subject mismatch");
             }
             if (!profile.emailVerified) {
-                return reply.code(401).send({
-                    error: "flytedesk-id account email is not verified",
-                    code: "email_not_verified",
-                });
+                return fail(401, "email_not_verified", "flytedesk-id account email is not verified");
             }
             if (options.onSignIn) {
                 await options.onSignIn(profile, request);
@@ -313,26 +382,61 @@ const flytedeskAuthPlugin = async (fastify, options) => {
             // only ever revokes the chain descended from one login, never sibling sessions.
             const familyId = randomUUID();
             await issueSession(request, reply, profile.sub, idpSession.id, familyId);
+            if (silent) {
+                // No top-level navigation at all — issueSession() above already set the real
+                // refresh cookie on this (the API's) origin as a side effect of this same
+                // response, which is the only thing that actually needed to happen. This page
+                // just tells the hidden iframe's listener it can stop waiting; the parent page
+                // picks the new session up via its own regular {routePrefix}/refresh + /me,
+                // exactly like any other reload would (AK-14, gap 2).
+                return sendSilentResult(reply, "success");
+            }
             return reply.redirect(options.postLoginRedirect);
         }
         catch (err) {
             request.log.error({ err }, "flytedesk-id callback failed");
-            return reply
-                .code(502)
-                .send({ error: "Sign-in with flytedesk-id failed", code: "idp_exchange_failed" });
+            return fail(502, "idp_exchange_failed", "Sign-in with flytedesk-id failed");
         }
     });
+    /** The one answer POST {routePrefix}/refresh gives a refresh token it will not
+     *  rotate. `clearCookie` only for a token that is genuinely dead (unrecognized,
+     *  expired, or reused — its whole family just ended); NOT for one that merely lost a
+     *  concurrent-tab race (AK-14, gap 3; MP-127): the winner is setting the browser's
+     *  fresh cookie at the same moment, and a clearing Set-Cookie on the loser's response
+     *  can land after it and delete the fresh token. */
+    function rejectRefresh(reply, { clearCookie }) {
+        if (clearCookie)
+            reply.clearCookie(refreshCookieName, { path: cookiePath });
+        return reply.code(401).send({ error: "Refresh token expired or revoked", code: "unauthenticated" });
+    }
     /**
      * POST {routePrefix}/refresh — no body, reads the refresh cookie. Rotates it on every
-     * successful call. A hash match on a row that's already revoked means this exact
-     * token was replayed (its legitimate rotation already consumed it) — that's treated
-     * as a security event: the whole family is revoked, not just this row, since every
-     * token downstream of the replayed one must be assumed compromised too.
+     * successful call.
+     *
+     * A presented token can be rejected two different ways (AK-14, gap 3; MP-127; RFC
+     * 9700 §4.14.2), and telling them apart is the whole point of this route:
      *
-     * The claim (store.claimRefreshTokenForRotation) happens BEFORE the expiry check and
-     * is what actually detects reuse — not a `stored.revokedAt` read, which would leave a
-     * window between two concurrent requests both observing "not yet revoked" before
-     * either write lands. See that method's doc comment in ./types.ts.
+     *  - It was ALREADY revoked before this request even started
+     *    (`stored.revokedAt`, from `findRefreshTokenByHash`'s own read, is non-null) — a
+     *    LATE event, from this request's point of view. If it was rotated
+     *    (`stored.rotated`) and that rotation happened less than `refreshReuseGraceMs`
+     *    ago, it's still plausibly a concurrent-tab race whose loser's request simply
+     *    took a while to arrive: 401, nothing revoked. Otherwise (never rotated at all, or
+     *    outside the window) it's reuse: the whole family is revoked, since every token
+     *    downstream of the replayed one must be assumed compromised too.
+     *  - It looked live at that same read (`revokedAt: null`), but a SIBLING request
+     *    claims it first (`store.claimRefreshTokenForRotation` returns `false`) — a
+     *    genuine, same-instant concurrent-tab race, decided purely by that method's
+     *    atomicity. Treated as a race unconditionally: no rotated/timing check needed
+     *    (there's nothing to check yet — the winner's rotation is still in flight), 401,
+     *    nothing revoked. This mirrors media-planner's own shape exactly
+     *    (`updateMany({revokedAt: null}); if (count !== 1) return false`).
+     *
+     * The claim happens BEFORE the expiry check and is what actually detects that second
+     * kind of loss — not a re-read of `revokedAt`, which would leave the exact window this
+     * method exists to close: two concurrent requests both observing "not yet revoked"
+     * before either write lands. See `AuthStore.claimRefreshTokenForRotation`'s doc
+     * comment in ./types.ts.
      */
     fastify.post(authRoutePath(routePrefix, "refresh"), async (request, reply) => {
         const token = request.cookies[refreshCookieName];
@@ -345,25 +449,36 @@ const flytedeskAuthPlugin = async (fastify, options) => {
             reply.clearCookie(refreshCookieName, { path: cookiePath });
             return reply.code(401).send({ error: "Refresh token not recognized", code: "unauthenticated" });
         }
-        const claimed = await store.claimRefreshTokenForRotation(stored.id);
-        if (!claimed) {
-            // Already revoked by the time this call's UPDATE ran — either a genuine prior
-            // revocation or a concurrent /refresh call that won the race. Both are reuse.
-            request.log.warn({ familyId: stored.familyId, userId: stored.userId }, "@flytedesk/app-kit/auth: refresh token reuse detected — revoking token family");
+        if (stored.revokedAt) {
+            const sinceRevokedMs = Date.now() - stored.revokedAt.getTime();
+            if (stored.rotated && sinceRevokedMs < refreshReuseGraceMs) {
+                return rejectRefresh(reply, { clearCookie: false });
+            }
+            request.log.warn({
+                familyId: stored.familyId,
+                userId: stored.userId,
+                rotated: stored.rotated,
+                sinceRevokedMs,
+            }, "@flytedesk/app-kit/auth: refresh token reuse detected — revoking token family");
             await store.revokeFamily(stored.familyId);
             reply.clearCookie(refreshCookieName, { path: cookiePath });
             return reply.code(401).send({ error: "Refresh token reuse detected", code: "token_reuse_detected" });
         }
         if (stored.expiresAt < new Date()) {
-            // Claimed (now revoked, so it can never be presented again) but past its TTL —
-            // an expired token, not a reuse event.
             reply.clearCookie(refreshCookieName, { path: cookiePath });
             return reply.code(401).send({ error: "Refresh token expired", code: "unauthenticated" });
         }
+        const claimed = await store.claimRefreshTokenForRotation(stored.id);
+        if (!claimed) {
+            // A sibling request claimed it first, in the tiny window since the read above —
+            // a same-instant concurrent-tab race, not reuse (see the route's doc comment).
+            return rejectRefresh(reply, { clearCookie: false });
+        }
         // Rotate: the claim above already revoked the used token; issue a fresh one in the
         // same family — limits replay if a cookie leaks, and idpSessionId carries forward
         // unchanged so this session's link to its flytedesk-id token pair survives the
-        // rotation.
+        // rotation. `replacesId` records the rotation so a later reuse-vs-race decision on
+        // THIS token (`stored.id`) can find it.
         const next = generateRefreshToken();
         const expiresAt = new Date(Date.now() + refreshTokenTtlSeconds * 1000);
         await store.createRefreshToken({
@@ -375,6 +490,7 @@ const flytedeskAuthPlugin = async (fastify, options) => {
             idpSessionId: stored.idpSessionId,
             userAgent: request.headers["user-agent"] ?? null,
             ip: request.ip,
+            replacesId: stored.id,
         });
         const { token: accessToken, expiresAt: accessExpiresAt } = await signAccessToken(options.accessTokenSecret, accessTokenTtlSeconds, stored.userId, stored.idpSessionId);
         reply.setCookie(refreshCookieName, next.token, refreshCookieOptions(refreshTokenTtlSeconds));

package/dist/auth/plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/auth/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChC,OAAO,aAA8C,MAAM,iBAAiB,CAAC;AAE7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAAyB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAYzG,MAAM,gCAAgC,GAAG,GAAG,CAAC;AAC7C,MAAM,iCAAiC,GAAG,SAAS,CAAC;AACpD,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAE9C,MAAM,uBAAuB,GAAG;IAC9B,UAAU;IACV,cAAc;IACd,QAAQ;IACR,aAAa;IACb,OAAO;IACP,mBAAmB;IACnB,mBAAmB;CACyC,CAAC;AAE/D,SAAS,qBAAqB,CAAC,OAA6B;IAC1D,KAAK,MAAM,GAAG,IAAI,uBAAuB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,qDAAqD,GAAG,GAAG,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,IACE,OAAO,CAAC,YAAY,IAAI,IAAI;QAC5B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,EAC7G,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,MAAM,mBAAmB,GAA6C,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;IAC/F,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAE/B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,iBAAiB,CAAC;IAC7D,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,gCAAgC,CAAC;IAChG,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,iCAAiC,CAAC;IACnG,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,iCAAiC,CAAC;IACnG,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAE5B,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,uBAAuB,EAAE,OAAO,CAAC,uBAAuB,EAAE,EAC5D,uFAAuF;YACrF,uFAAuF;YACvF,8EAA8E,CACjF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,gBAAgB,CAAC;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;KACjC,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAExE,OAAO,CAAC,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAE/C,oFAAoF;IACpF,qFAAqF;IACrF,qFAAqF;IACrF,iEAAiE;IACjE,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,MAAM,iBAAiB,GAAG,aAAa,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC;IAC7E,MAAM,eAAe,GAAG,aAAa,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACvF,kFAAkF;IAClF,kFAAkF;IAClF,oFAAoF;IACpF,mFAAmF;IACnF,sFAAsF;IACtF,kFAAkF;IAClF,mFAAmF;IACnF,mFAAmF;IACnF,gFAAgF;IAChF,sEAAsE;IACtE,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;IAE3E,SAAS,oBAAoB,CAAC,aAAqB;QACjD,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,OAAO,CAAC,aAAa;YAC7B,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,aAAa;SACtB,CAAC;IACJ,CAAC;IAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA0D,CAAC;IAE7F,MAAM,cAAc,GAAG,KAAK,CAAC;IAE7B;;;;;;;;;;;OAWG;IACH,KAAK,UAAU,qBAAqB,CAAC,OAAsB;QACzD,IAAI,OAAO,CAAC,uBAAuB,CAAC,OAAO,EAAE,GAAG,cAAc,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7E,OAAO,OAAO,CAAC,cAAc,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YAC7B,MAAM,IAAI,qBAAqB,CAAC,0DAA0D,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACvE,MAAM,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE;gBACvC,cAAc,EAAE,SAAS,CAAC,YAAY;gBACtC,uBAAuB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC;gBAC3E,eAAe,EAAE,SAAS,CAAC,aAAa,IAAI,OAAO,CAAC,eAAe;aACpE,CAAC,CAAC;YACH,OAAO,SAAS,CAAC,YAAY,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,UAAU,cAAc,CAC3B,OAAuB,EACvB,MAAoC;QAEpC,IAAI,OAA6B,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,iCAAiC,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACpF,iEAAiE,CAClE,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC,CAAC,qDAAqD;QAEvH,IAAI,cAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACpC,UAAU,YAAY,qBAAqB;gBACzC,CAAC,CAAC,2FAA2F;gBAC7F,CAAC,CAAC,kFAAkF,CACvF,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,aAA2C,CAAC;QAChD,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClD,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;gBAAE,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACpC,UAAU,YAAY,qBAAqB;oBACzC,CAAC,CAAC,4EAA4E;oBAC9E,CAAC,CAAC,yFAAyF,CAC9F,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;gBACpC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;oBACjC,KAAK,EAAE,aAAa;oBACpB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,uBAAuB;iBACxD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,+EAA+E;QAC/E,2DAA2D;QAC3D,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC;QACnC,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,OAAO;YACnB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,KAAK,EAAE,aAAa,CAAC,KAAK;YAC1B,WAAW,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACvG,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,mFAAmF;IACnF,yBAAyB;IACzB,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACnD,IAAI,IAAI;gBAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,gFAAgF;QAClF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,YAAY,CACzB,OAAuB,EACvB,KAAmB,EACnB,MAAc,EACd,YAAoB,EACpB,QAAgB;QAEhB,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,oBAAoB,EAAE,CAAC;QAC7D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,GAAG,IAAI,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC7B,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ;YACR,MAAM;YACN,SAAS,EAAE,IAAI;YACf,SAAS;YACT,YAAY;YACZ,SAAS,EAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAwB,IAAI,IAAI;YACxE,EAAE,EAAE,OAAO,CAAC,EAAE;SACf,CAAC,CAAC;QAEH,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,eAAe,CAC9E,OAAO,CAAC,iBAAiB,EACzB,qBAAqB,EACrB,MAAM,EACN,YAAY,CACb,CAAC;QACF,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,YAAY,EAAE,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC/F,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;IAC9E,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACxE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,YAAY,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAE5B,KAAK,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE;YACpE,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,OAAO,CAAC,aAAa;YAC7B,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH;;;;;;OAMG;IACH,OAAO,CAAC,GAAG,CACT,aAAa,CAAC,WAAW,EAAE,UAAU,CAAC,EACtC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC7C,KAAK,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAEzD,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,KAAK;iBACT,IAAI,CAAC,GAAG,CAAC;iBACT,IAAI,CAAC,EAAE,KAAK,EAAE,gCAAgC,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,kDAAkD;gBACzD,IAAI,EAAE,kBAAkB;aACzB,CAAC,CAAC;QACL,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,0CAA0C;gBACjD,IAAI,EAAE,sBAAsB;aAC7B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,KAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAwC,CAAC;QAC5E,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QAChG,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC1B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAClF,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YACtE,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC9D,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChC,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC1B,KAAK,EAAE,iDAAiD;oBACxD,IAAI,EAAE,kBAAkB;iBACzB,CAAC,CAAC;YACL,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC3B,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;oBAC1B,KAAK,EAAE,4CAA4C;oBACnD,IAAI,EAAE,oBAAoB;iBAC3B,CAAC,CAAC;YACL,CAAC;YAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;YAC1D,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC;gBAC9C,OAAO,EAAE,OAAO,CAAC,GAAG;gBACpB,IAAI;gBACJ,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,cAAc,EAAE,MAAM,CAAC,YAAY;gBACnC,uBAAuB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;gBACxE,eAAe,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;aAC9C,CAAC,CAAC;YAEH,6EAA6E;YAC7E,gFAAgF;YAChF,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC9B,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAEzE,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,8BAA8B,CAAC,CAAC;YAC3D,OAAO,KAAK;iBACT,IAAI,CAAC,GAAG,CAAC;iBACT,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACtF,CAAC;IACH,CAAC,CACF,CAAC;IAEF;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAClG,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,8EAA8E;YAC9E,8EAA8E;YAC9E,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EACpD,+EAA+E,CAChF,CAAC;YACF,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1C,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAClC,+EAA+E;YAC/E,uCAAuC;YACvC,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,mFAAmF;QACnF,kFAAkF;QAClF,+EAA+E;QAC/E,YAAY;QACZ,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,GAAG,IAAI,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC7B,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,SAAS;YACT,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAwB,IAAI,IAAI;YACxE,EAAE,EAAE,OAAO,CAAC,EAAE;SACf,CAAC,CAAC;QAEH,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,eAAe,CAC9E,OAAO,CAAC,iBAAiB,EACzB,qBAAqB,EACrB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,YAAY,CACpB,CAAC;QACF,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,EAAE,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC7F,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,oBAAoB,EAAE,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH;;;;;;;;;;OAUG;IACH,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7F,CAAC;QAED,IAAI,OAA6B,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,iCAAiC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,EAC1G,uEAAuE,CACxE,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,IAAI,cAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,EAC1C,UAAU,YAAY,qBAAqB;gBACzC,CAAC,CAAC,gFAAgF;gBAClF,CAAC,CAAC,qFAAqF,CAC1F,CAAC;YACF,IAAI,UAAU,YAAY,qBAAqB,EAAE,CAAC;gBAChD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC9G,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACjG,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;YACpD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,EAC1C,sEAAsE,CACvE,CAAC;YACF,IAAI,UAAU,YAAY,qBAAqB,EAAE,CAAC;gBAChD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC9G,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;;;;;;;OASG;IACH,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACrE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1E,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,MAAM,EAAE,CAAC;gBACX,2EAA2E;gBAC3E,wEAAwE;gBACxE,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC1C,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACnE,IAAI,UAAU,EAAE,eAAe,EAAE,CAAC;oBAChC,8EAA8E;oBAC9E,iEAAiE;oBACjE,wDAAwD;oBACxD,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;gBACxD,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACpD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,8EAA8E;oBAC9E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,gDAAgD;oBAChD,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,mCAAmC,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EACxG,mHAAmH,CACpH,CAAC;oBACF,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;oBAC3D,OAAO,KAAK;yBACT,IAAI,CAAC,GAAG,CAAC;yBACT,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,mBAAmB,EAAE;IACnD,IAAI,EAAE,yBAAyB;CAChC,CAAC,CAAC"}
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/auth/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChC,OAAO,aAA8C,MAAM,iBAAiB,CAAC;AAE7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAAyB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,aAAa,EACb,0BAA0B,GAE3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAYzG,MAAM,gCAAgC,GAAG,GAAG,CAAC;AAC7C,MAAM,iCAAiC,GAAG,SAAS,CAAC;AACpD,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAE9C,MAAM,uBAAuB,GAAG;IAC9B,UAAU;IACV,cAAc;IACd,QAAQ;IACR,aAAa;IACb,OAAO;IACP,mBAAmB;IACnB,mBAAmB;CACyC,CAAC;AAE/D,SAAS,qBAAqB,CAAC,OAA6B;IAC1D,KAAK,MAAM,GAAG,IAAI,uBAAuB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,qDAAqD,GAAG,GAAG,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,IACE,OAAO,CAAC,YAAY,IAAI,IAAI;QAC5B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,EAC7G,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,MAAM,mBAAmB,GAA6C,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;IAC/F,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAE/B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,iBAAiB,CAAC;IAC7D,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,gCAAgC,CAAC;IAChG,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,iCAAiC,CAAC;IACnG,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,iCAAiC,CAAC;IACnG,oFAAoF;IACpF,qEAAqE;IACrE,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,CAAC,GAAG,wBAAwB,CAAC;IACxF,2EAA2E;IAC3E,uFAAuF;IACvF,qFAAqF;IACrF,+EAA+E;IAC/E,8CAA8C;IAC9C,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC;IACzE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAE5B,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,uBAAuB,EAAE,OAAO,CAAC,uBAAuB,EAAE,EAC5D,uFAAuF;YACrF,uFAAuF;YACvF,8EAA8E,CACjF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,gBAAgB,CAAC;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;KACrD,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAExE,OAAO,CAAC,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAE/C,oFAAoF;IACpF,qFAAqF;IACrF,qFAAqF;IACrF,iEAAiE;IACjE,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,MAAM,iBAAiB,GAAG,aAAa,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC;IAC7E,MAAM,eAAe,GAAG,aAAa,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACvF,kFAAkF;IAClF,kFAAkF;IAClF,oFAAoF;IACpF,mFAAmF;IACnF,sFAAsF;IACtF,kFAAkF;IAClF,mFAAmF;IACnF,mFAAmF;IACnF,gFAAgF;IAChF,sEAAsE;IACtE,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;IAE3E,SAAS,oBAAoB,CAAC,aAAqB;QACjD,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,OAAO,CAAC,aAAa;YAC7B,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,aAAa;SACtB,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,SAAS,gBAAgB,CAAC,KAAmB,EAAE,MAA2B,EAAE,MAAe;QACzF,MAAM,OAAO,GAAsB;YACjC,MAAM,EAAE,0BAA0B;YAClC,MAAM;YACN,MAAM,EAAE,MAAM,IAAI,IAAI;SACvB,CAAC;QACF,OAAO,KAAK;aACT,IAAI,CAAC,WAAW,CAAC;aACjB,IAAI,CACH,qCAAqC;YACnC,kDAAkD;YAClD,6BAA6B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,IAAI;YACnG,GAAG;YACH,yBAAyB,CAC5B,CAAC;IACN,CAAC;IAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA0D,CAAC;IAE7F,MAAM,cAAc,GAAG,KAAK,CAAC;IAE7B;;;;;;;;;;;OAWG;IACH,KAAK,UAAU,qBAAqB,CAAC,OAAsB;QACzD,IAAI,OAAO,CAAC,uBAAuB,CAAC,OAAO,EAAE,GAAG,cAAc,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7E,OAAO,OAAO,CAAC,cAAc,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YAC7B,MAAM,IAAI,qBAAqB,CAAC,0DAA0D,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACvE,MAAM,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE;gBACvC,cAAc,EAAE,SAAS,CAAC,YAAY;gBACtC,uBAAuB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC;gBAC3E,eAAe,EAAE,SAAS,CAAC,aAAa,IAAI,OAAO,CAAC,eAAe;aACpE,CAAC,CAAC;YACH,OAAO,SAAS,CAAC,YAAY,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,UAAU,cAAc,CAC3B,OAAuB,EACvB,MAAoC;QAEpC,IAAI,OAA6B,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,iCAAiC,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACpF,iEAAiE,CAClE,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC,CAAC,qDAAqD;QAEvH,IAAI,cAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACpC,UAAU,YAAY,qBAAqB;gBACzC,CAAC,CAAC,2FAA2F;gBAC7F,CAAC,CAAC,kFAAkF,CACvF,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,aAA2C,CAAC;QAChD,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClD,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;gBAAE,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACpC,UAAU,YAAY,qBAAqB;oBACzC,CAAC,CAAC,4EAA4E;oBAC9E,CAAC,CAAC,yFAAyF,CAC9F,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;gBACpC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;oBACjC,KAAK,EAAE,aAAa;oBACpB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,uBAAuB;iBACxD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,+EAA+E;QAC/E,2DAA2D;QAC3D,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC;QACnC,MAAM,IAAI,GAAe;YACvB,EAAE,EAAE,OAAO,CAAC,OAAO;YACnB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,KAAK,EAAE,aAAa,CAAC,KAAK;YAC1B,WAAW,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACvG,CAAC;QAEF,8EAA8E;QAC9E,uFAAuF;QACvF,uFAAuF;QACvF,iFAAiF;QACjF,4EAA4E;QAC5E,0CAA0C;QAC1C,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,IAAI,UAA6B,CAAC;YAClC,IAAI,CAAC;gBACH,UAAU,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC5D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACxB,mFAAmF,CACpF,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,CAAC,UAAU;gBAAE,OAAO,SAAS,CAAC;YAClC,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iFAAiF;IACjF,mFAAmF;IACnF,yBAAyB;IACzB,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACnD,IAAI,IAAI;gBAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,gFAAgF;QAClF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,YAAY,CACzB,OAAuB,EACvB,KAAmB,EACnB,MAAc,EACd,YAAoB,EACpB,QAAgB;QAEhB,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,oBAAoB,EAAE,CAAC;QAC7D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,GAAG,IAAI,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC7B,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ;YACR,MAAM;YACN,SAAS,EAAE,IAAI;YACf,SAAS;YACT,YAAY;YACZ,SAAS,EAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAwB,IAAI,IAAI;YACxE,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,wEAAwE;YACxE,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QAEH,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,eAAe,CAC9E,OAAO,CAAC,iBAAiB,EACzB,qBAAqB,EACrB,MAAM,EACN,YAAY,CACb,CAAC;QACF,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,YAAY,EAAE,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC/F,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;IAC9E,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,GAAG,CACT,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,EACnC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,YAAY,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,KAAK,MAAM,CAAC;QAEjC,KAAK,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE;YAC5E,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,OAAO,CAAC,aAAa;YAC7B,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9E,CAAC,CACF,CAAC;IAEF;;;;;;OAMG;IACH,OAAO,CAAC,GAAG,CACT,aAAa,CAAC,WAAW,EAAE,UAAU,CAAC,EACtC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC7C,KAAK,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAEzD,6EAA6E;QAC7E,iFAAiF;QACjF,yEAAyE;QACzE,wEAAwE;QACxE,4EAA4E;QAC5E,2EAA2E;QAC3E,IAAI,KAAuE,CAAC;QAC5E,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACrC,IAAI,CAAC;oBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAyD,CAAC;gBAC7F,CAAC;gBAAC,MAAM,CAAC;oBACP,KAAK,GAAG,SAAS,CAAC;gBACpB,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;QAEtC,SAAS,IAAI,CAAC,MAAc,EAAE,IAAY,EAAE,OAAe;YACzD,IAAI,MAAM;gBAAE,OAAO,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,gCAAgC,KAAK,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,GAAG,EAAE,kBAAkB,EAAE,kDAAkD,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,GAAG,EAAE,sBAAsB,EAAE,0CAA0C,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YACtE,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC9D,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAC,GAAG,EAAE,kBAAkB,EAAE,iDAAiD,CAAC,CAAC;YAC1F,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,EAAE,4CAA4C,CAAC,CAAC;YACvF,CAAC;YAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;YAC1D,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC;gBAC9C,OAAO,EAAE,OAAO,CAAC,GAAG;gBACpB,IAAI;gBACJ,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,cAAc,EAAE,MAAM,CAAC,YAAY;gBACnC,uBAAuB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;gBACxE,eAAe,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;aAC9C,CAAC,CAAC;YAEH,6EAA6E;YAC7E,gFAAgF;YAChF,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC9B,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAEzE,IAAI,MAAM,EAAE,CAAC;gBACX,6EAA6E;gBAC7E,0EAA0E;gBAC1E,8EAA8E;gBAC9E,+EAA+E;gBAC/E,4EAA4E;gBAC5E,sDAAsD;gBACtD,OAAO,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,8BAA8B,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC,GAAG,EAAE,qBAAqB,EAAE,kCAAkC,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC,CACF,CAAC;IAEF;;;;;wDAKoD;IACpD,SAAS,aAAa,CAAC,KAAmB,EAAE,EAAE,WAAW,EAA4B;QACnF,IAAI,WAAW;YAAE,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC5E,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACtG,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAClG,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YAC/D,IAAI,MAAM,CAAC,OAAO,IAAI,cAAc,GAAG,mBAAmB,EAAE,CAAC;gBAC3D,OAAO,aAAa,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;YACtD,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,IAAI,CACd;gBACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,cAAc;aACf,EACD,+EAA+E,CAChF,CAAC;YACF,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1C,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAClC,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,gFAAgF;YAChF,+EAA+E;YAC/E,OAAO,aAAa,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,mFAAmF;QACnF,kFAAkF;QAClF,+EAA+E;QAC/E,mFAAmF;QACnF,wCAAwC;QACxC,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,GAAG,IAAI,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC7B,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,SAAS;YACT,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAwB,IAAI,IAAI;YACxE,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,UAAU,EAAE,MAAM,CAAC,EAAE;SACtB,CAAC,CAAC;QAEH,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,eAAe,CAC9E,OAAO,CAAC,iBAAiB,EACzB,qBAAqB,EACrB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,YAAY,CACpB,CAAC;QACF,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,EAAE,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC7F,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,oBAAoB,EAAE,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH;;;;;;;;;;OAUG;IACH,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7F,CAAC;QAED,IAAI,OAA6B,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,iCAAiC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,EAC1G,uEAAuE,CACxE,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,IAAI,cAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,EAC1C,UAAU,YAAY,qBAAqB;gBACzC,CAAC,CAAC,gFAAgF;gBAClF,CAAC,CAAC,qFAAqF,CAC1F,CAAC;YACF,IAAI,UAAU,YAAY,qBAAqB,EAAE,CAAC;gBAChD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC9G,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACjG,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;YACpD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,EAC1C,sEAAsE,CACvE,CAAC;YACF,IAAI,UAAU,YAAY,qBAAqB,EAAE,CAAC;gBAChD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC9G,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;;;;;;;OASG;IACH,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACrE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1E,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,MAAM,EAAE,CAAC;gBACX,2EAA2E;gBAC3E,wEAAwE;gBACxE,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC1C,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACnE,IAAI,UAAU,EAAE,eAAe,EAAE,CAAC;oBAChC,8EAA8E;oBAC9E,iEAAiE;oBACjE,wDAAwD;oBACxD,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;gBACxD,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACpD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,8EAA8E;oBAC9E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,gDAAgD;oBAChD,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,mCAAmC,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EACxG,mHAAmH,CACpH,CAAC;oBACF,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;oBAC3D,OAAO,KAAK;yBACT,IAAI,CAAC,GAAG,CAAC;yBACT,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,mBAAmB,EAAE;IACnD,IAAI,EAAE,yBAAyB;CAChC,CAAC,CAAC"}

package/dist/auth/shared-types.d.ts

@@ -62,6 +62,30 @@ export interface ApiErrorBody {
  * registration option), exactly as it always has been.
  */
 export declare const AUTH_ROUTE_PREFIX = "/auth";
+/**
+ * The one request deadline this module's browser client (`./client/httpClient.ts`'s
+ * `DEFAULT_REQUEST_DEADLINE_MS`) and server plugin (`../plugin.ts`'s default
+ * `refreshReuseGraceMs`) both derive from — AK-14, generalized from media-planner's
+ * `AUTH_REQUEST_DEADLINE_MS` (`@media-planner/shared`). A concurrent-tab race's loser
+ * can arrive up to two deadlines after the winner's rotation (see plugin.ts's
+ * `refreshReuseGraceMs` doc comment for the full reasoning), so the two constants must
+ * never drift apart — this is the one place either can change.
+ */
+export declare const AUTH_REQUEST_DEADLINE_MS = 10000;
+/**
+ * The `postMessage` contract a silent (`prompt=none`) `{routePrefix}/callback` answers
+ * with (`../plugin.ts`'s `sendSilentResult`) and `./client/silentAuth.ts`'s hidden-iframe
+ * listener consumes — AK-14, generalized from media-planner's `silentAuth.ts`. Shared
+ * here (rather than each side typing/stringing it separately) so the source tag can
+ * never drift between the two halves. Never rendered by a top-level navigation: only
+ * ever loaded inside the hidden iframe `attemptSilentResume()` creates.
+ */
+export declare const SILENT_AUTH_MESSAGE_SOURCE = "flytedesk-app-kit-silent-auth";
+export interface SilentAuthMessage {
+    source: typeof SILENT_AUTH_MESSAGE_SOURCE;
+    status: "success" | "error";
+    detail: string | null;
+}
 /** Route segments mounted under `{routePrefix}` by `../plugin.ts`. `me` is deliberately
  *  under the prefix, not a sibling `/me` — see plugin.ts's `GET {routePrefix}/me` doc
  *  comment (AK-18). */

package/dist/auth/shared-types.js

@@ -21,6 +21,25 @@
  * registration option), exactly as it always has been.
  */
 export const AUTH_ROUTE_PREFIX = "/auth";
+/**
+ * The one request deadline this module's browser client (`./client/httpClient.ts`'s
+ * `DEFAULT_REQUEST_DEADLINE_MS`) and server plugin (`../plugin.ts`'s default
+ * `refreshReuseGraceMs`) both derive from — AK-14, generalized from media-planner's
+ * `AUTH_REQUEST_DEADLINE_MS` (`@media-planner/shared`). A concurrent-tab race's loser
+ * can arrive up to two deadlines after the winner's rotation (see plugin.ts's
+ * `refreshReuseGraceMs` doc comment for the full reasoning), so the two constants must
+ * never drift apart — this is the one place either can change.
+ */
+export const AUTH_REQUEST_DEADLINE_MS = 10_000;
+/**
+ * The `postMessage` contract a silent (`prompt=none`) `{routePrefix}/callback` answers
+ * with (`../plugin.ts`'s `sendSilentResult`) and `./client/silentAuth.ts`'s hidden-iframe
+ * listener consumes — AK-14, generalized from media-planner's `silentAuth.ts`. Shared
+ * here (rather than each side typing/stringing it separately) so the source tag can
+ * never drift between the two halves. Never rendered by a top-level navigation: only
+ * ever loaded inside the hidden iframe `attemptSilentResume()` creates.
+ */
+export const SILENT_AUTH_MESSAGE_SOURCE = "flytedesk-app-kit-silent-auth";
 /** Route segments mounted under `{routePrefix}` by `../plugin.ts`. `me` is deliberately
  *  under the prefix, not a sibling `/me` — see plugin.ts's `GET {routePrefix}/me` doc
  *  comment (AK-18). */

package/dist/auth/shared-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"shared-types.js","sourceRoot":"","sources":["../../src/auth/shared-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA+CH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAEzC;;uBAEuB;AACvB,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,EAAE,EAAE,IAAI;IACR,IAAI,EAAE,MAAM;CAC6B,CAAC;AAI5C;;;qBAGqB;AACrB,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,OAAyB;IACrE,OAAO,GAAG,MAAM,IAAI,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;AACrD,CAAC"}
+{"version":3,"file":"shared-types.js","sourceRoot":"","sources":["../../src/auth/shared-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA+CH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAEzC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,+BAA+B,CAAC;AAQ1E;;uBAEuB;AACvB,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,EAAE,EAAE,IAAI;IACR,IAAI,EAAE,MAAM;CAC6B,CAAC;AAI5C;;;qBAGqB;AACrB,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,OAAyB;IACrE,OAAO,GAAG,MAAM,IAAI,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;AACrD,CAAC"}

package/dist/auth/testing/fake-idp.d.ts

@@ -59,6 +59,7 @@ export declare class FakeIdp {
     private idpSessionLive;
     private readonly accessTokenTtlSeconds;
     private forceRefreshFailure;
+    private hangTokenMs;
     private keys;
     private publicJwk;
     private readonly kid;
@@ -76,6 +77,17 @@ export declare class FakeIdp {
      *  re-login on this) without waiting on a real expiry or needing a separate
      *  `/revoke` call. */
     setForceRefreshFailure(force: boolean): void;
+    /**
+     * Delays every subsequent `POST /token` response by `ms` before answering normally —
+     * simulates a hung flytedesk-id (AK-14, gap 5) so a consumer's test can exercise
+     * `OidcClientOptions.tokenRequestTimeoutMs` end to end (the plugin's real
+     * `{routePrefix}/callback`/refresh paths timing out and failing loudly) rather than
+     * only at the `createOidcClient` unit level. The client's own `AbortSignal.timeout`
+     * fires and the request is aborted well before this delay elapses in that scenario —
+     * this fixture tolerates the resulting aborted connection (never throws on a write to
+     * an already-closed response). `0` (the default) disables the delay.
+     */
+    setHangTokenMs(ms: number): void;
     /**
      * Mutates a registered identity's roles/permissions/apps IN PLACE. Every live grant
      * already holds a reference to this identity object (this fixture keeps identities by

package/dist/auth/testing/fake-idp.js

@@ -17,6 +17,10 @@ export class FakeIdp {
     // Test-control: forces every subsequent refresh_token grant to fail — see
     // setForceRefreshFailure's doc comment.
     forceRefreshFailure = false;
+    // Test-control (AK-14, gap 5): delays every subsequent POST /token response by this
+    // many ms before answering normally — see setHangTokenMs's doc comment. 0 (default):
+    // no delay.
+    hangTokenMs = 0;
     keys;
     publicJwk;
     kid = "fake-idp-key";
@@ -52,6 +56,19 @@ export class FakeIdp {
     setForceRefreshFailure(force) {
         this.forceRefreshFailure = force;
     }
+    /**
+     * Delays every subsequent `POST /token` response by `ms` before answering normally —
+     * simulates a hung flytedesk-id (AK-14, gap 5) so a consumer's test can exercise
+     * `OidcClientOptions.tokenRequestTimeoutMs` end to end (the plugin's real
+     * `{routePrefix}/callback`/refresh paths timing out and failing loudly) rather than
+     * only at the `createOidcClient` unit level. The client's own `AbortSignal.timeout`
+     * fires and the request is aborted well before this delay elapses in that scenario —
+     * this fixture tolerates the resulting aborted connection (never throws on a write to
+     * an already-closed response). `0` (the default) disables the delay.
+     */
+    setHangTokenMs(ms) {
+        this.hangTokenMs = ms;
+    }
     /**
      * Mutates a registered identity's roles/permissions/apps IN PLACE. Every live grant
      * already holds a reference to this identity object (this fixture keeps identities by
@@ -81,7 +98,16 @@ export class FakeIdp {
             alg: "RS256",
         };
         this.server = createServer((req, res) => {
+            // A client that aborted mid-request (setHangTokenMs's AbortSignal.timeout
+            // scenario, AK-14) closes the underlying socket out from under `res` — without
+            // this, the eventual write this fixture still attempts (see the delayed /token
+            // branch below) emits an unhandled 'error' on `res`, which Node treats as an
+            // uncaught exception. This fixture legitimately outlives the aborted client, so
+            // that failure mode is expected here, not a bug to surface.
+            res.on("error", () => { });
             this.handle(req, res).catch((err) => {
+                if (res.writableEnded)
+                    return;
                 res.writeHead(500, { "content-type": "application/json" });
                 res.end(JSON.stringify({ error: "fake_idp_error", detail: String(err) }));
             });
@@ -99,6 +125,11 @@ export class FakeIdp {
         this.server = undefined;
     }
     json(res, status, body) {
+        // A client that aborted (AK-14's tokenRequestTimeoutMs scenario — see
+        // setHangTokenMs) has already closed its end; writing here would throw
+        // ERR_STREAM_WRITE_AFTER_END for no test-relevant reason. Silently skip instead.
+        if (res.writableEnded)
+            return;
         res.writeHead(status, { "content-type": "application/json" });
         res.end(JSON.stringify(body));
     }
@@ -181,6 +212,9 @@ export class FakeIdp {
             return void res.end();
         }
         if (req.method === "POST" && path === "/token") {
+            if (this.hangTokenMs > 0) {
+                await new Promise((resolve) => setTimeout(resolve, this.hangTokenMs));
+            }
             const form = await this.readForm(req);
             const grantType = form.get("grant_type");
             if (grantType === "authorization_code") {
@@ -293,6 +327,15 @@ export class FakeIdp {
             this.setIdpSessionLive(live === "true");
             return this.json(res, 200, { live: this.idpSessionLive });
         }
+        // Test-control: cross-process form of setHangTokenMs — see its doc comment.
+        if (req.method === "POST" && path === "/__set-hang-token-ms") {
+            const form = await this.readForm(req);
+            const ms = Number(form.get("ms") ?? "0");
+            if (!Number.isFinite(ms) || ms < 0)
+                return this.json(res, 400, { error: "invalid_ms" });
+            this.setHangTokenMs(ms);
+            return this.json(res, 200, { ms: this.hangTokenMs });
+        }
         // Test-control: cross-process form of setForceRefreshFailure — see its doc comment.
         if (req.method === "POST" && path === "/__set-force-refresh-failure") {
             const form = await this.readForm(req);