@flytedesk/app-kit 1.0.0 → 2.0.0

package/README.md

@@ -25,6 +25,33 @@ own domain work resumes.
 pnpm add @flytedesk/app-kit
 ```
 
+## Auth (`@flytedesk/app-kit/auth`)
+
+`idpRequestTimeoutMs` (`FlytedeskAuthOptions`/`OidcClientOptions`, default 5s) bounds
+**every** call this package makes to flytedesk-id — token, userinfo, the per-app
+authorization check, `/me/apps`, discovery and revocation — not just `/token`. A hung
+flytedesk-id endpoint fails loudly with the typed `IdpTimeoutError` instead of hanging
+the request indefinitely; this matters most for the authorization check, which runs on
+every authenticated request to every consumer of this package. Sign-out still completes
+locally (cookies cleared, refresh-token family revoked) even when the IdP-side
+revocation call itself times out.
+
+**Residual risk in the refresh-token grace window (RFC 9700 §4.14.2).** `POST
+{routePrefix}/refresh` rotates the presented refresh token on every call and treats a
+second presentation of an already-rotated token as a legitimate concurrent-tab race
+(401, nothing revoked) rather than reuse, as long as it arrives within
+`refreshReuseGraceMs` (default 20s) of the rotation. This is deliberate — two browser
+tabs sharing one cookie jar can otherwise trip false-positive reuse detection — but it
+means that within that same window, an attacker who has obtained a copy of a
+not-yet-presented refresh token and wins the race against the legitimate browser is
+**indistinguishable from a same-device two-tab race**: both look like "a token was
+rotated, then its predecessor was presented again shortly after." A presentation
+**outside** the window, or of a token that was never rotated at all, is always treated
+as reuse and revokes the whole family. Consumers who need a tighter bound can lower
+`refreshReuseGraceMs`, trading some tolerance for slow concurrent-tab requests for a
+narrower attack window; it cannot be set to zero without reintroducing the false-positive
+two-tab problem this window exists to solve.
+
 ## Publishing
 
 Published to the public npm registry under the `@flytedesk` org, access `restricted`.

package/dist/auth/index.d.ts

@@ -43,9 +43,9 @@
  *   app.get("/me", { preHandler: requireAuth }, async (request) => request.authUser);
  */
 export { requireAuth, requirePermission } from "./guards.js";
-export type { AuthedUser, AuthStore, CreateIdpSessionInput, CreateRefreshTokenInput, FlytedeskAuthOptions, IdpRole, IdpSessionRow, RefreshTokenRow, UpdateIdpSessionInput, UserinfoClaims, } from "./types.js";
+export type { AuthedUser, AuthStore, CreateIdpSessionInput, CreateRefreshTokenInput, FlytedeskAuthOptions, IdpRole, IdpSessionRow, RefreshTokenRow, RevokeFamilyReason, UpdateIdpSessionInput, UserinfoClaims, } from "./types.js";
 export type { AppSwitcherEntry, IdpAuthorization, IdpTokenResponse, IdTokenClaims, OidcClient, OidcClientOptions, } from "./oidc-client.js";
-export { createOidcClient, DEFAULT_OIDC_SCOPES, DEFAULT_TOKEN_REQUEST_TIMEOUT_MS } from "./oidc-client.js";
+export { createOidcClient, DEFAULT_OIDC_SCOPES, DEFAULT_IDP_REQUEST_TIMEOUT_MS } from "./oidc-client.js";
 export type { ApiErrorBody, SilentAuthMessage } from "./shared-types.js";
 export { AUTH_REQUEST_DEADLINE_MS, AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, authRoutePath, SILENT_AUTH_MESSAGE_SOURCE, type AuthRouteSegment, } from "./shared-types.js";
 export { IdpError, IdpUnavailableError, IdpTimeoutError, IdpAccessRevokedError, AuthStoreError, OidcHttpError, classifyIdpError, } from "./errors.js";

package/dist/auth/index.js

@@ -43,7 +43,7 @@
  *   app.get("/me", { preHandler: requireAuth }, async (request) => request.authUser);
  */
 export { requireAuth, requirePermission } from "./guards.js";
-export { createOidcClient, DEFAULT_OIDC_SCOPES, DEFAULT_TOKEN_REQUEST_TIMEOUT_MS } from "./oidc-client.js";
+export { createOidcClient, DEFAULT_OIDC_SCOPES, DEFAULT_IDP_REQUEST_TIMEOUT_MS } from "./oidc-client.js";
 export { AUTH_REQUEST_DEADLINE_MS, AUTH_ROUTE_PREFIX, AUTH_ROUTE_SEGMENTS, authRoutePath, SILENT_AUTH_MESSAGE_SOURCE, } from "./shared-types.js";
 export { IdpError, IdpUnavailableError, IdpTimeoutError, IdpAccessRevokedError, AuthStoreError, OidcHttpError, classifyIdpError, } from "./errors.js";
 export { generatePkce, randomState } from "./pkce.js";

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAuB7D,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,gCAAgC,EAAE,MAAM,kBAAkB,CAAC;AAG3G,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,0BAA0B,GAE3B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,QAAQ,EACR,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,aAAa,EACb,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,WAAW,EAAiB,MAAM,WAAW,CAAC;AAErE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,GAElB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2CG;AACH,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAwB7D,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,8BAA8B,EAAE,MAAM,kBAAkB,CAAC;AAGzG,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,0BAA0B,GAE3B,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,QAAQ,EACR,mBAAmB,EACnB,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,aAAa,EACb,gBAAgB,GACjB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,YAAY,EAAE,WAAW,EAAiB,MAAM,WAAW,CAAC;AAErE,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,iBAAiB,GAElB,MAAM,aAAa,CAAC"}

package/dist/auth/oidc-client.d.ts

@@ -10,12 +10,12 @@ import type { UserinfoClaims } from "./types.js";
  * narrower grant can override via `FlytedeskAuthOptions.scopes`/`OidcClientOptions.scopes`.
  */
 export declare const DEFAULT_OIDC_SCOPES: readonly ["openid", "email", "profile", "offline_access"];
-/** Sane default for every flytedesk-id `/token` call (AK-14, gap 5) — matches
- *  media-planner's `IDP_TOKEN_TIMEOUT_MS`, which `services/idpSession.ts` there sizes a
- *  DB transaction + advisory lock around specifically so it can never be held open while
- *  a `/token` call is still in flight. Configurable via
- *  `OidcClientOptions.tokenRequestTimeoutMs`. */
-export declare const DEFAULT_TOKEN_REQUEST_TIMEOUT_MS = 5000;
+/** Sane default for EVERY flytedesk-id call this client makes (AK-20, gap 1 —
+ *  generalized from AK-14 gap 5's `/token`-only timeout) — matches media-planner's
+ *  `IDP_TOKEN_TIMEOUT_MS`, which `services/idpSession.ts` there sizes a DB transaction +
+ *  advisory lock around specifically so it can never be held open while a flytedesk-id
+ *  call is still in flight. Configurable via `OidcClientOptions.idpRequestTimeoutMs`. */
+export declare const DEFAULT_IDP_REQUEST_TIMEOUT_MS = 5000;
 export interface OidcClientOptions {
     issuer: string;
     clientId: string;
@@ -24,11 +24,22 @@ export interface OidcClientOptions {
     /** OAuth scopes requested by `buildAuthorizeUrl`. Default `DEFAULT_OIDC_SCOPES`
      *  (includes `offline_access` — see that constant's doc comment). */
     scopes?: string[];
-    /** Bounds every `/token` call (`exchangeCodeForTokens`, `refreshIdpTokens`) via
-     *  `AbortSignal.timeout`. Default `DEFAULT_TOKEN_REQUEST_TIMEOUT_MS`. A hung
-     *  flytedesk-id response rejects with `IdpTimeoutError` instead of hanging the
-     *  caller (and, transitively, whatever lock/transaction it's inside) indefinitely. */
-    tokenRequestTimeoutMs?: number;
+    /**
+     * Bounds EVERY flytedesk-id call this client makes — `/token` (`exchangeCodeForTokens`,
+     * `refreshIdpTokens`), `/me` (`fetchUserinfo`), `/apps/{id}/authorization`
+     * (`fetchAuthorization`), `/me/apps` (`fetchMyApps`), discovery and revocation
+     * (`revokeIdpToken`) — via `AbortSignal.timeout`, through the one bounded-request
+     * helper every one of those methods goes through (AK-20, gap 1; generalized from
+     * AK-14 gap 5, which only bounded `/token`). Default `DEFAULT_IDP_REQUEST_TIMEOUT_MS`.
+     * A hung flytedesk-id response rejects with the typed `IdpTimeoutError` instead of
+     * hanging the caller (and, transitively, whatever lock/transaction/request it's
+     * inside) indefinitely. `fetchAuthorization` runs on every authenticated request
+     * (see `../plugin.ts`'s `loadAuthedUser`), so a hang there previously hung every
+     * signed-in request to every consumer of this package — this option is what closes
+     * that gap. No alias or deprecated name is kept for the old, narrower
+     * `tokenRequestTimeoutMs`.
+     */
+    idpRequestTimeoutMs?: number;
 }
 export interface IdpTokenResponse {
     access_token: string;

package/dist/auth/oidc-client.js

@@ -10,12 +10,12 @@ import { IdpTimeoutError, IdpUnavailableError, OidcHttpError } from "./errors.js
  * narrower grant can override via `FlytedeskAuthOptions.scopes`/`OidcClientOptions.scopes`.
  */
 export const DEFAULT_OIDC_SCOPES = ["openid", "email", "profile", "offline_access"];
-/** Sane default for every flytedesk-id `/token` call (AK-14, gap 5) — matches
- *  media-planner's `IDP_TOKEN_TIMEOUT_MS`, which `services/idpSession.ts` there sizes a
- *  DB transaction + advisory lock around specifically so it can never be held open while
- *  a `/token` call is still in flight. Configurable via
- *  `OidcClientOptions.tokenRequestTimeoutMs`. */
-export const DEFAULT_TOKEN_REQUEST_TIMEOUT_MS = 5_000;
+/** Sane default for EVERY flytedesk-id call this client makes (AK-20, gap 1 —
+ *  generalized from AK-14 gap 5's `/token`-only timeout) — matches media-planner's
+ *  `IDP_TOKEN_TIMEOUT_MS`, which `services/idpSession.ts` there sizes a DB transaction +
+ *  advisory lock around specifically so it can never be held open while a flytedesk-id
+ *  call is still in flight. Configurable via `OidcClientOptions.idpRequestTimeoutMs`. */
+export const DEFAULT_IDP_REQUEST_TIMEOUT_MS = 5_000;
 /**
  * One instance per FlytedeskAuthOptions (i.e. per plugin registration), not a module
  * singleton — keeps the JWKS/discovery caches below scoped to one issuer/client pair
@@ -39,35 +39,42 @@ export function createOidcClient(opts) {
         const clientSecret = encodeURIComponent(opts.clientSecret);
         return "Basic " + Buffer.from(`${clientId}:${clientSecret}`).toString("base64");
     }
-    const tokenRequestTimeoutMs = opts.tokenRequestTimeoutMs ?? DEFAULT_TOKEN_REQUEST_TIMEOUT_MS;
+    const idpRequestTimeoutMs = opts.idpRequestTimeoutMs ?? DEFAULT_IDP_REQUEST_TIMEOUT_MS;
     /**
-     * Bounded by `AbortSignal.timeout` (AK-14, gap 5): unbounded before this, a hung
-     * flytedesk-id `/token` response could hold open whatever the caller wraps this in —
-     * for a consumer following media-planner's model (`services/idpSession.ts`), a
-     * Postgres transaction + advisory lock sized around exactly this bound. A timeout
-     * throws the more specific `IdpTimeoutError`; any other network failure (DNS, refused
-     * connection, ...) is classified as `IdpUnavailableError` rather than propagating an
-     * unclassified error — both are typed, neither is swallowed.
+     * The ONE bounded-request helper every flytedesk-id call in this client goes through
+     * (AK-20, gap 1) — `tokenRequest` below, `fetchUserinfo`, `fetchAuthorization`,
+     * `fetchMyApps`, `getDiscovery` and `revokeIdpToken`'s own POST all call this instead
+     * of `fetch` directly. Bounded by `AbortSignal.timeout`: unbounded before this card, a
+     * hung flytedesk-id response on ANY of these — most importantly `fetchAuthorization`,
+     * which runs on every authenticated request via `../plugin.ts`'s `loadAuthedUser` —
+     * could hold open whatever the caller wraps it in (for a consumer following
+     * media-planner's model, a Postgres transaction + advisory lock). A timeout throws the
+     * more specific `IdpTimeoutError`; any other network failure (DNS, refused connection,
+     * ...) is classified as `IdpUnavailableError` rather than propagating an unclassified
+     * error — both are typed, neither is swallowed. Deliberately does NOT inspect
+     * `res.ok`: a non-2xx response is still a normal, successfully-received `Response`,
+     * and each call site classifies it into its own message/error shape.
      */
-    async function tokenRequest(body) {
-        let res;
+    async function idpFetch(url, init, label) {
         try {
-            res = await fetch(issuerUrl("/token"), {
-                method: "POST",
-                headers: {
-                    "Content-Type": "application/x-www-form-urlencoded",
-                    Authorization: basicAuthHeader(),
-                },
-                body: new URLSearchParams(body).toString(),
-                signal: AbortSignal.timeout(tokenRequestTimeoutMs),
-            });
+            return await fetch(url, { ...init, signal: AbortSignal.timeout(idpRequestTimeoutMs) });
         }
         catch (err) {
             if (err instanceof Error && (err.name === "TimeoutError" || err.name === "AbortError")) {
-                throw new IdpTimeoutError(`flytedesk-id /token did not respond within ${tokenRequestTimeoutMs}ms`, err);
+                throw new IdpTimeoutError(`flytedesk-id ${label} did not respond within ${idpRequestTimeoutMs}ms`, err);
             }
-            throw new IdpUnavailableError(`flytedesk-id /token request failed: ${err instanceof Error ? err.message : String(err)}`, err);
+            throw new IdpUnavailableError(`flytedesk-id ${label} request failed: ${err instanceof Error ? err.message : String(err)}`, err);
         }
+    }
+    async function tokenRequest(body) {
+        const res = await idpFetch(issuerUrl("/token"), {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/x-www-form-urlencoded",
+                Authorization: basicAuthHeader(),
+            },
+            body: new URLSearchParams(body).toString(),
+        }, "/token");
         if (!res.ok) {
             const text = await res.text().catch(() => "");
             throw new OidcHttpError(`flytedesk-id /token returned ${res.status}: ${text}`, res.status);
@@ -81,7 +88,7 @@ export function createOidcClient(opts) {
     }
     let discoveryCache;
     function getDiscovery() {
-        discoveryCache ??= fetch(issuerUrl("/.well-known/openid-configuration")).then((res) => {
+        discoveryCache ??= idpFetch(issuerUrl("/.well-known/openid-configuration"), {}, "discovery").then((res) => {
             if (!res.ok)
                 throw new Error(`flytedesk-id discovery returned ${res.status}`);
             return res.json();
@@ -144,9 +151,7 @@ export function createOidcClient(opts) {
         /** `GET {issuer}/me` — the profile claims (email/name/email_verified) the id_token
          *  deliberately doesn't carry for the Authorization Code flow. */
         async fetchUserinfo(idpAccessToken) {
-            const res = await fetch(issuerUrl("/me"), {
-                headers: { Authorization: `Bearer ${idpAccessToken}` },
-            });
+            const res = await idpFetch(issuerUrl("/me"), { headers: { Authorization: `Bearer ${idpAccessToken}` } }, "/me");
             if (!res.ok) {
                 throw new OidcHttpError(`flytedesk-id userinfo (/me) returned ${res.status}`, res.status);
             }
@@ -166,9 +171,7 @@ export function createOidcClient(opts) {
          *  by calling this live rather than memoizing the result — see FlytedeskAuthOptions
          *  authorizationCacheTtlMs's doc comment for the one sanctioned exception. */
         async fetchAuthorization(idpAccessToken, appId) {
-            const res = await fetch(issuerUrl(`/apps/${appId}/authorization`), {
-                headers: { Authorization: `Bearer ${idpAccessToken}` },
-            });
+            const res = await idpFetch(issuerUrl(`/apps/${appId}/authorization`), { headers: { Authorization: `Bearer ${idpAccessToken}` } }, "authorization endpoint");
             if (!res.ok) {
                 throw new OidcHttpError(`flytedesk-id authorization endpoint returned ${res.status}`, res.status);
             }
@@ -176,9 +179,7 @@ export function createOidcClient(opts) {
         },
         /** `GET {issuer}/me/apps` — see fetchMyApps's doc comment on OidcClient above. */
         async fetchMyApps(idpAccessToken) {
-            const res = await fetch(issuerUrl("/me/apps"), {
-                headers: { Authorization: `Bearer ${idpAccessToken}` },
-            });
+            const res = await idpFetch(issuerUrl("/me/apps"), { headers: { Authorization: `Bearer ${idpAccessToken}` } }, "/me/apps");
             if (!res.ok) {
                 throw new OidcHttpError(`flytedesk-id /me/apps returned ${res.status}`, res.status);
             }
@@ -194,17 +195,21 @@ export function createOidcClient(opts) {
                 const discovery = await getDiscovery();
                 if (!discovery.revocation_endpoint)
                     return false;
-                const res = await fetch(discovery.revocation_endpoint, {
+                const res = await idpFetch(discovery.revocation_endpoint, {
                     method: "POST",
                     headers: {
                         "Content-Type": "application/x-www-form-urlencoded",
                         Authorization: basicAuthHeader(),
                     },
                     body: new URLSearchParams({ token }).toString(),
-                });
+                }, "revocation");
                 return res.ok;
             }
             catch {
+                // Best-effort by design (see this method's doc comment above) — a timed-out or
+                // otherwise-failed revocation (AK-20, gap 1) must never block local logout, so
+                // an IdpTimeoutError/IdpUnavailableError from idpFetch is swallowed here exactly
+                // like any other failure, not treated specially.
                 return false;
             }
         },

package/dist/auth/oidc-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-client.js","sourceRoot":"","sources":["../../src/auth/oidc-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAwB,MAAM,MAAM,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAIlF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,CAAU,CAAC;AAE7F;;;;iDAIiD;AACjD,MAAM,CAAC,MAAM,gCAAgC,GAAG,KAAK,CAAC;AA+DtD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAuB;IACtD,SAAS,SAAS,CAAC,IAAY;QAC7B,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,eAAe;QACtB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,YAAY,GAAG,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3D,OAAO,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,qBAAqB,GAAG,IAAI,CAAC,qBAAqB,IAAI,gCAAgC,CAAC;IAE7F;;;;;;;;OAQG;IACH,KAAK,UAAU,YAAY,CAAC,IAA4B;QACtD,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE;gBACrC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,mCAAmC;oBACnD,aAAa,EAAE,eAAe,EAAE;iBACjC;gBACD,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;gBAC1C,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,qBAAqB,CAAC;aACnD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC;gBACvF,MAAM,IAAI,eAAe,CACvB,8CAA8C,qBAAqB,IAAI,EACvE,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,mBAAmB,CAC3B,uCAAuC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EACzF,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,aAAa,CAAC,gCAAgC,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;IAChD,CAAC;IAED,IAAI,IAAiC,CAAC;IACtC,SAAS,OAAO;QACd,IAAI,KAAK,kBAAkB,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,cAAsD,CAAC;IAC3D,SAAS,YAAY;QACnB,cAAc,KAAK,KAAK,CAAC,SAAS,CAAC,mCAAmC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACpF,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9E,OAAO,GAAG,CAAC,IAAI,EAAgC,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE7D,OAAO;QACL,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE;YAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACxC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;YAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;YACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrC,IAAI,MAAM;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACnD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC;QAED,4FAA4F;QAC5F,qBAAqB,CAAC,IAAI,EAAE,QAAQ;YAClC,OAAO,YAAY,CAAC;gBAClB,UAAU,EAAE,oBAAoB;gBAChC,IAAI;gBACJ,YAAY,EAAE,IAAI,CAAC,WAAW;gBAC9B,aAAa,EAAE,QAAQ;gBACvB,SAAS,EAAE,IAAI,CAAC,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;QAED;qCAC6B;QAC7B,gBAAgB,CAAC,YAAY;YAC3B,OAAO,YAAY,CAAC;gBAClB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,YAAY;gBAC3B,SAAS,EAAE,IAAI,CAAC,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;QAED;;;;;;;;WAQG;QACH,KAAK,CAAC,aAAa,CAAC,OAAO;YACzB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;gBACtD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YACH,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAC9B,CAAC;QAED;0EACkE;QAClE,KAAK,CAAC,aAAa,CAAC,cAAc;YAChC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE;gBACxC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,cAAc,EAAE,EAAE;aACvD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,aAAa,CAAC,wCAAwC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5F,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC3D,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACnE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;YACtF,CAAC;YACD,OAAO;gBACL,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,aAAa,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI;gBAC3C,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;aAC5D,CAAC;QACJ,CAAC;QAED;;;sFAG8E;QAC9E,KAAK,CAAC,kBAAkB,CAAC,cAAc,EAAE,KAAK;YAC5C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,SAAS,KAAK,gBAAgB,CAAC,EAAE;gBACjE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,cAAc,EAAE,EAAE;aACvD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,aAAa,CAAC,gDAAgD,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACpG,CAAC;YACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;QAChD,CAAC;QAED,kFAAkF;QAClF,KAAK,CAAC,WAAW,CAAC,cAAc;YAC9B,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE;gBAC7C,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,cAAc,EAAE,EAAE;aACvD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,aAAa,CAAC,kCAAkC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiC,CAAC;YAChE,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QAED;;;8FAGsF;QACtF,KAAK,CAAC,cAAc,CAAC,KAAK;YACxB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,YAAY,EAAE,CAAC;gBACvC,IAAI,CAAC,SAAS,CAAC,mBAAmB;oBAAE,OAAO,KAAK,CAAC;gBACjD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,mBAAmB,EAAE;oBACrD,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,cAAc,EAAE,mCAAmC;wBACnD,aAAa,EAAE,eAAe,EAAE;qBACjC;oBACD,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;iBAChD,CAAC,CAAC;gBACH,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"oidc-client.js","sourceRoot":"","sources":["../../src/auth/oidc-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAwB,MAAM,MAAM,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAIlF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,CAAU,CAAC;AAE7F;;;;yFAIyF;AACzF,MAAM,CAAC,MAAM,8BAA8B,GAAG,KAAK,CAAC;AA0EpD;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAuB;IACtD,SAAS,SAAS,CAAC,IAAY;QAC7B,OAAO,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAED;;;;;;;OAOG;IACH,SAAS,eAAe;QACtB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,YAAY,GAAG,kBAAkB,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3D,OAAO,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAClF,CAAC;IAED,MAAM,mBAAmB,GAAG,IAAI,CAAC,mBAAmB,IAAI,8BAA8B,CAAC;IAEvF;;;;;;;;;;;;;;OAcG;IACH,KAAK,UAAU,QAAQ,CAAC,GAAW,EAAE,IAAiB,EAAE,KAAa;QACnE,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,KAAK,cAAc,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC;gBACvF,MAAM,IAAI,eAAe,CACvB,gBAAgB,KAAK,2BAA2B,mBAAmB,IAAI,EACvE,GAAG,CACJ,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,mBAAmB,CAC3B,gBAAgB,KAAK,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC3F,GAAG,CACJ,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,UAAU,YAAY,CAAC,IAA4B;QACtD,MAAM,GAAG,GAAG,MAAM,QAAQ,CACxB,SAAS,CAAC,QAAQ,CAAC,EACnB;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,aAAa,EAAE,eAAe,EAAE;aACjC;YACD,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE;SAC3C,EACD,QAAQ,CACT,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,MAAM,IAAI,aAAa,CAAC,gCAAgC,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;IAChD,CAAC;IAED,IAAI,IAAiC,CAAC;IACtC,SAAS,OAAO;QACd,IAAI,KAAK,kBAAkB,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACzD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,cAAsD,CAAC;IAC3D,SAAS,YAAY;QACnB,cAAc,KAAK,QAAQ,CAAC,SAAS,CAAC,mCAAmC,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YACxG,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAC9E,OAAO,GAAG,CAAC,IAAI,EAAgC,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,mBAAmB,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAE7D,OAAO;QACL,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE;YAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;YACxC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;YACvD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;YAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;YAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;YACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrC,IAAI,MAAM;gBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YACnD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;QACxB,CAAC;QAED,4FAA4F;QAC5F,qBAAqB,CAAC,IAAI,EAAE,QAAQ;YAClC,OAAO,YAAY,CAAC;gBAClB,UAAU,EAAE,oBAAoB;gBAChC,IAAI;gBACJ,YAAY,EAAE,IAAI,CAAC,WAAW;gBAC9B,aAAa,EAAE,QAAQ;gBACvB,SAAS,EAAE,IAAI,CAAC,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;QAED;qCAC6B;QAC7B,gBAAgB,CAAC,YAAY;YAC3B,OAAO,YAAY,CAAC;gBAClB,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,YAAY;gBAC3B,SAAS,EAAE,IAAI,CAAC,QAAQ;aACzB,CAAC,CAAC;QACL,CAAC;QAED;;;;;;;;WAQG;QACH,KAAK,CAAC,aAAa,CAAC,OAAO;YACzB,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE;gBACtD,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB,CAAC,CAAC;YACH,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;YAC7E,CAAC;YACD,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QAC9B,CAAC;QAED;0EACkE;QAClE,KAAK,CAAC,aAAa,CAAC,cAAc;YAChC,MAAM,GAAG,GAAG,MAAM,QAAQ,CACxB,SAAS,CAAC,KAAK,CAAC,EAChB,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,cAAc,EAAE,EAAE,EAAE,EAC1D,KAAK,CACN,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,aAAa,CAAC,wCAAwC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YAC5F,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;YAC3D,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;gBACnE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;YACtF,CAAC;YACD,OAAO;gBACL,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,aAAa,EAAE,IAAI,CAAC,cAAc,KAAK,IAAI;gBAC3C,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;aAC5D,CAAC;QACJ,CAAC;QAED;;;sFAG8E;QAC9E,KAAK,CAAC,kBAAkB,CAAC,cAAc,EAAE,KAAK;YAC5C,MAAM,GAAG,GAAG,MAAM,QAAQ,CACxB,SAAS,CAAC,SAAS,KAAK,gBAAgB,CAAC,EACzC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,cAAc,EAAE,EAAE,EAAE,EAC1D,wBAAwB,CACzB,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,aAAa,CAAC,gDAAgD,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACpG,CAAC;YACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqB,CAAC;QAChD,CAAC;QAED,kFAAkF;QAClF,KAAK,CAAC,WAAW,CAAC,cAAc;YAC9B,MAAM,GAAG,GAAG,MAAM,QAAQ,CACxB,SAAS,CAAC,UAAU,CAAC,EACrB,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,cAAc,EAAE,EAAE,EAAE,EAC1D,UAAU,CACX,CAAC;YACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACZ,MAAM,IAAI,aAAa,CAAC,kCAAkC,GAAG,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;YACtF,CAAC;YACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiC,CAAC;YAChE,OAAO,IAAI,CAAC,IAAI,CAAC;QACnB,CAAC;QAED;;;8FAGsF;QACtF,KAAK,CAAC,cAAc,CAAC,KAAK;YACxB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,YAAY,EAAE,CAAC;gBACvC,IAAI,CAAC,SAAS,CAAC,mBAAmB;oBAAE,OAAO,KAAK,CAAC;gBACjD,MAAM,GAAG,GAAG,MAAM,QAAQ,CACxB,SAAS,CAAC,mBAAmB,EAC7B;oBACE,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,cAAc,EAAE,mCAAmC;wBACnD,aAAa,EAAE,eAAe,EAAE;qBACjC;oBACD,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,QAAQ,EAAE;iBAChD,EACD,YAAY,CACb,CAAC;gBACF,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,CAAC;YAAC,MAAM,CAAC;gBACP,+EAA+E;gBAC/E,+EAA+E;gBAC/E,iFAAiF;gBACjF,iDAAiD;gBACjD,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/plugin.js

@@ -63,7 +63,7 @@ const flytedeskAuthPlugin = async (fastify, options) => {
         clientSecret: options.clientSecret,
         redirectUri: options.redirectUri,
         scopes: options.scopes,
-        tokenRequestTimeoutMs: options.tokenRequestTimeoutMs,
+        idpRequestTimeoutMs: options.idpRequestTimeoutMs,
     });
     await fastify.register(fastifyCookie, { secret: options.cookieSecret });
     fastify.decorateRequest("authUser", undefined);
@@ -122,68 +122,86 @@ const flytedeskAuthPlugin = async (fastify, options) => {
      * it's not near expiry, otherwise a freshly refreshed one (persisted back via
      * store.updateIdpSession before returning, since flytedesk-id rotates the refresh
      * token on every use — see ./oidc-client.ts's refreshIdpTokens doc comment). Shared
-     * by loadAuthedUser (below) and the GET {routePrefix}/apps route, so the refresh
-     * behaviour — and its failure classification — can't drift between the two call
-     * sites. Throws IdpAccessRevokedError (nothing left to refresh with, or flytedesk-id
+     * by authorizeIdpSession (below, and therefore by both loadAuthedUser and POST
+     * {routePrefix}/refresh) and the GET {routePrefix}/apps route, so the refresh
+     * behaviour — and its failure classification — can't drift between call sites.
+     * Throws IdpAccessRevokedError (nothing left to refresh with, or flytedesk-id
      * rejected the refresh token) or IdpUnavailableError (an outage) — never swallows;
      * every caller is expected to log what it decides to do with the failure (fail
      * loudly, AK-16).
+     *
+     * AK-20, gap 2326: the actual refresh happens under `store.withIdpSessionLock`, and
+     * RE-READS the session once the lock is held — flytedesk-id rotates its own refresh
+     * token on every use, so two concurrent requests on the same near-expiry session
+     * would otherwise both read "stale" before either write landed, both present the
+     * SAME (about-to-be-consumed) refresh token to flytedesk-id, and the loser would get
+     * an otherwise perfectly good session signed out. The re-read lets a lock loser
+     * notice a sibling already refreshed while it waited and reuse that result instead of
+     * refreshing again.
      */
     async function getLiveIdpAccessToken(session) {
         if (session.idpAccessTokenExpiresAt.getTime() - EXPIRY_SKEW_MS >= Date.now()) {
             return session.idpAccessToken;
         }
-        if (!session.idpRefreshToken) {
-            throw new IdpAccessRevokedError("No IdP refresh token on this session — re-login required");
-        }
         try {
-            const refreshed = await oidc.refreshIdpTokens(session.idpRefreshToken);
-            await store.updateIdpSession(session.id, {
-                idpAccessToken: refreshed.access_token,
-                idpAccessTokenExpiresAt: new Date(Date.now() + refreshed.expires_in * 1000),
-                idpRefreshToken: refreshed.refresh_token ?? session.idpRefreshToken,
+            return await store.withIdpSessionLock(session.id, async () => {
+                const fresh = await store.findIdpSession(session.id);
+                if (!fresh) {
+                    throw new IdpAccessRevokedError("IdP session no longer exists — re-login required");
+                }
+                if (fresh.idpAccessTokenExpiresAt.getTime() - EXPIRY_SKEW_MS >= Date.now()) {
+                    // A sibling request already refreshed this session while this one waited for
+                    // the lock — reuse its result rather than refreshing (and rotating) again.
+                    return fresh.idpAccessToken;
+                }
+                if (!fresh.idpRefreshToken) {
+                    throw new IdpAccessRevokedError("No IdP refresh token on this session — re-login required");
+                }
+                const refreshed = await oidc.refreshIdpTokens(fresh.idpRefreshToken);
+                await store.updateIdpSession(fresh.id, {
+                    idpAccessToken: refreshed.access_token,
+                    idpAccessTokenExpiresAt: new Date(Date.now() + refreshed.expires_in * 1000),
+                    idpRefreshToken: refreshed.refresh_token ?? fresh.idpRefreshToken,
+                });
+                return refreshed.access_token;
             });
-            return refreshed.access_token;
         }
         catch (err) {
             throw classifyIdpError(err);
         }
     }
     /**
-     * Live per-request by default: resolves `request.authUser` from the access token's
-     * `sid` by looking up the IdpSession, refreshing the IdP token pair if it's near
-     * expiry, then calling flytedesk-id's authorization endpoint fresh — see
-     * FlytedeskAuthOptions.authorizationCacheTtlMs for the one opt-in exception. Never
-     * throws: any failure just means no AuthedUser gets attached — requireAuth 401s from
-     * there. Every failure that is NOT a routine "no session"/"nothing to refresh with"
-     * outcome is still logged with context (fail loudly, AK-16), distinguishing a
-     * flytedesk-id outage from a genuinely revoked session from an AuthStore failure.
+     * The authorization pipeline shared by loadAuthedUser (below, run on every
+     * authenticated request from an access token's already-verified claims) and POST
+     * {routePrefix}/refresh (AK-20, gap 2) — refreshes the IdP token pair if it's near
+     * expiry, then calls flytedesk-id's authorization endpoint fresh (see
+     * FlytedeskAuthOptions.authorizationCacheTtlMs for the one opt-in exception), builds
+     * the AuthedUser, then runs the onAuthorizeUser hook if configured. Extracted into one
+     * function specifically so `/refresh` can never drift from what an ordinary
+     * authenticated request would decide: a refresh must not mint a fresh access token for
+     * a user this SAME pipeline would reject (e.g. a suspended user) — otherwise that user
+     * could keep refreshing (rotating their family, extending its lifetime) indefinitely
+     * even though every resource request the minted token is then used for still 401s.
+     * Never throws: any failure just means no AuthedUser — the caller decides what that
+     * means for its own route. Every failure that is NOT a routine "nothing to refresh
+     * with" outcome is still logged with context (fail loudly, AK-16), distinguishing a
+     * flytedesk-id outage from a genuinely revoked session.
      */
-    async function loadAuthedUser(request, claims) {
-        let session;
-        try {
-            session = await store.findIdpSession(claims.sid);
-        }
-        catch (err) {
-            request.log.error({ err: new AuthStoreError("AuthStore.findIdpSession failed", err), sid: claims.sid }, "@flytedesk/app-kit/auth: AuthStore error looking up IdP session");
-            return undefined;
-        }
-        if (!session || session.subject !== claims.sub)
-            return undefined; // no session for this claim — expected, not an error
+    async function authorizeIdpSession(request, session) {
         let idpAccessToken;
         try {
             idpAccessToken = await getLiveIdpAccessToken(session);
         }
         catch (err) {
             const classified = classifyIdpError(err);
-            request.log.error({ err: classified, sid: claims.sid }, classified instanceof IdpAccessRevokedError
+            request.log.error({ err: classified, sid: session.id }, classified instanceof IdpAccessRevokedError
                 ? "@flytedesk/app-kit/auth: flytedesk-id refresh token revoked or expired — forcing re-login"
                 : "@flytedesk/app-kit/auth: flytedesk-id token refresh failed — possible IdP outage");
             return undefined;
         }
         let authorization;
         if (options.authorizationCacheTtlMs) {
-            const cached = authorizationCache.get(claims.sid);
+            const cached = authorizationCache.get(session.id);
             if (cached && cached.expiresAt > Date.now())
                 authorization = cached.value;
         }
@@ -193,13 +211,13 @@ const flytedeskAuthPlugin = async (fastify, options) => {
             }
             catch (err) {
                 const classified = classifyIdpError(err);
-                request.log.error({ err: classified, sid: claims.sid }, classified instanceof IdpAccessRevokedError
+                request.log.error({ err: classified, sid: session.id }, classified instanceof IdpAccessRevokedError
                     ? "@flytedesk/app-kit/auth: flytedesk-id revoked this session's authorization"
                     : "@flytedesk/app-kit/auth: flytedesk-id authorization lookup failed — possible IdP outage");
                 return undefined;
             }
             if (options.authorizationCacheTtlMs) {
-                authorizationCache.set(claims.sid, {
+                authorizationCache.set(session.id, {
                     value: authorization,
                     expiresAt: Date.now() + options.authorizationCacheTtlMs,
                 });
@@ -229,7 +247,7 @@ const flytedeskAuthPlugin = async (fastify, options) => {
                 authorized = await options.onAuthorizeUser(user, request);
             }
             catch (err) {
-                request.log.error({ err, sid: claims.sid }, "@flytedesk/app-kit/auth: onAuthorizeUser threw — treating the session as rejected");
+                request.log.error({ err, sid: session.id }, "@flytedesk/app-kit/auth: onAuthorizeUser threw — treating the session as rejected");
                 return undefined;
             }
             if (!authorized)
@@ -238,6 +256,25 @@ const flytedeskAuthPlugin = async (fastify, options) => {
         }
         return user;
     }
+    /**
+     * Live per-request by default: resolves `request.authUser` from the access token's
+     * `sid` by looking up the IdpSession, then running it through authorizeIdpSession
+     * above. Never throws: any failure just means no AuthedUser gets attached —
+     * requireAuth 401s from there.
+     */
+    async function loadAuthedUser(request, claims) {
+        let session;
+        try {
+            session = await store.findIdpSession(claims.sid);
+        }
+        catch (err) {
+            request.log.error({ err: new AuthStoreError("AuthStore.findIdpSession failed", err), sid: claims.sid }, "@flytedesk/app-kit/auth: AuthStore error looking up IdP session");
+            return undefined;
+        }
+        if (!session || session.subject !== claims.sub)
+            return undefined; // no session for this claim — expected, not an error
+        return authorizeIdpSession(request, session);
+    }
     // onRequest, not preHandler: this needs to run before any route-level preHandler
     // (requireAuth/requirePermission included) so request.authUser is already resolved
     // by the time those run.
@@ -291,8 +328,23 @@ const flytedeskAuthPlugin = async (fastify, options) => {
      * route is identical to an interactive sign-in; only the stashed `silent` flag (which
      * routes the callback's response — see GET {routePrefix}/callback below) and the
      * `prompt` passed to buildAuthorizeUrl differ.
+     *
+     * `prompt` is schema-validated to the literal `"none"` (AK-20, gap 4) — the only
+     * value this route's silent-resume handling actually understands; anything else (a
+     * typo, or some other OIDC prompt semantics this plugin never implements) is rejected
+     * with a 400 by Fastify's own schema validation rather than being passed straight
+     * through to flytedesk-id's `/auth` endpoint unexamined.
      */
-    fastify.get(authRoutePath(routePrefix, "login"), async (request, reply) => {
+    fastify.get(authRoutePath(routePrefix, "login"), {
+        schema: {
+            querystring: {
+                type: "object",
+                properties: {
+                    prompt: { type: "string", enum: ["none"] },
+                },
+            },
+        },
+    }, async (request, reply) => {
         const { verifier, challenge } = generatePkce();
         const state = randomState();
         const prompt = request.query.prompt;
@@ -460,7 +512,13 @@ const flytedeskAuthPlugin = async (fastify, options) => {
                 rotated: stored.rotated,
                 sinceRevokedMs,
             }, "@flytedesk/app-kit/auth: refresh token reuse detected — revoking token family");
-            await store.revokeFamily(stored.familyId);
+            await store.revokeFamily(stored.familyId, {
+                type: "reuse_detected",
+                replayedToken: stored,
+                sinceRotatedMs: sinceRevokedMs,
+                ip: request.ip,
+                userAgent: request.headers["user-agent"] ?? null,
+            });
             reply.clearCookie(refreshCookieName, { path: cookiePath });
             return reply.code(401).send({ error: "Refresh token reuse detected", code: "token_reuse_detected" });
         }
@@ -468,6 +526,41 @@ const flytedeskAuthPlugin = async (fastify, options) => {
             reply.clearCookie(refreshCookieName, { path: cookiePath });
             return reply.code(401).send({ error: "Refresh token expired", code: "unauthenticated" });
         }
+        // AK-20, gap 2: run the SAME authorization pipeline loadAuthedUser runs on every
+        // other authenticated request — including onAuthorizeUser — before minting a fresh
+        // access token. Without this, a user the app suspended (via onAuthorizeUser) could
+        // keep refreshing forever: their resource requests with the minted token would
+        // still 401, but nothing ever ended the session, so their family kept rotating and
+        // its lifetime kept extending indefinitely. A rejection here revokes the whole
+        // family, exactly like a detected reuse — the point of rotating at all is defeated
+        // if a rejected user's family just keeps living. Deliberately BEFORE the atomic
+        // claim below (not after): this call can be slow (a real network round trip to
+        // flytedesk-id), and running it between the claim and the mint would widen the
+        // window in which a genuinely concurrent sibling request's read of this same row
+        // could land — the atomic claim and the mint that follows it must stay adjacent,
+        // exactly as they were before this card, or the plugin's own concurrent-tab-race
+        // handling (gap 3) becomes measurably flakier under load, not just under test.
+        let idpSession;
+        try {
+            idpSession = await store.findIdpSession(stored.idpSessionId);
+        }
+        catch (err) {
+            request.log.error({ err: new AuthStoreError("AuthStore.findIdpSession failed", err), idpSessionId: stored.idpSessionId }, "@flytedesk/app-kit/auth: /refresh AuthStore error looking up IdP session");
+            return reply.code(502).send({ error: "Could not load the signed-in session", code: "auth_store_failed" });
+        }
+        if (!idpSession) {
+            request.log.warn({ familyId: stored.familyId, idpSessionId: stored.idpSessionId }, "@flytedesk/app-kit/auth: /refresh — no IdP session left for this refresh token — revoking family");
+            await store.revokeFamily(stored.familyId, { type: "authorization_rejected" });
+            reply.clearCookie(refreshCookieName, { path: cookiePath });
+            return reply.code(401).send({ error: "Session not found", code: "unauthenticated" });
+        }
+        const authorized = await authorizeIdpSession(request, idpSession);
+        if (!authorized) {
+            request.log.warn({ familyId: stored.familyId, userId: stored.userId }, "@flytedesk/app-kit/auth: /refresh rejected by the authorization check — revoking token family");
+            await store.revokeFamily(stored.familyId, { type: "authorization_rejected" });
+            reply.clearCookie(refreshCookieName, { path: cookiePath });
+            return reply.code(401).send({ error: "Authorization rejected", code: "unauthenticated" });
+        }
         const claimed = await store.claimRefreshTokenForRotation(stored.id);
         if (!claimed) {
             // A sibling request claimed it first, in the tiny window since the read above —
@@ -581,7 +674,7 @@ const flytedeskAuthPlugin = async (fastify, options) => {
             if (stored) {
                 // Revoke the local family FIRST and unconditionally — that's what actually
                 // keeps a signed-out browser locked out, independent of anything below.
-                await store.revokeFamily(stored.familyId);
+                await store.revokeFamily(stored.familyId, { type: "signed_out" });
                 const idpSession = await store.findIdpSession(stored.idpSessionId);
                 if (idpSession?.idpRefreshToken) {
                     // revokeIdpToken's own contract (see oidc-client.ts) is never to throw — this

package/dist/auth/plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/auth/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChC,OAAO,aAA8C,MAAM,iBAAiB,CAAC;AAE7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAAyB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,aAAa,EACb,0BAA0B,GAE3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAYzG,MAAM,gCAAgC,GAAG,GAAG,CAAC;AAC7C,MAAM,iCAAiC,GAAG,SAAS,CAAC;AACpD,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAE9C,MAAM,uBAAuB,GAAG;IAC9B,UAAU;IACV,cAAc;IACd,QAAQ;IACR,aAAa;IACb,OAAO;IACP,mBAAmB;IACnB,mBAAmB;CACyC,CAAC;AAE/D,SAAS,qBAAqB,CAAC,OAA6B;IAC1D,KAAK,MAAM,GAAG,IAAI,uBAAuB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,qDAAqD,GAAG,GAAG,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,IACE,OAAO,CAAC,YAAY,IAAI,IAAI;QAC5B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,EAC7G,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,MAAM,mBAAmB,GAA6C,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;IAC/F,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAE/B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,iBAAiB,CAAC;IAC7D,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,gCAAgC,CAAC;IAChG,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,iCAAiC,CAAC;IACnG,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,iCAAiC,CAAC;IACnG,oFAAoF;IACpF,qEAAqE;IACrE,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,CAAC,GAAG,wBAAwB,CAAC;IACxF,2EAA2E;IAC3E,uFAAuF;IACvF,qFAAqF;IACrF,+EAA+E;IAC/E,8CAA8C;IAC9C,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC;IACzE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAE5B,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,uBAAuB,EAAE,OAAO,CAAC,uBAAuB,EAAE,EAC5D,uFAAuF;YACrF,uFAAuF;YACvF,8EAA8E,CACjF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,gBAAgB,CAAC;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;KACrD,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAExE,OAAO,CAAC,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAE/C,oFAAoF;IACpF,qFAAqF;IACrF,qFAAqF;IACrF,iEAAiE;IACjE,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,MAAM,iBAAiB,GAAG,aAAa,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC;IAC7E,MAAM,eAAe,GAAG,aAAa,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACvF,kFAAkF;IAClF,kFAAkF;IAClF,oFAAoF;IACpF,mFAAmF;IACnF,sFAAsF;IACtF,kFAAkF;IAClF,mFAAmF;IACnF,mFAAmF;IACnF,gFAAgF;IAChF,sEAAsE;IACtE,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;IAE3E,SAAS,oBAAoB,CAAC,aAAqB;QACjD,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,OAAO,CAAC,aAAa;YAC7B,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,aAAa;SACtB,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,SAAS,gBAAgB,CAAC,KAAmB,EAAE,MAA2B,EAAE,MAAe;QACzF,MAAM,OAAO,GAAsB;YACjC,MAAM,EAAE,0BAA0B;YAClC,MAAM;YACN,MAAM,EAAE,MAAM,IAAI,IAAI;SACvB,CAAC;QACF,OAAO,KAAK;aACT,IAAI,CAAC,WAAW,CAAC;aACjB,IAAI,CACH,qCAAqC;YACnC,kDAAkD;YAClD,6BAA6B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,IAAI;YACnG,GAAG;YACH,yBAAyB,CAC5B,CAAC;IACN,CAAC;IAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA0D,CAAC;IAE7F,MAAM,cAAc,GAAG,KAAK,CAAC;IAE7B;;;;;;;;;;;OAWG;IACH,KAAK,UAAU,qBAAqB,CAAC,OAAsB;QACzD,IAAI,OAAO,CAAC,uBAAuB,CAAC,OAAO,EAAE,GAAG,cAAc,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7E,OAAO,OAAO,CAAC,cAAc,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YAC7B,MAAM,IAAI,qBAAqB,CAAC,0DAA0D,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACvE,MAAM,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE;gBACvC,cAAc,EAAE,SAAS,CAAC,YAAY;gBACtC,uBAAuB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC;gBAC3E,eAAe,EAAE,SAAS,CAAC,aAAa,IAAI,OAAO,CAAC,eAAe;aACpE,CAAC,CAAC;YACH,OAAO,SAAS,CAAC,YAAY,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,UAAU,cAAc,CAC3B,OAAuB,EACvB,MAAoC;QAEpC,IAAI,OAA6B,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,iCAAiC,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACpF,iEAAiE,CAClE,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC,CAAC,qDAAqD;QAEvH,IAAI,cAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACpC,UAAU,YAAY,qBAAqB;gBACzC,CAAC,CAAC,2FAA2F;gBAC7F,CAAC,CAAC,kFAAkF,CACvF,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,aAA2C,CAAC;QAChD,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClD,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;gBAAE,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACpC,UAAU,YAAY,qBAAqB;oBACzC,CAAC,CAAC,4EAA4E;oBAC9E,CAAC,CAAC,yFAAyF,CAC9F,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;gBACpC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;oBACjC,KAAK,EAAE,aAAa;oBACpB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,uBAAuB;iBACxD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,+EAA+E;QAC/E,2DAA2D;QAC3D,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC;QACnC,MAAM,IAAI,GAAe;YACvB,EAAE,EAAE,OAAO,CAAC,OAAO;YACnB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,KAAK,EAAE,aAAa,CAAC,KAAK;YAC1B,WAAW,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACvG,CAAC;QAEF,8EAA8E;QAC9E,uFAAuF;QACvF,uFAAuF;QACvF,iFAAiF;QACjF,4EAA4E;QAC5E,0CAA0C;QAC1C,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,IAAI,UAA6B,CAAC;YAClC,IAAI,CAAC;gBACH,UAAU,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC5D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACxB,mFAAmF,CACpF,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,CAAC,UAAU;gBAAE,OAAO,SAAS,CAAC;YAClC,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iFAAiF;IACjF,mFAAmF;IACnF,yBAAyB;IACzB,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACnD,IAAI,IAAI;gBAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,gFAAgF;QAClF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,YAAY,CACzB,OAAuB,EACvB,KAAmB,EACnB,MAAc,EACd,YAAoB,EACpB,QAAgB;QAEhB,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,oBAAoB,EAAE,CAAC;QAC7D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,GAAG,IAAI,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC7B,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ;YACR,MAAM;YACN,SAAS,EAAE,IAAI;YACf,SAAS;YACT,YAAY;YACZ,SAAS,EAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAwB,IAAI,IAAI;YACxE,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,wEAAwE;YACxE,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QAEH,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,eAAe,CAC9E,OAAO,CAAC,iBAAiB,EACzB,qBAAqB,EACrB,MAAM,EACN,YAAY,CACb,CAAC;QACF,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,YAAY,EAAE,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC/F,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;IAC9E,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,GAAG,CACT,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,EACnC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,YAAY,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,KAAK,MAAM,CAAC;QAEjC,KAAK,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE;YAC5E,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,OAAO,CAAC,aAAa;YAC7B,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9E,CAAC,CACF,CAAC;IAEF;;;;;;OAMG;IACH,OAAO,CAAC,GAAG,CACT,aAAa,CAAC,WAAW,EAAE,UAAU,CAAC,EACtC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC7C,KAAK,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAEzD,6EAA6E;QAC7E,iFAAiF;QACjF,yEAAyE;QACzE,wEAAwE;QACxE,4EAA4E;QAC5E,2EAA2E;QAC3E,IAAI,KAAuE,CAAC;QAC5E,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACrC,IAAI,CAAC;oBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAyD,CAAC;gBAC7F,CAAC;gBAAC,MAAM,CAAC;oBACP,KAAK,GAAG,SAAS,CAAC;gBACpB,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;QAEtC,SAAS,IAAI,CAAC,MAAc,EAAE,IAAY,EAAE,OAAe;YACzD,IAAI,MAAM;gBAAE,OAAO,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,gCAAgC,KAAK,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,GAAG,EAAE,kBAAkB,EAAE,kDAAkD,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,GAAG,EAAE,sBAAsB,EAAE,0CAA0C,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YACtE,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC9D,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAC,GAAG,EAAE,kBAAkB,EAAE,iDAAiD,CAAC,CAAC;YAC1F,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,EAAE,4CAA4C,CAAC,CAAC;YACvF,CAAC;YAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;YAC1D,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC;gBAC9C,OAAO,EAAE,OAAO,CAAC,GAAG;gBACpB,IAAI;gBACJ,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,cAAc,EAAE,MAAM,CAAC,YAAY;gBACnC,uBAAuB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;gBACxE,eAAe,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;aAC9C,CAAC,CAAC;YAEH,6EAA6E;YAC7E,gFAAgF;YAChF,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC9B,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAEzE,IAAI,MAAM,EAAE,CAAC;gBACX,6EAA6E;gBAC7E,0EAA0E;gBAC1E,8EAA8E;gBAC9E,+EAA+E;gBAC/E,4EAA4E;gBAC5E,sDAAsD;gBACtD,OAAO,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,8BAA8B,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC,GAAG,EAAE,qBAAqB,EAAE,kCAAkC,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC,CACF,CAAC;IAEF;;;;;wDAKoD;IACpD,SAAS,aAAa,CAAC,KAAmB,EAAE,EAAE,WAAW,EAA4B;QACnF,IAAI,WAAW;YAAE,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC5E,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACtG,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAClG,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YAC/D,IAAI,MAAM,CAAC,OAAO,IAAI,cAAc,GAAG,mBAAmB,EAAE,CAAC;gBAC3D,OAAO,aAAa,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;YACtD,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,IAAI,CACd;gBACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,cAAc;aACf,EACD,+EAA+E,CAChF,CAAC;YACF,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1C,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAClC,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,gFAAgF;YAChF,+EAA+E;YAC/E,OAAO,aAAa,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,mFAAmF;QACnF,kFAAkF;QAClF,+EAA+E;QAC/E,mFAAmF;QACnF,wCAAwC;QACxC,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,GAAG,IAAI,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC7B,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,SAAS;YACT,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAwB,IAAI,IAAI;YACxE,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,UAAU,EAAE,MAAM,CAAC,EAAE;SACtB,CAAC,CAAC;QAEH,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,eAAe,CAC9E,OAAO,CAAC,iBAAiB,EACzB,qBAAqB,EACrB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,YAAY,CACpB,CAAC;QACF,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,EAAE,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC7F,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,oBAAoB,EAAE,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH;;;;;;;;;;OAUG;IACH,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7F,CAAC;QAED,IAAI,OAA6B,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,iCAAiC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,EAC1G,uEAAuE,CACxE,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,IAAI,cAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,EAC1C,UAAU,YAAY,qBAAqB;gBACzC,CAAC,CAAC,gFAAgF;gBAClF,CAAC,CAAC,qFAAqF,CAC1F,CAAC;YACF,IAAI,UAAU,YAAY,qBAAqB,EAAE,CAAC;gBAChD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC9G,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACjG,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;YACpD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,EAC1C,sEAAsE,CACvE,CAAC;YACF,IAAI,UAAU,YAAY,qBAAqB,EAAE,CAAC;gBAChD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC9G,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;;;;;;;OASG;IACH,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACrE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1E,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,MAAM,EAAE,CAAC;gBACX,2EAA2E;gBAC3E,wEAAwE;gBACxE,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC1C,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACnE,IAAI,UAAU,EAAE,eAAe,EAAE,CAAC;oBAChC,8EAA8E;oBAC9E,iEAAiE;oBACjE,wDAAwD;oBACxD,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;gBACxD,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACpD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,8EAA8E;oBAC9E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,gDAAgD;oBAChD,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,mCAAmC,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EACxG,mHAAmH,CACpH,CAAC;oBACF,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;oBAC3D,OAAO,KAAK;yBACT,IAAI,CAAC,GAAG,CAAC;yBACT,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,mBAAmB,EAAE;IACnD,IAAI,EAAE,yBAAyB;CAChC,CAAC,CAAC"}
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/auth/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChC,OAAO,aAA8C,MAAM,iBAAiB,CAAC;AAE7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAAyB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,aAAa,EACb,0BAA0B,GAE3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAYzG,MAAM,gCAAgC,GAAG,GAAG,CAAC;AAC7C,MAAM,iCAAiC,GAAG,SAAS,CAAC;AACpD,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAE9C,MAAM,uBAAuB,GAAG;IAC9B,UAAU;IACV,cAAc;IACd,QAAQ;IACR,aAAa;IACb,OAAO;IACP,mBAAmB;IACnB,mBAAmB;CACyC,CAAC;AAE/D,SAAS,qBAAqB,CAAC,OAA6B;IAC1D,KAAK,MAAM,GAAG,IAAI,uBAAuB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,qDAAqD,GAAG,GAAG,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,IACE,OAAO,CAAC,YAAY,IAAI,IAAI;QAC5B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,EAC7G,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,MAAM,mBAAmB,GAA6C,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;IAC/F,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAE/B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,iBAAiB,CAAC;IAC7D,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,gCAAgC,CAAC;IAChG,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,iCAAiC,CAAC;IACnG,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,iCAAiC,CAAC;IACnG,oFAAoF;IACpF,qEAAqE;IACrE,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,CAAC,GAAG,wBAAwB,CAAC;IACxF,2EAA2E;IAC3E,uFAAuF;IACvF,qFAAqF;IACrF,+EAA+E;IAC/E,8CAA8C;IAC9C,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC;IACzE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAE5B,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,uBAAuB,EAAE,OAAO,CAAC,uBAAuB,EAAE,EAC5D,uFAAuF;YACrF,uFAAuF;YACvF,8EAA8E,CACjF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,gBAAgB,CAAC;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;KACjD,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAExE,OAAO,CAAC,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAE/C,oFAAoF;IACpF,qFAAqF;IACrF,qFAAqF;IACrF,iEAAiE;IACjE,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,MAAM,iBAAiB,GAAG,aAAa,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC;IAC7E,MAAM,eAAe,GAAG,aAAa,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACvF,kFAAkF;IAClF,kFAAkF;IAClF,oFAAoF;IACpF,mFAAmF;IACnF,sFAAsF;IACtF,kFAAkF;IAClF,mFAAmF;IACnF,mFAAmF;IACnF,gFAAgF;IAChF,sEAAsE;IACtE,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;IAE3E,SAAS,oBAAoB,CAAC,aAAqB;QACjD,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,OAAO,CAAC,aAAa;YAC7B,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,aAAa;SACtB,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,SAAS,gBAAgB,CAAC,KAAmB,EAAE,MAA2B,EAAE,MAAe;QACzF,MAAM,OAAO,GAAsB;YACjC,MAAM,EAAE,0BAA0B;YAClC,MAAM;YACN,MAAM,EAAE,MAAM,IAAI,IAAI;SACvB,CAAC;QACF,OAAO,KAAK;aACT,IAAI,CAAC,WAAW,CAAC;aACjB,IAAI,CACH,qCAAqC;YACnC,kDAAkD;YAClD,6BAA6B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,IAAI;YACnG,GAAG;YACH,yBAAyB,CAC5B,CAAC;IACN,CAAC;IAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA0D,CAAC;IAE7F,MAAM,cAAc,GAAG,KAAK,CAAC;IAE7B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,KAAK,UAAU,qBAAqB,CAAC,OAAsB;QACzD,IAAI,OAAO,CAAC,uBAAuB,CAAC,OAAO,EAAE,GAAG,cAAc,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7E,OAAO,OAAO,CAAC,cAAc,CAAC;QAChC,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;gBAC3D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACrD,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,qBAAqB,CAAC,kDAAkD,CAAC,CAAC;gBACtF,CAAC;gBACD,IAAI,KAAK,CAAC,uBAAuB,CAAC,OAAO,EAAE,GAAG,cAAc,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBAC3E,6EAA6E;oBAC7E,2EAA2E;oBAC3E,OAAO,KAAK,CAAC,cAAc,CAAC;gBAC9B,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;oBAC3B,MAAM,IAAI,qBAAqB,CAAC,0DAA0D,CAAC,CAAC;gBAC9F,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;gBACrE,MAAM,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE;oBACrC,cAAc,EAAE,SAAS,CAAC,YAAY;oBACtC,uBAAuB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC;oBAC3E,eAAe,EAAE,SAAS,CAAC,aAAa,IAAI,KAAK,CAAC,eAAe;iBAClE,CAAC,CAAC;gBACH,OAAO,SAAS,CAAC,YAAY,CAAC;YAChC,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,UAAU,mBAAmB,CAChC,OAAuB,EACvB,OAAsB;QAEtB,IAAI,cAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,EACpC,UAAU,YAAY,qBAAqB;gBACzC,CAAC,CAAC,2FAA2F;gBAC7F,CAAC,CAAC,kFAAkF,CACvF,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,aAA2C,CAAC;QAChD,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAClD,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;gBAAE,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,EACpC,UAAU,YAAY,qBAAqB;oBACzC,CAAC,CAAC,4EAA4E;oBAC9E,CAAC,CAAC,yFAAyF,CAC9F,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;gBACpC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE;oBACjC,KAAK,EAAE,aAAa;oBACpB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,uBAAuB;iBACxD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,+EAA+E;QAC/E,2DAA2D;QAC3D,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC;QACnC,MAAM,IAAI,GAAe;YACvB,EAAE,EAAE,OAAO,CAAC,OAAO;YACnB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,KAAK,EAAE,aAAa,CAAC,KAAK;YAC1B,WAAW,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACvG,CAAC;QAEF,8EAA8E;QAC9E,uFAAuF;QACvF,uFAAuF;QACvF,iFAAiF;QACjF,4EAA4E;QAC5E,0CAA0C;QAC1C,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,IAAI,UAA6B,CAAC;YAClC,IAAI,CAAC;gBACH,UAAU,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC5D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,EACxB,mFAAmF,CACpF,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,CAAC,UAAU;gBAAE,OAAO,SAAS,CAAC;YAClC,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,cAAc,CAC3B,OAAuB,EACvB,MAAoC;QAEpC,IAAI,OAA6B,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,iCAAiC,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACpF,iEAAiE,CAClE,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC,CAAC,qDAAqD;QAEvH,OAAO,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,iFAAiF;IACjF,mFAAmF;IACnF,yBAAyB;IACzB,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACnD,IAAI,IAAI;gBAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,gFAAgF;QAClF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,YAAY,CACzB,OAAuB,EACvB,KAAmB,EACnB,MAAc,EACd,YAAoB,EACpB,QAAgB;QAEhB,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,oBAAoB,EAAE,CAAC;QAC7D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,GAAG,IAAI,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC7B,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ;YACR,MAAM;YACN,SAAS,EAAE,IAAI;YACf,SAAS;YACT,YAAY;YACZ,SAAS,EAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAwB,IAAI,IAAI;YACxE,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,wEAAwE;YACxE,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QAEH,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,eAAe,CAC9E,OAAO,CAAC,iBAAiB,EACzB,qBAAqB,EACrB,MAAM,EACN,YAAY,CACb,CAAC;QACF,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,YAAY,EAAE,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC/F,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;IAC9E,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,CAAC,GAAG,CACT,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,EACnC;QACE,MAAM,EAAE;YACN,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE;iBAC3C;aACF;SACF;KACF,EACD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,YAAY,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,KAAK,MAAM,CAAC;QAEjC,KAAK,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE;YAC5E,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,OAAO,CAAC,aAAa;YAC7B,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9E,CAAC,CACF,CAAC;IAEF;;;;;;OAMG;IACH,OAAO,CAAC,GAAG,CACT,aAAa,CAAC,WAAW,EAAE,UAAU,CAAC,EACtC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC7C,KAAK,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAEzD,6EAA6E;QAC7E,iFAAiF;QACjF,yEAAyE;QACzE,wEAAwE;QACxE,4EAA4E;QAC5E,2EAA2E;QAC3E,IAAI,KAAuE,CAAC;QAC5E,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACrC,IAAI,CAAC;oBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAyD,CAAC;gBAC7F,CAAC;gBAAC,MAAM,CAAC;oBACP,KAAK,GAAG,SAAS,CAAC;gBACpB,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;QAEtC,SAAS,IAAI,CAAC,MAAc,EAAE,IAAY,EAAE,OAAe;YACzD,IAAI,MAAM;gBAAE,OAAO,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,gCAAgC,KAAK,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,GAAG,EAAE,kBAAkB,EAAE,kDAAkD,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,GAAG,EAAE,sBAAsB,EAAE,0CAA0C,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YACtE,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC9D,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAC,GAAG,EAAE,kBAAkB,EAAE,iDAAiD,CAAC,CAAC;YAC1F,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,EAAE,4CAA4C,CAAC,CAAC;YACvF,CAAC;YAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;YAC1D,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC;gBAC9C,OAAO,EAAE,OAAO,CAAC,GAAG;gBACpB,IAAI;gBACJ,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,cAAc,EAAE,MAAM,CAAC,YAAY;gBACnC,uBAAuB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;gBACxE,eAAe,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;aAC9C,CAAC,CAAC;YAEH,6EAA6E;YAC7E,gFAAgF;YAChF,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC9B,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAEzE,IAAI,MAAM,EAAE,CAAC;gBACX,6EAA6E;gBAC7E,0EAA0E;gBAC1E,8EAA8E;gBAC9E,+EAA+E;gBAC/E,4EAA4E;gBAC5E,sDAAsD;gBACtD,OAAO,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,8BAA8B,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC,GAAG,EAAE,qBAAqB,EAAE,kCAAkC,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC,CACF,CAAC;IAEF;;;;;wDAKoD;IACpD,SAAS,aAAa,CAAC,KAAmB,EAAE,EAAE,WAAW,EAA4B;QACnF,IAAI,WAAW;YAAE,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC5E,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACtG,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAClG,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YAC/D,IAAI,MAAM,CAAC,OAAO,IAAI,cAAc,GAAG,mBAAmB,EAAE,CAAC;gBAC3D,OAAO,aAAa,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;YACtD,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,IAAI,CACd;gBACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,cAAc;aACf,EACD,+EAA+E,CAChF,CAAC;YACF,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE;gBACxC,IAAI,EAAE,gBAAgB;gBACtB,aAAa,EAAE,MAAM;gBACrB,cAAc,EAAE,cAAc;gBAC9B,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,SAAS,EAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAwB,IAAI,IAAI;aACzE,CAAC,CAAC;YACH,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAClC,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,iFAAiF;QACjF,mFAAmF;QACnF,mFAAmF;QACnF,+EAA+E;QAC/E,mFAAmF;QACnF,+EAA+E;QAC/E,mFAAmF;QACnF,gFAAgF;QAChF,+EAA+E;QAC/E,+EAA+E;QAC/E,iFAAiF;QACjF,iFAAiF;QACjF,iFAAiF;QACjF,+EAA+E;QAC/E,IAAI,UAAgC,CAAC;QACrC,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,iCAAiC,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EACtG,0EAA0E,CAC3E,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EAChE,kGAAkG,CACnG,CAAC;YACF,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAC9E,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EACpD,+FAA+F,CAChG,CAAC;YACF,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAC9E,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,gFAAgF;YAChF,+EAA+E;YAC/E,OAAO,aAAa,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,mFAAmF;QACnF,kFAAkF;QAClF,+EAA+E;QAC/E,mFAAmF;QACnF,wCAAwC;QACxC,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,GAAG,IAAI,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC7B,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,SAAS;YACT,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAwB,IAAI,IAAI;YACxE,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,UAAU,EAAE,MAAM,CAAC,EAAE;SACtB,CAAC,CAAC;QAEH,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,eAAe,CAC9E,OAAO,CAAC,iBAAiB,EACzB,qBAAqB,EACrB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,YAAY,CACpB,CAAC;QACF,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,EAAE,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC7F,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,oBAAoB,EAAE,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH;;;;;;;;;;OAUG;IACH,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7F,CAAC;QAED,IAAI,OAA6B,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,iCAAiC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,EAC1G,uEAAuE,CACxE,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,IAAI,cAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,EAC1C,UAAU,YAAY,qBAAqB;gBACzC,CAAC,CAAC,gFAAgF;gBAClF,CAAC,CAAC,qFAAqF,CAC1F,CAAC;YACF,IAAI,UAAU,YAAY,qBAAqB,EAAE,CAAC;gBAChD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC9G,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACjG,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;YACpD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,EAC1C,sEAAsE,CACvE,CAAC;YACF,IAAI,UAAU,YAAY,qBAAqB,EAAE,CAAC;gBAChD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC9G,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;;;;;;;OASG;IACH,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACrE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1E,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,MAAM,EAAE,CAAC;gBACX,2EAA2E;gBAC3E,wEAAwE;gBACxE,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;gBAClE,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACnE,IAAI,UAAU,EAAE,eAAe,EAAE,CAAC;oBAChC,8EAA8E;oBAC9E,iEAAiE;oBACjE,wDAAwD;oBACxD,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;gBACxD,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACpD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,8EAA8E;oBAC9E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,gDAAgD;oBAChD,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,mCAAmC,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EACxG,mHAAmH,CACpH,CAAC;oBACF,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;oBAC3D,OAAO,KAAK;yBACT,IAAI,CAAC,GAAG,CAAC;yBACT,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,mBAAmB,EAAE;IACnD,IAAI,EAAE,yBAAyB;CAChC,CAAC,CAAC"}

package/dist/auth/testing/fake-idp.d.ts

@@ -48,6 +48,15 @@ export interface FakeIdpOptions {
      *  minutes, matching real flytedesk-id's default) — lets a consumer's test drive a
      *  real expiry-then-refresh cycle on its own clock instead of waiting on a real one. */
     accessTokenTtlSeconds?: number;
+    /**
+     * Default `false`, matching real flytedesk-id's discovery document (see the `POST
+     * /revoke` route's own doc comment below) — `oidc-client.ts`'s `revokeIdpToken` reads
+     * discovery and no-ops whenever `revocation_endpoint` is absent, exactly as it does
+     * against the real IdP today. Set `true` only for a test that specifically needs to
+     * drive `revokeIdpToken`'s REAL HTTP call end to end (e.g. AK-20's `setHangRevokeMs`
+     * coverage) — a deliberate, narrow opt-in, not this fixture's default behaviour.
+     */
+    advertiseRevocationEndpoint?: boolean;
 }
 export declare class FakeIdp {
     private server?;
@@ -58,8 +67,11 @@ export declare class FakeIdp {
     private nextIdentityKey;
     private idpSessionLive;
     private readonly accessTokenTtlSeconds;
+    private readonly advertiseRevocationEndpoint;
     private forceRefreshFailure;
     private hangTokenMs;
+    private hangAuthorizationMs;
+    private hangRevokeMs;
     private keys;
     private publicJwk;
     private readonly kid;
@@ -88,6 +100,17 @@ export declare class FakeIdp {
      * an already-closed response). `0` (the default) disables the delay.
      */
     setHangTokenMs(ms: number): void;
+    /** Mirrors setHangTokenMs, above, for `GET /apps/:appId/authorization` (AK-20, gap 1)
+     *  — lets a consumer's test exercise `OidcClientOptions.idpRequestTimeoutMs` against
+     *  the ONE call that runs on every authenticated request (`fetchAuthorization`, via
+     *  `../plugin.ts`'s `loadAuthedUser`/`authorizeIdpSession`), the specific hang this
+     *  option was generalized to close. `0` (the default) disables the delay. */
+    setHangAuthorizationMs(ms: number): void;
+    /** Mirrors setHangTokenMs, above, for `POST /revoke` (AK-20, gap 1) — lets a
+     *  consumer's test exercise `revokeIdpToken`'s "logout still completes locally when
+     *  the IdP revoke times out" guarantee against a REAL hang, not just a mocked
+     *  rejection. `0` (the default) disables the delay. */
+    setHangRevokeMs(ms: number): void;
     /**
      * Mutates a registered identity's roles/permissions/apps IN PLACE. Every live grant
      * already holds a reference to this identity object (this fixture keeps identities by

package/dist/auth/testing/fake-idp.js

@@ -14,6 +14,7 @@ export class FakeIdp {
     // `error=login_required` back to redirect_uri if it's not. Defaults to true.
     idpSessionLive = true;
     accessTokenTtlSeconds;
+    advertiseRevocationEndpoint;
     // Test-control: forces every subsequent refresh_token grant to fail — see
     // setForceRefreshFailure's doc comment.
     forceRefreshFailure = false;
@@ -21,6 +22,13 @@ export class FakeIdp {
     // many ms before answering normally — see setHangTokenMs's doc comment. 0 (default):
     // no delay.
     hangTokenMs = 0;
+    // Test-control (AK-20, gap 1): mirrors hangTokenMs for the two other endpoints
+    // OidcClientOptions.idpRequestTimeoutMs specifically closes a hang gap for —
+    // authorization (fetchAuthorization, run on EVERY authenticated request via
+    // ../plugin.ts's loadAuthedUser/authorizeIdpSession) and revocation (revokeIdpToken,
+    // run on logout). 0 (default): no delay.
+    hangAuthorizationMs = 0;
+    hangRevokeMs = 0;
     keys;
     publicJwk;
     kid = "fake-idp-key";
@@ -31,6 +39,7 @@ export class FakeIdp {
         this.appId = opts.appId ?? opts.clientId;
         this.identities = opts.identities;
         this.accessTokenTtlSeconds = opts.accessTokenTtlSeconds ?? 900;
+        this.advertiseRevocationEndpoint = opts.advertiseRevocationEndpoint ?? false;
         if (!(opts.defaultIdentityKey in this.identities)) {
             throw new Error(`FakeIdp: defaultIdentityKey "${opts.defaultIdentityKey}" is not in identities`);
         }
@@ -69,6 +78,21 @@ export class FakeIdp {
     setHangTokenMs(ms) {
         this.hangTokenMs = ms;
     }
+    /** Mirrors setHangTokenMs, above, for `GET /apps/:appId/authorization` (AK-20, gap 1)
+     *  — lets a consumer's test exercise `OidcClientOptions.idpRequestTimeoutMs` against
+     *  the ONE call that runs on every authenticated request (`fetchAuthorization`, via
+     *  `../plugin.ts`'s `loadAuthedUser`/`authorizeIdpSession`), the specific hang this
+     *  option was generalized to close. `0` (the default) disables the delay. */
+    setHangAuthorizationMs(ms) {
+        this.hangAuthorizationMs = ms;
+    }
+    /** Mirrors setHangTokenMs, above, for `POST /revoke` (AK-20, gap 1) — lets a
+     *  consumer's test exercise `revokeIdpToken`'s "logout still completes locally when
+     *  the IdP revoke times out" guarantee against a REAL hang, not just a mocked
+     *  rejection. `0` (the default) disables the delay. */
+    setHangRevokeMs(ms) {
+        this.hangRevokeMs = ms;
+    }
     /**
      * Mutates a registered identity's roles/permissions/apps IN PLACE. Every live grant
      * already holds a reference to this identity object (this fixture keeps identities by
@@ -170,14 +194,18 @@ export class FakeIdp {
                 token_endpoint: `${this.baseUrl}/token`,
                 jwks_uri: `${this.baseUrl}/jwks`,
                 userinfo_endpoint: `${this.baseUrl}/me`,
-                // No revocation_endpoint (AK-16): real flytedesk-id's oidc-provider config
-                // (src/lib/oidcProvider.ts) never enables `features.revocation`, so its own
-                // discovery document never advertises one either — this fixture must match
-                // that exactly, or a test against it would pass while the real deployment
+                // No revocation_endpoint BY DEFAULT (AK-16): real flytedesk-id's oidc-provider
+                // config (src/lib/oidcProvider.ts) never enables `features.revocation`, so its
+                // own discovery document never advertises one either — this fixture matches
+                // that by default, or a test against it would pass while the real deployment
                 // silently no-ops the same code path (see oidc-client.ts's revokeIdpToken,
                 // which is a deliberate no-op whenever revocation_endpoint is absent). The
-                // POST /revoke route below is a separate, fixed test-control mechanism, not an
-                // OIDC endpoint this fixture ever claims to have.
+                // POST /revoke route below exists either way, as a fixed test-control
+                // mechanism; `advertiseRevocationEndpoint` (AK-20, gap 1) is the deliberate,
+                // narrow opt-in a test takes when it specifically needs revokeIdpToken's REAL
+                // HTTP call (e.g. a hung-revocation timeout test) rather than the real,
+                // production no-op.
+                ...(this.advertiseRevocationEndpoint ? { revocation_endpoint: `${this.baseUrl}/revoke` } : {}),
                 response_types_supported: ["code"],
                 id_token_signing_alg_values_supported: ["RS256"],
                 code_challenge_methods_supported: ["S256"],
@@ -279,6 +307,9 @@ export class FakeIdp {
             });
         }
         if (req.method === "GET" && path === `/apps/${this.appId}/authorization`) {
+            if (this.hangAuthorizationMs > 0) {
+                await new Promise((resolve) => setTimeout(resolve, this.hangAuthorizationMs));
+            }
             const grant = this.tokenGrant(req);
             if (!grant)
                 return this.json(res, 401, { error: "invalid_token" });
@@ -298,6 +329,9 @@ export class FakeIdp {
             return this.json(res, 200, { apps: grant.identity.apps ?? [] });
         }
         if (req.method === "POST" && path === "/revoke") {
+            if (this.hangRevokeMs > 0) {
+                await new Promise((resolve) => setTimeout(resolve, this.hangRevokeMs));
+            }
             const form = await this.readForm(req);
             this.grants.delete(form.get("token") ?? "");
             return this.json(res, 200, {});
@@ -336,6 +370,24 @@ export class FakeIdp {
             this.setHangTokenMs(ms);
             return this.json(res, 200, { ms: this.hangTokenMs });
         }
+        // Test-control: cross-process form of setHangAuthorizationMs — see its doc comment.
+        if (req.method === "POST" && path === "/__set-hang-authorization-ms") {
+            const form = await this.readForm(req);
+            const ms = Number(form.get("ms") ?? "0");
+            if (!Number.isFinite(ms) || ms < 0)
+                return this.json(res, 400, { error: "invalid_ms" });
+            this.setHangAuthorizationMs(ms);
+            return this.json(res, 200, { ms: this.hangAuthorizationMs });
+        }
+        // Test-control: cross-process form of setHangRevokeMs — see its doc comment.
+        if (req.method === "POST" && path === "/__set-hang-revoke-ms") {
+            const form = await this.readForm(req);
+            const ms = Number(form.get("ms") ?? "0");
+            if (!Number.isFinite(ms) || ms < 0)
+                return this.json(res, 400, { error: "invalid_ms" });
+            this.setHangRevokeMs(ms);
+            return this.json(res, 200, { ms: this.hangRevokeMs });
+        }
         // Test-control: cross-process form of setForceRefreshFailure — see its doc comment.
         if (req.method === "POST" && path === "/__set-force-refresh-failure") {
             const form = await this.readForm(req);

package/dist/auth/testing/fake-idp.js.map

@@ -1 +1 @@
-{"version":3,"file":"fake-idp.js","sourceRoot":"","sources":["../../../src/auth/testing/fake-idp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,OAAO,EAAY,MAAM,MAAM,CAAC;AAuDrE,MAAM,OAAO,OAAO;IACV,MAAM,CAAU;IAChB,OAAO,GAAG,EAAE,CAAC;IACJ,QAAQ,CAAS;IACjB,KAAK,CAAS;IACd,UAAU,CAAkC;IACrD,eAAe,CAAS;IAChC,sFAAsF;IACtF,qFAAqF;IACrF,0EAA0E;IAC1E,6EAA6E;IACrE,cAAc,GAAG,IAAI,CAAC;IACb,qBAAqB,CAAS;IAC/C,0EAA0E;IAC1E,wCAAwC;IAChC,mBAAmB,GAAG,KAAK,CAAC;IACpC,oFAAoF;IACpF,qFAAqF;IACrF,YAAY;IACJ,WAAW,GAAG,CAAC,CAAC;IAChB,IAAI,CAA+C;IACnD,SAAS,CAAO;IACP,GAAG,GAAG,cAAc,CAAC;IACrB,KAAK,GAAG,IAAI,GAAG,EAAgE,CAAC;IAChF,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAExD,YAAY,IAAoB;QAC9B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC;QACzC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC,qBAAqB,IAAI,GAAG,CAAC;QAC/D,IAAI,CAAC,CAAC,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACb,gCAAgC,IAAI,CAAC,kBAAkB,wBAAwB,CAChF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,kBAAkB,CAAC;IACjD,CAAC;IAED,iDAAiD;IACjD,eAAe,CAAC,GAAW;QACzB,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,GAAG,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC;IAC7B,CAAC;IAED,0CAA0C;IAC1C,iBAAiB,CAAC,IAAa;QAC7B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED;;;;;0BAKsB;IACtB,sBAAsB,CAAC,KAAc;QACnC,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC;IACnC,CAAC;IAED;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAU;QACvB,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC;IACxB,CAAC;IAED;;;;;;;OAOG;IACH,cAAc,CAAC,GAAW,EAAE,KAA4C;QACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,GAAG,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,GAAG;QACL,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC;QAClB,IAAI,CAAC,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,SAAS,GAAG;YACf,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,OAAO;SACb,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACtC,0EAA0E;YAC1E,+EAA+E;YAC/E,+EAA+E;YAC/E,6EAA6E;YAC7E,gFAAgF;YAChF,4DAA4D;YAC5D,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAClC,IAAI,GAAG,CAAC,aAAa;oBAAE,OAAO;gBAC9B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5E,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,MAAO,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QACtF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAO,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACxF,IAAI,CAAC,OAAO,GAAG,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,MAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC3F,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;IAC1B,CAAC;IAEO,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;QAC7D,sEAAsE;QACtE,uEAAuE;QACvE,iFAAiF;QACjF,IAAI,GAAG,CAAC,aAAa;YAAE,OAAO;QAC9B,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,GAAoB;QACzC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,GAAG;YAAE,MAAM,CAAC,IAAI,CAAC,CAAW,CAAC,CAAC;QACpD,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,CAAC;IAEO,MAAM,CAAC,GAAoB;QACjC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACpC,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,QAAyB;QACjD,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC;aACnB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aACnD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;aACvB,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;aAC1B,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;aACxB,WAAW,EAAE;aACb,iBAAiB,CAAC,KAAK,CAAC;aACxB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;IAEO,UAAU,CAAC,QAAyB;QAC1C,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAClE,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,GAAoB,EAAE,GAAmB;QAC5D,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;QAExB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,mCAAmC,EAAE,CAAC;YACzE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACzB,MAAM,EAAE,IAAI,CAAC,OAAO;gBACpB,sBAAsB,EAAE,GAAG,IAAI,CAAC,OAAO,OAAO;gBAC9C,cAAc,EAAE,GAAG,IAAI,CAAC,OAAO,QAAQ;gBACvC,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,OAAO;gBAChC,iBAAiB,EAAE,GAAG,IAAI,CAAC,OAAO,KAAK;gBACvC,2EAA2E;gBAC3E,4EAA4E;gBAC5E,2EAA2E;gBAC3E,0EAA0E;gBAC1E,2EAA2E;gBAC3E,2EAA2E;gBAC3E,+EAA+E;gBAC/E,kDAAkD;gBAClD,wBAAwB,EAAE,CAAC,MAAM,CAAC;gBAClC,qCAAqC,EAAE,CAAC,OAAO,CAAC;gBAChD,gCAAgC,EAAE,CAAC,MAAM,CAAC;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,qFAAqF;QACrF,mFAAmF;QACnF,+EAA+E;QAC/E,6DAA6D;QAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAChD,MAAM,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;YACjE,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,CAAC,WAAW;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YAEhF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;YACjC,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;gBAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;gBAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;gBACjD,OAAO,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;YACxB,CAAC;YAED,MAAM,IAAI,GAAG,QAAQ,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAE,EAAE,aAAa,EAAE,CAAC,CAAC;YAC1F,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACnC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACjD,OAAO,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/C,IAAI,IAAI,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACzC,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;gBACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;gBACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACnC,IAAI,CAAC,KAAK;oBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;gBACnE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACxB,0EAA0E;gBAC1E,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAC5E,IAAI,KAAK,CAAC,aAAa,IAAI,SAAS,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;oBAC7D,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;gBAClF,CAAC;gBACD,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACtE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBACzB,YAAY,EAAE,WAAW;oBACzB,QAAQ,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC;oBAChD,aAAa,EAAE,YAAY;oBAC3B,UAAU,EAAE,QAAQ;oBACpB,UAAU,EAAE,IAAI,CAAC,qBAAqB;iBACvC,CAAC,CAAC;YACL,CAAC;YACD,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;gBAClC,gFAAgF;gBAChF,2EAA2E;gBAC3E,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAC;gBAC3F,CAAC;gBACD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;gBAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAClC,IAAI,CAAC,KAAK;oBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;gBACnE,2EAA2E;gBAC3E,8EAA8E;gBAC9E,6EAA6E;gBAC7E,6EAA6E;gBAC7E,uEAAuE;gBACvE,sEAAsE;gBACtE,oCAAoC;gBACpC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACvB,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACtE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBACzB,YAAY,EAAE,WAAW;oBACzB,QAAQ,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC;oBAChD,aAAa,EAAE,YAAY;oBAC3B,UAAU,EAAE,QAAQ;oBACpB,UAAU,EAAE,IAAI,CAAC,qBAAqB;iBACvC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACzB,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG;gBACvB,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;gBAC3B,cAAc,EAAE,IAAI;gBACpB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,gBAAgB,EAAE,CAAC;YACzE,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACzB,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG;gBAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;gBAC3B,0EAA0E;gBAC1E,6EAA6E;gBAC7E,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;aACzE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAChD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACjC,CAAC;QAED,iFAAiF;QACjF,oFAAoF;QACpF,qFAAqF;QACrF,6BAA6B;QAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACtC,CAAC;QAED,iFAAiF;QACjF,+EAA+E;QAC/E,mBAAmB;QACnB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC9B,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBACxC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;YACxC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,4EAA4E;QAC5E,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YACxF,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACvD,CAAC;QAED,oFAAoF;QACpF,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,8BAA8B,EAAE,CAAC;YACrE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;gBAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,CAAC,sBAAsB,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC;YAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,oFAAoF;QACpF,oFAAoF;QACpF,6EAA6E;QAC7E,mFAAmF;QACnF,kBAAkB;QAClB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,KAA4C,CAAC;YACjD,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAA0C,CAAC;YACzF,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjF,CAAC;YACD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACtC,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAEO,UAAU,CAAC,GAAoB;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,CAAC;CACF"}
+{"version":3,"file":"fake-idp.js","sourceRoot":"","sources":["../../../src/auth/testing/fake-idp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA0D,MAAM,WAAW,CAAC;AACjG,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,OAAO,EAAY,MAAM,MAAM,CAAC;AAgErE,MAAM,OAAO,OAAO;IACV,MAAM,CAAU;IAChB,OAAO,GAAG,EAAE,CAAC;IACJ,QAAQ,CAAS;IACjB,KAAK,CAAS;IACd,UAAU,CAAkC;IACrD,eAAe,CAAS;IAChC,sFAAsF;IACtF,qFAAqF;IACrF,0EAA0E;IAC1E,6EAA6E;IACrE,cAAc,GAAG,IAAI,CAAC;IACb,qBAAqB,CAAS;IAC9B,2BAA2B,CAAU;IACtD,0EAA0E;IAC1E,wCAAwC;IAChC,mBAAmB,GAAG,KAAK,CAAC;IACpC,oFAAoF;IACpF,qFAAqF;IACrF,YAAY;IACJ,WAAW,GAAG,CAAC,CAAC;IACxB,+EAA+E;IAC/E,6EAA6E;IAC7E,4EAA4E;IAC5E,qFAAqF;IACrF,yCAAyC;IACjC,mBAAmB,GAAG,CAAC,CAAC;IACxB,YAAY,GAAG,CAAC,CAAC;IACjB,IAAI,CAA+C;IACnD,SAAS,CAAO;IACP,GAAG,GAAG,cAAc,CAAC;IACrB,KAAK,GAAG,IAAI,GAAG,EAAgE,CAAC;IAChF,MAAM,GAAG,IAAI,GAAG,EAAsB,CAAC;IAExD,YAAY,IAAoB;QAC9B,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC9B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC;QACzC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;QAClC,IAAI,CAAC,qBAAqB,GAAG,IAAI,CAAC,qBAAqB,IAAI,GAAG,CAAC;QAC/D,IAAI,CAAC,2BAA2B,GAAG,IAAI,CAAC,2BAA2B,IAAI,KAAK,CAAC;QAC7E,IAAI,CAAC,CAAC,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,KAAK,CACb,gCAAgC,IAAI,CAAC,kBAAkB,wBAAwB,CAChF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC,kBAAkB,CAAC;IACjD,CAAC;IAED,iDAAiD;IACjD,eAAe,CAAC,GAAW;QACzB,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,GAAG,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC;IAC7B,CAAC;IAED,0CAA0C;IAC1C,iBAAiB,CAAC,IAAa;QAC7B,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED;;;;;0BAKsB;IACtB,sBAAsB,CAAC,KAAc;QACnC,IAAI,CAAC,mBAAmB,GAAG,KAAK,CAAC;IACnC,CAAC;IAED;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAU;QACvB,IAAI,CAAC,WAAW,GAAG,EAAE,CAAC;IACxB,CAAC;IAED;;;;iFAI6E;IAC7E,sBAAsB,CAAC,EAAU;QAC/B,IAAI,CAAC,mBAAmB,GAAG,EAAE,CAAC;IAChC,CAAC;IAED;;;2DAGuD;IACvD,eAAe,CAAC,EAAU;QACxB,IAAI,CAAC,YAAY,GAAG,EAAE,CAAC;IACzB,CAAC;IAED;;;;;;;OAOG;IACH,cAAc,CAAC,GAAW,EAAE,KAA4C;QACtE,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,wCAAwC,GAAG,GAAG,CAAC,CAAC;QAClE,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,IAAI,GAAG;QACL,IAAI,CAAC,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC;QAClB,IAAI,CAAC,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,IAAI,CAAC,SAAS,GAAG;YACf,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACzC,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,GAAG,EAAE,KAAK;YACV,GAAG,EAAE,OAAO;SACb,CAAC;QACF,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACtC,0EAA0E;YAC1E,+EAA+E;YAC/E,+EAA+E;YAC/E,6EAA6E;YAC7E,gFAAgF;YAChF,4DAA4D;YAC5D,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC1B,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBAClC,IAAI,GAAG,CAAC,aAAa;oBAAE,OAAO;gBAC9B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5E,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,MAAO,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QACtF,MAAM,IAAI,GAAG,IAAI,CAAC,MAAO,CAAC,OAAO,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QACxF,IAAI,CAAC,OAAO,GAAG,oBAAoB,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,IAAI;QACR,IAAI,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,MAAO,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAC3F,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;IAC1B,CAAC;IAEO,IAAI,CAAC,GAAmB,EAAE,MAAc,EAAE,IAAa;QAC7D,sEAAsE;QACtE,uEAAuE;QACvE,iFAAiF;QACjF,IAAI,GAAG,CAAC,aAAa;YAAE,OAAO;QAC9B,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC9D,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAChC,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,GAAoB;QACzC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,GAAG;YAAE,MAAM,CAAC,IAAI,CAAC,CAAW,CAAC,CAAC;QACpD,OAAO,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IACrE,CAAC;IAEO,MAAM,CAAC,GAAoB;QACjC,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QACpC,OAAO,CAAC,EAAE,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtD,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,QAAyB;QACjD,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC;aACnB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;aACnD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC;aACvB,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC;aAC1B,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;aACxB,WAAW,EAAE;aACb,iBAAiB,CAAC,KAAK,CAAC;aACxB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChC,CAAC;IAEO,UAAU,CAAC,QAAyB;QAC1C,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAClE,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC5C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,MAAM,CAAC,GAAoB,EAAE,GAAmB;QAC5D,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC;QAExB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,mCAAmC,EAAE,CAAC;YACzE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACzB,MAAM,EAAE,IAAI,CAAC,OAAO;gBACpB,sBAAsB,EAAE,GAAG,IAAI,CAAC,OAAO,OAAO;gBAC9C,cAAc,EAAE,GAAG,IAAI,CAAC,OAAO,QAAQ;gBACvC,QAAQ,EAAE,GAAG,IAAI,CAAC,OAAO,OAAO;gBAChC,iBAAiB,EAAE,GAAG,IAAI,CAAC,OAAO,KAAK;gBACvC,+EAA+E;gBAC/E,+EAA+E;gBAC/E,4EAA4E;gBAC5E,6EAA6E;gBAC7E,2EAA2E;gBAC3E,2EAA2E;gBAC3E,sEAAsE;gBACtE,6EAA6E;gBAC7E,8EAA8E;gBAC9E,wEAAwE;gBACxE,oBAAoB;gBACpB,GAAG,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,GAAG,IAAI,CAAC,OAAO,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC9F,wBAAwB,EAAE,CAAC,MAAM,CAAC;gBAClC,qCAAqC,EAAE,CAAC,OAAO,CAAC;gBAChD,gCAAgC,EAAE,CAAC,MAAM,CAAC;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACzD,CAAC;QAED,qFAAqF;QACrF,mFAAmF;QACnF,+EAA+E;QAC/E,6DAA6D;QAC7D,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAChD,MAAM,aAAa,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;YACjE,MAAM,MAAM,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,CAAC,WAAW;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC,CAAC;YAEhF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC;YACjC,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,CAAC;gBAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,gBAAgB,CAAC,CAAC;gBAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;gBACjD,OAAO,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;YACxB,CAAC;YAED,MAAM,IAAI,GAAG,QAAQ,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YAC7D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,eAAe,CAAE,EAAE,aAAa,EAAE,CAAC,CAAC;YAC1F,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACnC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACjD,OAAO,KAAK,GAAG,CAAC,GAAG,EAAE,CAAC;QACxB,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/C,IAAI,IAAI,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACzC,IAAI,SAAS,KAAK,oBAAoB,EAAE,CAAC;gBACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;gBACjD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACnC,IAAI,CAAC,KAAK;oBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;gBACnE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACxB,0EAA0E;gBAC1E,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAC5E,IAAI,KAAK,CAAC,aAAa,IAAI,SAAS,KAAK,KAAK,CAAC,aAAa,EAAE,CAAC;oBAC7D,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;gBAClF,CAAC;gBACD,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACtE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBACzB,YAAY,EAAE,WAAW;oBACzB,QAAQ,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC;oBAChD,aAAa,EAAE,YAAY;oBAC3B,UAAU,EAAE,QAAQ;oBACpB,UAAU,EAAE,IAAI,CAAC,qBAAqB;iBACvC,CAAC,CAAC;YACL,CAAC;YACD,IAAI,SAAS,KAAK,eAAe,EAAE,CAAC;gBAClC,gFAAgF;gBAChF,2EAA2E;gBAC3E,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;oBAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAC;gBAC3F,CAAC;gBACD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC;gBAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAClC,IAAI,CAAC,KAAK;oBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;gBACnE,2EAA2E;gBAC3E,8EAA8E;gBAC9E,6EAA6E;gBAC7E,6EAA6E;gBAC7E,uEAAuE;gBACvE,sEAAsE;gBACtE,oCAAoC;gBACpC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACvB,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACtE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;oBACzB,YAAY,EAAE,WAAW;oBACzB,QAAQ,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC;oBAChD,aAAa,EAAE,YAAY;oBAC3B,UAAU,EAAE,QAAQ;oBACpB,UAAU,EAAE,IAAI,CAAC,qBAAqB;iBACvC,CAAC,CAAC;YACL,CAAC;YACD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACzB,GAAG,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG;gBACvB,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;gBAC3B,cAAc,EAAE,IAAI;gBACpB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI;aAC1B,CAAC,CAAC;QACL,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,gBAAgB,EAAE,CAAC;YACzE,IAAI,IAAI,CAAC,mBAAmB,GAAG,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE;gBACzB,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC,GAAG;gBAC1B,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,KAAK;gBAC3B,0EAA0E;gBAC1E,6EAA6E;gBAC7E,WAAW,EAAE,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;aACzE,CAAC,CAAC;QACL,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,IAAI,KAAK,UAAU,EAAE,CAAC;YAChD,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACnC,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACnE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAChD,IAAI,IAAI,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QACjC,CAAC;QAED,iFAAiF;QACjF,oFAAoF;QACpF,qFAAqF;QACrF,6BAA6B;QAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC;YACjE,CAAC;YACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACtC,CAAC;QAED,iFAAiF;QACjF,+EAA+E;QAC/E,mBAAmB;QACnB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAC9B,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;gBACxC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,CAAC;YACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC;YACxC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,4EAA4E;QAC5E,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,sBAAsB,EAAE,CAAC;YAC7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YACxF,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;YACxB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACvD,CAAC;QAED,oFAAoF;QACpF,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,8BAA8B,EAAE,CAAC;YACrE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YACxF,IAAI,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;YAChC,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QAED,6EAA6E;QAC7E,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,uBAAuB,EAAE,CAAC;YAC9D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;YACxF,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;YACzB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC,CAAC;QACxD,CAAC;QAED,oFAAoF;QACpF,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,8BAA8B,EAAE,CAAC;YACrE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YAChC,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;gBAC1C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC;YAChE,CAAC;YACD,IAAI,CAAC,sBAAsB,CAAC,KAAK,KAAK,MAAM,CAAC,CAAC;YAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,mBAAmB,EAAE,CAAC,CAAC;QAClE,CAAC;QAED,oFAAoF;QACpF,oFAAoF;QACpF,6EAA6E;QAC7E,mFAAmF;QACnF,kBAAkB;QAClB,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,IAAI,KAAK,oBAAoB,EAAE,CAAC;YAC3D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YAClC,IAAI,KAA4C,CAAC;YACjD,IAAI,CAAC;gBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAA0C,CAAC;YACzF,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACjF,CAAC;YACD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACtC,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3D,CAAC;IAEO,UAAU,CAAC,GAAoB;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACzD,CAAC;CACF"}

package/dist/auth/types.d.ts

@@ -124,15 +124,71 @@ export interface AuthStore {
      * before this is ever called) already resolves it — see that field's doc comment.
      */
     claimRefreshTokenForRotation(id: string): Promise<boolean>;
-    /** Reuse-detection path: revoke every row sharing this familyId. */
-    revokeFamily(familyId: string): Promise<void>;
+    /**
+     * Revoke every row sharing this familyId — called for reuse detection, sign-out, and
+     * an authorization rejection on refresh (see `RevokeFamilyReason`, AK-20 gap 2327).
+     * `reason` carries WHY, so a consumer's implementation can write its own audit record
+     * (e.g. media-planner's reuse-detection log) without the plugin knowing anything about
+     * that consumer's audit schema — see `RevokeFamilyReason`'s doc comment for what each
+     * variant carries.
+     */
+    revokeFamily(familyId: string, reason: RevokeFamilyReason): Promise<void>;
     createIdpSession(row: CreateIdpSessionInput): Promise<{
         id: string;
     }>;
     findIdpSession(id: string): Promise<IdpSessionRow | null>;
     updateIdpSession(id: string, patch: UpdateIdpSessionInput): Promise<void>;
     deleteIdpSession(id: string): Promise<void>;
+    /**
+     * Runs `fn` while holding an exclusive, per-session lock (AK-20, gap 2326) — a
+     * Postgres-backed store implements this with an advisory lock scoped to `sessionId`
+     * (e.g. `pg_advisory_xact_lock(hashtext(sessionId))`, taken and released within the
+     * same transaction `fn` runs in), so the lock is held across concurrent requests on
+     * different server instances, not just within one process; an in-memory store (tests,
+     * the hello-world example) can implement it with a simple per-key mutex/queue.
+     *
+     * Fixes a real race in `../plugin.ts`'s `getLiveIdpAccessToken`: flytedesk-id rotates
+     * its own refresh token on every use, so two concurrent requests on the same
+     * near-expiry session could both read "stale" before either write landed, both call
+     * `oidc.refreshIdpTokens` with the SAME (about-to-be-consumed) refresh token, and the
+     * loser's request then presents a refresh token flytedesk-id has already rotated away
+     * — getting that otherwise perfectly legitimate session signed out. Every caller of
+     * `getLiveIdpAccessToken` re-reads the session INSIDE the lock and skips its own
+     * refresh if a sibling request already refreshed it while this one was waiting.
+     */
+    withIdpSessionLock<T>(sessionId: string, fn: () => Promise<T>): Promise<T>;
 }
+/**
+ * Why `AuthStore.revokeFamily` (above) is revoking a family — AK-20, gap 2327. Lets a
+ * consumer's own `AuthStore` implementation write an audit record (e.g.
+ * media-planner's reuse-detection log, which records how long after rotation the reuse
+ * was observed and the requesting IP) without `../plugin.ts` knowing anything about that
+ * consumer's audit schema.
+ */
+export type RevokeFamilyReason = {
+    /** A refresh token already rotated away was presented again — either a genuine
+     *  replay/leak, or a same-cookie-jar tab's request that arrived too late to be
+     *  treated as a race (see `RefreshTokenRow.rotated`'s doc comment and
+     *  `FlytedeskAuthOptions.refreshReuseGraceMs`). */
+    type: "reuse_detected";
+    /** The refresh token row that was replayed, exactly as `findRefreshTokenByHash`
+     *  read it. */
+    replayedToken: RefreshTokenRow;
+    /** Milliseconds between `replayedToken`'s rotation and this replay. */
+    sinceRotatedMs: number;
+    ip: string;
+    userAgent: string | null;
+} | {
+    /** POST {routePrefix}/logout — the family is revoked unconditionally as part of
+     *  ending the session, independent of anything else about the request. */
+    type: "signed_out";
+} | {
+    /** POST {routePrefix}/refresh ran the SAME authorization pipeline
+     *  `loadAuthedUser` runs (live IdP authorization, `onAuthorizeUser`) and it
+     *  rejected this session — e.g. a locally-suspended user, a role flytedesk-id
+     *  since revoked, or the backing IdP session no longer existing at all. */
+    type: "authorization_rejected";
+};
 export interface FlytedeskAuthOptions {
     /** This app's OAuth client_id, as registered with flytedesk-id. */
     clientId: string;
@@ -189,12 +245,19 @@ export interface FlytedeskAuthOptions {
      */
     scopes?: string[];
     /**
-     * Bounds every flytedesk-id `/token` call via `AbortSignal.timeout` (AK-14, gap 5).
-     * Default `DEFAULT_TOKEN_REQUEST_TIMEOUT_MS` (5s, matching media-planner's
-     * `IDP_TOKEN_TIMEOUT_MS`). A hung flytedesk-id response fails loudly with a typed
-     * `IdpTimeoutError` instead of hanging the caller indefinitely.
+     * Bounds EVERY flytedesk-id call this plugin's OIDC client makes — token, userinfo
+     * (`/me`), authorization (`/apps/{id}/authorization`), `/me/apps`, discovery and
+     * revocation — via `AbortSignal.timeout`, through the one bounded-request helper every
+     * one of those calls goes through (AK-20, gap 1; generalized from AK-14 gap 5, which
+     * only bounded `/token`). Default `DEFAULT_IDP_REQUEST_TIMEOUT_MS` (5s, matching
+     * media-planner's `IDP_TOKEN_TIMEOUT_MS`). A hung flytedesk-id response fails loudly
+     * with the typed `IdpTimeoutError` instead of hanging the caller indefinitely — most
+     * importantly for the authorization call, which `loadAuthedUser` (`../plugin.ts`) runs
+     * on every authenticated request, so a hang there previously hung every signed-in
+     * request across every consumer of this package. No alias or deprecated name is kept
+     * for the old, narrower `tokenRequestTimeoutMs`.
      */
-    tokenRequestTimeoutMs?: number;
+    idpRequestTimeoutMs?: number;
     /**
      * How long after a refresh token was rotated a second presentation of it is still
      * treated as a concurrent-tab race rather than reuse (AK-14, gap 3; MP-127; RFC 9700

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flytedesk/app-kit",
-  "version": "1.0.0",
+  "version": "2.0.0",
   "description": "Shared platform kit for flytedesk apps: flytedesk-id auth (BFF/OIDC client) and a Postgres-native trace/audit layer.",
   "type": "module",
   "license": "UNLICENSED",