@flytedesk/app-kit 1.0.0 → 3.0.0

package/dist/auth/plugin.js

@@ -4,7 +4,7 @@ import fastifyCookie from "@fastify/cookie";
 import { AuthStoreError, IdpAccessRevokedError, classifyIdpError } from "./errors.js";
 import { createOidcClient } from "./oidc-client.js";
 import { generatePkce, randomState } from "./pkce.js";
-import { AUTH_REQUEST_DEADLINE_MS, AUTH_ROUTE_PREFIX, authRoutePath, SILENT_AUTH_MESSAGE_SOURCE, } from "./shared-types.js";
+import { AUTH_REQUEST_DEADLINE_MS, AUTH_ROUTE_PREFIX, authRoutePath, SILENT_AUTH_MESSAGE_SOURCE, SIGNIN_ERROR_QUERY_PARAM, } from "./shared-types.js";
 import { generateRefreshToken, hashRefreshToken, signAccessToken, verifyAccessToken } from "./tokens.js";
 const DEFAULT_ACCESS_TOKEN_TTL_SECONDS = 900;
 const DEFAULT_REFRESH_TOKEN_TTL_SECONDS = 2_592_000;
@@ -16,6 +16,7 @@ const REQUIRED_STRING_OPTIONS = [
     "redirectUri",
     "appId",
     "postLoginRedirect",
+    "signInUrl",
     "accessTokenSecret",
 ];
 function assertRequiredOptions(options) {
@@ -63,7 +64,7 @@ const flytedeskAuthPlugin = async (fastify, options) => {
         clientSecret: options.clientSecret,
         redirectUri: options.redirectUri,
         scopes: options.scopes,
-        tokenRequestTimeoutMs: options.tokenRequestTimeoutMs,
+        idpRequestTimeoutMs: options.idpRequestTimeoutMs,
     });
     await fastify.register(fastifyCookie, { secret: options.cookieSecret });
     fastify.decorateRequest("authUser", undefined);
@@ -122,68 +123,86 @@ const flytedeskAuthPlugin = async (fastify, options) => {
      * it's not near expiry, otherwise a freshly refreshed one (persisted back via
      * store.updateIdpSession before returning, since flytedesk-id rotates the refresh
      * token on every use — see ./oidc-client.ts's refreshIdpTokens doc comment). Shared
-     * by loadAuthedUser (below) and the GET {routePrefix}/apps route, so the refresh
-     * behaviour — and its failure classification — can't drift between the two call
-     * sites. Throws IdpAccessRevokedError (nothing left to refresh with, or flytedesk-id
+     * by authorizeIdpSession (below, and therefore by both loadAuthedUser and POST
+     * {routePrefix}/refresh) and the GET {routePrefix}/apps route, so the refresh
+     * behaviour — and its failure classification — can't drift between call sites.
+     * Throws IdpAccessRevokedError (nothing left to refresh with, or flytedesk-id
      * rejected the refresh token) or IdpUnavailableError (an outage) — never swallows;
      * every caller is expected to log what it decides to do with the failure (fail
      * loudly, AK-16).
+     *
+     * AK-20, gap 2326: the actual refresh happens under `store.withIdpSessionLock`, and
+     * RE-READS the session once the lock is held — flytedesk-id rotates its own refresh
+     * token on every use, so two concurrent requests on the same near-expiry session
+     * would otherwise both read "stale" before either write landed, both present the
+     * SAME (about-to-be-consumed) refresh token to flytedesk-id, and the loser would get
+     * an otherwise perfectly good session signed out. The re-read lets a lock loser
+     * notice a sibling already refreshed while it waited and reuse that result instead of
+     * refreshing again.
      */
     async function getLiveIdpAccessToken(session) {
         if (session.idpAccessTokenExpiresAt.getTime() - EXPIRY_SKEW_MS >= Date.now()) {
             return session.idpAccessToken;
         }
-        if (!session.idpRefreshToken) {
-            throw new IdpAccessRevokedError("No IdP refresh token on this session — re-login required");
-        }
         try {
-            const refreshed = await oidc.refreshIdpTokens(session.idpRefreshToken);
-            await store.updateIdpSession(session.id, {
-                idpAccessToken: refreshed.access_token,
-                idpAccessTokenExpiresAt: new Date(Date.now() + refreshed.expires_in * 1000),
-                idpRefreshToken: refreshed.refresh_token ?? session.idpRefreshToken,
+            return await store.withIdpSessionLock(session.id, async () => {
+                const fresh = await store.findIdpSession(session.id);
+                if (!fresh) {
+                    throw new IdpAccessRevokedError("IdP session no longer exists — re-login required");
+                }
+                if (fresh.idpAccessTokenExpiresAt.getTime() - EXPIRY_SKEW_MS >= Date.now()) {
+                    // A sibling request already refreshed this session while this one waited for
+                    // the lock — reuse its result rather than refreshing (and rotating) again.
+                    return fresh.idpAccessToken;
+                }
+                if (!fresh.idpRefreshToken) {
+                    throw new IdpAccessRevokedError("No IdP refresh token on this session — re-login required");
+                }
+                const refreshed = await oidc.refreshIdpTokens(fresh.idpRefreshToken);
+                await store.updateIdpSession(fresh.id, {
+                    idpAccessToken: refreshed.access_token,
+                    idpAccessTokenExpiresAt: new Date(Date.now() + refreshed.expires_in * 1000),
+                    idpRefreshToken: refreshed.refresh_token ?? fresh.idpRefreshToken,
+                });
+                return refreshed.access_token;
             });
-            return refreshed.access_token;
         }
         catch (err) {
             throw classifyIdpError(err);
         }
     }
     /**
-     * Live per-request by default: resolves `request.authUser` from the access token's
-     * `sid` by looking up the IdpSession, refreshing the IdP token pair if it's near
-     * expiry, then calling flytedesk-id's authorization endpoint fresh — see
-     * FlytedeskAuthOptions.authorizationCacheTtlMs for the one opt-in exception. Never
-     * throws: any failure just means no AuthedUser gets attached — requireAuth 401s from
-     * there. Every failure that is NOT a routine "no session"/"nothing to refresh with"
-     * outcome is still logged with context (fail loudly, AK-16), distinguishing a
-     * flytedesk-id outage from a genuinely revoked session from an AuthStore failure.
+     * The authorization pipeline shared by loadAuthedUser (below, run on every
+     * authenticated request from an access token's already-verified claims) and POST
+     * {routePrefix}/refresh (AK-20, gap 2) — refreshes the IdP token pair if it's near
+     * expiry, then calls flytedesk-id's authorization endpoint fresh (see
+     * FlytedeskAuthOptions.authorizationCacheTtlMs for the one opt-in exception), builds
+     * the AuthedUser, then runs the onAuthorizeUser hook if configured. Extracted into one
+     * function specifically so `/refresh` can never drift from what an ordinary
+     * authenticated request would decide: a refresh must not mint a fresh access token for
+     * a user this SAME pipeline would reject (e.g. a suspended user) — otherwise that user
+     * could keep refreshing (rotating their family, extending its lifetime) indefinitely
+     * even though every resource request the minted token is then used for still 401s.
+     * Never throws: any failure just means no AuthedUser — the caller decides what that
+     * means for its own route. Every failure that is NOT a routine "nothing to refresh
+     * with" outcome is still logged with context (fail loudly, AK-16), distinguishing a
+     * flytedesk-id outage from a genuinely revoked session.
      */
-    async function loadAuthedUser(request, claims) {
-        let session;
-        try {
-            session = await store.findIdpSession(claims.sid);
-        }
-        catch (err) {
-            request.log.error({ err: new AuthStoreError("AuthStore.findIdpSession failed", err), sid: claims.sid }, "@flytedesk/app-kit/auth: AuthStore error looking up IdP session");
-            return undefined;
-        }
-        if (!session || session.subject !== claims.sub)
-            return undefined; // no session for this claim — expected, not an error
+    async function authorizeIdpSession(request, session) {
         let idpAccessToken;
         try {
             idpAccessToken = await getLiveIdpAccessToken(session);
         }
         catch (err) {
             const classified = classifyIdpError(err);
-            request.log.error({ err: classified, sid: claims.sid }, classified instanceof IdpAccessRevokedError
+            request.log.error({ err: classified, sid: session.id }, classified instanceof IdpAccessRevokedError
                 ? "@flytedesk/app-kit/auth: flytedesk-id refresh token revoked or expired — forcing re-login"
                 : "@flytedesk/app-kit/auth: flytedesk-id token refresh failed — possible IdP outage");
             return undefined;
         }
         let authorization;
         if (options.authorizationCacheTtlMs) {
-            const cached = authorizationCache.get(claims.sid);
+            const cached = authorizationCache.get(session.id);
             if (cached && cached.expiresAt > Date.now())
                 authorization = cached.value;
         }
@@ -193,13 +212,13 @@ const flytedeskAuthPlugin = async (fastify, options) => {
             }
             catch (err) {
                 const classified = classifyIdpError(err);
-                request.log.error({ err: classified, sid: claims.sid }, classified instanceof IdpAccessRevokedError
+                request.log.error({ err: classified, sid: session.id }, classified instanceof IdpAccessRevokedError
                     ? "@flytedesk/app-kit/auth: flytedesk-id revoked this session's authorization"
                     : "@flytedesk/app-kit/auth: flytedesk-id authorization lookup failed — possible IdP outage");
                 return undefined;
             }
             if (options.authorizationCacheTtlMs) {
-                authorizationCache.set(claims.sid, {
+                authorizationCache.set(session.id, {
                     value: authorization,
                     expiresAt: Date.now() + options.authorizationCacheTtlMs,
                 });
@@ -229,7 +248,7 @@ const flytedeskAuthPlugin = async (fastify, options) => {
                 authorized = await options.onAuthorizeUser(user, request);
             }
             catch (err) {
-                request.log.error({ err, sid: claims.sid }, "@flytedesk/app-kit/auth: onAuthorizeUser threw — treating the session as rejected");
+                request.log.error({ err, sid: session.id }, "@flytedesk/app-kit/auth: onAuthorizeUser threw — treating the session as rejected");
                 return undefined;
             }
             if (!authorized)
@@ -238,6 +257,25 @@ const flytedeskAuthPlugin = async (fastify, options) => {
         }
         return user;
     }
+    /**
+     * Live per-request by default: resolves `request.authUser` from the access token's
+     * `sid` by looking up the IdpSession, then running it through authorizeIdpSession
+     * above. Never throws: any failure just means no AuthedUser gets attached —
+     * requireAuth 401s from there.
+     */
+    async function loadAuthedUser(request, claims) {
+        let session;
+        try {
+            session = await store.findIdpSession(claims.sid);
+        }
+        catch (err) {
+            request.log.error({ err: new AuthStoreError("AuthStore.findIdpSession failed", err), sid: claims.sid }, "@flytedesk/app-kit/auth: AuthStore error looking up IdP session");
+            return undefined;
+        }
+        if (!session || session.subject !== claims.sub)
+            return undefined; // no session for this claim — expected, not an error
+        return authorizeIdpSession(request, session);
+    }
     // onRequest, not preHandler: this needs to run before any route-level preHandler
     // (requireAuth/requirePermission included) so request.authUser is already resolved
     // by the time those run.
@@ -291,8 +329,23 @@ const flytedeskAuthPlugin = async (fastify, options) => {
      * route is identical to an interactive sign-in; only the stashed `silent` flag (which
      * routes the callback's response — see GET {routePrefix}/callback below) and the
      * `prompt` passed to buildAuthorizeUrl differ.
+     *
+     * `prompt` is schema-validated to the literal `"none"` (AK-20, gap 4) — the only
+     * value this route's silent-resume handling actually understands; anything else (a
+     * typo, or some other OIDC prompt semantics this plugin never implements) is rejected
+     * with a 400 by Fastify's own schema validation rather than being passed straight
+     * through to flytedesk-id's `/auth` endpoint unexamined.
      */
-    fastify.get(authRoutePath(routePrefix, "login"), async (request, reply) => {
+    fastify.get(authRoutePath(routePrefix, "login"), {
+        schema: {
+            querystring: {
+                type: "object",
+                properties: {
+                    prompt: { type: "string", enum: ["none"] },
+                },
+            },
+        },
+    }, async (request, reply) => {
         const { verifier, challenge } = generatePkce();
         const state = randomState();
         const prompt = request.query.prompt;
@@ -307,6 +360,21 @@ const flytedeskAuthPlugin = async (fastify, options) => {
         });
         return reply.redirect(oidc.buildAuthorizeUrl({ state, challenge, prompt }));
     });
+    /**
+     * AK-19: where every INTERACTIVE (non-silent) callback failure below redirects, with
+     * a normalized `SignInErrorCode` — never the raw internal failure code and never any
+     * human-readable detail (see `fail` below) — so the app's own sign-in page can render
+     * a specific message from one query param, without each app parsing the callback's
+     * internal error taxonomy. `options.signInUrl` is required (see its doc comment in
+     * ./types.ts): there is no fallback to `postLoginRedirect` or any other guessed path,
+     * so a consumer that forgets to configure it fails registration loudly instead of
+     * shipping this exact dead end unnoticed.
+     */
+    function redirectToSignIn(reply, signInErrorCode) {
+        const target = new URL(options.signInUrl);
+        target.searchParams.set(SIGNIN_ERROR_QUERY_PARAM, signInErrorCode);
+        return reply.redirect(target.toString());
+    }
     /**
      * GET {routePrefix}/callback — flytedesk-id's redirect_uri for this client. Validates
      * `state`, exchanges `code` + the stashed PKCE verifier at flytedesk-id's /token
@@ -324,6 +392,22 @@ const flytedeskAuthPlugin = async (fastify, options) => {
         // IdP-side session is genuinely gone too) still needs to answer through
         // sendSilentResult, or the hidden iframe's listener would wait out its full
         // timeout for a postMessage that was never going to arrive (AK-14, gap 2).
+        //
+        // AK-19, missing-cookie decision: when the login-attempt cookie itself is gone
+        // (expired past its loginAttemptTtlSeconds, or never arrived), `stash` stays
+        // undefined and `silent` below is deliberately `false` — this callback has no way
+        // to recover the `silent` flag that lived only in that cookie, so it can't answer
+        // through sendSilentResult even for an attempt that actually was silent. That's
+        // a deliberate, documented choice, not an oversight: a silent (`prompt=none`)
+        // attempt runs in a hidden iframe and flytedesk-id answers it within seconds, so
+        // in practice an EXPIRED cookie (the 10-minute loginAttemptTtlSeconds) can only
+        // mean an interactive attempt. Treating this case as interactive is also harmless
+        // for the vanishingly unlikely case it's wrong: a redirect delivered inside a
+        // hidden iframe is invisible to the user, and the parent page's own listener
+        // simply times out exactly as it would have if this callback had never answered
+        // at all. The same reasoning — and the same fallback to `silent = false` — applies
+        // identically below whenever `stash` can't be recovered for any other reason
+        // (the cookie's signature fails, or its JSON payload is malformed).
         let stash;
         if (raw) {
             const unsigned = request.unsignCookie(raw);
@@ -337,22 +421,48 @@ const flytedeskAuthPlugin = async (fastify, options) => {
             }
         }
         const silent = stash?.silent === true;
-        function fail(status, code, message) {
+        /**
+         * Answers ONE callback failure. Silent (AK-14): unchanged — the postMessage page,
+         * carrying the raw internal `code`, consumed only inside the hidden iframe
+         * (`sendSilentResult` above); never a top-level navigation, so it was never the
+         * raw-JSON dead end this card fixes. Interactive (AK-19): redirects (302) to the
+         * app's own sign-in page via `redirectToSignIn`, carrying only the normalized
+         * `signInErrorCode` — never `code`, never `message`, never a response body at all.
+         * `message` (and `err`, when the failure came from an upstream call) is logged
+         * server-side ONLY, exactly once, right here — the one place every failure branch
+         * below funnels through — so no call site has to remember to log it itself.
+         */
+        function fail(code, message, signInErrorCode, err) {
             if (silent)
                 return sendSilentResult(reply, "error", code);
-            return reply.code(status).send({ error: message, code });
+            // Always .error, not .warn: every one of these is the "fail loudly" pattern
+            // this file uses throughout (AK-16) — the ONLY place the real detail (and, for
+            // an upstream failure, the actual err) is ever recorded, since the redirect
+            // below carries neither.
+            request.log.error({ err, code }, `@flytedesk/app-kit/auth: interactive callback failed — ${message}`);
+            return redirectToSignIn(reply, signInErrorCode);
         }
         if (error) {
-            return fail(400, error, `flytedesk-id sign-in failed: ${error}`);
+            // access_denied: the user declined at flytedesk-id — "cancelled". Every other
+            // idp_error (including login_required reaching here on an INTERACTIVE attempt,
+            // which is unexpected but not impossible) collapses to "other" — see
+            // SignInErrorCode's doc comment on why this stays a closed, three-way set.
+            const signInErrorCode = error === "access_denied" ? "cancelled" : "other";
+            return fail(error, `flytedesk-id sign-in failed: ${error}`, signInErrorCode);
         }
         if (!code || !state || !raw) {
-            return fail(400, "invalid_callback", "Missing code/state, or the login attempt expired");
+            // Missing cookie specifically means the 10-minute login-attempt window elapsed
+            // before flytedesk-id redirected back — "expired" (see the missing-cookie
+            // decision above). Missing code/state with the cookie still present is a
+            // different, much rarer malformed-request shape — "other".
+            const signInErrorCode = !raw ? "expired" : "other";
+            return fail("invalid_callback", "Missing code/state, or the login attempt expired", signInErrorCode);
         }
         if (!stash) {
-            return fail(400, "invalid_login_cookie", "Login attempt cookie failed verification");
+            return fail("invalid_login_cookie", "Login attempt cookie failed verification", "other");
         }
         if (stash.state !== state) {
-            return fail(400, "invalid_state", "State mismatch");
+            return fail("invalid_state", "State mismatch", "other");
         }
         try {
             const tokens = await oidc.exchangeCodeForTokens(code, stash.verifier);
@@ -361,10 +471,10 @@ const flytedeskAuthPlugin = async (fastify, options) => {
             const idToken = await oidc.verifyIdToken(tokens.id_token);
             const profile = await oidc.fetchUserinfo(tokens.access_token);
             if (profile.sub !== idToken.sub) {
-                return fail(401, "subject_mismatch", "flytedesk-id id_token/userinfo subject mismatch");
+                return fail("subject_mismatch", "flytedesk-id id_token/userinfo subject mismatch", "other");
             }
             if (!profile.emailVerified) {
-                return fail(401, "email_not_verified", "flytedesk-id account email is not verified");
+                return fail("email_not_verified", "flytedesk-id account email is not verified", "other");
             }
             if (options.onSignIn) {
                 await options.onSignIn(profile, request);
@@ -394,8 +504,7 @@ const flytedeskAuthPlugin = async (fastify, options) => {
             return reply.redirect(options.postLoginRedirect);
         }
         catch (err) {
-            request.log.error({ err }, "flytedesk-id callback failed");
-            return fail(502, "idp_exchange_failed", "Sign-in with flytedesk-id failed");
+            return fail("idp_exchange_failed", "Sign-in with flytedesk-id failed", "other", err);
         }
     });
     /** The one answer POST {routePrefix}/refresh gives a refresh token it will not
@@ -460,7 +569,13 @@ const flytedeskAuthPlugin = async (fastify, options) => {
                 rotated: stored.rotated,
                 sinceRevokedMs,
             }, "@flytedesk/app-kit/auth: refresh token reuse detected — revoking token family");
-            await store.revokeFamily(stored.familyId);
+            await store.revokeFamily(stored.familyId, {
+                type: "reuse_detected",
+                replayedToken: stored,
+                sinceRotatedMs: sinceRevokedMs,
+                ip: request.ip,
+                userAgent: request.headers["user-agent"] ?? null,
+            });
             reply.clearCookie(refreshCookieName, { path: cookiePath });
             return reply.code(401).send({ error: "Refresh token reuse detected", code: "token_reuse_detected" });
         }
@@ -468,6 +583,41 @@ const flytedeskAuthPlugin = async (fastify, options) => {
             reply.clearCookie(refreshCookieName, { path: cookiePath });
             return reply.code(401).send({ error: "Refresh token expired", code: "unauthenticated" });
         }
+        // AK-20, gap 2: run the SAME authorization pipeline loadAuthedUser runs on every
+        // other authenticated request — including onAuthorizeUser — before minting a fresh
+        // access token. Without this, a user the app suspended (via onAuthorizeUser) could
+        // keep refreshing forever: their resource requests with the minted token would
+        // still 401, but nothing ever ended the session, so their family kept rotating and
+        // its lifetime kept extending indefinitely. A rejection here revokes the whole
+        // family, exactly like a detected reuse — the point of rotating at all is defeated
+        // if a rejected user's family just keeps living. Deliberately BEFORE the atomic
+        // claim below (not after): this call can be slow (a real network round trip to
+        // flytedesk-id), and running it between the claim and the mint would widen the
+        // window in which a genuinely concurrent sibling request's read of this same row
+        // could land — the atomic claim and the mint that follows it must stay adjacent,
+        // exactly as they were before this card, or the plugin's own concurrent-tab-race
+        // handling (gap 3) becomes measurably flakier under load, not just under test.
+        let idpSession;
+        try {
+            idpSession = await store.findIdpSession(stored.idpSessionId);
+        }
+        catch (err) {
+            request.log.error({ err: new AuthStoreError("AuthStore.findIdpSession failed", err), idpSessionId: stored.idpSessionId }, "@flytedesk/app-kit/auth: /refresh AuthStore error looking up IdP session");
+            return reply.code(502).send({ error: "Could not load the signed-in session", code: "auth_store_failed" });
+        }
+        if (!idpSession) {
+            request.log.warn({ familyId: stored.familyId, idpSessionId: stored.idpSessionId }, "@flytedesk/app-kit/auth: /refresh — no IdP session left for this refresh token — revoking family");
+            await store.revokeFamily(stored.familyId, { type: "authorization_rejected" });
+            reply.clearCookie(refreshCookieName, { path: cookiePath });
+            return reply.code(401).send({ error: "Session not found", code: "unauthenticated" });
+        }
+        const authorized = await authorizeIdpSession(request, idpSession);
+        if (!authorized) {
+            request.log.warn({ familyId: stored.familyId, userId: stored.userId }, "@flytedesk/app-kit/auth: /refresh rejected by the authorization check — revoking token family");
+            await store.revokeFamily(stored.familyId, { type: "authorization_rejected" });
+            reply.clearCookie(refreshCookieName, { path: cookiePath });
+            return reply.code(401).send({ error: "Authorization rejected", code: "unauthenticated" });
+        }
         const claimed = await store.claimRefreshTokenForRotation(stored.id);
         if (!claimed) {
             // A sibling request claimed it first, in the tiny window since the read above —
@@ -581,7 +731,7 @@ const flytedeskAuthPlugin = async (fastify, options) => {
             if (stored) {
                 // Revoke the local family FIRST and unconditionally — that's what actually
                 // keeps a signed-out browser locked out, independent of anything below.
-                await store.revokeFamily(stored.familyId);
+                await store.revokeFamily(stored.familyId, { type: "signed_out" });
                 const idpSession = await store.findIdpSession(stored.idpSessionId);
                 if (idpSession?.idpRefreshToken) {
                     // revokeIdpToken's own contract (see oidc-client.ts) is never to throw — this

package/dist/auth/plugin.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/auth/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChC,OAAO,aAA8C,MAAM,iBAAiB,CAAC;AAE7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAAyB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,aAAa,EACb,0BAA0B,GAE3B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAYzG,MAAM,gCAAgC,GAAG,GAAG,CAAC;AAC7C,MAAM,iCAAiC,GAAG,SAAS,CAAC;AACpD,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAE9C,MAAM,uBAAuB,GAAG;IAC9B,UAAU;IACV,cAAc;IACd,QAAQ;IACR,aAAa;IACb,OAAO;IACP,mBAAmB;IACnB,mBAAmB;CACyC,CAAC;AAE/D,SAAS,qBAAqB,CAAC,OAA6B;IAC1D,KAAK,MAAM,GAAG,IAAI,uBAAuB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,qDAAqD,GAAG,GAAG,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,IACE,OAAO,CAAC,YAAY,IAAI,IAAI;QAC5B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,EAC7G,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,MAAM,mBAAmB,GAA6C,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;IAC/F,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAE/B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,iBAAiB,CAAC;IAC7D,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,gCAAgC,CAAC;IAChG,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,iCAAiC,CAAC;IACnG,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,iCAAiC,CAAC;IACnG,oFAAoF;IACpF,qEAAqE;IACrE,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,CAAC,GAAG,wBAAwB,CAAC;IACxF,2EAA2E;IAC3E,uFAAuF;IACvF,qFAAqF;IACrF,+EAA+E;IAC/E,8CAA8C;IAC9C,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC;IACzE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAE5B,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,uBAAuB,EAAE,OAAO,CAAC,uBAAuB,EAAE,EAC5D,uFAAuF;YACrF,uFAAuF;YACvF,8EAA8E,CACjF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,gBAAgB,CAAC;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;KACrD,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAExE,OAAO,CAAC,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAE/C,oFAAoF;IACpF,qFAAqF;IACrF,qFAAqF;IACrF,iEAAiE;IACjE,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,MAAM,iBAAiB,GAAG,aAAa,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC;IAC7E,MAAM,eAAe,GAAG,aAAa,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACvF,kFAAkF;IAClF,kFAAkF;IAClF,oFAAoF;IACpF,mFAAmF;IACnF,sFAAsF;IACtF,kFAAkF;IAClF,mFAAmF;IACnF,mFAAmF;IACnF,gFAAgF;IAChF,sEAAsE;IACtE,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;IAE3E,SAAS,oBAAoB,CAAC,aAAqB;QACjD,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,OAAO,CAAC,aAAa;YAC7B,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,aAAa;SACtB,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,SAAS,gBAAgB,CAAC,KAAmB,EAAE,MAA2B,EAAE,MAAe;QACzF,MAAM,OAAO,GAAsB;YACjC,MAAM,EAAE,0BAA0B;YAClC,MAAM;YACN,MAAM,EAAE,MAAM,IAAI,IAAI;SACvB,CAAC;QACF,OAAO,KAAK;aACT,IAAI,CAAC,WAAW,CAAC;aACjB,IAAI,CACH,qCAAqC;YACnC,kDAAkD;YAClD,6BAA6B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,IAAI;YACnG,GAAG;YACH,yBAAyB,CAC5B,CAAC;IACN,CAAC;IAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA0D,CAAC;IAE7F,MAAM,cAAc,GAAG,KAAK,CAAC;IAE7B;;;;;;;;;;;OAWG;IACH,KAAK,UAAU,qBAAqB,CAAC,OAAsB;QACzD,IAAI,OAAO,CAAC,uBAAuB,CAAC,OAAO,EAAE,GAAG,cAAc,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7E,OAAO,OAAO,CAAC,cAAc,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC;YAC7B,MAAM,IAAI,qBAAqB,CAAC,0DAA0D,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACvE,MAAM,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE;gBACvC,cAAc,EAAE,SAAS,CAAC,YAAY;gBACtC,uBAAuB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC;gBAC3E,eAAe,EAAE,SAAS,CAAC,aAAa,IAAI,OAAO,CAAC,eAAe;aACpE,CAAC,CAAC;YACH,OAAO,SAAS,CAAC,YAAY,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,UAAU,cAAc,CAC3B,OAAuB,EACvB,MAAoC;QAEpC,IAAI,OAA6B,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,iCAAiC,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACpF,iEAAiE,CAClE,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC,CAAC,qDAAqD;QAEvH,IAAI,cAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACpC,UAAU,YAAY,qBAAqB;gBACzC,CAAC,CAAC,2FAA2F;gBAC7F,CAAC,CAAC,kFAAkF,CACvF,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,aAA2C,CAAC;QAChD,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAClD,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;gBAAE,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACpC,UAAU,YAAY,qBAAqB;oBACzC,CAAC,CAAC,4EAA4E;oBAC9E,CAAC,CAAC,yFAAyF,CAC9F,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;gBACpC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE;oBACjC,KAAK,EAAE,aAAa;oBACpB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,uBAAuB;iBACxD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,+EAA+E;QAC/E,2DAA2D;QAC3D,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC;QACnC,MAAM,IAAI,GAAe;YACvB,EAAE,EAAE,OAAO,CAAC,OAAO;YACnB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,KAAK,EAAE,aAAa,CAAC,KAAK;YAC1B,WAAW,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACvG,CAAC;QAEF,8EAA8E;QAC9E,uFAAuF;QACvF,uFAAuF;QACvF,iFAAiF;QACjF,4EAA4E;QAC5E,0CAA0C;QAC1C,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,IAAI,UAA6B,CAAC;YAClC,IAAI,CAAC;gBACH,UAAU,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC5D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACxB,mFAAmF,CACpF,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,CAAC,UAAU;gBAAE,OAAO,SAAS,CAAC;YAClC,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED,iFAAiF;IACjF,mFAAmF;IACnF,yBAAyB;IACzB,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACnD,IAAI,IAAI;gBAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,gFAAgF;QAClF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,YAAY,CACzB,OAAuB,EACvB,KAAmB,EACnB,MAAc,EACd,YAAoB,EACpB,QAAgB;QAEhB,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,oBAAoB,EAAE,CAAC;QAC7D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,GAAG,IAAI,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC7B,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ;YACR,MAAM;YACN,SAAS,EAAE,IAAI;YACf,SAAS;YACT,YAAY;YACZ,SAAS,EAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAwB,IAAI,IAAI;YACxE,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,wEAAwE;YACxE,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QAEH,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,eAAe,CAC9E,OAAO,CAAC,iBAAiB,EACzB,qBAAqB,EACrB,MAAM,EACN,YAAY,CACb,CAAC;QACF,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,YAAY,EAAE,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC/F,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;IAC9E,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,GAAG,CACT,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,EACnC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,YAAY,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,KAAK,MAAM,CAAC;QAEjC,KAAK,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE;YAC5E,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,OAAO,CAAC,aAAa;YAC7B,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9E,CAAC,CACF,CAAC;IAEF;;;;;;OAMG;IACH,OAAO,CAAC,GAAG,CACT,aAAa,CAAC,WAAW,EAAE,UAAU,CAAC,EACtC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC7C,KAAK,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAEzD,6EAA6E;QAC7E,iFAAiF;QACjF,yEAAyE;QACzE,wEAAwE;QACxE,4EAA4E;QAC5E,2EAA2E;QAC3E,IAAI,KAAuE,CAAC;QAC5E,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACrC,IAAI,CAAC;oBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAyD,CAAC;gBAC7F,CAAC;gBAAC,MAAM,CAAC;oBACP,KAAK,GAAG,SAAS,CAAC;gBACpB,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;QAEtC,SAAS,IAAI,CAAC,MAAc,EAAE,IAAY,EAAE,OAAe;YACzD,IAAI,MAAM;gBAAE,OAAO,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAC1D,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,OAAO,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,gCAAgC,KAAK,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,GAAG,EAAE,kBAAkB,EAAE,kDAAkD,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,GAAG,EAAE,sBAAsB,EAAE,0CAA0C,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,GAAG,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YACtE,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC9D,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAC,GAAG,EAAE,kBAAkB,EAAE,iDAAiD,CAAC,CAAC;YAC1F,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,GAAG,EAAE,oBAAoB,EAAE,4CAA4C,CAAC,CAAC;YACvF,CAAC;YAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;YAC1D,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC;gBAC9C,OAAO,EAAE,OAAO,CAAC,GAAG;gBACpB,IAAI;gBACJ,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,cAAc,EAAE,MAAM,CAAC,YAAY;gBACnC,uBAAuB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;gBACxE,eAAe,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;aAC9C,CAAC,CAAC;YAEH,6EAA6E;YAC7E,gFAAgF;YAChF,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC9B,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAEzE,IAAI,MAAM,EAAE,CAAC;gBACX,6EAA6E;gBAC7E,0EAA0E;gBAC1E,8EAA8E;gBAC9E,+EAA+E;gBAC/E,4EAA4E;gBAC5E,sDAAsD;gBACtD,OAAO,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,8BAA8B,CAAC,CAAC;YAC3D,OAAO,IAAI,CAAC,GAAG,EAAE,qBAAqB,EAAE,kCAAkC,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC,CACF,CAAC;IAEF;;;;;wDAKoD;IACpD,SAAS,aAAa,CAAC,KAAmB,EAAE,EAAE,WAAW,EAA4B;QACnF,IAAI,WAAW;YAAE,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC5E,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACtG,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAClG,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YAC/D,IAAI,MAAM,CAAC,OAAO,IAAI,cAAc,GAAG,mBAAmB,EAAE,CAAC;gBAC3D,OAAO,aAAa,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;YACtD,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,IAAI,CACd;gBACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,cAAc;aACf,EACD,+EAA+E,CAChF,CAAC;YACF,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1C,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAClC,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,gFAAgF;YAChF,+EAA+E;YAC/E,OAAO,aAAa,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,mFAAmF;QACnF,kFAAkF;QAClF,+EAA+E;QAC/E,mFAAmF;QACnF,wCAAwC;QACxC,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,GAAG,IAAI,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC7B,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,SAAS;YACT,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAwB,IAAI,IAAI;YACxE,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,UAAU,EAAE,MAAM,CAAC,EAAE;SACtB,CAAC,CAAC;QAEH,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,eAAe,CAC9E,OAAO,CAAC,iBAAiB,EACzB,qBAAqB,EACrB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,YAAY,CACpB,CAAC;QACF,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,EAAE,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC7F,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,oBAAoB,EAAE,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH;;;;;;;;;;OAUG;IACH,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7F,CAAC;QAED,IAAI,OAA6B,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,iCAAiC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,EAC1G,uEAAuE,CACxE,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,IAAI,cAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,EAC1C,UAAU,YAAY,qBAAqB;gBACzC,CAAC,CAAC,gFAAgF;gBAClF,CAAC,CAAC,qFAAqF,CAC1F,CAAC;YACF,IAAI,UAAU,YAAY,qBAAqB,EAAE,CAAC;gBAChD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC9G,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACjG,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;YACpD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,EAC1C,sEAAsE,CACvE,CAAC;YACF,IAAI,UAAU,YAAY,qBAAqB,EAAE,CAAC;gBAChD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC9G,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;;;;;;;OASG;IACH,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACrE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1E,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,MAAM,EAAE,CAAC;gBACX,2EAA2E;gBAC3E,wEAAwE;gBACxE,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC1C,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACnE,IAAI,UAAU,EAAE,eAAe,EAAE,CAAC;oBAChC,8EAA8E;oBAC9E,iEAAiE;oBACjE,wDAAwD;oBACxD,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;gBACxD,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACpD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,8EAA8E;oBAC9E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,gDAAgD;oBAChD,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,mCAAmC,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EACxG,mHAAmH,CACpH,CAAC;oBACF,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;oBAC3D,OAAO,KAAK;yBACT,IAAI,CAAC,GAAG,CAAC;yBACT,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,mBAAmB,EAAE;IACnD,IAAI,EAAE,yBAAyB;CAChC,CAAC,CAAC"}
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../src/auth/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,gBAAgB,CAAC;AAChC,OAAO,aAA8C,MAAM,iBAAiB,CAAC;AAE7E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACtF,OAAO,EAAE,gBAAgB,EAAyB,MAAM,kBAAkB,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,aAAa,EACb,0BAA0B,EAC1B,wBAAwB,GAGzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAYzG,MAAM,gCAAgC,GAAG,GAAG,CAAC;AAC7C,MAAM,iCAAiC,GAAG,SAAS,CAAC;AACpD,MAAM,iCAAiC,GAAG,GAAG,CAAC;AAE9C,MAAM,uBAAuB,GAAG;IAC9B,UAAU;IACV,cAAc;IACd,QAAQ;IACR,aAAa;IACb,OAAO;IACP,mBAAmB;IACnB,WAAW;IACX,mBAAmB;CACyC,CAAC;AAE/D,SAAS,qBAAqB,CAAC,OAA6B;IAC1D,KAAK,MAAM,GAAG,IAAI,uBAAuB,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CAAC,qDAAqD,GAAG,GAAG,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;IACD,IACE,OAAO,CAAC,YAAY,IAAI,IAAI;QAC5B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,EAC7G,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,MAAM,mBAAmB,GAA6C,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE;IAC/F,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAE/B,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,iBAAiB,CAAC;IAC7D,MAAM,qBAAqB,GAAG,OAAO,CAAC,qBAAqB,IAAI,gCAAgC,CAAC;IAChG,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,iCAAiC,CAAC;IACnG,MAAM,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,IAAI,iCAAiC,CAAC;IACnG,oFAAoF;IACpF,qEAAqE;IACrE,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,CAAC,GAAG,wBAAwB,CAAC;IACxF,2EAA2E;IAC3E,uFAAuF;IACvF,qFAAqF;IACrF,+EAA+E;IAC/E,8CAA8C;IAC9C,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC;IACzE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAE5B,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;QACpC,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,uBAAuB,EAAE,OAAO,CAAC,uBAAuB,EAAE,EAC5D,uFAAuF;YACrF,uFAAuF;YACvF,8EAA8E,CACjF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,gBAAgB,CAAC;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,mBAAmB,EAAE,OAAO,CAAC,mBAAmB;KACjD,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAExE,OAAO,CAAC,eAAe,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAE/C,oFAAoF;IACpF,qFAAqF;IACrF,qFAAqF;IACrF,iEAAiE;IACjE,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC5C,MAAM,iBAAiB,GAAG,aAAa,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC;IAC7E,MAAM,eAAe,GAAG,aAAa,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC,kBAAkB,CAAC;IACvF,kFAAkF;IAClF,kFAAkF;IAClF,oFAAoF;IACpF,mFAAmF;IACnF,sFAAsF;IACtF,kFAAkF;IAClF,mFAAmF;IACnF,mFAAmF;IACnF,gFAAgF;IAChF,sEAAsE;IACtE,MAAM,UAAU,GAAG,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC;IAE3E,SAAS,oBAAoB,CAAC,aAAqB;QACjD,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,OAAO,CAAC,aAAa;YAC7B,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,aAAa;SACtB,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,SAAS,gBAAgB,CAAC,KAAmB,EAAE,MAA2B,EAAE,MAAe;QACzF,MAAM,OAAO,GAAsB;YACjC,MAAM,EAAE,0BAA0B;YAClC,MAAM;YACN,MAAM,EAAE,MAAM,IAAI,IAAI;SACvB,CAAC;QACF,OAAO,KAAK;aACT,IAAI,CAAC,WAAW,CAAC;aACjB,IAAI,CACH,qCAAqC;YACnC,kDAAkD;YAClD,6BAA6B,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,sBAAsB,CAAC,IAAI;YACnG,GAAG;YACH,yBAAyB,CAC5B,CAAC;IACN,CAAC;IAED,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA0D,CAAC;IAE7F,MAAM,cAAc,GAAG,KAAK,CAAC;IAE7B;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,KAAK,UAAU,qBAAqB,CAAC,OAAsB;QACzD,IAAI,OAAO,CAAC,uBAAuB,CAAC,OAAO,EAAE,GAAG,cAAc,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC7E,OAAO,OAAO,CAAC,cAAc,CAAC;QAChC,CAAC;QACD,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,IAAI,EAAE;gBAC3D,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACrD,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,MAAM,IAAI,qBAAqB,CAAC,kDAAkD,CAAC,CAAC;gBACtF,CAAC;gBACD,IAAI,KAAK,CAAC,uBAAuB,CAAC,OAAO,EAAE,GAAG,cAAc,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;oBAC3E,6EAA6E;oBAC7E,2EAA2E;oBAC3E,OAAO,KAAK,CAAC,cAAc,CAAC;gBAC9B,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;oBAC3B,MAAM,IAAI,qBAAqB,CAAC,0DAA0D,CAAC,CAAC;gBAC9F,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;gBACrE,MAAM,KAAK,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,EAAE;oBACrC,cAAc,EAAE,SAAS,CAAC,YAAY;oBACtC,uBAAuB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,UAAU,GAAG,IAAI,CAAC;oBAC3E,eAAe,EAAE,SAAS,CAAC,aAAa,IAAI,KAAK,CAAC,eAAe;iBAClE,CAAC,CAAC;gBACH,OAAO,SAAS,CAAC,YAAY,CAAC;YAChC,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,UAAU,mBAAmB,CAChC,OAAuB,EACvB,OAAsB;QAEtB,IAAI,cAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,EACpC,UAAU,YAAY,qBAAqB;gBACzC,CAAC,CAAC,2FAA2F;gBAC7F,CAAC,CAAC,kFAAkF,CACvF,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,aAA2C,CAAC;QAChD,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;YACpC,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAClD,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;gBAAE,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,aAAa,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,aAAa,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,cAAc,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,EACpC,UAAU,YAAY,qBAAqB;oBACzC,CAAC,CAAC,4EAA4E;oBAC9E,CAAC,CAAC,yFAAyF,CAC9F,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,OAAO,CAAC,uBAAuB,EAAE,CAAC;gBACpC,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE;oBACjC,KAAK,EAAE,aAAa;oBACpB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,uBAAuB;iBACxD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,gFAAgF;QAChF,+EAA+E;QAC/E,2DAA2D;QAC3D,MAAM,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,GAAG,CAAC;QACnC,MAAM,IAAI,GAAe;YACvB,EAAE,EAAE,OAAO,CAAC,OAAO;YACnB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,OAAO,CAAC,EAAE;YACrB,KAAK,EAAE,aAAa,CAAC,KAAK;YAC1B,WAAW,EAAE,aAAa,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACvG,CAAC;QAEF,8EAA8E;QAC9E,uFAAuF;QACvF,uFAAuF;QACvF,iFAAiF;QACjF,4EAA4E;QAC5E,0CAA0C;QAC1C,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC;YAC5B,IAAI,UAA6B,CAAC;YAClC,IAAI,CAAC;gBACH,UAAU,GAAG,MAAM,OAAO,CAAC,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC5D,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,EAAE,EACxB,mFAAmF,CACpF,CAAC;gBACF,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,IAAI,CAAC,UAAU;gBAAE,OAAO,SAAS,CAAC;YAClC,OAAO,UAAU,CAAC;QACpB,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,cAAc,CAC3B,OAAuB,EACvB,MAAoC;QAEpC,IAAI,OAA6B,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,iCAAiC,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,EACpF,iEAAiE,CAClE,CAAC;YACF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC,CAAC,qDAAqD;QAEvH,OAAO,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,iFAAiF;IACjF,mFAAmF;IACnF,yBAAyB;IACzB,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC;QAC7C,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO;QAC3C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACnF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACnD,IAAI,IAAI;gBAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,gFAAgF;QAClF,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,KAAK,UAAU,YAAY,CACzB,OAAuB,EACvB,KAAmB,EACnB,MAAc,EACd,YAAoB,EACpB,QAAgB;QAEhB,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,oBAAoB,EAAE,CAAC;QAC7D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,GAAG,IAAI,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC7B,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ;YACR,MAAM;YACN,SAAS,EAAE,IAAI;YACf,SAAS;YACT,YAAY;YACZ,SAAS,EAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAwB,IAAI,IAAI;YACxE,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,wEAAwE;YACxE,UAAU,EAAE,IAAI;SACjB,CAAC,CAAC;QAEH,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,eAAe,CAC9E,OAAO,CAAC,iBAAiB,EACzB,qBAAqB,EACrB,MAAM,EACN,YAAY,CACb,CAAC;QACF,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,YAAY,EAAE,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC/F,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC;IAC9E,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,OAAO,CAAC,GAAG,CACT,aAAa,CAAC,WAAW,EAAE,OAAO,CAAC,EACnC;QACE,MAAM,EAAE;YACN,WAAW,EAAE;gBACX,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACV,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE;iBAC3C;aACF;SACF;KACF,EACD,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,YAAY,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,KAAK,MAAM,CAAC;QAEjC,KAAK,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE;YAC5E,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,OAAO,CAAC,aAAa;YAC7B,IAAI,EAAE,UAAU;YAChB,MAAM,EAAE,sBAAsB;YAC9B,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QAEH,OAAO,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9E,CAAC,CACF,CAAC;IAEF;;;;;;;;;OASG;IACH,SAAS,gBAAgB,CAAC,KAAmB,EAAE,eAAgC;QAC7E,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1C,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,wBAAwB,EAAE,eAAe,CAAC,CAAC;QACnE,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;OAMG;IACH,OAAO,CAAC,GAAG,CACT,aAAa,CAAC,WAAW,EAAE,UAAU,CAAC,EACtC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC;QAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QAC7C,KAAK,CAAC,WAAW,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAEzD,6EAA6E;QAC7E,iFAAiF;QACjF,yEAAyE;QACzE,wEAAwE;QACxE,4EAA4E;QAC5E,2EAA2E;QAC3E,EAAE;QACF,+EAA+E;QAC/E,6EAA6E;QAC7E,kFAAkF;QAClF,kFAAkF;QAClF,gFAAgF;QAChF,8EAA8E;QAC9E,iFAAiF;QACjF,gFAAgF;QAChF,kFAAkF;QAClF,8EAA8E;QAC9E,6EAA6E;QAC7E,gFAAgF;QAChF,mFAAmF;QACnF,6EAA6E;QAC7E,oEAAoE;QACpE,IAAI,KAAuE,CAAC;QAC5E,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;YAC3C,IAAI,QAAQ,CAAC,KAAK,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;gBACrC,IAAI,CAAC;oBACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAyD,CAAC;gBAC7F,CAAC;gBAAC,MAAM,CAAC;oBACP,KAAK,GAAG,SAAS,CAAC;gBACpB,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;QAEtC;;;;;;;;;;WAUG;QACH,SAAS,IAAI,CAAC,IAAY,EAAE,OAAe,EAAE,eAAgC,EAAE,GAAa;YAC1F,IAAI,MAAM;gBAAE,OAAO,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;YAC1D,4EAA4E;YAC5E,+EAA+E;YAC/E,4EAA4E;YAC5E,yBAAyB;YACzB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,0DAA0D,OAAO,EAAE,CAAC,CAAC;YACtG,OAAO,gBAAgB,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QAClD,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACV,8EAA8E;YAC9E,+EAA+E;YAC/E,qEAAqE;YACrE,2EAA2E;YAC3E,MAAM,eAAe,GAAoB,KAAK,KAAK,eAAe,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC;YAC3F,OAAO,IAAI,CAAC,KAAK,EAAE,gCAAgC,KAAK,EAAE,EAAE,eAAe,CAAC,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;YAC5B,+EAA+E;YAC/E,0EAA0E;YAC1E,yEAAyE;YACzE,2DAA2D;YAC3D,MAAM,eAAe,GAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;YACpE,OAAO,IAAI,CAAC,kBAAkB,EAAE,kDAAkD,EAAE,eAAe,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,sBAAsB,EAAE,0CAA0C,EAAE,OAAO,CAAC,CAAC;QAC3F,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC,eAAe,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC;YACtE,yEAAyE;YACzE,yEAAyE;YACzE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC1D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC9D,IAAI,OAAO,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG,EAAE,CAAC;gBAChC,OAAO,IAAI,CAAC,kBAAkB,EAAE,iDAAiD,EAAE,OAAO,CAAC,CAAC;YAC9F,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC;gBAC3B,OAAO,IAAI,CAAC,oBAAoB,EAAE,4CAA4C,EAAE,OAAO,CAAC,CAAC;YAC3F,CAAC;YAED,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC3C,CAAC;YAED,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC;YAC1D,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC;gBAC9C,OAAO,EAAE,OAAO,CAAC,GAAG;gBACpB,IAAI;gBACJ,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,cAAc,EAAE,MAAM,CAAC,YAAY;gBACnC,uBAAuB,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;gBACxE,eAAe,EAAE,MAAM,CAAC,aAAa,IAAI,IAAI;aAC9C,CAAC,CAAC;YAEH,6EAA6E;YAC7E,gFAAgF;YAChF,MAAM,QAAQ,GAAG,UAAU,EAAE,CAAC;YAC9B,MAAM,YAAY,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;YAEzE,IAAI,MAAM,EAAE,CAAC;gBACX,6EAA6E;gBAC7E,0EAA0E;gBAC1E,8EAA8E;gBAC9E,+EAA+E;gBAC/E,4EAA4E;gBAC5E,sDAAsD;gBACtD,OAAO,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,qBAAqB,EAAE,kCAAkC,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;QACvF,CAAC;IACH,CAAC,CACF,CAAC;IAEF;;;;;wDAKoD;IACpD,SAAS,aAAa,CAAC,KAAmB,EAAE,EAAE,WAAW,EAA4B;QACnF,IAAI,WAAW;YAAE,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC5E,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kCAAkC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;IACtG,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC3E,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,kBAAkB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;QACxD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAClG,CAAC;QAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;YAC/D,IAAI,MAAM,CAAC,OAAO,IAAI,cAAc,GAAG,mBAAmB,EAAE,CAAC;gBAC3D,OAAO,aAAa,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;YACtD,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,IAAI,CACd;gBACE,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,cAAc;aACf,EACD,+EAA+E,CAChF,CAAC;YACF,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE;gBACxC,IAAI,EAAE,gBAAgB;gBACtB,aAAa,EAAE,MAAM;gBACrB,cAAc,EAAE,cAAc;gBAC9B,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,SAAS,EAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAwB,IAAI,IAAI;aACzE,CAAC,CAAC;YACH,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,sBAAsB,EAAE,CAAC,CAAC;QACvG,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YAClC,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uBAAuB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC3F,CAAC;QAED,iFAAiF;QACjF,mFAAmF;QACnF,mFAAmF;QACnF,+EAA+E;QAC/E,mFAAmF;QACnF,+EAA+E;QAC/E,mFAAmF;QACnF,gFAAgF;QAChF,+EAA+E;QAC/E,+EAA+E;QAC/E,iFAAiF;QACjF,iFAAiF;QACjF,iFAAiF;QACjF,+EAA+E;QAC/E,IAAI,UAAgC,CAAC;QACrC,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,iCAAiC,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EACtG,0EAA0E,CAC3E,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EAChE,kGAAkG,CACnG,CAAC;YACF,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAC9E,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAClE,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,IAAI,CACd,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EACpD,+FAA+F,CAChG,CAAC;YACF,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;YAC9E,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wBAAwB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,4BAA4B,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,gFAAgF;YAChF,+EAA+E;YAC/E,OAAO,aAAa,CAAC,KAAK,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,mFAAmF;QACnF,kFAAkF;QAClF,+EAA+E;QAC/E,mFAAmF;QACnF,wCAAwC;QACxC,MAAM,IAAI,GAAG,oBAAoB,EAAE,CAAC;QACpC,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,sBAAsB,GAAG,IAAI,CAAC,CAAC;QACvE,MAAM,KAAK,CAAC,kBAAkB,CAAC;YAC7B,EAAE,EAAE,UAAU,EAAE;YAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,SAAS;YACT,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAwB,IAAI,IAAI;YACxE,EAAE,EAAE,OAAO,CAAC,EAAE;YACd,UAAU,EAAE,MAAM,CAAC,EAAE;SACtB,CAAC,CAAC;QAEH,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,eAAe,CAC9E,OAAO,CAAC,iBAAiB,EACzB,qBAAqB,EACrB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,YAAY,CACpB,CAAC;QACF,KAAK,CAAC,SAAS,CAAC,iBAAiB,EAAE,IAAI,CAAC,KAAK,EAAE,oBAAoB,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC7F,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,oBAAoB,EAAE,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH;;;;;;;;;;OAUG;IACH,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACvE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7F,CAAC;QAED,IAAI,OAA6B,CAAC;QAClC,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACnE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,iCAAiC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,EAC1G,uEAAuE,CACxE,CAAC;YACF,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,sCAAsC,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACvF,CAAC;QAED,IAAI,cAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,cAAc,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,EAC1C,UAAU,YAAY,qBAAqB;gBACzC,CAAC,CAAC,gFAAgF;gBAClF,CAAC,CAAC,qFAAqF,CAC1F,CAAC;YACF,IAAI,UAAU,YAAY,qBAAqB,EAAE,CAAC;gBAChD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC9G,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACjG,CAAC;QAED,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;YACpD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,EAC1C,sEAAsE,CACvE,CAAC;YACF,IAAI,UAAU,YAAY,qBAAqB,EAAE,CAAC;gBAChD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,IAAI,EAAE,oBAAoB,EAAE,CAAC,CAAC;YAC9G,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,6BAA6B,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACjG,CAAC;IACH,CAAC,CAAC,CAAC;IAEH;;;;;;;;;OASG;IACH,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QACrE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,CAAC;QAC7F,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH;;;;;;;OAOG;IACH,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC1E,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;QACjD,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,MAAM,EAAE,CAAC;gBACX,2EAA2E;gBAC3E,wEAAwE;gBACxE,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;gBAClE,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACnE,IAAI,UAAU,EAAE,eAAe,EAAE,CAAC;oBAChC,8EAA8E;oBAC9E,iEAAiE;oBACjE,wDAAwD;oBACxD,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC;gBACxD,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,KAAK,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;gBACpD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,8EAA8E;oBAC9E,4EAA4E;oBAC5E,6EAA6E;oBAC7E,gDAAgD;oBAChD,OAAO,CAAC,GAAG,CAAC,KAAK,CACf,EAAE,GAAG,EAAE,IAAI,cAAc,CAAC,mCAAmC,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,EACxG,mHAAmH,CACpH,CAAC;oBACF,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;oBAC3D,OAAO,KAAK;yBACT,IAAI,CAAC,GAAG,CAAC;yBACT,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;gBACrF,CAAC;YACH,CAAC;QACH,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,iBAAiB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;QAC3D,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG,EAAE,CAAC,mBAAmB,EAAE;IACnD,IAAI,EAAE,yBAAyB;CAChC,CAAC,CAAC"}

package/dist/auth/shared-types.d.ts

@@ -86,6 +86,33 @@ export interface SilentAuthMessage {
     status: "success" | "error";
     detail: string | null;
 }
+/**
+ * AK-19: the query param name `../plugin.ts`'s callback redirects with on every
+ * INTERACTIVE (non-silent) failure, and `./client/signInError.ts` reads (and clears)
+ * from the app's own sign-in page URL. Shared here — like every other name both halves
+ * need to agree on in this file — so a renamed param is a compile-time change on both
+ * sides, never a silent runtime drift.
+ */
+export declare const SIGNIN_ERROR_QUERY_PARAM = "signin_error";
+/**
+ * AK-19: the small, closed set of reasons an interactive callback failure can carry in
+ * `SIGNIN_ERROR_QUERY_PARAM` — deliberately NOT the raw internal failure code
+ * (`invalid_callback`, `invalid_state`, `idp_exchange_failed`, ...): the sign-in page
+ * only ever needs to pick one of three plain messages (see
+ * `./client/signInError.ts`'s `describeSignInError`), and collapsing every internal
+ * code down to this set here, once, is what lets both the server and the client stay
+ * ignorant of each other's internal error taxonomy.
+ *  - "expired": the 10-minute login-attempt cookie was gone by the time flytedesk-id
+ *    redirected back (`../plugin.ts`'s `invalid_callback` branch, missing-cookie case).
+ *  - "cancelled": flytedesk-id reported `error=access_denied` — the user declined at
+ *    the IdP.
+ *  - "other": every other failure branch (invalid state, a cookie that failed
+ *    verification, token exchange/verification failures, and any other `idp_error`
+ *    besides `access_denied`) — deliberately not distinguished further here; the real
+ *    detail is logged server-side only, never put in this param.
+ */
+export declare const SIGNIN_ERROR_CODES: readonly ["expired", "cancelled", "other"];
+export type SignInErrorCode = (typeof SIGNIN_ERROR_CODES)[number];
 /** Route segments mounted under `{routePrefix}` by `../plugin.ts`. `me` is deliberately
  *  under the prefix, not a sibling `/me` — see plugin.ts's `GET {routePrefix}/me` doc
  *  comment (AK-18). */

package/dist/auth/shared-types.js

@@ -40,6 +40,32 @@ export const AUTH_REQUEST_DEADLINE_MS = 10_000;
  * ever loaded inside the hidden iframe `attemptSilentResume()` creates.
  */
 export const SILENT_AUTH_MESSAGE_SOURCE = "flytedesk-app-kit-silent-auth";
+/**
+ * AK-19: the query param name `../plugin.ts`'s callback redirects with on every
+ * INTERACTIVE (non-silent) failure, and `./client/signInError.ts` reads (and clears)
+ * from the app's own sign-in page URL. Shared here — like every other name both halves
+ * need to agree on in this file — so a renamed param is a compile-time change on both
+ * sides, never a silent runtime drift.
+ */
+export const SIGNIN_ERROR_QUERY_PARAM = "signin_error";
+/**
+ * AK-19: the small, closed set of reasons an interactive callback failure can carry in
+ * `SIGNIN_ERROR_QUERY_PARAM` — deliberately NOT the raw internal failure code
+ * (`invalid_callback`, `invalid_state`, `idp_exchange_failed`, ...): the sign-in page
+ * only ever needs to pick one of three plain messages (see
+ * `./client/signInError.ts`'s `describeSignInError`), and collapsing every internal
+ * code down to this set here, once, is what lets both the server and the client stay
+ * ignorant of each other's internal error taxonomy.
+ *  - "expired": the 10-minute login-attempt cookie was gone by the time flytedesk-id
+ *    redirected back (`../plugin.ts`'s `invalid_callback` branch, missing-cookie case).
+ *  - "cancelled": flytedesk-id reported `error=access_denied` — the user declined at
+ *    the IdP.
+ *  - "other": every other failure branch (invalid state, a cookie that failed
+ *    verification, token exchange/verification failures, and any other `idp_error`
+ *    besides `access_denied`) — deliberately not distinguished further here; the real
+ *    detail is logged server-side only, never put in this param.
+ */
+export const SIGNIN_ERROR_CODES = ["expired", "cancelled", "other"];
 /** Route segments mounted under `{routePrefix}` by `../plugin.ts`. `me` is deliberately
  *  under the prefix, not a sibling `/me` — see plugin.ts's `GET {routePrefix}/me` doc
  *  comment (AK-18). */

package/dist/auth/shared-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"shared-types.js","sourceRoot":"","sources":["../../src/auth/shared-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA+CH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAEzC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,+BAA+B,CAAC;AAQ1E;;uBAEuB;AACvB,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,EAAE,EAAE,IAAI;IACR,IAAI,EAAE,MAAM;CAC6B,CAAC;AAI5C;;;qBAGqB;AACrB,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,OAAyB;IACrE,OAAO,GAAG,MAAM,IAAI,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;AACrD,CAAC"}
+{"version":3,"file":"shared-types.js","sourceRoot":"","sources":["../../src/auth/shared-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA+CH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,OAAO,CAAC;AAEzC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,+BAA+B,CAAC;AAQ1E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,cAAc,CAAC;AAEvD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,SAAS,EAAE,WAAW,EAAE,OAAO,CAAU,CAAC;AAI7E;;uBAEuB;AACvB,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,KAAK,EAAE,OAAO;IACd,QAAQ,EAAE,UAAU;IACpB,OAAO,EAAE,SAAS;IAClB,MAAM,EAAE,QAAQ;IAChB,EAAE,EAAE,IAAI;IACR,IAAI,EAAE,MAAM;CAC6B,CAAC;AAI5C;;;qBAGqB;AACrB,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,OAAyB;IACrE,OAAO,GAAG,MAAM,IAAI,mBAAmB,CAAC,OAAO,CAAC,EAAE,CAAC;AACrD,CAAC"}

package/dist/auth/testing/fake-idp.d.ts

@@ -48,6 +48,15 @@ export interface FakeIdpOptions {
      *  minutes, matching real flytedesk-id's default) — lets a consumer's test drive a
      *  real expiry-then-refresh cycle on its own clock instead of waiting on a real one. */
     accessTokenTtlSeconds?: number;
+    /**
+     * Default `false`, matching real flytedesk-id's discovery document (see the `POST
+     * /revoke` route's own doc comment below) — `oidc-client.ts`'s `revokeIdpToken` reads
+     * discovery and no-ops whenever `revocation_endpoint` is absent, exactly as it does
+     * against the real IdP today. Set `true` only for a test that specifically needs to
+     * drive `revokeIdpToken`'s REAL HTTP call end to end (e.g. AK-20's `setHangRevokeMs`
+     * coverage) — a deliberate, narrow opt-in, not this fixture's default behaviour.
+     */
+    advertiseRevocationEndpoint?: boolean;
 }
 export declare class FakeIdp {
     private server?;
@@ -58,8 +67,11 @@ export declare class FakeIdp {
     private nextIdentityKey;
     private idpSessionLive;
     private readonly accessTokenTtlSeconds;
+    private readonly advertiseRevocationEndpoint;
     private forceRefreshFailure;
     private hangTokenMs;
+    private hangAuthorizationMs;
+    private hangRevokeMs;
     private keys;
     private publicJwk;
     private readonly kid;
@@ -88,6 +100,17 @@ export declare class FakeIdp {
      * an already-closed response). `0` (the default) disables the delay.
      */
     setHangTokenMs(ms: number): void;
+    /** Mirrors setHangTokenMs, above, for `GET /apps/:appId/authorization` (AK-20, gap 1)
+     *  — lets a consumer's test exercise `OidcClientOptions.idpRequestTimeoutMs` against
+     *  the ONE call that runs on every authenticated request (`fetchAuthorization`, via
+     *  `../plugin.ts`'s `loadAuthedUser`/`authorizeIdpSession`), the specific hang this
+     *  option was generalized to close. `0` (the default) disables the delay. */
+    setHangAuthorizationMs(ms: number): void;
+    /** Mirrors setHangTokenMs, above, for `POST /revoke` (AK-20, gap 1) — lets a
+     *  consumer's test exercise `revokeIdpToken`'s "logout still completes locally when
+     *  the IdP revoke times out" guarantee against a REAL hang, not just a mocked
+     *  rejection. `0` (the default) disables the delay. */
+    setHangRevokeMs(ms: number): void;
     /**
      * Mutates a registered identity's roles/permissions/apps IN PLACE. Every live grant
      * already holds a reference to this identity object (this fixture keeps identities by