@frontmcp/auth 1.3.0 → 1.4.0

package/options/interfaces.d.ts

@@ -1,6 +1,7 @@
-import { JSONWebKeySet, JWK } from '../common/jwt.types';
-import type { RedisConfig } from '../session/transport-session.types';
 import type { CimdConfigInput } from '../cimd';
+import type { AuthLogger } from '../common';
+import { type JSONWebKeySet, type JWK } from '../common/jwt.types';
+import type { RedisConfig } from '../session/transport-session.types';
 /**
  * Public access configuration for tools/prompts
  */
@@ -116,15 +117,96 @@ export interface RemoteProviderConfig {
     /** User info endpoint override */
     userInfoEndpoint?: string;
 }
+/**
+ * SQLite configuration for token storage.
+ *
+ * `path` is required: the auth layer has no default-path resolver, so SQLite
+ * persistence is opt-in and explicit.
+ */
+export interface TokenStorageSqliteConfig {
+    /** Path to the `.sqlite` database file used for auth persistence. */
+    path: string;
+    /** Optional at-rest value encryption (AES-256-GCM via HKDF-SHA256). */
+    encryption?: {
+        secret: string;
+    };
+    /** Interval in ms for purging expired keys (default 60000). */
+    ttlCleanupIntervalMs?: number;
+    /** Enable WAL mode for better read concurrency (default true). */
+    walMode?: boolean;
+}
 /**
  * Token storage configuration (simplified, BC-030)
  *
- * Either the string 'memory' for in-memory storage,
- * or an object { redis: RedisConfig } for Redis storage.
+ * - `'memory'` — in-memory storage (default; lost on restart).
+ * - `{ redis: RedisConfig }` — Redis-backed persistence.
+ * - `{ sqlite: TokenStorageSqliteConfig }` — local SQLite-file persistence.
  */
 export type TokenStorageConfig = 'memory' | {
     redis: RedisConfig;
+} | {
+    sqlite: TokenStorageSqliteConfig;
 };
+/**
+ * How a secure-store namespace is derived from the request:
+ * - `user` (default): keyed by the authenticated subject (`sub`).
+ * - `session`: keyed by the transport `sessionId`.
+ * - `global`: a single server-wide namespace.
+ */
+export type SecureStoreScope = 'user' | 'session' | 'global';
+/**
+ * At-rest encryption settings for the built-in secure-store backings. Ignored
+ * for a custom `{ backend }` backing.
+ */
+export interface SecureStoreEncryptionConfig {
+    /** Server pepper mixed into HKDF key derivation. Defaults to `VAULT_SECRET ?? JWT_SECRET`. */
+    pepper?: string;
+}
+/**
+ * A custom secure-store backing — an object implementing the four-method
+ * `SecureStoreBackend` contract (e.g. an OS-keychain backend). Typed loosely
+ * here (the strict `SecureStoreBackend` interface lives in `session/`) so the
+ * options module stays free of session imports.
+ */
+export interface SecureStoreCustomBackend {
+    get(namespace: string, key: string): Promise<string | null>;
+    set(namespace: string, key: string, value: string, ttlMs?: number): Promise<void>;
+    delete(namespace: string, key: string): Promise<boolean>;
+    list(namespace: string): Promise<string[]>;
+    dispose?(): Promise<void>;
+}
+/** Fields shared by the object-form secure-store configs. */
+interface SecureStoreCommonConfig {
+    /** Namespace scope. @default 'user' */
+    scope?: SecureStoreScope;
+    /** Default TTL (ms) for stored secrets. @default undefined (no expiry) */
+    ttlMs?: number;
+    /** At-rest encryption settings (built-in backings only). */
+    encryption?: SecureStoreEncryptionConfig;
+}
+/**
+ * Secure-store configuration (#470) — the general session-scoped secure-secret
+ * store backing for `this.secureStore`.
+ *
+ * - `'memory'` — in-memory, AES-256-GCM-encrypted (default; lost on restart).
+ * - `{ sqlite }` — local SQLite-file persistence (survives restart).
+ * - `{ redis }` — Redis-backed persistence.
+ * - `{ backend }` — a custom backing (e.g. an OS keychain). No native dependency
+ *   is bundled by the framework.
+ *
+ * The object forms also accept `scope`, `ttlMs`, and (for built-ins) `encryption`.
+ */
+export type SecureStoreConfig = 'memory' | (SecureStoreCommonConfig & {
+    sqlite?: never;
+    redis?: never;
+    backend?: never;
+}) | (SecureStoreCommonConfig & {
+    sqlite: TokenStorageSqliteConfig;
+}) | (SecureStoreCommonConfig & {
+    redis: RedisConfig;
+}) | (SecureStoreCommonConfig & {
+    backend: SecureStoreCustomBackend;
+});
 /**
  * Token refresh configuration
  */
@@ -195,6 +277,118 @@ export interface FederatedAuthConfig {
      * - 'format': Only validates the state format is correct
      */
     stateValidation: 'strict' | 'format';
+    /**
+     * Minimum number of upstream providers a user must link before a FrontMCP JWT
+     * is minted (defaults to 1 at runtime when `providers` are configured).
+     */
+    minProviders?: number;
+    /**
+     * Provider ids that MUST be linked before a JWT is minted.
+     */
+    requiredProviders?: string[];
+}
+/**
+ * Declarative upstream OAuth provider for local-mode multi-provider
+ * orchestration. See {@link LocalAuthOptionsInterface.providers}.
+ */
+export interface UpstreamProviderOptions {
+    /** Stable provider id (e.g. `'github'`). */
+    id: string;
+    /** Human-readable display name. Defaults to `id`. */
+    name?: string;
+    /** Authorization endpoint (canonical name). */
+    authorizationEndpoint?: string;
+    /** Authorization endpoint (alias for {@link authorizationEndpoint}). */
+    authorizeUrl?: string;
+    /** Token endpoint (canonical name). */
+    tokenEndpoint?: string;
+    /** Token endpoint (alias for {@link tokenEndpoint}). */
+    tokenUrl?: string;
+    /** OAuth client id issued by the upstream provider. */
+    clientId: string;
+    /** OAuth client secret (confidential clients). */
+    clientSecret?: string;
+    /** Scopes to request from the upstream provider. */
+    scopes?: string[];
+    /** User info endpoint (optional). */
+    userInfoEndpoint?: string;
+    /** JWKS URI for upstream id_token validation (optional). */
+    jwksUri?: string;
+}
+/**
+ * A pre-registered (trusted) OAuth client for the LOCAL Authorization Server.
+ * Seeded into the client registry at startup so the authorize/token flows
+ * accept it without a Dynamic Client Registration round-trip. See
+ * {@link LocalDcrConfig.clients}. No PII is stored — only OAuth client metadata.
+ */
+export interface LocalDcrClient {
+    /** Stable, pre-assigned client identifier. */
+    clientId: string;
+    /** Confidential-client secret. Omit for public (PKCE) clients. */
+    clientSecret?: string;
+    /** Exact redirect URIs this client may use (at least one). */
+    redirectUris: string[];
+    /** Human-readable client name for consent/login screens. */
+    clientName?: string;
+    /**
+     * Token-endpoint auth method.
+     * @default 'none'
+     */
+    tokenEndpointAuthMethod?: 'none' | 'client_secret_basic' | 'client_secret_post';
+    /**
+     * Allowed grant types.
+     * @default ['authorization_code']
+     */
+    grantTypes?: Array<'authorization_code' | 'refresh_token'>;
+    /**
+     * Allowed response types.
+     * @default ['code']
+     */
+    responseTypes?: Array<'code'>;
+    /** Optional space-delimited default scope string. */
+    scope?: string;
+}
+/**
+ * Declarative control surface for the LOCAL Authorization Server's Dynamic
+ * Client Registration endpoint (`POST /oauth/register`) and client allowlist.
+ *
+ * IMPORTANT: distinct from the upstream-provider `dcrEnabled`/
+ * `registrationEndpoint` fields on {@link ProviderConfig}/
+ * {@link RemoteProviderConfig} (those register THIS server against an upstream
+ * IdP and are not read by the local AS). Every field is optional; omitting the
+ * whole `dcr` block preserves the historical behavior exactly (DCR enabled in
+ * dev, disabled in production; no allowlist; no initial access token).
+ */
+export interface LocalDcrConfig {
+    /**
+     * Whether `POST /oauth/register` is active and `registration_endpoint` is
+     * advertised. When unset, the historical guard applies (on in dev, off in
+     * production).
+     */
+    enabled?: boolean;
+    /**
+     * Redirect-URI allowlist (exact match or simple `*` glob). When set, both DCR
+     * registrations and `/oauth/authorize` reject a `redirect_uri` not on the
+     * list. When unset, no redirect_uri allowlist is enforced.
+     */
+    allowedRedirectUris?: string[];
+    /**
+     * Client-id allowlist. When set, only these ids may register or be used at
+     * `/oauth/authorize` (CIMD URL client ids are exempt). When unset, any id is
+     * accepted subject to the other checks.
+     */
+    allowedClientIds?: string[];
+    /**
+     * Initial Access Token (RFC 7591 §3). When set, `POST /oauth/register`
+     * requires a matching `Authorization: Bearer <token>` header. When unset,
+     * registration is unauthenticated (historical behavior).
+     */
+    initialAccessToken?: string;
+    /**
+     * Pre-registered trusted clients seeded at startup. Accepted by the
+     * authorize/token flows without a DCR round-trip.
+     */
+    clients?: LocalDcrClient[];
 }
 /**
  * Progressive/Incremental authorization configuration
@@ -221,6 +415,269 @@ export interface IncrementalAuthConfig {
      */
     showAllAppsAtOnce?: boolean;
 }
+/**
+ * A single custom field rendered on the local-mode login page.
+ *
+ * Fields are declarative: FrontMCP renders them on the default login page and
+ * forwards their submitted values to {@link LocalAuthOptionsInterface.authenticate}
+ * as `input.fields`. No PII is persisted by FrontMCP — fields are passed
+ * through to your verifier and never stored.
+ */
+export interface LoginFieldConfig {
+    /** HTML input type. `hidden` fields are submitted but not shown. */
+    type: 'text' | 'password' | 'email' | 'select' | 'hidden';
+    /** Field label shown above the input. Defaults to the field key. */
+    label?: string;
+    /** Whether the browser should require a value before submit. */
+    required?: boolean;
+    /** Placeholder text for text/email/password inputs. */
+    placeholder?: string;
+    /** Options for a `select` field. Ignored for other types. */
+    options?: Array<{
+        value: string;
+        label: string;
+    }>;
+}
+/**
+ * Subject derivation strategy for local logins.
+ *
+ * - `per-session` (default): every login yields a fresh subject (stateless).
+ * - `per-account`: the value of {@link LoginSubjectConfig.fromField} is hashed
+ *   into a stable subject so the same account maps to the same `sub`.
+ */
+export interface LoginSubjectConfig {
+    /** Login field whose submitted value seeds a stable subject. */
+    fromField?: string;
+    /** How the subject is derived. @default 'per-session' */
+    strategy?: 'per-session' | 'per-account';
+}
+/**
+ * Declarative customization of the built-in local-mode login page.
+ *
+ * Set any of these to tailor the default `/oauth/authorize` login page without
+ * replacing the OAuth flow. When `render` is provided it fully overrides the
+ * built-in page; otherwise `fields` extend the default email/name form.
+ */
+export interface LoginConfig {
+    /** Page heading. Defaults to "Sign In". */
+    title?: string;
+    /** Sub-heading shown under the title. */
+    subtitle?: string;
+    /** Logo image URL shown above the form. */
+    logoUri?: string;
+    /**
+     * Extra fields appended to the login form, keyed by field name. The
+     * submitted values are forwarded to {@link LocalAuthOptionsInterface.authenticate}
+     * as `input.fields[name]`.
+     */
+    fields?: Record<string, LoginFieldConfig>;
+    /**
+     * Full HTML override for the login page. Receives a {@link LoginRenderContext}
+     * and must return a complete HTML document string. When set, `title`,
+     * `subtitle`, `logoUri`, and `fields` are NOT auto-rendered — you own the markup.
+     */
+    render?: (ctx: LoginRenderContext) => string;
+    /** Controls how the authenticated subject (`sub`) is derived. */
+    subject?: LoginSubjectConfig;
+}
+/**
+ * Context passed to a custom {@link LoginConfig.render} function. Carries the
+ * client identity (CIMD `client_name`/`logo_uri` when available), requested
+ * scopes, the pending-authorization id (must be submitted back), the callback
+ * path to POST/GET to, the declared {@link LoginConfig.fields}, and a previous
+ * error message (set when {@link AuthenticateResult} failed and the page is
+ * being re-rendered).
+ */
+export interface LoginRenderContext {
+    /** OAuth client_id (or CIMD URL) of the requesting client. */
+    clientId: string;
+    /** Human-readable client name (CIMD `client_name` when available, else clientId). */
+    clientName: string;
+    /** CIMD `logo_uri` when available. */
+    logoUri?: string;
+    /** Requested OAuth scopes. */
+    scopes: string[];
+    /** Pending-authorization id; MUST be submitted back as `pending_auth_id`. */
+    pendingAuthId: string;
+    /** Path the login form should submit to (the `/oauth/callback` endpoint). */
+    callbackPath: string;
+    /** The declared custom login fields (may be empty). */
+    fields: Record<string, LoginFieldConfig>;
+    /** Error message to display when re-rendering after a failed authenticate(). */
+    error?: string;
+    /**
+     * Submitted field values to pre-fill on re-render (set when the page is
+     * re-rendered after a failed authenticate()). Keyed by field name.
+     */
+    values?: Record<string, string>;
+}
+/**
+ * Input handed to {@link LocalAuthOptionsInterface.authenticate}: the submitted
+ * login-field values keyed by field name. Built-in `email`/`name` fields are
+ * included alongside any declared custom {@link LoginConfig.fields}.
+ */
+export interface AuthenticateInput {
+    /** Submitted login-field values keyed by field name. */
+    fields: Record<string, string>;
+    /**
+     * Present only when `authenticate()` is re-invoked from a mid-session
+     * add-credential flow (Checkpoint 3b). Carries the framework-verified subject,
+     * the credential key being connected, and the optional opaque context from the
+     * original `requireConnect({ key, context })` call. When set, the verifier
+     * should return `{ ok: true, credentials: [{ key, secret, … }] }` to ADD the
+     * credential to the existing session vault (a new token is NOT minted).
+     */
+    resume?: {
+        /** Framework-verified subject the credential is being connected for. */
+        sub: string;
+        /** Credential key being connected. */
+        key: string;
+        /** Optional opaque context forwarded from `requireConnect`. */
+        context?: string;
+    };
+}
+/**
+ * Context handed to {@link LocalAuthOptionsInterface.authenticate}. Provides DI
+ * access (`get`), a `fetch` for outbound calls, a scoped `logger`, and the
+ * requesting client's identity.
+ */
+export interface AuthenticateContext {
+    /** Resolve a provider/service from the DI container. */
+    get<T>(token: unknown): T;
+    /** Outbound fetch (use for verifying credentials against an upstream API). */
+    fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+    /** Scoped logger for diagnostics. */
+    logger: AuthLogger;
+    /** OAuth client_id (or CIMD URL) of the requesting client, when known. */
+    clientId?: string;
+    /** Human-readable client name (CIMD `client_name`), when known. */
+    clientName?: string;
+}
+/**
+ * A credential the verifier wants FrontMCP to persist for the session.
+ *
+ * Persisted (Checkpoint 3b) into the built-in, AES-256-GCM-encrypted, per-session
+ * credential vault keyed by the authenticated `sub`, and exposed to tools via
+ * `this.credentials.get(key)` / `list()` / `requireConnect({ key })`. The vault
+ * is enabled automatically in `local` (and `remote`) modes; a fresh authorize
+ * rotates the vault so a reconnect starts empty.
+ */
+export interface AuthenticateCredential {
+    /** Stable key the credential is stored under (e.g. provider id). */
+    key: string;
+    /** The secret value (token, api key, …). */
+    secret: string;
+    /** Optional non-secret metadata stored alongside the credential. */
+    metadata?: Record<string, unknown>;
+}
+/**
+ * Result of a successful local {@link LocalAuthOptionsInterface.authenticate}.
+ */
+export interface AuthenticateSuccess {
+    ok: true;
+    /** Explicit subject. When omitted, the subject is derived from the login subject strategy / anonymousSubject. */
+    sub?: string;
+    /** Custom claims to embed in the minted access token (namespaced to avoid clobbering reserved claims). */
+    claims?: Record<string, unknown>;
+    /** Per-session credentials to persist into the encrypted vault (`this.credentials`) — see {@link AuthenticateCredential}. */
+    credentials?: AuthenticateCredential[];
+    /** Optional informational message. */
+    message?: string;
+}
+/**
+ * Result of a failed local {@link LocalAuthOptionsInterface.authenticate}. The
+ * login page is re-rendered with `message` shown to the user.
+ */
+export interface AuthenticateFailure {
+    ok: false;
+    /** Error message shown on the re-rendered login page. */
+    message: string;
+    /** Optional field name to focus/highlight on the re-rendered page. */
+    retryField?: string;
+}
+/**
+ * Discriminated union returned by {@link LocalAuthOptionsInterface.authenticate}.
+ */
+export type AuthenticateResult = AuthenticateSuccess | AuthenticateFailure;
+/**
+ * Custom verification step for local-mode logins.
+ *
+ * Receives the submitted login fields and a {@link AuthenticateContext}; returns
+ * `{ ok: true, sub?, claims?, credentials? }` to mint a token, or
+ * `{ ok: false, message, retryField? }` to reject the login and re-render the
+ * page. When `authenticate` is configured, the built-in email requirement no
+ * longer applies (the verifier decides what is required via its `fields`).
+ */
+export type AuthenticateFn = (input: AuthenticateInput, ctx: AuthenticateContext) => Promise<AuthenticateResult>;
+/**
+ * Which built-in authorization page a custom React component replaces. Mirrors
+ * the SDK-side `AuthSlot` and the `@frontmcp/ui/auth` client contract. A slot is
+ * a KEY in {@link AuthUiMap}; its value is the relative `.tsx`/`.jsx` path.
+ */
+export type AuthSlot = 'login' | 'consent' | 'incremental' | 'federated' | 'error';
+/**
+ * Custom authorization-UI map: a slot → relative component file path. Each path
+ * is a `.tsx`/`.jsx` source resolved RELATIVE TO THE CONFIG FILE that declared
+ * it (the `@FrontMcp` / `@App` source directory, captured automatically — no
+ * `fileURLToPath` needed); absolute paths pass through unchanged. The component
+ * is transpiled server-side and client-rendered (esm.sh import-map). When a slot
+ * is absent the built-in HTML page is served unchanged.
+ *
+ * @example
+ * ```ts
+ * ui: { login: './auth/login.tsx', consent: './auth/consent.tsx' }
+ * ```
+ */
+export type AuthUiMap = Partial<Record<AuthSlot, string>>;
+/**
+ * Server-side accumulator-aware context handed to an {@link AuthExtraHandler}.
+ * Intentionally minimal and PII-free: the extra name, the pending-auth id (for
+ * correlation), and the items already accepted for this extra.
+ */
+export interface AuthExtraContext {
+    /** The extra name being handled (the `action` posted by the page). */
+    name: string;
+    /** The pending authorization id this submission belongs to (when known). */
+    pendingAuthId?: string;
+    /** Items already accepted for this extra (the current accumulator). */
+    current: unknown[];
+}
+/**
+ * Result an {@link AuthExtraHandler} returns. The handler only hands back the
+ * NEW items it accepted; the framework merges them into the per-pending-auth
+ * accumulator and echoes the full map back to the page (so `useAddedItems(name)`
+ * reflects them on re-render).
+ */
+export interface AuthExtraResult {
+    /** Whether the field was accepted. */
+    ok: boolean;
+    /** Human-readable validation error when `ok` is false. */
+    error?: string;
+    /** Items to APPEND to this extra's accumulator on success. */
+    addedItems?: unknown[];
+    /** Free-form side-effect data echoed back to the client. */
+    sideEffects?: Record<string, unknown>;
+}
+/**
+ * A server handler for a custom auth-UI extra (`auth.extras[name]`). Receives the
+ * page's validated field submission and the {@link AuthExtraContext}; returns
+ * (or resolves to) an {@link AuthExtraResult}. Replaces the old `@AuthExtra`
+ * class — a plain function keyed by the extra name.
+ *
+ * @example
+ * ```ts
+ * extras: {
+ *   'envs:add': async (input, ctx) => {
+ *     const key = String(input.key ?? '').trim();
+ *     if (!key) return { ok: false, error: 'key required' };
+ *     return { ok: true, addedItems: [{ key, value: input.value }] };
+ *   },
+ * }
+ * ```
+ */
+export type AuthExtraHandler = (input: Record<string, unknown>, ctx: AuthExtraContext) => Promise<AuthExtraResult> | AuthExtraResult;
+/** Custom auth-UI extras map: extra name → server handler function. */
+export type AuthExtrasMap = Record<string, AuthExtraHandler>;
 export interface PublicAuthOptionsInterface {
     mode: 'public';
     issuer?: string;
@@ -247,6 +704,15 @@ export interface LocalAuthOptionsInterface {
     mode: 'local';
     local?: LocalSigningConfig;
     tokenStorage?: TokenStorageConfig;
+    /**
+     * Backing for the general session-scoped secure-secret store (`this.secureStore`,
+     * #470). Selects memory / sqlite / redis / a custom (e.g. OS-keychain) backend,
+     * plus the namespace `scope`. Optional — omitting it defaults to an in-memory,
+     * AES-256-GCM-encrypted, `user`-scoped store.
+     *
+     * @see SecureStoreConfig
+     */
+    secureStore?: SecureStoreConfig;
     allowDefaultPublic?: boolean;
     anonymousScopes?: string[];
     publicAccess?: PublicAccessConfig;
@@ -256,6 +722,99 @@ export interface LocalAuthOptionsInterface {
     expectedAudience?: string | string[];
     incrementalAuth?: IncrementalAuthConfig;
     cimd?: CimdConfigInput;
+    /**
+     * Require an email at the `/oauth/callback` login step.
+     *
+     * When `true` (default) the callback rejects a non-incremental login that
+     * carries no email — the historical behavior. Set to `false` for
+     * single-operator local setups (e.g. Claude Code against `mode: 'local'`)
+     * where a login should mint a code without prompting for an email; the
+     * callback then derives a stable anonymous `sub` from
+     * {@link LocalAuthOptionsInterface.anonymousSubject}.
+     *
+     * @default true
+     */
+    requireEmail?: boolean;
+    /**
+     * Stable subject identifier used to mint the authorization code when
+     * {@link LocalAuthOptionsInterface.requireEmail} is `false` and no email is
+     * provided. Defaults to `'local-operator'`. The same value always maps to
+     * the same `sub`, so the single operator keeps a stable identity.
+     *
+     * @default 'local-operator'
+     */
+    anonymousSubject?: string;
+    /**
+     * Declarative customization of the built-in local login page (title,
+     * subtitle, logo, extra fields, full HTML override, and subject strategy).
+     * Optional — omitting it preserves the default email/name login form exactly.
+     *
+     * @see LoginConfig
+     */
+    login?: LoginConfig;
+    /**
+     * Custom verification step run at `/oauth/callback` before a token is minted.
+     * Receives the submitted login fields and returns `{ ok: true, … }` to mint a
+     * token (optionally with an explicit `sub` and custom `claims`) or
+     * `{ ok: false, message }` to reject and re-render the login page.
+     *
+     * When set, the built-in email requirement (`requireEmail`) no longer applies.
+     * Omitting it preserves the default email/anonymous login path exactly.
+     *
+     * @see AuthenticateFn
+     */
+    authenticate?: AuthenticateFn;
+    /**
+     * Upstream OAuth providers (GitHub, Slack, Jira, …) to orchestrate in local
+     * mode. When declared, FrontMCP federates them at `/oauth/authorize`, refuses
+     * to mint a JWT until the {@link FederatedAuthConfig.minProviders} threshold
+     * (default 1) is met, stores each provider's tokens encrypted, and exposes
+     * them to tools via `this.orchestration.getToken(id)`. Optional — omitting it
+     * preserves the default single-operator local login exactly.
+     *
+     * @see UpstreamProviderOptions
+     */
+    providers?: UpstreamProviderOptions[];
+    /**
+     * Local Authorization Server Dynamic Client Registration control surface
+     * (#462): gate `POST /oauth/register`, allowlist redirect URIs / client ids,
+     * require an initial access token, and seed pre-registered trusted clients.
+     * Optional — omitting it preserves today's behavior exactly (DCR on in dev,
+     * off in production; no allowlist; no initial access token).
+     *
+     * @see LocalDcrConfig
+     */
+    dcr?: LocalDcrConfig;
+    /**
+     * Custom authorization-UI slots (#469): a slot → relative `.tsx`/`.jsx` path
+     * map. Each component replaces the built-in login / consent / incremental /
+     * federated / error page. Relative paths resolve against THIS config file's
+     * directory (captured automatically — no `fileURLToPath`); absolute paths pass
+     * through. Scoped to THIS auth config, so each app under `splitByApp` gets its
+     * own custom UI. When a slot is absent, the built-in HTML page is served
+     * unchanged (the no-config default).
+     *
+     * @example
+     * ```ts
+     * auth: { mode: 'local', ui: { login: './auth/login.tsx' } }
+     * ```
+     * @see AuthUiMap
+     */
+    ui?: AuthUiMap;
+    /**
+     * Server handlers for custom auth-UI extras (#469): an extra name → handler
+     * function map. Each handler accepts a validated field submission and returns
+     * `{ ok, error?, addedItems?, sideEffects? }`; accepted items accumulate
+     * server-side so `useAddedItems(name)` reflects them on re-render. Scoped to
+     * THIS auth config (per-app under `splitByApp`).
+     *
+     * @example
+     * ```ts
+     * extras: { 'envs:add': async (input, ctx) => ({ ok: true, addedItems: [...] }) }
+     * ```
+     * @see AuthExtraHandler
+     */
+    extras?: AuthExtrasMap;
 }
 export interface RemoteAuthOptionsInterface {
     mode: 'remote';
@@ -266,6 +825,12 @@ export interface RemoteAuthOptionsInterface {
     providerConfig?: ProviderConfig;
     local?: LocalSigningConfig;
     tokenStorage?: TokenStorageConfig;
+    /**
+     * Backing for the general session-scoped secure-secret store (`this.secureStore`,
+     * #470). See {@link SecureStoreConfig}. Optional — defaults to an in-memory,
+     * AES-256-GCM-encrypted, `user`-scoped store.
+     */
+    secureStore?: SecureStoreConfig;
     allowDefaultPublic?: boolean;
     anonymousScopes?: string[];
     publicAccess?: PublicAccessConfig;
@@ -275,6 +840,16 @@ export interface RemoteAuthOptionsInterface {
     expectedAudience?: string | string[];
     incrementalAuth?: IncrementalAuthConfig;
     cimd?: CimdConfigInput;
+    /**
+     * Custom authorization-UI slots (#469), scoped to this auth config.
+     * See {@link LocalAuthOptionsInterface.ui}.
+     */
+    ui?: AuthUiMap;
+    /**
+     * Server handlers for custom auth-UI extras (#469), scoped to this auth config.
+     * See {@link LocalAuthOptionsInterface.extras}.
+     */
+    extras?: AuthExtrasMap;
 }
 export type AuthOptionsInterface = PublicAuthOptionsInterface | TransparentAuthOptionsInterface | LocalAuthOptionsInterface | RemoteAuthOptionsInterface;
 export type LocalOrRemoteAuthOptionsInterface = LocalAuthOptionsInterface | RemoteAuthOptionsInterface;
@@ -287,4 +862,5 @@ export type OrchestratedRemoteOptionsInterface = RemoteAuthOptionsInterface;
 export type OrchestratedAuthOptionsInterface = LocalOrRemoteAuthOptionsInterface;
 /** @deprecated Removed - modes are now 'local' | 'remote' */
 export type OrchestratedType = 'local' | 'remote';
+export {};
 //# sourceMappingURL=interfaces.d.ts.map

package/options/interfaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../src/options/interfaces.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AACtE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAM/C;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,CAAC;IAEzB;;;OAGG;IACH,OAAO,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,CAAC;IAE3B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,OAAO,CAAC,EAAE,GAAG,GAAG,UAAU,CAAC;IAE3B;;;OAGG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IAErB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,4BAA4B;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IAErB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,8BAA8B;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,+CAA+C;IAC/C,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B,kCAAkC;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB,4BAA4B;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IAErB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,8BAA8B;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,+CAA+C;IAC/C,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B,kCAAkC;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG;IAAE,KAAK,EAAE,WAAW,CAAA;CAAE,CAAC;AAEnE;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,WAAW,GAAG,cAAc,CAAC;AAE9D;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B,gDAAgD;IAChD,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B,uDAAuD;IACvD,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAEzB,wDAAwD;IACxD,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,eAAe,EAAE,QAAQ,GAAG,QAAQ,CAAC;CACtC;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IAExC;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAMD,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,OAAO,CAAC,EAAE,GAAG,GAAG,UAAU,CAAC;CAC5B;AAED,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,aAAa,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACrC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACrC,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACrC,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,IAAI,CAAC,EAAE,eAAe,CAAC;CACxB;AAMD,MAAM,MAAM,oBAAoB,GAC5B,0BAA0B,GAC1B,+BAA+B,GAC/B,yBAAyB,GACzB,0BAA0B,CAAC;AAE/B,MAAM,MAAM,iCAAiC,GAAG,yBAAyB,GAAG,0BAA0B,CAAC;AAEvG,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,aAAa,GAAG,OAAO,GAAG,QAAQ,CAAC;AAMrE,gDAAgD;AAChD,MAAM,MAAM,iCAAiC,GAAG,yBAAyB,CAAC;AAC1E,iDAAiD;AACjD,MAAM,MAAM,kCAAkC,GAAG,0BAA0B,CAAC;AAC5E,wDAAwD;AACxD,MAAM,MAAM,gCAAgC,GAAG,iCAAiC,CAAC;AACjF,6DAA6D;AAC7D,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,QAAQ,CAAC"}
+{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../src/options/interfaces.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,GAAG,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oCAAoC,CAAC;AAMtE;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,CAAC;IAEzB;;;OAGG;IACH,OAAO,CAAC,EAAE,KAAK,GAAG,MAAM,EAAE,CAAC;IAE3B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,OAAO,CAAC,EAAE,GAAG,GAAG,UAAU,CAAC;IAE3B;;;OAGG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IAErB;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,4BAA4B;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IAErB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,8BAA8B;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,+CAA+C;IAC/C,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B,kCAAkC;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,QAAQ,EAAE,MAAM,CAAC;IAEjB,4BAA4B;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IAEd;;;OAGG;IACH,EAAE,CAAC,EAAE,MAAM,CAAC;IAEZ;;;OAGG;IACH,IAAI,CAAC,EAAE,aAAa,CAAC;IAErB,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,mDAAmD;IACnD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,8BAA8B;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB,+CAA+C;IAC/C,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAE9B,kCAAkC;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,qEAAqE;IACrE,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,UAAU,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAChC,+DAA+D;IAC/D,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,kEAAkE;IAClE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;GAMG;AACH,MAAM,MAAM,kBAAkB,GAAG,QAAQ,GAAG;IAAE,KAAK,EAAE,WAAW,CAAA;CAAE,GAAG;IAAE,MAAM,EAAE,wBAAwB,CAAA;CAAE,CAAC;AAM1G;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;AAE7D;;;GAGG;AACH,MAAM,WAAW,2BAA2B;IAC1C,8FAA8F;IAC9F,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;GAKG;AACH,MAAM,WAAW,wBAAwB;IACvC,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5D,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClF,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3C,OAAO,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3B;AAED,6DAA6D;AAC7D,UAAU,uBAAuB;IAC/B,uCAAuC;IACvC,KAAK,CAAC,EAAE,gBAAgB,CAAC;IACzB,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,UAAU,CAAC,EAAE,2BAA2B,CAAC;CAC1C;AAED;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,iBAAiB,GACzB,QAAQ,GACR,CAAC,uBAAuB,GAAG;IAAE,MAAM,CAAC,EAAE,KAAK,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IAAC,OAAO,CAAC,EAAE,KAAK,CAAA;CAAE,CAAC,GAC9E,CAAC,uBAAuB,GAAG;IAAE,MAAM,EAAE,wBAAwB,CAAA;CAAE,CAAC,GAChE,CAAC,uBAAuB,GAAG;IAAE,KAAK,EAAE,WAAW,CAAA;CAAE,CAAC,GAClD,CAAC,uBAAuB,GAAG;IAAE,OAAO,EAAE,wBAAwB,CAAA;CAAE,CAAC,CAAC;AAEtE;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,WAAW,GAAG,cAAc,CAAC;AAE9D;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;OAGG;IACH,UAAU,CAAC,EAAE,OAAO,CAAC;IAErB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAE3B,gDAAgD;IAChD,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAE1B,uDAAuD;IACvD,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAEzB,wDAAwD;IACxD,oBAAoB,CAAC,EAAE,MAAM,EAAE,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC;;;;OAIG;IACH,eAAe,EAAE,QAAQ,GAAG,QAAQ,CAAC;IAErC;;;OAGG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED;;;GAGG;AACH,MAAM,WAAW,uBAAuB;IACtC,4CAA4C;IAC5C,EAAE,EAAE,MAAM,CAAC;IACX,qDAAqD;IACrD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,wEAAwE;IACxE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uCAAuC;IACvC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,uDAAuD;IACvD,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,qCAAqC;IACrC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,4DAA4D;IAC5D,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,GAAG,qBAAqB,GAAG,oBAAoB,CAAC;IAChF;;;OAGG;IACH,UAAU,CAAC,EAAE,KAAK,CAAC,oBAAoB,GAAG,eAAe,CAAC,CAAC;IAC3D;;;OAGG;IACH,aAAa,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAC9B,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;;;;;;GAUG;AACH,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;OAIG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC;CAC5B;AAED;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC;;;OAGG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;IAElB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IAExC;;;OAGG;IACH,SAAS,CAAC,EAAE,OAAO,CAAC;IAEpB;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAOD;;;;;;;GAOG;AACH,MAAM,WAAW,gBAAgB;IAC/B,oEAAoE;IACpE,IAAI,EAAE,MAAM,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAC;IAC1D,oEAAoE;IACpE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gEAAgE;IAChE,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uDAAuD;IACvD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,yDAAyD;IACzD,QAAQ,CAAC,EAAE,aAAa,GAAG,aAAa,CAAC;CAC1C;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IAC1B,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC1C;;;;OAIG;IACH,MAAM,CAAC,EAAE,CAAC,GAAG,EAAE,kBAAkB,KAAK,MAAM,CAAC;IAC7C,iEAAiE;IACjE,OAAO,CAAC,EAAE,kBAAkB,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,kBAAkB;IACjC,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,qFAAqF;IACrF,UAAU,EAAE,MAAM,CAAC;IACnB,sCAAsC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,8BAA8B;IAC9B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,6EAA6E;IAC7E,aAAa,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IACzC,gFAAgF;IAChF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACjC;AAED;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/B;;;;;;;OAOG;IACH,MAAM,CAAC,EAAE;QACP,wEAAwE;QACxE,GAAG,EAAE,MAAM,CAAC;QACZ,sCAAsC;QACtC,GAAG,EAAE,MAAM,CAAC;QACZ,+DAA+D;QAC/D,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,wDAAwD;IACxD,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,GAAG,CAAC,CAAC;IAC1B,8EAA8E;IAC9E,KAAK,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvE,qCAAqC;IACrC,MAAM,EAAE,UAAU,CAAC;IACnB,0EAA0E;IAC1E,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,sBAAsB;IACrC,oEAAoE;IACpE,GAAG,EAAE,MAAM,CAAC;IACZ,4CAA4C;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,IAAI,CAAC;IACT,iHAAiH;IACjH,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0GAA0G;IAC1G,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,6HAA6H;IAC7H,WAAW,CAAC,EAAE,sBAAsB,EAAE,CAAC;IACvC,sCAAsC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,KAAK,CAAC;IACV,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;IAChB,sEAAsE;IACtE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,GAAG,mBAAmB,CAAC;AAE3E;;;;;;;;GAQG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,mBAAmB,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;AAMjH;;;;GAIG;AACH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,SAAS,GAAG,aAAa,GAAG,WAAW,GAAG,OAAO,CAAC;AAEnF;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAE1D;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,4EAA4E;IAC5E,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,OAAO,EAAE,OAAO,EAAE,CAAC;CACpB;AAED;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,sCAAsC;IACtC,EAAE,EAAE,OAAO,CAAC;IACZ,0DAA0D;IAC1D,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;IACvB,4DAA4D;IAC5D,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACvC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,GAAG,EAAE,gBAAgB,KAClB,OAAO,CAAC,eAAe,CAAC,GAAG,eAAe,CAAC;AAEhD,uEAAuE;AACvE,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;AAM7D,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,IAAI,CAAC,EAAE,aAAa,CAAC;IACrB,OAAO,CAAC,EAAE,GAAG,GAAG,UAAU,CAAC;CAC5B;AAED,MAAM,WAAW,+BAA+B;IAC9C,IAAI,EAAE,aAAa,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACrC,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAED,MAAM,WAAW,yBAAyB;IACxC,IAAI,EAAE,OAAO,CAAC;IACd,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACrC,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB;;;;;;;;;;OAUG;IACH,YAAY,CAAC,EAAE,cAAc,CAAC;IAC9B;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,uBAAuB,EAAE,CAAC;IACtC;;;;;;;;OAQG;IACH,GAAG,CAAC,EAAE,cAAc,CAAC;IACrB;;;;;;;;;;;;;;OAcG;IACH,EAAE,CAAC,EAAE,SAAS,CAAC;IACf;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,EAAE,QAAQ,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,KAAK,CAAC,EAAE,kBAAkB,CAAC;IAC3B,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC;;;;OAIG;IACH,WAAW,CAAC,EAAE,iBAAiB,CAAC;IAChC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,kBAAkB,CAAC;IAClC,OAAO,CAAC,EAAE,aAAa,CAAC;IACxB,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B,gBAAgB,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACrC,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,IAAI,CAAC,EAAE,eAAe,CAAC;IACvB;;;OAGG;IACH,EAAE,CAAC,EAAE,SAAS,CAAC;IACf;;;OAGG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAMD,MAAM,MAAM,oBAAoB,GAC5B,0BAA0B,GAC1B,+BAA+B,GAC/B,yBAAyB,GACzB,0BAA0B,CAAC;AAE/B,MAAM,MAAM,iCAAiC,GAAG,yBAAyB,GAAG,0BAA0B,CAAC;AAEvG,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,aAAa,GAAG,OAAO,GAAG,QAAQ,CAAC;AAMrE,gDAAgD;AAChD,MAAM,MAAM,iCAAiC,GAAG,yBAAyB,CAAC;AAC1E,iDAAiD;AACjD,MAAM,MAAM,kCAAkC,GAAG,0BAA0B,CAAC;AAC5E,wDAAwD;AACxD,MAAM,MAAM,gCAAgC,GAAG,iCAAiC,CAAC;AACjF,6DAA6D;AAC7D,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,QAAQ,CAAC"}