@gusnips/react 0.9.29 → 0.9.31

package/README.md

@@ -696,10 +696,19 @@ your scripts signs in on a machine with no browser, it prints a short code, and
 it on your device page. `@gusnips/server/oauth` is the server half. These two hooks are the
 logic for the two pages. The pages themselves are yours.
 
+```ts
+import { createOAuthConsoleApi } from "@gusnips/react/oauth";
+
+export const oauthApi = createOAuthConsoleApi(api, "/auth/oauth");
+```
+
+That is both pages' calls to the server's `oauthConsoleRoutes`, mounted at `/auth/oauth` behind
+your sign-in. `api` is your `createApiClient` client, or any object with its `get` and `post`.
+
 ```tsx
 import { useConsentRequest } from "@gusnips/react/oauth";
 
-const consent = useConsentRequest(api.oauth, useLocation().search);
+const consent = useConsentRequest(oauthApi.consent, useLocation().search);
 
 if (consent.state.status === "ready")
   return (
@@ -709,9 +718,11 @@ if (consent.state.status === "ready")
   );
 ```
 
-`api.oauth` is two calls to your own API: `describe(query)` and `approve(query, choice)`. They
-reach the server's `describe` and `approve` through routes behind your sign-in. `state.status` is
-`loading`, `refused`, `failed` or `ready`:
+If your routes are your own, pass your own two calls instead: `describe(query)` and
+`approve(query, choice)`. The choice is anything your page adds, such as a workspace, and it reaches
+the server's approver. With no choice, call `approve()`. When your server adds fields to the view,
+type them as the second parameter, `ConsentApi<Choice, { spaces: Space[] }>`, and
+`state.view.spaces` is typed too. `state.status` is `loading`, `refused`, `failed` or `ready`:
 
 - **`refused`** means the request is not one to answer: an unknown app, or a return address it
   never registered. Show `refusal.message` (or your own words for `refusal.reason`) and a link
@@ -726,13 +737,23 @@ for a second press. Approve sends the browser on with `window.location.assign`,
 an app's own scheme such as `cursor://`.
 
 ```tsx
-import { useDeviceApproval } from "@gusnips/react/oauth";
+import { useDeviceApproval, useDeviceCodeField } from "@gusnips/react/oauth";
 
-const device = useDeviceApproval(api.device, useLocation().search);
+const device = useDeviceApproval(oauthApi.device, useLocation().search);
+const field = useDeviceCodeField(device);
 
-<input value={device.code} onChange={(event) => device.setCode(event.target.value)} />;
+<label htmlFor={field.inputProps.id}>Code</label>
+<input {...field.inputProps} />
+<p {...field.statusProps}>{device.invalidLetter ? "Codes have no vowels." : null}</p>
 ```
 
+`useDeviceCodeField` is the field's wiring: the input's id, value and change handler, the
+attributes a typed code needs (no autocomplete, capitals, no spell check), `aria-invalid`, and the
+status line as the input's description, read out when it changes. It focuses the field only when it
+starts empty. It also keeps the code in the address as `?code=`, so a reload or a shared link comes
+back to the same code. It replaces the address and never pushes, so Back still leaves the page.
+Once the person decides, the code leaves the address, because the server no longer knows it.
+
 The link the script prints carries `?code=`, so the field usually starts full. The field shows
 what was typed as `WDJB-MJHT`, however it was typed. `invalidLetter` turns on as soon as a letter
 no code uses (a vowel) is typed, so you can say so before all eight are in. `state.status` adds
@@ -743,6 +764,77 @@ and send a stranger the link, and that sentence is the only guard against it. On
 page stays decided: it never asks the server again, because the server no longer knows the code,
 and asking on the next focus would tell someone who just said yes that their code is wrong.
 
+`approve(choice)` sends a choice with the yes, as on the consent page; `deny()` sends none.
+`pending` is `"approve"` or `"deny"` from the press until the server answers, so the spinner goes
+on the button that was pressed.
+
+## A new API key, shown once
+
+```ts
+import { createKeyLifecycle } from "@gusnips/react/keys";
+
+export const apiKeys = createKeyLifecycle<ApiKey>();
+```
+
+Make it once, beside your query client, outside every route. It keeps each new key's secret in
+memory until the person presses Done. A second key never replaces the first, and a trip to your
+docs and back loses neither.
+
+Tell it who is signed in, and where, from the code that already hears about sign-in and workspace
+changes:
+
+```ts
+apiKeys.setScope(user ? `${user.id}:${workspaceId}` : null);
+```
+
+A new scope forgets every unread secret. A request started before the change rejects with
+`KeyScopeChangedError` instead of showing its secret, even when the same account signs straight
+back in. Build the scope from ids, never from an access token: a token refresh is not a new person.
+
+Send your create request through it:
+
+```ts
+const create = useMutation({
+  mutationFn: (name: string) =>
+    apiKeys.create(async () => {
+      const { key, ...record } = await api.post<NewApiKey>("/keys", { name });
+      return { record, key };
+    }),
+  onSuccess: () => queryClient.invalidateQueries({ queryKey: ["keys"] }),
+});
+```
+
+`create` keeps the secret and resolves only the record. In three products we read, `mutation.data`
+held the whole answer, so the secret stayed in react-query's cache for as long as the cache kept
+the mutation. A record that still contains the secret is refused, so that mistake shows on the
+first try. The reveal lands even when the page that asked has unmounted.
+
+Show what is unread, and let the person say they saved it:
+
+```tsx
+const reveals = useKeyReveals(apiKeys);
+
+return reveals.map(({ record, key }) => (
+  <KeyReveal key={record.id} secret={key} onDone={() => apiKeys.dismiss(record.id)} />
+));
+```
+
+Copy with `useCopy`, and keep Done separate: a copy can fail, and the secret must stay on screen
+when it does. Revoke goes through the same object:
+
+```ts
+mutationFn: (id: string) => apiKeys.revoke(id, () => api.delete(`/keys/${id}`)),
+```
+
+Only a successful revoke forgets that key's secret. A failed one leaves it on screen, because the
+key still works.
+
+Nothing is written to storage or the URL, so a reload loses an unread secret. While one is unread
+the tab asks before it closes, and the listener goes away with the last one, because a page with
+a `beforeunload` listener is kept out of some browsers' back-forward cache. Draw the list through
+`queryView`, so a failed refresh keeps the rows instead of saying there are no keys. Forms,
+permissions, plan limits and every word on the page stay yours.
+
 ## Also here
 
 `ErrorBoundary`, an SSE reader split into a platform-free parser and a stream wrapper,
@@ -824,7 +916,8 @@ lives behind a subpath, so you install a dependency only if you import the thing
 | `@gusnips/react/contract` | two prerender names                      | nothing               |
 | `@gusnips/react/theme`    | `createTheme`, `startTheme`              | react                 |
 | `@gusnips/react/commands` | slash matching and `useSlashCommands`    | react                 |
-| `@gusnips/react/oauth`    | `useConsentRequest`, `useDeviceApproval` | @tanstack/react-query |
+| `@gusnips/react/oauth`    | the consent and device page hooks        | @tanstack/react-query |
+| `@gusnips/react/keys`     | `createKeyLifecycle`, `useKeyReveals`    | react                 |
 
 The rule behind that table: **a peer marked optional must not be reachable from the main entry
 point.** An optional peer the barrel imports anyway is not optional: it is a required one whose
@@ -834,4 +927,4 @@ about it.
 `@tanstack/react-query`, `i18next` and `react-i18next` are optional and stay in the main entry,
 because only their types are used and types erase.
 
-MIT · part of [frontkit](https://github.com/gusnips/frontkit)
+MIT · part of [kit](https://github.com/gusnips/kit)

package/dist/keys.d.ts

@@ -0,0 +1,58 @@
+/**
+ * A new API key, the one time the server sends its secret. Three products wrote this flow, and
+ * each knew one part the others missed:
+ *
+ * - One kept unread secrets in a list outside the page, so a second key did not overwrite the
+ *   first and a trip to the docs did not lose either. The tab asked before closing only while one
+ *   was unread, and signing out forgot them all.
+ * - One kept the secret out of the list cache, folding only the record into it.
+ * - None kept it out of react-query's MUTATION cache. Each `mutationFn` resolved the whole answer,
+ *   secret included, so `mutation.data` held it, one of them under a comment promising it did not.
+ *
+ * So `create` takes the secret here and resolves only the record, and the request is the caller's.
+ * Forms, permissions, list queries, invalidation and copy feedback stay in the product.
+ */
+/** What your create request resolves: the record your list shows, and the secret beside it. */
+export interface RevealedKey<Record> {
+    readonly record: Record;
+    readonly key: string;
+}
+/** The account or workspace changed while a create or revoke was in flight. */
+export declare class KeyScopeChangedError extends Error {
+    readonly operation: "create" | "revoke";
+    constructor(operation: "create" | "revoke");
+}
+export interface KeyLifecycle<Record> {
+    /**
+     * Who and where keys are made for: the signed-in account and the workspace, joined into one
+     * string, or `null` once signed out. Call it from your auth and workspace subscription, never
+     * from the keys page, which may not be mounted. A new scope forgets every unread secret and
+     * rejects requests started under the old one, including when the same account signs back in.
+     */
+    setScope(scope: string | null): void;
+    /**
+     * Run your create request, keep its secret here, and resolve only the record. Use it as a
+     * `mutationFn`: neither the result nor the variables carry the secret, and the reveal still
+     * lands when the page that asked has unmounted.
+     */
+    create(request: () => Promise<RevealedKey<Record>>): Promise<Record>;
+    /** Run your revoke request. Only a success, in the same scope, forgets that key's secret. */
+    revoke(id: string, request: () => Promise<unknown>): Promise<void>;
+    /** The person saved it. Wire this to "Done", never to a copy: a copy can fail. */
+    dismiss(id: string): void;
+    /** Unread secrets, newest first. */
+    getSnapshot(): readonly RevealedKey<Record>[];
+    subscribe(listener: () => void): () => void;
+}
+/**
+ * One per app, created at module scope, outside every route. Memory only: never storage, the URL
+ * or a query cache, so a reload loses an unread secret, and the tab asks before closing while one
+ * is unread. The listener comes and goes with the secrets because a page with a `beforeunload`
+ * listener is kept out of some browsers' back-forward cache.
+ */
+export declare function createKeyLifecycle<Record extends {
+    readonly id: string;
+}>(): KeyLifecycle<Record>;
+/** Unread secrets, newest first. Unmounting the component forgets nothing. */
+export declare function useKeyReveals<Record>(lifecycle: KeyLifecycle<Record>): readonly RevealedKey<Record>[];
+//# sourceMappingURL=keys.d.ts.map

package/dist/keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;GAaG;AAEH,+FAA+F;AAC/F,MAAM,WAAW,WAAW,CAAC,MAAM;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED,+EAA+E;AAC/E,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,QAAQ,CAAC;gBAE5B,SAAS,EAAE,QAAQ,GAAG,QAAQ;CAS3C;AAED,MAAM,WAAW,YAAY,CAAC,MAAM;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACrE,6FAA6F;IAC7F,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,kFAAkF;IAClF,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,oCAAoC;IACpC,WAAW,IAAI,SAAS,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;IAC9C,SAAS,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC;CAC7C;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,SAAS;IAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CAAE,KAAK,YAAY,CAAC,MAAM,CAAC,CAkEjG;AAKD,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,MAAM,EAClC,SAAS,EAAE,YAAY,CAAC,MAAM,CAAC,GAC9B,SAAS,WAAW,CAAC,MAAM,CAAC,EAAE,CAEhC"}

package/dist/keys.js

@@ -0,0 +1,94 @@
+import { useSyncExternalStore } from "react";
+/** The account or workspace changed while a create or revoke was in flight. */
+export class KeyScopeChangedError extends Error {
+    operation;
+    constructor(operation) {
+        super(operation === "create"
+            ? "The account or workspace changed before the new key could be shown. If nobody saved it, revoke it from that workspace's keys."
+            : "The account or workspace changed while the key was being revoked. Check that workspace's keys to see whether it worked.");
+        this.name = "KeyScopeChangedError";
+        this.operation = operation;
+    }
+}
+/**
+ * One per app, created at module scope, outside every route. Memory only: never storage, the URL
+ * or a query cache, so a reload loses an unread secret, and the tab asks before closing while one
+ * is unread. The listener comes and goes with the secrets because a page with a `beforeunload`
+ * listener is kept out of some browsers' back-forward cache.
+ */
+export function createKeyLifecycle() {
+    let revealed = [];
+    let scope = null;
+    let generation = 0;
+    const listeners = new Set();
+    // Per instance, so two lifecycles never remove each other's prompt.
+    function askBeforeLeaving(event) {
+        event.preventDefault();
+        // Older Chrome and Safari prompt only when this is set too. The browser picks the words.
+        event.returnValue = "";
+    }
+    function publish(next) {
+        const wasUnread = revealed.length > 0;
+        revealed = next;
+        if (wasUnread !== next.length > 0 && typeof window !== "undefined") {
+            if (next.length > 0)
+                window.addEventListener("beforeunload", askBeforeLeaving);
+            else
+                window.removeEventListener("beforeunload", askBeforeLeaving);
+        }
+        for (const listener of listeners)
+            listener();
+    }
+    /** Runs `request` under the current scope and refuses an answer that outlived it. */
+    async function scoped(operation, request) {
+        if (scope === null)
+            throw new Error("Call setScope with the signed-in account and workspace first.");
+        const started = generation;
+        const answer = await request();
+        if (started !== generation)
+            throw new KeyScopeChangedError(operation);
+        return answer;
+    }
+    function dismiss(id) {
+        const next = revealed.filter((one) => one.record.id !== id);
+        if (next.length !== revealed.length)
+            publish(next);
+    }
+    return {
+        setScope(next) {
+            if (scope === next)
+                return;
+            scope = next;
+            generation++;
+            if (revealed.length > 0)
+                publish([]);
+        },
+        async create(request) {
+            const { record, key } = await scoped("create", request);
+            // The record goes on to react-query and often into the list cache. A request that passed
+            // the whole answer as the record would put the secret there, which is the bug this exists
+            // to end, so say so on the first try instead.
+            if (JSON.stringify(record).includes(key))
+                throw new Error("The record still holds the secret. Resolve it without the key field.");
+            publish([{ record, key }, ...revealed]);
+            return record;
+        },
+        async revoke(id, request) {
+            await scoped("revoke", request);
+            dismiss(id);
+        },
+        dismiss,
+        getSnapshot: () => revealed,
+        subscribe(listener) {
+            listeners.add(listener);
+            return () => listeners.delete(listener);
+        },
+    };
+}
+// The server has no unread secrets, and a prerender must never print one.
+const none = [];
+/** Unread secrets, newest first. Unmounting the component forgets nothing. */
+export function useKeyReveals(lifecycle) {
+    return useSyncExternalStore(lifecycle.subscribe, lifecycle.getSnapshot, () => none);
+}
+//# sourceMappingURL=keys.js.map

package/dist/keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keys.js","sourceRoot":"","sources":["../src/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,OAAO,CAAC;AAuB7C,+EAA+E;AAC/E,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,SAAS,CAAsB;IAExC,YAAY,SAA8B;QACxC,KAAK,CACH,SAAS,KAAK,QAAQ;YACpB,CAAC,CAAC,+HAA+H;YACjI,CAAC,CAAC,yHAAyH,CAC9H,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;QACnC,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;IAC7B,CAAC;CACF;AAyBD;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB;IAChC,IAAI,QAAQ,GAAmC,EAAE,CAAC;IAClD,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,IAAI,UAAU,GAAG,CAAC,CAAC;IACnB,MAAM,SAAS,GAAG,IAAI,GAAG,EAAc,CAAC;IAExC,oEAAoE;IACpE,SAAS,gBAAgB,CAAC,KAAwB;QAChD,KAAK,CAAC,cAAc,EAAE,CAAC;QACvB,yFAAyF;QACzF,KAAK,CAAC,WAAW,GAAG,EAAE,CAAC;IACzB,CAAC;IAED,SAAS,OAAO,CAAC,IAAoC;QACnD,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QACtC,QAAQ,GAAG,IAAI,CAAC;QAChB,IAAI,SAAS,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;YACnE,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,MAAM,CAAC,gBAAgB,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;;gBAC1E,MAAM,CAAC,mBAAmB,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;QACpE,CAAC;QACD,KAAK,MAAM,QAAQ,IAAI,SAAS;YAAE,QAAQ,EAAE,CAAC;IAC/C,CAAC;IAED,qFAAqF;IACrF,KAAK,UAAU,MAAM,CAAI,SAA8B,EAAE,OAAyB;QAChF,IAAI,KAAK,KAAK,IAAI;YAChB,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACnF,MAAM,OAAO,GAAG,UAAU,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC;QAC/B,IAAI,OAAO,KAAK,UAAU;YAAE,MAAM,IAAI,oBAAoB,CAAC,SAAS,CAAC,CAAC;QACtE,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,SAAS,OAAO,CAAC,EAAU;QACzB,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5D,IAAI,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC;IAED,OAAO;QACL,QAAQ,CAAC,IAAI;YACX,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO;YAC3B,KAAK,GAAG,IAAI,CAAC;YACb,UAAU,EAAE,CAAC;YACb,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QACvC,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACxD,yFAAyF;YACzF,0FAA0F;YAC1F,8CAA8C;YAC9C,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;gBACtC,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;YAC1F,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC;YACxC,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO;YACtB,MAAM,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAChC,OAAO,CAAC,EAAE,CAAC,CAAC;QACd,CAAC;QACD,OAAO;QACP,WAAW,EAAE,GAAG,EAAE,CAAC,QAAQ;QAC3B,SAAS,CAAC,QAAQ;YAChB,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACxB,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,MAAM,IAAI,GAAqB,EAAE,CAAC;AAElC,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAC3B,SAA+B;IAE/B,OAAO,oBAAoB,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;AACtF,CAAC"}

package/dist/oauth.d.ts

@@ -1,10 +1,13 @@
+import { type ChangeEvent } from "react";
+import type { ApiClient } from "./api-client.ts";
 /**
  * The two pages behind an agent's sign-in: the consent page, where Claude or ChatGPT sends a
  * person to connect, and the device page, where a script's short code is typed and approved.
  * `@gusnips/server/oauth` is the server half. Logic only: the pages are the product's.
  *
  * Each hook takes your two API calls, so your client, your session and your envelope stay yours,
- * and returns one state to draw. What they settle once:
+ * and returns one state to draw. `createOAuthConsoleApi` writes those calls for the server's
+ * `oauthConsoleRoutes`. What they settle once:
  *
  * - A refusal (an unknown app, a return address it never registered) is a STATE, never a
  *   redirect: sending the browser anywhere on a bad request is how an open redirect is built.
@@ -22,7 +25,8 @@ export interface OAuthRefusal {
     /** An English fallback a person can read. */
     message: string;
 }
-export interface ConsentView {
+/** `Extra` is anything your server adds to the view, such as the workspaces a person may pick. */
+export type ConsentView<Extra extends object = object> = Extra & {
     ok: true;
     /** What the app calls itself. Anyone may pick any name, so show `redirectHost` beside it. */
     clientName: string;
@@ -32,8 +36,8 @@ export interface ConsentView {
     keyName: string;
     /** Where "Cancel" goes: back to the app, which is told the person said no. */
     cancelUrl: string;
-}
-export interface DeviceView {
+};
+export type DeviceView<Extra extends object = object> = Extra & {
     ok: true;
     clientName: string;
     /** As the script printed it: `WDJB-MJHT`. */
@@ -41,17 +45,17 @@ export interface DeviceView {
     keyName: string;
     /** ISO time: JSON carries the server's `Date` as a string. */
     expiresAt: string;
-}
-export interface ConsentApi<Choice> {
+};
+export interface ConsentApi<Choice = void, Extra extends object = object> {
     /** Your API's call to the server's `describe`, with the query string as it came. */
-    describe(query: string): Promise<ConsentView | OAuthRefusal>;
+    describe(query: string): Promise<ConsentView<Extra> | OAuthRefusal>;
     /** Your API's call to `approve`. `choice` is anything your page adds, such as a workspace. */
     approve(query: string, choice: Choice): Promise<{
         ok: true;
         redirectTo: string;
     } | OAuthRefusal>;
 }
-export type ConsentState = {
+export type ConsentState<Extra extends object = object> = {
     status: "loading";
 }
 /** Show `refusal` and a way home. Never a link back to the app. */
@@ -66,10 +70,10 @@ export type ConsentState = {
     retry: () => void;
 } | {
     status: "ready";
-    view: ConsentView;
+    view: ConsentView<Extra>;
 };
-export interface ConsentRequest<Choice> {
-    state: ConsentState;
+export interface ConsentRequest<Choice = void, Extra extends object = object> {
+    state: ConsentState<Extra>;
     approve(choice: Choice): void;
     /** From the press until the browser has left. Keep the button busy the whole time. */
     leaving: boolean;
@@ -80,16 +84,16 @@ export interface ConsentRequest<Choice> {
  *     const consent = useConsentRequest(api.oauth, useLocation().search);
  *     if (consent.state.status === "ready") ... consent.approve(workspaceId)
  */
-export declare function useConsentRequest<Choice = void>(api: ConsentApi<Choice>, search: string): ConsentRequest<Choice>;
-export interface DeviceApi {
+export declare function useConsentRequest<Choice = void, Extra extends object = object>(api: ConsentApi<Choice, Extra>, search: string): ConsentRequest<Choice, Extra>;
+export interface DeviceApi<Choice = void, Extra extends object = object> {
     /** Your API's call to the server's `describeDevice`. */
-    describe(code: string): Promise<DeviceView | OAuthRefusal>;
-    /** Your API's call to `decideDevice`. */
-    decide(code: string, decision: "approve" | "deny"): Promise<{
+    describe(code: string): Promise<DeviceView<Extra> | OAuthRefusal>;
+    /** Your API's call to `decideDevice`. `choice` comes with a yes only, as on the consent page. */
+    decide(code: string, decision: "approve" | "deny", choice?: Choice): Promise<{
         ok: true;
     } | OAuthRefusal>;
 }
-export type DeviceState = 
+export type DeviceState<Extra extends object = object> = 
 /** Fewer than 8 letters so far, or one a code never uses (see `invalidLetter`). */
 {
     status: "typing";
@@ -112,7 +116,7 @@ export type DeviceState =
  */
  | {
     status: "ready";
-    view: DeviceView;
+    view: DeviceView<Extra>;
 }
 /** Done. Tell them to go back to the app, which carries on by itself. */
  | {
@@ -120,16 +124,18 @@ export type DeviceState =
 } | {
     status: "denied";
 };
-export interface DeviceApproval {
-    state: DeviceState;
+export interface DeviceApproval<Choice = void, Extra extends object = object> {
+    state: DeviceState<Extra>;
     /** What the field shows, formatted as they type: `WDJB-MJ`. */
     code: string;
     setCode(input: string): void;
     /** A typed letter no code uses: a vowel. Say so now, not after eight letters. */
     invalidLetter: boolean;
-    approve(): void;
+    approve(choice: Choice): void;
     deny(): void;
     deciding: boolean;
+    /** Which button was pressed, until the server answers: put the spinner on that one. */
+    pending: "approve" | "deny" | null;
     /** The decision did not answer. Show it beside the buttons; pressing again retries. */
     decideError: unknown;
 }
@@ -141,5 +147,53 @@ export declare function formatUserCode(input: string): string;
  *
  * The link the script prints carries `?code=`, so the field usually starts full.
  */
-export declare function useDeviceApproval(api: DeviceApi, search: string): DeviceApproval;
+export declare function useDeviceApproval<Choice = void, Extra extends object = object>(api: DeviceApi<Choice, Extra>, search: string): DeviceApproval<Choice, Extra>;
+export interface DeviceCodeField {
+    /** Spread on the code's `<input>`. Point your `<label htmlFor>` at its `id`. */
+    inputProps: {
+        id: string;
+        value: string;
+        onChange(event: ChangeEvent<HTMLInputElement>): void;
+        placeholder: string;
+        autoComplete: "off";
+        autoCapitalize: "characters";
+        spellCheck: false;
+        /** Only when the field starts empty: a code from the link is there to be read first. */
+        autoFocus: boolean;
+        disabled: boolean;
+        "aria-invalid": boolean;
+        "aria-describedby": string;
+    };
+    /** Spread on the line under the field that says what is happening: a vowel, checking, refused. */
+    statusProps: {
+        id: string;
+        "aria-live": "polite";
+    };
+}
+/**
+ *     const field = useDeviceCodeField(device);
+ *     <label htmlFor={field.inputProps.id}>Code</label>
+ *     <input {...field.inputProps} />
+ *     <p {...field.statusProps}>{device.invalidLetter ? "Codes have no vowels." : null}</p>
+ *
+ * The field's wiring, and the code kept in the address as `?code=`, so a reload or a shared link
+ * comes back to the same code. The address is replaced, never pushed, so Back still leaves the
+ * page, and the router's own state rides along. Once decided the code leaves the address: the
+ * server no longer knows it, and a reload would only tell the person it is wrong.
+ */
+export declare function useDeviceCodeField<Choice, Extra extends object>(device: DeviceApproval<Choice, Extra>): DeviceCodeField;
+/** The calls the console API makes. `createApiClient`'s client fits as it is. */
+export type OAuthConsoleHttp = Pick<ApiClient, "get" | "post">;
+/**
+ *     export const oauthApi = createOAuthConsoleApi(api, "/auth/oauth");
+ *     useConsentRequest(oauthApi.consent, search);
+ *     useDeviceApproval(oauthApi.device, search);
+ *
+ * Both pages' calls to the server's `oauthConsoleRoutes`, mounted at `basePath` behind your
+ * sign-in. A choice travels as `choice`, which is where those routes hand it to your approver.
+ */
+export declare function createOAuthConsoleApi<Choice = void>(http: OAuthConsoleHttp, basePath: string): {
+    consent: ConsentApi<Choice>;
+    device: DeviceApi<Choice>;
+};
 //# sourceMappingURL=oauth.d.ts.map

package/dist/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,MAAM,kBAAkB,GAC5B,gBAAgB,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,cAAc,CAAC;AAEjG,gFAAgF;AAChF,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,kBAAkB,CAAC;IAC3B,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,IAAI,CAAC;IACT,6FAA6F;IAC7F,UAAU,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,YAAY,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,IAAI,CAAC;IACT,UAAU,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,UAAU,CAAC,MAAM;IAChC,oFAAoF;IACpF,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,YAAY,CAAC,CAAC;IAC7D,8FAA8F;IAC9F,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,YAAY,CAAC,CAAC;CAClG;AAED,MAAM,MAAM,YAAY,GACpB;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE;AACvB,mEAAmE;GACjE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,YAAY,CAAA;CAAE;AAC9C,6EAA6E;GAC3E;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,IAAI,CAAA;CAAE,GACvD;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,WAAW,CAAA;CAAE,CAAC;AAE3C,MAAM,WAAW,cAAc,CAAC,MAAM;IACpC,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,sFAAsF;IACtF,OAAO,EAAE,OAAO,CAAC;IACjB,iFAAiF;IACjF,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,GAAG,IAAI,EAC7C,GAAG,EAAE,UAAU,CAAC,MAAM,CAAC,EACvB,MAAM,EAAE,MAAM,GACb,cAAc,CAAC,MAAM,CAAC,CA8BxB;AAED,MAAM,WAAW,SAAS;IACxB,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,YAAY,CAAC,CAAC;IAC3D,yCAAyC;IACzC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG,YAAY,CAAC,CAAC;CAC1F;AAED,MAAM,MAAM,WAAW;AACrB,mFAAmF;AACjF;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE;AACvB,iFAAiF;GAC/E;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,YAAY,CAAA;CAAE,GAC5C;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,IAAI,CAAA;CAAE;AACzD;;;;GAIG;GACD;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,UAAU,CAAA;CAAE;AACvC,yEAAyE;GACvE;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,GACtB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEzB,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,WAAW,CAAC;IACnB,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iFAAiF;IACjF,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,IAAI,IAAI,CAAC;IAChB,IAAI,IAAI,IAAI,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,uFAAuF;IACvF,WAAW,EAAE,OAAO,CAAC;CACtB;AAMD,iGAAiG;AACjG,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMpD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,cAAc,CA2ChF"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AACA,OAAO,EAA8B,KAAK,WAAW,EAAE,MAAM,OAAO,CAAC;AACrE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAEjD;;;;;;;;;;;;;;;;GAgBG;AAEH,MAAM,MAAM,kBAAkB,GAC5B,gBAAgB,GAAG,mBAAmB,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,cAAc,CAAC;AAEjG,gFAAgF;AAChF,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,KAAK,CAAC;IACV,MAAM,EAAE,kBAAkB,CAAC;IAC3B,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,kGAAkG;AAClG,MAAM,MAAM,WAAW,CAAC,KAAK,SAAS,MAAM,GAAG,MAAM,IAAI,KAAK,GAAG;IAC/D,EAAE,EAAE,IAAI,CAAC;IACT,6FAA6F;IAC7F,UAAU,EAAE,MAAM,CAAC;IACnB,wFAAwF;IACxF,YAAY,EAAE,MAAM,CAAC;IACrB,wCAAwC;IACxC,OAAO,EAAE,MAAM,CAAC;IAChB,8EAA8E;IAC9E,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,UAAU,CAAC,KAAK,SAAS,MAAM,GAAG,MAAM,IAAI,KAAK,GAAG;IAC9D,EAAE,EAAE,IAAI,CAAC;IACT,UAAU,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,WAAW,UAAU,CAAC,MAAM,GAAG,IAAI,EAAE,KAAK,SAAS,MAAM,GAAG,MAAM;IACtE,oFAAoF;IACpF,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC,CAAC;IACpE,8FAA8F;IAC9F,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAAG,YAAY,CAAC,CAAC;CAClG;AAED,MAAM,MAAM,YAAY,CAAC,KAAK,SAAS,MAAM,GAAG,MAAM,IAClD;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE;AACvB,mEAAmE;GACjE;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,YAAY,CAAA;CAAE;AAC9C,6EAA6E;GAC3E;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,IAAI,CAAA;CAAE,GACvD;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,CAAA;CAAE,CAAC;AAElD,MAAM,WAAW,cAAc,CAAC,MAAM,GAAG,IAAI,EAAE,KAAK,SAAS,MAAM,GAAG,MAAM;IAC1E,KAAK,EAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IAC3B,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,sFAAsF;IACtF,OAAO,EAAE,OAAO,CAAC;IACjB,iFAAiF;IACjF,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,GAAG,IAAI,EAAE,KAAK,SAAS,MAAM,GAAG,MAAM,EAC5E,GAAG,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,EAC9B,MAAM,EAAE,MAAM,GACb,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CA8B/B;AAED,MAAM,WAAW,SAAS,CAAC,MAAM,GAAG,IAAI,EAAE,KAAK,SAAS,MAAM,GAAG,MAAM;IACrE,wDAAwD;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,YAAY,CAAC,CAAC;IAClE,iGAAiG;IACjG,MAAM,CACJ,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,SAAS,GAAG,MAAM,EAC5B,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,GAAG,YAAY,CAAC,CAAC;CACzC;AAED,MAAM,MAAM,WAAW,CAAC,KAAK,SAAS,MAAM,GAAG,MAAM;AACnD,mFAAmF;AACjF;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,SAAS,CAAA;CAAE;AACvB,iFAAiF;GAC/E;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,YAAY,CAAA;CAAE,GAC5C;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,IAAI,CAAA;CAAE;AACzD;;;;GAIG;GACD;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,CAAA;CAAE;AAC9C,yEAAyE;GACvE;IAAE,MAAM,EAAE,UAAU,CAAA;CAAE,GACtB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEzB,MAAM,WAAW,cAAc,CAAC,MAAM,GAAG,IAAI,EAAE,KAAK,SAAS,MAAM,GAAG,MAAM;IAC1E,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1B,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iFAAiF;IACjF,aAAa,EAAE,OAAO,CAAC;IACvB,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,IAAI,IAAI,IAAI,CAAC;IACb,QAAQ,EAAE,OAAO,CAAC;IAClB,uFAAuF;IACvF,OAAO,EAAE,SAAS,GAAG,MAAM,GAAG,IAAI,CAAC;IACnC,uFAAuF;IACvF,WAAW,EAAE,OAAO,CAAC;CACtB;AAMD,iGAAiG;AACjG,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMpD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,GAAG,IAAI,EAAE,KAAK,SAAS,MAAM,GAAG,MAAM,EAC5E,GAAG,EAAE,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,EAC7B,MAAM,EAAE,MAAM,GACb,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,CA6C/B;AAED,MAAM,WAAW,eAAe;IAC9B,gFAAgF;IAChF,UAAU,EAAE;QACV,EAAE,EAAE,MAAM,CAAC;QACX,KAAK,EAAE,MAAM,CAAC;QACd,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,gBAAgB,CAAC,GAAG,IAAI,CAAC;QACrD,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,KAAK,CAAC;QACpB,cAAc,EAAE,YAAY,CAAC;QAC7B,UAAU,EAAE,KAAK,CAAC;QAClB,wFAAwF;QACxF,SAAS,EAAE,OAAO,CAAC;QACnB,QAAQ,EAAE,OAAO,CAAC;QAClB,cAAc,EAAE,OAAO,CAAC;QACxB,kBAAkB,EAAE,MAAM,CAAC;KAC5B,CAAC;IACF,kGAAkG;IAClG,WAAW,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,QAAQ,CAAA;KAAE,CAAC;CACpD;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,KAAK,SAAS,MAAM,EAC7D,MAAM,EAAE,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,GACpC,eAAe,CA6BjB;AAED,iFAAiF;AACjF,MAAM,MAAM,gBAAgB,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,GAAG,MAAM,CAAC,CAAC;AAE/D;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,GAAG,IAAI,EACjD,IAAI,EAAE,gBAAgB,EACtB,QAAQ,EAAE,MAAM,GACf;IAAE,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAA;CAAE,CAY5D"}

package/dist/oauth.js

@@ -1,5 +1,5 @@
 import { useMutation, useQuery } from "@tanstack/react-query";
-import { useState } from "react";
+import { useEffect, useId, useState } from "react";
 /**
  *     const consent = useConsentRequest(api.oauth, useLocation().search);
  *     if (consent.state.status === "ready") ... consent.approve(workspaceId)
@@ -59,9 +59,9 @@ export function useDeviceApproval(api, search) {
     const invalidLetter = [...letters].some((letter) => !ALPHABET.includes(letter));
     const complete = letters.length === LENGTH && !invalidLetter;
     const decision = useMutation({
-        mutationFn: (choice) => api.decide(letters, choice),
+        mutationFn: (pressed) => api.decide(letters, pressed.decision, pressed.choice),
     });
-    const decided = decision.data?.ok === true ? decision.variables : undefined;
+    const decided = decision.isSuccess && decision.data.ok ? decision.variables.decision : undefined;
     const request = useQuery({
         queryKey: ["@gusnips/react/oauth", "device", letters],
         queryFn: () => api.describe(letters),
@@ -90,10 +90,73 @@ export function useDeviceApproval(api, search) {
             setTyped(formatUserCode(input));
         },
         invalidLetter,
-        approve: () => decision.mutate("approve"),
-        deny: () => decision.mutate("deny"),
+        approve: (choice) => decision.mutate({ decision: "approve", choice }),
+        deny: () => decision.mutate({ decision: "deny" }),
         deciding: decision.isPending,
+        pending: decision.isPending ? decision.variables.decision : null,
         decideError: decision.error,
     };
 }
+/**
+ *     const field = useDeviceCodeField(device);
+ *     <label htmlFor={field.inputProps.id}>Code</label>
+ *     <input {...field.inputProps} />
+ *     <p {...field.statusProps}>{device.invalidLetter ? "Codes have no vowels." : null}</p>
+ *
+ * The field's wiring, and the code kept in the address as `?code=`, so a reload or a shared link
+ * comes back to the same code. The address is replaced, never pushed, so Back still leaves the
+ * page, and the router's own state rides along. Once decided the code leaves the address: the
+ * server no longer knows it, and a reload would only tell the person it is wrong.
+ */
+export function useDeviceCodeField(device) {
+    const id = useId();
+    const statusId = `${id}-status`;
+    const { status } = device.state;
+    const inAddress = status === "approved" || status === "denied" ? "" : device.code;
+    useEffect(() => {
+        const url = new URL(window.location.href);
+        if (inAddress)
+            url.searchParams.set("code", inAddress);
+        else
+            url.searchParams.delete("code");
+        if (url.href !== window.location.href)
+            window.history.replaceState(window.history.state, "", url);
+    }, [inAddress]);
+    return {
+        inputProps: {
+            id,
+            value: device.code,
+            onChange: (event) => device.setCode(event.target.value),
+            placeholder: "WDJB-MJHT",
+            autoComplete: "off",
+            autoCapitalize: "characters",
+            spellCheck: false,
+            autoFocus: device.code === "",
+            disabled: device.deciding,
+            "aria-invalid": device.invalidLetter || status === "refused",
+            "aria-describedby": statusId,
+        },
+        statusProps: { id: statusId, "aria-live": "polite" },
+    };
+}
+/**
+ *     export const oauthApi = createOAuthConsoleApi(api, "/auth/oauth");
+ *     useConsentRequest(oauthApi.consent, search);
+ *     useDeviceApproval(oauthApi.device, search);
+ *
+ * Both pages' calls to the server's `oauthConsoleRoutes`, mounted at `basePath` behind your
+ * sign-in. A choice travels as `choice`, which is where those routes hand it to your approver.
+ */
+export function createOAuthConsoleApi(http, basePath) {
+    return {
+        consent: {
+            describe: (query) => http.get(`${basePath}/request?${query}`),
+            approve: (query, choice) => http.post(`${basePath}/approve`, { query, choice }),
+        },
+        device: {
+            describe: (code) => http.get(`${basePath}/device?code=${encodeURIComponent(code)}`),
+            decide: (code, decision, choice) => http.post(`${basePath}/device`, { code, decision, choice }),
+        },
+    };
+}
 //# sourceMappingURL=oauth.js.map

package/dist/oauth.js.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AA4EjC;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAuB,EACvB,MAAc;IAEd,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,QAAQ,CAAC;QACvB,QAAQ,EAAE,CAAC,sBAAsB,EAAE,SAAS,EAAE,KAAK,CAAC;QACpD,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;KACnC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,WAAW,CAAC;QAC3B,UAAU,EAAE,CAAC,MAAc,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;QAC1D,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE;YACpB,IAAI,MAAM,CAAC,EAAE;gBAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC;KACF,CAAC,CAAC;IAEH,2FAA2F;IAC3F,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC5B,MAAM,OAAO,GACX,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,IAAI,KAAmB,CAAC;IACxB,IAAI,OAAO;QAAE,KAAK,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;SAC/C,IAAI,MAAM,EAAE,EAAE,KAAK,IAAI;QAAE,KAAK,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;SACnE,IAAI,OAAO,CAAC,OAAO;QACtB,KAAK,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;;QACrF,KAAK,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAEnC,OAAO;QACL,KAAK;QACL,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;QAC5C,OAAO,EAAE,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,IAAI;QACzD,YAAY,EAAE,QAAQ,CAAC,KAAK;KAC7B,CAAC;AACJ,CAAC;AAwCD,uEAAuE;AACvE,MAAM,QAAQ,GAAG,sBAAsB,CAAC;AACxC,MAAM,MAAM,GAAG,CAAC,CAAC;AAEjB,iGAAiG;AACjG,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,OAAO,GAAG,KAAK;SAClB,WAAW,EAAE;SACb,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpB,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AACrF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAc,EAAE,MAAc;IAC9D,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CACrC,cAAc,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAC9D,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,aAAa,CAAC;IAE7D,MAAM,QAAQ,GAAG,WAAW,CAAC;QAC3B,UAAU,EAAE,CAAC,MAA0B,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC;KACxE,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,MAAM,OAAO,GAAG,QAAQ,CAAC;QACvB,QAAQ,EAAE,CAAC,sBAAsB,EAAE,QAAQ,EAAE,OAAO,CAAC;QACrD,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;QACpC,OAAO,EAAE,QAAQ,IAAI,OAAO,KAAK,SAAS;KAC3C,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC5B,MAAM,OAAO,GACX,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,IAAI,KAAkB,CAAC;IACvB,IAAI,OAAO,KAAK,SAAS;QAAE,KAAK,GAAG,EAAE,MAAM,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;SACxF,IAAI,CAAC,QAAQ;QAAE,KAAK,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;SAC5C,IAAI,OAAO;QAAE,KAAK,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;SACpD,IAAI,MAAM,EAAE,EAAE,KAAK,IAAI;QAAE,KAAK,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;SACnE,IAAI,OAAO,CAAC,OAAO;QACtB,KAAK,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;;QACrF,KAAK,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAEnC,OAAO;QACL,KAAK;QACL,IAAI;QACJ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,aAAa;QACb,OAAO,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC;QACzC,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;QACnC,QAAQ,EAAE,QAAQ,CAAC,SAAS;QAC5B,WAAW,EAAE,QAAQ,CAAC,KAAK;KAC5B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"oauth.js","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAoB,MAAM,OAAO,CAAC;AA+ErE;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAA8B,EAC9B,MAAc;IAEd,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,QAAQ,CAAC;QACvB,QAAQ,EAAE,CAAC,sBAAsB,EAAE,SAAS,EAAE,KAAK,CAAC;QACpD,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;KACnC,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,WAAW,CAAC;QAC3B,UAAU,EAAE,CAAC,MAAc,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;QAC1D,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE;YACpB,IAAI,MAAM,CAAC,EAAE;gBAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC3D,CAAC;KACF,CAAC,CAAC;IAEH,2FAA2F;IAC3F,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC5B,MAAM,OAAO,GACX,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,IAAI,KAA0B,CAAC;IAC/B,IAAI,OAAO;QAAE,KAAK,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;SAC/C,IAAI,MAAM,EAAE,EAAE,KAAK,IAAI;QAAE,KAAK,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;SACnE,IAAI,OAAO,CAAC,OAAO;QACtB,KAAK,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;;QACrF,KAAK,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAEnC,OAAO;QACL,KAAK;QACL,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;QAC5C,OAAO,EAAE,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,IAAI;QACzD,YAAY,EAAE,QAAQ,CAAC,KAAK;KAC7B,CAAC;AACJ,CAAC;AA8CD,uEAAuE;AACvE,MAAM,QAAQ,GAAG,sBAAsB,CAAC;AACxC,MAAM,MAAM,GAAG,CAAC,CAAC;AAEjB,iGAAiG;AACjG,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,OAAO,GAAG,KAAK;SAClB,WAAW,EAAE;SACb,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpB,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;AACrF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAA6B,EAC7B,MAAc;IAEd,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,GAAG,QAAQ,CAAC,GAAG,EAAE,CACrC,cAAc,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAC9D,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,aAAa,CAAC;IAE7D,MAAM,QAAQ,GAAG,WAAW,CAAC;QAC3B,UAAU,EAAE,CAAC,OAA0D,EAAE,EAAE,CACzE,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC;KACxD,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IACjG,MAAM,OAAO,GAAG,QAAQ,CAAC;QACvB,QAAQ,EAAE,CAAC,sBAAsB,EAAE,QAAQ,EAAE,OAAO,CAAC;QACrD,OAAO,EAAE,GAAG,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC;QACpC,OAAO,EAAE,QAAQ,IAAI,OAAO,KAAK,SAAS;KAC3C,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAC5B,MAAM,OAAO,GACX,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACrF,IAAI,KAAyB,CAAC;IAC9B,IAAI,OAAO,KAAK,SAAS;QAAE,KAAK,GAAG,EAAE,MAAM,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;SACxF,IAAI,CAAC,QAAQ;QAAE,KAAK,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;SAC5C,IAAI,OAAO;QAAE,KAAK,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;SACpD,IAAI,MAAM,EAAE,EAAE,KAAK,IAAI;QAAE,KAAK,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;SACnE,IAAI,OAAO,CAAC,OAAO;QACtB,KAAK,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;;QACrF,KAAK,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IAEnC,OAAO;QACL,KAAK;QACL,IAAI;QACJ,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACjB,QAAQ,CAAC,KAAK,EAAE,CAAC;YACjB,QAAQ,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;QAClC,CAAC;QACD,aAAa;QACb,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC;QACrE,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACjD,QAAQ,EAAE,QAAQ,CAAC,SAAS;QAC5B,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;QAChE,WAAW,EAAE,QAAQ,CAAC,KAAK;KAC5B,CAAC;AACJ,CAAC;AAsBD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAqC;IAErC,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,QAAQ,GAAG,GAAG,EAAE,SAAS,CAAC;IAChC,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC;IAChC,MAAM,SAAS,GAAG,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IAClF,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,SAAS;YAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;;YAClD,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,QAAQ,CAAC,IAAI;YACnC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/D,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAEhB,OAAO;QACL,UAAU,EAAE;YACV,EAAE;YACF,KAAK,EAAE,MAAM,CAAC,IAAI;YAClB,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC;YACvD,WAAW,EAAE,WAAW;YACxB,YAAY,EAAE,KAAK;YACnB,cAAc,EAAE,YAAY;YAC5B,UAAU,EAAE,KAAK;YACjB,SAAS,EAAE,MAAM,CAAC,IAAI,KAAK,EAAE;YAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,cAAc,EAAE,MAAM,CAAC,aAAa,IAAI,MAAM,KAAK,SAAS;YAC5D,kBAAkB,EAAE,QAAQ;SAC7B;QACD,WAAW,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE;KACrD,CAAC;AACJ,CAAC;AAKD;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAsB,EACtB,QAAgB;IAEhB,OAAO;QACL,OAAO,EAAE;YACP,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,YAAY,KAAK,EAAE,CAAC;YAC7D,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;SAChF;QACD,MAAM,EAAE;YACN,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,gBAAgB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YACnF,MAAM,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,CACjC,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;SAC9D;KACF,CAAC;AACJ,CAAC"}