@flytedesk/app-kit 5.0.0 → 7.0.0

package/dist/auth/client/authSession.js

@@ -0,0 +1,581 @@
+/**
+ * The flytedesk ID session lifecycle — the ONE owner of every sign-in and session
+ * decision a flytedesk ID app makes (AK-35, PLN-2 R-14; design: PLN-2 architecture
+ * "flytedesk ID session lifecycle"). An app never builds any of this itself: it renders
+ * its shell for a usable session and the design system's `SessionScreen` for the rest
+ * (`./useAuthSession.ts`'s `SessionBoundary`), and reads the session through
+ * `authSession` / `useAuthSession`.
+ *
+ *  - Signed out: shows "signing in" and sends the browser through flytedesk ID with a
+ *    top-level navigation, carrying the exact `path?query#hash` as the return target.
+ *    Sign-in is only ever that navigation: it is the one request that can carry
+ *    `prompt=consent`, which flytedesk ID requires before it issues a refresh token
+ *    (see `../plugin.ts`'s `/login`).
+ *  - Session lost mid-use (a refused refresh, `onSessionEnded`): "session expired", then
+ *    the same automatic sign-in, back to the same URL.
+ *  - Checked every 10 minutes while the tab is visible, and when it becomes visible or
+ *    focused (at most once a minute).
+ *  - An outage (`AuthUnavailableError`) is never a sign-out: "unavailable", retried with
+ *    backoff (AK-23).
+ *  - Sign-out ends this app's session and flytedesk ID's (RP-initiated logout), and never
+ *    bounces straight back in (the server's signed-out marker forces `prompt=login`).
+ *  - Cross-tab: only a visible tab navigates, and while one tab is signing in (a short
+ *    claim) the others wait for its `signed-in` message.
+ *  - Loop guard: a tab that arrives back still signed out within two minutes of starting
+ *    a sign-in, or with `signin_error`, shows the sign-in-failed state with a manual
+ *    retry — never another automatic redirect.
+ *
+ * Framework-agnostic and browser-safe (ZERO Node imports, like `./httpClient.ts`). Every
+ * browser API it touches comes through an `AuthSessionEnvironment`, so the state machine
+ * is tested with a scripted environment and the real one is `browserEnvironment()`.
+ */
+import { absoluteApiUrl, apiRequest, ApiRequestError, AuthUnavailableError, onAuthUnavailable, onSessionEnded, refreshAccessToken, setAccessToken, } from "./httpClient.js";
+import { safeReturnTarget } from "../returnTarget.js";
+import { AUTH_ROUTE_PREFIX, AUTH_REQUEST_DEADLINE_MS, authRoutePath, RETURN_TO_QUERY_PARAM, SIGNIN_ERROR_CODES, SIGNIN_ERROR_QUERY_PARAM, } from "../shared-types.js";
+/** How often a visible, signed-in tab verifies its session. */
+export const SESSION_CHECK_INTERVAL_MS = 10 * 60_000;
+/** A tab becoming visible or focused re-checks at most this often. */
+export const FOCUS_CHECK_MIN_INTERVAL_MS = 60_000;
+/** A tab arriving back still signed out this soon after starting a sign-in is a loop. */
+export const SIGN_IN_LOOP_WINDOW_MS = 2 * 60_000;
+/** How long one tab's sign-in claim makes the other visible tabs wait for it — a round
+ *  trip while flytedesk ID is still signed in. */
+export const SIGN_IN_CLAIM_MS = 20_000;
+/** A page still here this long after handing the browser to a top-level navigation was
+ *  not navigated (the user cancelled it): it acts on its own behalf again. Well past a
+ *  slow round trip, during which the old page legitimately stays up. */
+export const NAVIGATION_STALL_MS = 60_000;
+/** First delay before re-verifying a session the server could not verify (AK-23). */
+export const UNAVAILABLE_RETRY_BASE_MS = 1_000;
+/** The backoff's ceiling: an outage is retried every this-many ms at most. */
+export const UNAVAILABLE_RETRY_MAX_MS = 30_000;
+/** Storage keys and the BroadcastChannel name — one namespace, never an app's. */
+export const SIGN_IN_ATTEMPT_KEY = "flytedesk-app-kit.auth.signInStartedAt";
+export const SIGN_IN_CLAIM_KEY = "flytedesk-app-kit.auth.signInClaim";
+export const SESSION_CHANNEL = "flytedesk-app-kit-session";
+/**
+ * Jittered exponential backoff for the `"unavailable"` state's automatic retries: the
+ * ceiling doubles per attempt (1s, 2s, 4s, … capped at UNAVAILABLE_RETRY_MAX_MS) and the
+ * delay is drawn uniformly from its upper half ("equal jitter", AK-23 L-c) — so every
+ * tab that saw the same outage does not retry in the same instant when it ends.
+ */
+export function unavailableRetryDelayMs(attempt, random = Math.random) {
+    const ceiling = Math.min(UNAVAILABLE_RETRY_BASE_MS * 2 ** attempt, UNAVAILABLE_RETRY_MAX_MS);
+    return Math.round(ceiling / 2 + random() * (ceiling / 2));
+}
+/** The plain message each sign-in failure shows (AK-19's closed code set). */
+export const SIGN_IN_ERROR_MESSAGES = {
+    expired: "Your sign-in took too long. Please try again.",
+    cancelled: "Sign-in was cancelled.",
+    other: "Sign-in didn't complete. Please try again.",
+};
+const STORAGE_BLOCKED_MESSAGE = "This browser is blocking this site's storage, so you can't be signed in automatically. Please try again.";
+const ME_PATH = authRoutePath(AUTH_ROUTE_PREFIX, "me");
+const APPS_PATH = authRoutePath(AUTH_ROUTE_PREFIX, "apps");
+const LOGOUT_PATH = authRoutePath(AUTH_ROUTE_PREFIX, "logout");
+const LOGIN_PATH = authRoutePath(AUTH_ROUTE_PREFIX, "login");
+function isSignInErrorCode(value) {
+    return SIGNIN_ERROR_CODES.includes(value);
+}
+function asError(err) {
+    return err instanceof Error ? err : new Error(String(err));
+}
+export function createAuthSession(env) {
+    let state = { status: "checking" };
+    const listeners = new Set();
+    let started = false;
+    let teardown = [];
+    let channel = null;
+    /** Which load may still change state: every fresh load and every sign-out bumps it, and
+     *  a load that finds it moved on drops its answer. */
+    let epoch = 0;
+    let retryTimer = null;
+    let retryAttempt = 0;
+    let claimTimer = null;
+    let checkInFlight = null;
+    let lastCheckedAt = 0;
+    /** The `signin_error` this page arrived with (read once, then stripped from the URL). */
+    let arrivedSignInError = null;
+    /** The user last verified — kept through an outage, for display and identity checks. */
+    let lastUser = null;
+    let lastApps = [];
+    let lastAppsError = null;
+    /** Set once this page has handed the browser to a top-level navigation. Until the
+     *  page goes (or comes back from the back/forward cache) nothing may act on its behalf:
+     *  a focus event in that moment must not re-check and show a false sign-in failure. */
+    let navigating = false;
+    let navigationStallTimer = null;
+    /** Loads started and not yet settled — a stale load's late refresh token is dropped
+     *  only when no newer load shares that refresh (see `load`). */
+    let loadsInFlight = 0;
+    function setState(next) {
+        state = next;
+        for (const listener of listeners)
+            listener();
+    }
+    function clearTimer(timer) {
+        if (timer !== null)
+            clearTimeout(timer);
+        return null;
+    }
+    // ── Storage-backed guard and claim ────────────────────────────────────────────────
+    /** The loop guard's record: when this tab last started a sign-in. `blocked` when
+     *  sessionStorage can't be read — the guard can't be kept, so the tab must not
+     *  redirect automatically (fail closed). */
+    function readAttempt() {
+        try {
+            const raw = env.sessionStorage().getItem(SIGN_IN_ATTEMPT_KEY);
+            const startedAt = raw === null ? null : Number(raw);
+            return {
+                blocked: false,
+                startedAt: Number.isFinite(startedAt) ? startedAt : null,
+            };
+        }
+        catch {
+            return { blocked: true };
+        }
+    }
+    /** Records a sign-in start; false when sessionStorage refuses. */
+    function writeAttempt() {
+        try {
+            env.sessionStorage().setItem(SIGN_IN_ATTEMPT_KEY, String(Date.now()));
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+    function clearAttempt() {
+        try {
+            env.sessionStorage().removeItem(SIGN_IN_ATTEMPT_KEY);
+        }
+        catch {
+            // Nothing was recorded that could be read back either.
+        }
+    }
+    /** When another tab claimed the sign-in, if that claim is still live. A blocked
+     *  localStorage means no claim — a courtesy lost, never correctness (every attempt
+     *  has its own server-side cookie). */
+    function liveClaimAt() {
+        try {
+            const at = Number(env.localStorage().getItem(SIGN_IN_CLAIM_KEY));
+            return Number.isFinite(at) && at > 0 && Date.now() - at < SIGN_IN_CLAIM_MS
+                ? at
+                : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    function writeClaim() {
+        try {
+            env.localStorage().setItem(SIGN_IN_CLAIM_KEY, String(Date.now()));
+        }
+        catch {
+            // See liveClaimAt.
+        }
+    }
+    function releaseClaim() {
+        try {
+            env.localStorage().removeItem(SIGN_IN_CLAIM_KEY);
+        }
+        catch {
+            // See liveClaimAt.
+        }
+    }
+    // ── URLs ──────────────────────────────────────────────────────────────────────────
+    function navigate(url) {
+        navigating = true;
+        navigationStallTimer = clearTimer(navigationStallTimer);
+        navigationStallTimer = setTimeout(() => {
+            navigationStallTimer = null;
+            navigating = false;
+        }, NAVIGATION_STALL_MS);
+        env.navigate(url);
+    }
+    /** `GET {api}{prefix}/login`, carrying this page's `path?query#hash` when it is a
+     *  safe return target. */
+    function loginUrl() {
+        const here = new URL(env.href());
+        const target = safeReturnTarget(`${here.pathname}${here.search}${here.hash}`);
+        const url = new URL(absoluteApiUrl(LOGIN_PATH, new URL(env.href()).origin));
+        if (target !== null)
+            url.searchParams.set(RETURN_TO_QUERY_PARAM, target);
+        return url.toString();
+    }
+    /** Reads and strips `signin_error` from the URL this page arrived with. */
+    function consumeArrivedSignInError() {
+        const url = new URL(env.href());
+        const raw = url.searchParams.get(SIGNIN_ERROR_QUERY_PARAM);
+        if (raw === null)
+            return null;
+        url.searchParams.delete(SIGNIN_ERROR_QUERY_PARAM);
+        env.replaceUrl(url.toString());
+        return isSignInErrorCode(raw) ? raw : "other";
+    }
+    // ── Transitions ───────────────────────────────────────────────────────────────────
+    function signInFailed(message) {
+        releaseClaim();
+        setState({
+            status: "error",
+            kind: "sign-in-failed",
+            error: new Error(message),
+        });
+    }
+    function loadFailed(err) {
+        retryAttempt = 0;
+        setState({ status: "error", kind: "load-failed", error: asError(err) });
+    }
+    /** The server says this browser has no session. */
+    function signedOutVerdict(reason) {
+        retryTimer = clearTimer(retryTimer);
+        retryAttempt = 0;
+        setAccessToken(null);
+        if (arrivedSignInError !== null) {
+            signInFailed(SIGN_IN_ERROR_MESSAGES[arrivedSignInError]);
+            return;
+        }
+        const attempt = readAttempt();
+        if (attempt.blocked) {
+            signInFailed(STORAGE_BLOCKED_MESSAGE);
+            return;
+        }
+        if (attempt.startedAt !== null &&
+            Date.now() - attempt.startedAt < SIGN_IN_LOOP_WINDOW_MS) {
+            // Back from flytedesk ID (or Back from its page) and still signed out: never loop.
+            signInFailed(SIGN_IN_ERROR_MESSAGES.other);
+            return;
+        }
+        setState({ status: "signing-in", reason });
+        proceedToSignIn();
+    }
+    /** Navigates to flytedesk ID when this tab may: it is visible and no other tab holds a
+     *  live sign-in claim. Otherwise it waits (a hidden tab re-checks when it becomes
+     *  visible; a claim-blocked tab retries when the claim expires or on `signed-in`). */
+    function proceedToSignIn() {
+        if (state.status !== "signing-in" || !env.isVisible())
+            return;
+        const claimedAt = liveClaimAt();
+        if (claimedAt !== null) {
+            claimTimer = clearTimer(claimTimer);
+            claimTimer = setTimeout(() => {
+                claimTimer = null;
+                proceedToSignIn();
+            }, SIGN_IN_CLAIM_MS - (Date.now() - claimedAt));
+            return;
+        }
+        if (!writeAttempt()) {
+            signInFailed(STORAGE_BLOCKED_MESSAGE);
+            return;
+        }
+        writeClaim();
+        navigate(loginUrl());
+    }
+    function enterAuthenticated(user, apps, appsError) {
+        retryTimer = clearTimer(retryTimer);
+        claimTimer = clearTimer(claimTimer);
+        retryAttempt = 0;
+        lastCheckedAt = Date.now();
+        const justSignedIn = (() => {
+            const attempt = readAttempt();
+            return !attempt.blocked && attempt.startedAt !== null;
+        })();
+        arrivedSignInError = null;
+        lastUser = user;
+        lastApps = apps;
+        lastAppsError = appsError;
+        setState({ status: "authenticated", user, apps, appsError });
+        if (justSignedIn) {
+            // This tab just completed a sign-in round trip: tell the tabs waiting on it.
+            clearAttempt();
+            releaseClaim();
+            channel?.post({ type: "signed-in", userId: user.id });
+        }
+    }
+    function scheduleRetry(err) {
+        if (retryTimer !== null)
+            return;
+        const retryInMs = unavailableRetryDelayMs(retryAttempt);
+        retryAttempt += 1;
+        setState({
+            status: "unavailable",
+            user: lastUser,
+            apps: lastApps,
+            appsError: lastAppsError,
+            error: err,
+            retryInMs,
+        });
+        retryTimer = setTimeout(() => {
+            retryTimer = null;
+            void load({ show: false });
+        }, retryInMs);
+    }
+    /** The switcher feed, non-blocking (AK-23, N2): a failure is `apps: []` plus the error,
+     *  never a failed load and never a session verdict. */
+    async function loadApps() {
+        try {
+            const res = await apiRequest(APPS_PATH, {
+                skipAuthRetry: true,
+                deadlineMs: AUTH_REQUEST_DEADLINE_MS,
+            });
+            return { apps: res.apps, error: null };
+        }
+        catch (err) {
+            return { apps: [], error: asError(err) };
+        }
+    }
+    /**
+     * Verifies the session from the refresh cookie: `POST /refresh` (the shared,
+     * single-flighted one), then `/me`, then `/apps`. `show` puts up the checking state
+     * first (a fresh load); a retry keeps showing what it was showing until it has an
+     * answer. A refresh 401, or `/me` 401 right after a good refresh, is the verdict.
+     */
+    async function load({ show }) {
+        epoch += 1;
+        loadsInFlight += 1;
+        const mine = epoch;
+        const current = () => mine === epoch;
+        claimTimer = clearTimer(claimTimer);
+        if (show) {
+            retryTimer = clearTimer(retryTimer);
+            retryAttempt = 0;
+            setState({ status: "checking" });
+        }
+        try {
+            const token = await refreshAccessToken();
+            if (!current()) {
+                // A newer decision owns the state. The shared refresh stored its token as it
+                // landed. When a newer LOAD is in flight it shares that same refresh and needs
+                // the token, so it is left alone. When none is, and the decision is that this tab
+                // holds no session (signed out elsewhere, signing out), the late token must not
+                // linger in memory.
+                const noSession = state.status !== "authenticated" && state.status !== "unavailable";
+                if (loadsInFlight === 1 && noSession)
+                    setAccessToken(null);
+                return;
+            }
+            if (token === null) {
+                signedOutVerdict(lastUser === null ? "signed-out" : "expired");
+                return;
+            }
+            const me = await apiRequest(ME_PATH, {
+                skipAuthRetry: true,
+                deadlineMs: AUTH_REQUEST_DEADLINE_MS,
+            });
+            if (!current())
+                return;
+            if (lastUser !== null && me.user.id !== lastUser.id) {
+                // Another tab signed this browser in as someone else: nothing this page holds in
+                // memory may be shown as the new user.
+                env.reload();
+                return;
+            }
+            const feed = await loadApps();
+            if (!current())
+                return;
+            enterAuthenticated(me.user, feed.apps, feed.error);
+        }
+        catch (err) {
+            if (!current())
+                return;
+            if (err instanceof AuthUnavailableError) {
+                scheduleRetry(err);
+                return;
+            }
+            if (err instanceof ApiRequestError && err.status === 401) {
+                signedOutVerdict(lastUser === null ? "signed-out" : "expired");
+                return;
+            }
+            loadFailed(err);
+        }
+        finally {
+            loadsInFlight -= 1;
+        }
+    }
+    /** One cheap verification of a signed-in session — `GET /me` through the normal
+     *  401 -> refresh -> retry path, so a refused refresh ends the session through
+     *  `onSessionEnded` and an outage becomes `unavailable` through `onAuthUnavailable`.
+     *  Single-flighted per tab. A failure that is neither a verdict nor an outage (a 500)
+     *  changes nothing: the next check tries again. */
+    function check() {
+        if (state.status !== "authenticated")
+            return Promise.resolve();
+        checkInFlight ??= (async () => {
+            const mine = epoch;
+            try {
+                const me = await apiRequest(ME_PATH, {
+                    deadlineMs: AUTH_REQUEST_DEADLINE_MS,
+                });
+                if (mine !== epoch || state.status !== "authenticated")
+                    return;
+                lastCheckedAt = Date.now();
+                if (me.user.id !== state.user.id) {
+                    env.reload();
+                    return;
+                }
+                lastUser = me.user;
+                setState({ ...state, user: me.user });
+            }
+            catch (err) {
+                // A refused refresh (onSessionEnded) and an outage (onAuthUnavailable) have
+                // already moved the state. What is left to decide here: `/me` answering 401
+                // after a SUCCESSFUL refresh is the same verdict `load` treats it as.
+                const stillCurrent = mine === epoch && state.status === "authenticated";
+                if (stillCurrent &&
+                    err instanceof ApiRequestError &&
+                    !(err instanceof AuthUnavailableError) &&
+                    err.status === 401) {
+                    signedOutVerdict("expired");
+                }
+            }
+            finally {
+                checkInFlight = null;
+            }
+        })();
+        return checkInFlight;
+    }
+    // ── Events ────────────────────────────────────────────────────────────────────────
+    function onAttention() {
+        if (navigating)
+            return;
+        if (state.status === "signing-in") {
+            // Another tab may have signed in while this one waited: check before navigating.
+            void load({ show: false });
+            return;
+        }
+        if (state.status === "authenticated" &&
+            Date.now() - lastCheckedAt >= FOCUS_CHECK_MIN_INTERVAL_MS) {
+            void check();
+        }
+    }
+    function onMessage(message) {
+        if (navigating)
+            return;
+        if (message.type === "signed-in") {
+            if (state.status === "authenticated") {
+                if (state.user.id !== message.userId)
+                    env.reload();
+                return;
+            }
+            if (state.status !== "signing-out")
+                void load({ show: false });
+            return;
+        }
+        // signed-out: another tab signed this browser out.
+        if (state.status === "signing-out")
+            return;
+        epoch += 1;
+        retryTimer = clearTimer(retryTimer);
+        setAccessToken(null);
+        lastUser = null;
+        setState({ status: "signing-in", reason: "signed-out" });
+        proceedToSignIn();
+    }
+    function start() {
+        if (started)
+            return;
+        started = true;
+        arrivedSignInError = consumeArrivedSignInError();
+        channel = env.openChannel(onMessage);
+        teardown = [
+            onSessionEnded(() => {
+                if (state.status !== "authenticated" && state.status !== "unavailable")
+                    return;
+                epoch += 1;
+                signedOutVerdict("expired");
+            }),
+            onAuthUnavailable((err) => {
+                if (state.status === "authenticated")
+                    scheduleRetry(err);
+            }),
+            env.onAttention(onAttention),
+            env.onRestore(() => {
+                navigating = false;
+                navigationStallTimer = clearTimer(navigationStallTimer);
+                void load({ show: true });
+            }),
+            (() => {
+                const timer = setInterval(() => {
+                    if (env.isVisible())
+                        void check();
+                }, SESSION_CHECK_INTERVAL_MS);
+                return () => clearInterval(timer);
+            })(),
+        ];
+        void load({ show: true });
+    }
+    return {
+        getSnapshot() {
+            return state;
+        },
+        subscribe(listener) {
+            listeners.add(listener);
+            start();
+            return () => {
+                listeners.delete(listener);
+            };
+        },
+        async signOut() {
+            if (state.status !== "authenticated" && state.status !== "unavailable") {
+                throw new Error(`Cannot sign out while ${state.status}`);
+            }
+            epoch += 1;
+            retryTimer = clearTimer(retryTimer);
+            setState({ status: "signing-out" });
+            let endSessionUrl;
+            try {
+                const res = await apiRequest(LOGOUT_PATH, {
+                    method: "POST",
+                    skipAuthRetry: true,
+                    deadlineMs: AUTH_REQUEST_DEADLINE_MS,
+                });
+                endSessionUrl = res.endSessionUrl;
+            }
+            catch (err) {
+                const carried = err instanceof ApiRequestError ? err.body.endSessionUrl : undefined;
+                if (typeof carried !== "string") {
+                    // The server did not end the session (or we can't tell): find out what it is.
+                    void load({ show: false });
+                    throw err;
+                }
+                // 502 logout_store_failed: the session is over anyway (its cookie is cleared).
+                endSessionUrl = carried;
+            }
+            setAccessToken(null);
+            lastUser = null;
+            channel?.post({ type: "signed-out" });
+            navigate(endSessionUrl);
+        },
+        retry() {
+            if (state.status !== "error")
+                return;
+            if (state.kind === "load-failed") {
+                void load({ show: true });
+                return;
+            }
+            arrivedSignInError = null;
+            writeAttempt();
+            navigate(loginUrl());
+        },
+        async refreshUser() {
+            // A check already in flight may have read the user before the change being
+            // refreshed for: wait it out, then read again.
+            if (checkInFlight)
+                await checkInFlight;
+            await check();
+        },
+        stop() {
+            for (const undo of teardown)
+                undo();
+            teardown = [];
+            channel?.close();
+            channel = null;
+            retryTimer = clearTimer(retryTimer);
+            claimTimer = clearTimer(claimTimer);
+            navigationStallTimer = clearTimer(navigationStallTimer);
+            listeners.clear();
+            started = false;
+        },
+    };
+}
+//# sourceMappingURL=authSession.js.map

package/dist/auth/client/authSession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authSession.js","sourceRoot":"","sources":["../../../src/auth/client/authSession.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EACL,cAAc,EACd,UAAU,EACV,eAAe,EACf,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,EACd,kBAAkB,EAClB,cAAc,GACf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,aAAa,EACb,qBAAqB,EACrB,kBAAkB,EAClB,wBAAwB,GAGzB,MAAM,oBAAoB,CAAC;AAE5B,+DAA+D;AAC/D,MAAM,CAAC,MAAM,yBAAyB,GAAG,EAAE,GAAG,MAAM,CAAC;AACrD,sEAAsE;AACtE,MAAM,CAAC,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAClD,yFAAyF;AACzF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAG,MAAM,CAAC;AACjD;kDACkD;AAClD,MAAM,CAAC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AACvC;;wEAEwE;AACxE,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAC1C,qFAAqF;AACrF,MAAM,CAAC,MAAM,yBAAyB,GAAG,KAAK,CAAC;AAC/C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C,kFAAkF;AAClF,MAAM,CAAC,MAAM,mBAAmB,GAAG,wCAAwC,CAAC;AAC5E,MAAM,CAAC,MAAM,iBAAiB,GAAG,oCAAoC,CAAC;AACtE,MAAM,CAAC,MAAM,eAAe,GAAG,2BAA2B,CAAC;AAE3D;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAe,EACf,SAAuB,IAAI,CAAC,MAAM;IAElC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CACtB,yBAAyB,GAAG,CAAC,IAAI,OAAO,EACxC,wBAAwB,CACzB,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,sBAAsB,GAAoC;IACrE,OAAO,EAAE,+CAA+C;IACxD,SAAS,EAAE,wBAAwB;IACnC,KAAK,EAAE,4CAA4C;CACpD,CAAC;AACF,MAAM,uBAAuB,GAC3B,0GAA0G,CAAC;AA6H7G,MAAM,OAAO,GAAG,aAAa,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;AACvD,MAAM,SAAS,GAAG,aAAa,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC;AAC3D,MAAM,WAAW,GAAG,aAAa,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;AAC/D,MAAM,UAAU,GAAG,aAAa,CAAC,iBAAiB,EAAE,OAAO,CAAC,CAAC;AAM7D,SAAS,iBAAiB,CAAC,KAAa;IACtC,OAAQ,kBAAwC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,SAAS,OAAO,CAAC,GAAY;IAC3B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,iBAAiB,CAC/B,GAA2B;IAE3B,IAAI,KAAK,GAAiC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACjE,MAAM,SAAS,GAAG,IAAI,GAAG,EAAc,CAAC;IACxC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,QAAQ,GAAsB,EAAE,CAAC;IACrC,IAAI,OAAO,GAA6D,IAAI,CAAC;IAE7E;0DACsD;IACtD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,UAAU,GAAyC,IAAI,CAAC;IAC5D,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,UAAU,GAAyC,IAAI,CAAC;IAC5D,IAAI,aAAa,GAAyB,IAAI,CAAC;IAC/C,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,yFAAyF;IACzF,IAAI,kBAAkB,GAA2B,IAAI,CAAC;IACtD,wFAAwF;IACxF,IAAI,QAAQ,GAAsB,IAAI,CAAC;IACvC,IAAI,QAAQ,GAAuB,EAAE,CAAC;IACtC,IAAI,aAAa,GAAiB,IAAI,CAAC;IACvC;;2FAEuF;IACvF,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,oBAAoB,GAAyC,IAAI,CAAC;IACtE;oEACgE;IAChE,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,SAAS,QAAQ,CAAC,IAAkC;QAClD,KAAK,GAAG,IAAI,CAAC;QACb,KAAK,MAAM,QAAQ,IAAI,SAAS;YAAE,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAED,SAAS,UAAU,CAAC,KAA2C;QAC7D,IAAI,KAAK,KAAK,IAAI;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,qFAAqF;IAErF;;gDAE4C;IAC5C,SAAS,WAAW;QAElB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,GAAG,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC;YAC9D,MAAM,SAAS,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACpD,OAAO;gBACL,OAAO,EAAE,KAAK;gBACd,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI;aACzD,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,kEAAkE;IAClE,SAAS,YAAY;QACnB,IAAI,CAAC;YACH,GAAG,CAAC,cAAc,EAAE,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACtE,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,SAAS,YAAY;QACnB,IAAI,CAAC;YACH,GAAG,CAAC,cAAc,EAAE,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,uDAAuD;QACzD,CAAC;IACH,CAAC;IAED;;2CAEuC;IACvC,SAAS,WAAW;QAClB,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC;YACjE,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,gBAAgB;gBACxE,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,IAAI,CAAC;QACX,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,SAAS,UAAU;QACjB,IAAI,CAAC;YACH,GAAG,CAAC,YAAY,EAAE,CAAC,OAAO,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB;QACrB,CAAC;IACH,CAAC;IAED,SAAS,YAAY;QACnB,IAAI,CAAC;YACH,GAAG,CAAC,YAAY,EAAE,CAAC,UAAU,CAAC,iBAAiB,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,mBAAmB;QACrB,CAAC;IACH,CAAC;IAED,qFAAqF;IAErF,SAAS,QAAQ,CAAC,GAAW;QAC3B,UAAU,GAAG,IAAI,CAAC;QAClB,oBAAoB,GAAG,UAAU,CAAC,oBAAoB,CAAC,CAAC;QACxD,oBAAoB,GAAG,UAAU,CAAC,GAAG,EAAE;YACrC,oBAAoB,GAAG,IAAI,CAAC;YAC5B,UAAU,GAAG,KAAK,CAAC;QACrB,CAAC,EAAE,mBAAmB,CAAC,CAAC;QACxB,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC;IAED;8BAC0B;IAC1B,SAAS,QAAQ;QACf,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACjC,MAAM,MAAM,GAAG,gBAAgB,CAC7B,GAAG,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,CAC7C,CAAC;QACF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,UAAU,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC5E,IAAI,MAAM,KAAK,IAAI;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;QACzE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED,2EAA2E;IAC3E,SAAS,yBAAyB;QAChC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAC3D,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAC9B,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC;QAClD,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/B,OAAO,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;IAChD,CAAC;IAED,qFAAqF;IAErF,SAAS,YAAY,CAAC,OAAe;QACnC,YAAY,EAAE,CAAC;QACf,QAAQ,CAAC;YACP,MAAM,EAAE,OAAO;YACf,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,IAAI,KAAK,CAAC,OAAO,CAAC;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,SAAS,UAAU,CAAC,GAAY;QAC9B,YAAY,GAAG,CAAC,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC1E,CAAC;IAED,mDAAmD;IACnD,SAAS,gBAAgB,CAAC,MAAgC;QACxD,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACpC,YAAY,GAAG,CAAC,CAAC;QACjB,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,kBAAkB,KAAK,IAAI,EAAE,CAAC;YAChC,YAAY,CAAC,sBAAsB,CAAC,kBAAkB,CAAC,CAAC,CAAC;YACzD,OAAO;QACT,CAAC;QACD,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;QAC9B,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,YAAY,CAAC,uBAAuB,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QACD,IACE,OAAO,CAAC,SAAS,KAAK,IAAI;YAC1B,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,GAAG,sBAAsB,EACvD,CAAC;YACD,mFAAmF;YACnF,YAAY,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YAC3C,OAAO;QACT,CAAC;QACD,QAAQ,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3C,eAAe,EAAE,CAAC;IACpB,CAAC;IAED;;0FAEsF;IACtF,SAAS,eAAe;QACtB,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE;YAAE,OAAO;QAC9D,MAAM,SAAS,GAAG,WAAW,EAAE,CAAC;QAChC,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;YACpC,UAAU,GAAG,UAAU,CACrB,GAAG,EAAE;gBACH,UAAU,GAAG,IAAI,CAAC;gBAClB,eAAe,EAAE,CAAC;YACpB,CAAC,EACD,gBAAgB,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAC5C,CAAC;YACF,OAAO;QACT,CAAC;QACD,IAAI,CAAC,YAAY,EAAE,EAAE,CAAC;YACpB,YAAY,CAAC,uBAAuB,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QACD,UAAU,EAAE,CAAC;QACb,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IACvB,CAAC;IAED,SAAS,kBAAkB,CACzB,IAAgB,EAChB,IAAwB,EACxB,SAAuB;QAEvB,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACpC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACpC,YAAY,GAAG,CAAC,CAAC;QACjB,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC3B,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE;YACzB,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;YAC9B,OAAO,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC;QACxD,CAAC,CAAC,EAAE,CAAC;QACL,kBAAkB,GAAG,IAAI,CAAC;QAC1B,QAAQ,GAAG,IAAI,CAAC;QAChB,QAAQ,GAAG,IAAI,CAAC;QAChB,aAAa,GAAG,SAAS,CAAC;QAC1B,QAAQ,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7D,IAAI,YAAY,EAAE,CAAC;YACjB,6EAA6E;YAC7E,YAAY,EAAE,CAAC;YACf,YAAY,EAAE,CAAC;YACf,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,SAAS,aAAa,CAAC,GAAyB;QAC9C,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO;QAChC,MAAM,SAAS,GAAG,uBAAuB,CAAC,YAAY,CAAC,CAAC;QACxD,YAAY,IAAI,CAAC,CAAC;QAClB,QAAQ,CAAC;YACP,MAAM,EAAE,aAAa;YACrB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,QAAQ;YACd,SAAS,EAAE,aAAa;YACxB,KAAK,EAAE,GAAG;YACV,SAAS;SACV,CAAC,CAAC;QACH,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;YAC3B,UAAU,GAAG,IAAI,CAAC;YAClB,KAAK,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7B,CAAC,EAAE,SAAS,CAAC,CAAC;IAChB,CAAC;IAED;2DACuD;IACvD,KAAK,UAAU,QAAQ;QAIrB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAA+B,SAAS,EAAE;gBACpE,aAAa,EAAE,IAAI;gBACnB,UAAU,EAAE,wBAAwB;aACrC,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,IAAI,CAAC,EAAE,IAAI,EAAqB;QAC7C,KAAK,IAAI,CAAC,CAAC;QACX,aAAa,IAAI,CAAC,CAAC;QACnB,MAAM,IAAI,GAAG,KAAK,CAAC;QACnB,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,KAAK,KAAK,CAAC;QACrC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACpC,IAAI,IAAI,EAAE,CAAC;YACT,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;YACpC,YAAY,GAAG,CAAC,CAAC;YACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,kBAAkB,EAAE,CAAC;YACzC,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;gBACf,6EAA6E;gBAC7E,+EAA+E;gBAC/E,kFAAkF;gBAClF,gFAAgF;gBAChF,oBAAoB;gBACpB,MAAM,SAAS,GACb,KAAK,CAAC,MAAM,KAAK,eAAe,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,CAAC;gBACrE,IAAI,aAAa,KAAK,CAAC,IAAI,SAAS;oBAAE,cAAc,CAAC,IAAI,CAAC,CAAC;gBAC3D,OAAO;YACT,CAAC;YACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;gBACnB,gBAAgB,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAC/D,OAAO;YACT,CAAC;YACD,MAAM,EAAE,GAAG,MAAM,UAAU,CAAuB,OAAO,EAAE;gBACzD,aAAa,EAAE,IAAI;gBACnB,UAAU,EAAE,wBAAwB;aACrC,CAAC,CAAC;YACH,IAAI,CAAC,OAAO,EAAE;gBAAE,OAAO;YACvB,IAAI,QAAQ,KAAK,IAAI,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACpD,iFAAiF;gBACjF,uCAAuC;gBACvC,GAAG,CAAC,MAAM,EAAE,CAAC;gBACb,OAAO;YACT,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,QAAQ,EAAE,CAAC;YAC9B,IAAI,CAAC,OAAO,EAAE;gBAAE,OAAO;YACvB,kBAAkB,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,OAAO,EAAE;gBAAE,OAAO;YACvB,IAAI,GAAG,YAAY,oBAAoB,EAAE,CAAC;gBACxC,aAAa,CAAC,GAAG,CAAC,CAAC;gBACnB,OAAO;YACT,CAAC;YACD,IAAI,GAAG,YAAY,eAAe,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACzD,gBAAgB,CAAC,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAC/D,OAAO;YACT,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,CAAC;QAClB,CAAC;gBAAS,CAAC;YACT,aAAa,IAAI,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED;;;;uDAImD;IACnD,SAAS,KAAK;QACZ,IAAI,KAAK,CAAC,MAAM,KAAK,eAAe;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC/D,aAAa,KAAK,CAAC,KAAK,IAAI,EAAE;YAC5B,MAAM,IAAI,GAAG,KAAK,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,MAAM,UAAU,CAAuB,OAAO,EAAE;oBACzD,UAAU,EAAE,wBAAwB;iBACrC,CAAC,CAAC;gBACH,IAAI,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,eAAe;oBAAE,OAAO;gBAC/D,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBAC3B,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;oBACjC,GAAG,CAAC,MAAM,EAAE,CAAC;oBACb,OAAO;gBACT,CAAC;gBACD,QAAQ,GAAG,EAAE,CAAC,IAAI,CAAC;gBACnB,QAAQ,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,4EAA4E;gBAC5E,4EAA4E;gBAC5E,sEAAsE;gBACtE,MAAM,YAAY,GAAG,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,eAAe,CAAC;gBACxE,IACE,YAAY;oBACZ,GAAG,YAAY,eAAe;oBAC9B,CAAC,CAAC,GAAG,YAAY,oBAAoB,CAAC;oBACtC,GAAG,CAAC,MAAM,KAAK,GAAG,EAClB,CAAC;oBACD,gBAAgB,CAAC,SAAS,CAAC,CAAC;gBAC9B,CAAC;YACH,CAAC;oBAAS,CAAC;gBACT,aAAa,GAAG,IAAI,CAAC;YACvB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,aAAa,CAAC;IACvB,CAAC;IAED,qFAAqF;IAErF,SAAS,WAAW;QAClB,IAAI,UAAU;YAAE,OAAO;QACvB,IAAI,KAAK,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;YAClC,iFAAiF;YACjF,KAAK,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3B,OAAO;QACT,CAAC;QACD,IACE,KAAK,CAAC,MAAM,KAAK,eAAe;YAChC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,IAAI,2BAA2B,EACzD,CAAC;YACD,KAAK,KAAK,EAAE,CAAC;QACf,CAAC;IACH,CAAC;IAED,SAAS,SAAS,CAAC,OAAuB;QACxC,IAAI,UAAU;YAAE,OAAO;QACvB,IAAI,OAAO,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YACjC,IAAI,KAAK,CAAC,MAAM,KAAK,eAAe,EAAE,CAAC;gBACrC,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,OAAO,CAAC,MAAM;oBAAE,GAAG,CAAC,MAAM,EAAE,CAAC;gBACnD,OAAO;YACT,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa;gBAAE,KAAK,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC/D,OAAO;QACT,CAAC;QACD,mDAAmD;QACnD,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa;YAAE,OAAO;QAC3C,KAAK,IAAI,CAAC,CAAC;QACX,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACpC,cAAc,CAAC,IAAI,CAAC,CAAC;QACrB,QAAQ,GAAG,IAAI,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;QACzD,eAAe,EAAE,CAAC;IACpB,CAAC;IAED,SAAS,KAAK;QACZ,IAAI,OAAO;YAAE,OAAO;QACpB,OAAO,GAAG,IAAI,CAAC;QACf,kBAAkB,GAAG,yBAAyB,EAAE,CAAC;QACjD,OAAO,GAAG,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;QACrC,QAAQ,GAAG;YACT,cAAc,CAAC,GAAG,EAAE;gBAClB,IAAI,KAAK,CAAC,MAAM,KAAK,eAAe,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa;oBACpE,OAAO;gBACT,KAAK,IAAI,CAAC,CAAC;gBACX,gBAAgB,CAAC,SAAS,CAAC,CAAC;YAC9B,CAAC,CAAC;YACF,iBAAiB,CAAC,CAAC,GAAG,EAAE,EAAE;gBACxB,IAAI,KAAK,CAAC,MAAM,KAAK,eAAe;oBAAE,aAAa,CAAC,GAAG,CAAC,CAAC;YAC3D,CAAC,CAAC;YACF,GAAG,CAAC,WAAW,CAAC,WAAW,CAAC;YAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBACjB,UAAU,GAAG,KAAK,CAAC;gBACnB,oBAAoB,GAAG,UAAU,CAAC,oBAAoB,CAAC,CAAC;gBACxD,KAAK,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YAC5B,CAAC,CAAC;YACF,CAAC,GAAG,EAAE;gBACJ,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE;oBAC7B,IAAI,GAAG,CAAC,SAAS,EAAE;wBAAE,KAAK,KAAK,EAAE,CAAC;gBACpC,CAAC,EAAE,yBAAyB,CAAC,CAAC;gBAC9B,OAAO,GAAG,EAAE,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;YACpC,CAAC,CAAC,EAAE;SACL,CAAC;QACF,KAAK,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5B,CAAC;IAED,OAAO;QACL,WAAW;YACT,OAAO,KAA2C,CAAC;QACrD,CAAC;QAED,SAAS,CAAC,QAAQ;YAChB,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxB,KAAK,EAAE,CAAC;YACR,OAAO,GAAG,EAAE;gBACV,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC7B,CAAC,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,OAAO;YACX,IAAI,KAAK,CAAC,MAAM,KAAK,eAAe,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;gBACvE,MAAM,IAAI,KAAK,CAAC,yBAAyB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;YAC3D,CAAC;YACD,KAAK,IAAI,CAAC,CAAC;YACX,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;YACpC,QAAQ,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC;YACpC,IAAI,aAAqB,CAAC;YAC1B,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAA4B,WAAW,EAAE;oBACnE,MAAM,EAAE,MAAM;oBACd,aAAa,EAAE,IAAI;oBACnB,UAAU,EAAE,wBAAwB;iBACrC,CAAC,CAAC;gBACH,aAAa,GAAG,GAAG,CAAC,aAAa,CAAC;YACpC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,OAAO,GACX,GAAG,YAAY,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,CAAC;gBACtE,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;oBAChC,8EAA8E;oBAC9E,KAAK,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;oBAC3B,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,+EAA+E;gBAC/E,aAAa,GAAG,OAAO,CAAC;YAC1B,CAAC;YACD,cAAc,CAAC,IAAI,CAAC,CAAC;YACrB,QAAQ,GAAG,IAAI,CAAC;YAChB,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;YACtC,QAAQ,CAAC,aAAa,CAAC,CAAC;QAC1B,CAAC;QAED,KAAK;YACH,IAAI,KAAK,CAAC,MAAM,KAAK,OAAO;gBAAE,OAAO;YACrC,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;gBACjC,KAAK,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1B,OAAO;YACT,CAAC;YACD,kBAAkB,GAAG,IAAI,CAAC;YAC1B,YAAY,EAAE,CAAC;YACf,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;QACvB,CAAC;QAED,KAAK,CAAC,WAAW;YACf,2EAA2E;YAC3E,+CAA+C;YAC/C,IAAI,aAAa;gBAAE,MAAM,aAAa,CAAC;YACvC,MAAM,KAAK,EAAE,CAAC;QAChB,CAAC;QAED,IAAI;YACF,KAAK,MAAM,IAAI,IAAI,QAAQ;gBAAE,IAAI,EAAE,CAAC;YACpC,QAAQ,GAAG,EAAE,CAAC;YACd,OAAO,EAAE,KAAK,EAAE,CAAC;YACjB,OAAO,GAAG,IAAI,CAAC;YACf,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;YACpC,UAAU,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;YACpC,oBAAoB,GAAG,UAAU,CAAC,oBAAoB,CAAC,CAAC;YACxD,SAAS,CAAC,KAAK,EAAE,CAAC;YAClB,OAAO,GAAG,KAAK,CAAC;QAClB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/client/browserEnvironment.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The real browser behind `./authSession.ts`'s `AuthSessionEnvironment` (AK-35), and the
+ * one per-tab `authSession` every app reads. Browser-safe, ZERO Node imports.
+ *
+ * This package's tsconfig deliberately has no "DOM" lib (it is Node-first — see
+ * `./httpClient.ts`'s own `declare const window`), so the few browser globals used here
+ * are declared below with exactly the members this file touches. The declarations are
+ * erased at compile time and resolve to the real browser objects at runtime.
+ */
+import { type AuthSessionController, type AuthSessionEnvironment } from "./authSession.js";
+export declare function browserEnvironment(): AuthSessionEnvironment;
+/**
+ * THE session of this tab — one lifecycle, however many components or modules read it.
+ * Created on first use (never at import, so importing this module is safe during SSR or
+ * in a Node test). React code reads it through `useAuthSession()`; anything else (an
+ * API helper, a store outside React) through `authSession.getSnapshot()` and
+ * `authSession.subscribe()`.
+ */
+export declare const authSession: Omit<AuthSessionController, "stop">;
+/** Test seam (`@flytedesk/app-kit/auth/client/testing`): stops and forgets the tab's
+ *  lifecycle, so the next use starts a fresh one. */
+export declare function resetAuthSession(): void;