@iaurelius/accounts-expo 0.3.0 → 0.4.1

package/README.md

@@ -81,13 +81,46 @@ Only the application's native apps may do this (registered as mobile in the cons
 page's bot check (Turnstile) cannot run on a native screen: the per-address and per-IP limits still
 apply.
 
+- Both steps throw an `OAuthError`. A refusal keeps the application's code (`INVALID_OTP`,
+  `ACCOUNT_LOCKED`, `ACCOUNT_OTP_LIMITED`, `organization_required`…). A limit without a code of its own
+  is `too_many_requests` (`status` 429), and a `5xx` or no answer `temporarily_unavailable`; both carry
+  `retryAfter` in seconds when the application says how long to wait. None of them touches the session
+  the device already had.
+- The code for the session waits up to a minute, like the hosted sign-in's code exchange, and is sent
+  once: the application spends it (and issues a refresh token) as soon as it arrives, so giving up after
+  10 seconds would waste it and sending it again would only be refused.
+- If the person signs out while the code is on its way, they stay signed out and the refresh token its
+  answer brings is revoked. A refresh of the session before, still on its way, does not bring that one back.
+- Signing in while already signed in ("use another account") replaces the session: once the new one is on the
+  device, the refresh token of the one before is revoked, so it does not stay alive at your application.
+
 ### Tokens and the network
 
-- `getToken()` gives a token for your `audience`, refreshed a minute before it expires. When your API
-  refuses one (a 401), ask once more with `getToken({ forceRefresh: true })` before signing the person out.
+- `getToken()` gives a token for your `audience`, refreshed a minute before it expires. While the token still
+  lasts, `getToken()` gives it at once and the refresh goes on in the background, so a network that hangs holds
+  no call; once it has expired, `getToken()` waits for the refresh. When your API refuses one (a 401), ask once
+  with `getToken({ forceRefresh: true })`:
+  - Several refusals of the same token make a single refresh, and a token that a refresh (forced, or the one
+    in the background) gave less than 30 seconds ago is given again: an API that always answers 401 cannot use
+    up the application's limit, and a 401 for the token you held just before a refresh replaced it gets the
+    new one at once.
+  - It resolves to `null` only when the session is over (then sign the person out). If no new token can be had
+    now (no network, or the application asked to wait), it throws an `OAuthError` (exported by this package) with `error: "temporarily_unavailable"`:
+    the person is still signed in; try again later.
 - On start, the session kept on the device shows at once (`isLoaded` and `isSignedIn`), and its refresh
   follows. Offline, the person stays signed in with the token they have.
-- Each request to your application gives up after 10 seconds (`requestTimeoutMs` on `<AccountsProvider>`).
+- Each request to your application gives up after 10 seconds (`requestTimeoutMs` on `<AccountsProvider>`),
+  except those to the token endpoint:
+  - A refresh that gets no answer in 8 seconds is sent once more, at once and identical, and that second try
+    waits up to a minute. When the application processes a refresh it rotates the refresh token, and it answers
+    the old one again with the same tokens for two minutes. Sending it again early is what keeps the second
+    try within that time.
+  - The new refresh token is kept on the device as soon as the answer arrives, before the profile is read
+    again: an app that iOS or Android ends right then starts next time with a token that still refreshes.
+    And if the answer never arrived at all (the phone was locked while it was on its way), the application
+    takes the token the device still has, however late, as long as nobody has used the one it never got.
+  - The sign-in's code exchange waits up to a minute and is sent once more if no answer comes. A code sent twice
+    is refused and the refresh token it issued is revoked, so none is left alive on no device.
 
 ## Security
 
@@ -95,6 +128,8 @@ apply.
 - **ID token:** it comes straight from the token endpoint over TLS, so its issuer, audience, nonce and expiry are checked (OIDC Core 3.1.3.7).
 - **On the device:** tokens stay in SecureStore, split in parts because Android is unreliable past 2 KB.
 - **Revocation:** a person who is banned or signed out everywhere is out at the next refresh. Sign-out revokes the refresh token.
+- **Refresh:** only a refusal for good signs the person out: a `4xx` with an OAuth error, such as `invalid_grant` (revoked, banned), `invalid_client`, `invalid_scope` or `invalid_target` (your `audience` changed). A `429` (many phones behind one carrier IP), a `5xx`, no answer or a `4xx` without an OAuth error (a firewall's page) keeps the session and its refresh token; the access token serves while it lasts, and no refresh is tried again before the server's `Retry-After`. A refreshed ID token must be the same person (`iss`, `sub`, `aud`), and userinfo's `sub` must match.
+- **Sign-out during a refresh or a sign-in:** a refresh that was on its way when the person signed out (or signed in again) does not bring the old session back, and a sign-in (hosted page or your own screen) that was on its way when they signed out does not sign them in: its answer is dropped and its refresh token revoked. A sign-in answer whose ID token is not for that sign-in is refused, and its refresh token revoked too.
 - **Bundle size:** the package uses no Node APIs and no WebCrypto (`expo-crypto` instead), and does not pull jose into your bundle.
 
 ## License

package/dist/core.d.ts

@@ -38,7 +38,9 @@ export type ClientOptions = {
     /** Refresh when the access token has less than this left (default 60 s). */
     refreshBeforeSeconds?: number;
     /** Each request to the application gives up after this long (default 10 s): on a bad network the app
-     * does not wait for the system's own timeout, and a session kept on the device goes on meanwhile. */
+     * does not wait for the system's own timeout, and a session kept on the device goes on meanwhile.
+     * The token endpoint (refresh, sign-in) and the code of your own sign-in screen have their own waits: see
+     * REFRESH_FIRST_TRY_MS and TOKEN_TIMEOUT_MS. */
     requestTimeoutMs?: number;
 };
 /** A store that splits big values (SecureStore is unreliable past ~2 KB on Android): key.n holds the count. */
@@ -48,7 +50,7 @@ export declare function queryOf(url: string): Record<string, string>;
 export declare function createAccountsClient(o: ClientOptions): {
     readonly state: AccountsState;
     subscribe(l: (s: AccountsState) => void): () => void;
-    /** The session kept on the device, refreshed if needed. */
+    /** The session kept on the device, shown at once; resolves once its refresh, if it was due, has ended. */
     load(): Promise<AccountsState>;
     /** Opens the hosted page; resolves once the person is back (signed in, or unchanged if they closed it). */
     signIn: () => Promise<AccountsState>;
@@ -59,8 +61,14 @@ export declare function createAccountsClient(o: ClientOptions): {
     signInWithEmailCode: (email: string, code: string) => Promise<AccountsState>;
     /** The same, on "create an account". */
     signUp: () => Promise<AccountsState>;
-    /** An access token for your API, refreshed if it is about to expire; null when signed out.
-     * forceRefresh: a new one even if this one still lasts (your API just refused it). */
+    /**
+     * An access token for your API; null when signed out. One about to expire is refreshed: while it still lasts it
+     * is given at once and the refresh goes on in the background; once expired, the call waits for the refresh.
+     * forceRefresh: a new one even if this one still lasts (your API just refused it). Compare-and-refresh: several
+     * refusals of the same token make one refresh, and a token a refresh (forced or not) gave less than 30 s ago is given
+     * again instead of rotating once more. If no new token can be had now (no answer, a 429), it throws an
+     * OAuthError (temporarily_unavailable) and the session stays; it resolves to null only when the session is over.
+     */
     getToken(opts?: {
         forceRefresh?: boolean;
     }): Promise<string | null>;

package/dist/core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AAIA,OAAO,EAWL,KAAK,SAAS,EACd,KAAK,WAAW,EACjB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,WAAW,EAAE,CAAC;AAE5B,MAAM,MAAM,OAAO,GAAG;IAAE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC;AACvJ,MAAM,MAAM,iBAAiB,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAA;CAAE,CAAC;AACxH,MAAM,MAAM,OAAO,GAAG;IAAE,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;CAAE,CAAC;AACxG,MAAM,MAAM,MAAM,GAAG;IAAE,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC;AAE9G,MAAM,MAAM,aAAa,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAI3H,MAAM,MAAM,aAAa,GAAG;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,kIAAkI;IAClI,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,4EAA4E;IAC5E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;yGACqG;IACrG,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAeF,+GAA+G;AAC/G,wBAAgB,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,SAAO,GAAG,OAAO,CAqB9D;AAED,uGAAuG;AACvG,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAU3D;AAED,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,aAAa;;iBAgJpC,CAAC,CAAC,EAAE,aAAa,KAAK,IAAI;IAMvC,2DAA2D;;IAgB3D,2GAA2G;;IAE3G,8FAA8F;2BApE5D,MAAM;;;iCAMA,MAAM,QAAQ,MAAM;IAiE5D,wCAAwC;;IAExC;0FACsF;oBACjE;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE;IAG/C,gGAAgG;mBAC5E;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE;EAQ/C;AAED,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AAIA,OAAO,EAeL,KAAK,SAAS,EACd,KAAK,WAAW,EAEjB,MAAM,0BAA0B,CAAC;AAElC,YAAY,EAAE,WAAW,EAAE,CAAC;AAE5B,MAAM,MAAM,OAAO,GAAG;IAAE,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAAC,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAAC,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAAE,CAAC;AACvJ,MAAM,MAAM,iBAAiB,GAAG;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAA;CAAE,CAAC;AACxH,MAAM,MAAM,OAAO,GAAG;IAAE,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;CAAE,CAAC;AACxG,MAAM,MAAM,MAAM,GAAG;IAAE,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IAAC,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CAAE,CAAC;AAE9G,MAAM,MAAM,aAAa,GAAG;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,UAAU,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC;AAI3H,MAAM,MAAM,aAAa,GAAG;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,kIAAkI;IAClI,WAAW,EAAE,MAAM,CAAC;IACpB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,4EAA4E;IAC5E,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;oDAGgD;IAChD,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAkDF,+GAA+G;AAC/G,wBAAgB,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,SAAO,GAAG,OAAO,CAqB9D;AAED,uGAAuG;AACvG,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAU3D;AAED,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,aAAa;;iBA0PpC,CAAC,CAAC,EAAE,aAAa,KAAK,IAAI;IAMvC,0GAA0G;;IAgB1G,2GAA2G;;IAE3G,8FAA8F;2BAnG5D,MAAM;;;iCASA,MAAM,QAAQ,MAAM;IA6F5D,wCAAwC;;IAExC;;;;;;;OAOG;oBACkB;QAAE,YAAY,CAAC,EAAE,OAAO,CAAA;KAAE;IAW/C,gGAAgG;mBAC5E;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE;EAS/C;AAED,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/core.js

@@ -2,8 +2,26 @@
 // S256, state, nonce, RFC 9207's iss), the session kept in a secure store, an access token that refreshes
 // itself, and sign-out. The platform's parts (store, browser, crypto) are passed in: src/expo.ts gives
 // Expo's; the tests give Node's and the platform's own server.
-import { OAuthError, authorizationUrl, endSessionUrl, exchangeCode, fetchUserInfo, issuerFromPublishableKey, readIdToken, refreshTokens, revokeToken, userFromClaims, } from "@iaurelius/accounts/oidc";
+import { OAuthError, authorizationUrl, endSessionUrl, exchangeCode, fetchUserInfo, issuerFromPublishableKey, readIdToken, refreshBackoff, refreshTokens, retryAfterOf, revokeToken, sameIdentity, sessionEnded, userFromClaims, } from "@iaurelius/accounts/oidc";
 const now = () => Math.floor(Date.now() / 1000);
+/**
+ * A refresh the application has processed rotates the refresh token: if its answer never arrives, the old one is
+ * all the device has, and presenting it after the application's reuse window ends every session of the person in
+ * this app. The application answers it the same again only within that window (10 s today). So a refresh gets no
+ * answer for 8 s at most before it is sent again, at once and identical, and the second one lands inside the window
+ * (PR32-A1). That one then waits up to TOKEN_TIMEOUT_MS: it is the last chance for this rotation.
+ */
+const REFRESH_FIRST_TRY_MS = 8_000;
+/**
+ * The longest wait on the token endpoint (or requestTimeoutMs, if longer): a refresh sent again, the code
+ * exchange, and the code of the app's own sign-in screen. A code has no reuse window: sent twice it is refused and
+ * what it issued revoked, so its first try waits this long too (a slow answer still signs in). The screen's code is
+ * spent, and a refresh token issued, once the application has it: given up earlier, that refresh token would stay
+ * alive on no device and the person would need a new code.
+ */
+const TOKEN_TIMEOUT_MS = 60_000;
+/** A forced refresh (getToken({ forceRefresh: true })) at most this often after any refresh: the token that one got is given again. */
+const FORCE_COOLDOWN_MS = 30_000;
 /** fetch that gives up after `ms` (React Native's has no timeout of its own). */
 function withTimeout(f, ms) {
     const base = f ?? ((input, init) => globalThis.fetch(input, init));
@@ -14,6 +32,22 @@ function withTimeout(f, ms) {
         return base(input, { ...init, signal: ac.signal }).finally(() => clearTimeout(timer));
     };
 }
+/**
+ * The token endpoint's requests: one that got no answer (the network, or its timeout) is sent again once, at once
+ * and identical, with `again` (a longer wait). If the application had processed it, it answers the same again (a
+ * refresh within its reuse window) or revokes what it issued (a code used twice): the rotated refresh token is not
+ * lost, nor left alive on no device.
+ */
+function sentTwiceIfUnanswered(first, again) {
+    return async (input, init) => {
+        try {
+            return await first(input, init);
+        }
+        catch {
+            return again(input, init);
+        }
+    };
+}
 /** A store that splits big values (SecureStore is unreliable past ~2 KB on Android): key.n holds the count. */
 export function chunked(storage, size = 1800) {
     return {
@@ -59,6 +93,11 @@ export function createAccountsClient(o) {
     const issuer = issuerFromPublishableKey(o.publishableKey);
     const fetch = withTimeout(o.fetch, o.requestTimeoutMs ?? 10_000);
     const creds = { issuer, clientId: o.clientId, fetch };
+    // The token endpoint: one more try if no answer came (H-X01 of the review of #31). A refresh's first try gives up
+    // within the application's reuse window, so that the second still gets the same answer (PR32-A1).
+    const longest = withTimeout(o.fetch, Math.max(o.requestTimeoutMs ?? 10_000, TOKEN_TIMEOUT_MS));
+    const refreshCreds = { ...creds, fetch: sentTwiceIfUnanswered(withTimeout(o.fetch, REFRESH_FIRST_TRY_MS), longest) };
+    const codeCreds = { ...creds, fetch: sentTwiceIfUnanswered(longest, longest) };
     const store = chunked(o.storage);
     const key = `accounts.${o.clientId.replace(/[^A-Za-z0-9._-]/g, "_")}`;
     let session = null;
@@ -76,16 +115,20 @@ export function createAccountsClient(o) {
         for (const l of listeners)
             l(state);
     }
+    // One write to the device at a time, in the order they were asked for. expo-secure-store keeps that order
+    // itself (one serial queue); a store that does not could run the removal of a sign-out ahead of the write
+    // of a refresh, or of a sign-in, that was still saving, and leave that session on the device.
+    let writing = Promise.resolve();
     async function save(s) {
         session = s;
-        if (s)
-            await store.set(key, JSON.stringify(s));
-        else
-            await store.remove(key);
+        const write = writing.then(() => (s ? store.set(key, JSON.stringify(s)) : store.remove(key)));
+        writing = write.catch(() => undefined); // a write that fails is its caller's error, not the next write's
+        await write;
         publish();
     }
-    async function profile(accessToken) {
-        const c = await fetchUserInfo({ issuer, accessToken, fetch });
+    /** The profile from userinfo, only if it is about `sub` (the ID token's person). */
+    async function profile(accessToken, sub) {
+        const c = await fetchUserInfo({ issuer, accessToken, fetch, sub });
         if (!c)
             return undefined;
         const p = {};
@@ -99,9 +142,31 @@ export function createAccountsClient(o) {
             p.picture = c.picture;
         return p;
     }
+    // Every sign-in and sign-out starts a new epoch: a refresh that began in an older one does not save what it
+    // gets (a sign-out while it was on its way stays a sign-out) and revokes the refresh token it was given.
+    let epoch = 0;
+    // After a 429 or no answer, no refresh before the server's Retry-After (a carrier's shared IP, an outage).
+    const backoff = refreshBackoff();
+    const sameEpoch = async (started, t) => {
+        if (started === epoch)
+            return true;
+        if (t.refreshToken)
+            await revokeToken(creds, { token: t.refreshToken, hint: "refresh_token" });
+        return false;
+    };
+    // The last refresh: the token it got, and when (compare-and-refresh, H-X04). Any refresh, not only a forced
+    // one: the API refuses the token an app was given before a refresh in the background replaced it, and what
+    // that app is asking for is the one that refresh got.
+    let latest = { to: "", at: 0 };
     // One refresh at a time: two screens asking for a token at once share it (the refresh token rotates).
     let refreshing = null;
-    async function fresh(force = false) {
+    /**
+     * The session, with its access token refreshed if it is about to expire. A token that still lasts is given at
+     * once and the refresh goes on in the background (R-03): on a network that hangs, a refresh can take a minute,
+     * and the token in hand is good meanwhile. Only a forced refresh, one of an expired token, or `wait` (load())
+     * waits for the refresh to end.
+     */
+    async function fresh(force = false, wait = false) {
         const s = session;
         if (!s)
             return null;
@@ -113,26 +178,64 @@ export function createAccountsClient(o) {
             await save(null);
             return null;
         }
+        if (backoff.waiting)
+            return s.exp > now() ? s : null;
+        const started = epoch;
         refreshing ??= (async () => {
             try {
-                const t = await refreshTokens(creds, { refreshToken: s.rt, resource: o.audience });
-                const next = { at: t.accessToken, rt: t.refreshToken ?? s.rt, it: t.idToken ?? s.it, exp: t.expiresAt, u: (await profile(t.accessToken)) ?? s.u };
-                await save(next);
-                return next;
-            }
-            catch (e) {
-                // Refused (revoked, banned, session over): out. Unreachable: the token while it lasts.
-                if (e instanceof OAuthError && e.status >= 400 && e.status < 500) {
+                let t;
+                try {
+                    t = await refreshTokens(refreshCreds, { refreshToken: s.rt, resource: o.audience });
+                }
+                catch (e) {
+                    // Refused for good (invalid_grant: revoked, banned, session over): out. Anything else (429, 5xx, no
+                    // answer): the session and its refresh token are kept, and the token serves while it lasts.
+                    if (sessionEnded(e)) {
+                        if (started === epoch)
+                            await save(null);
+                        return session;
+                    }
+                    backoff.failed(e);
+                    return s.exp > now() ? s : null;
+                }
+                backoff.succeeded();
+                if (!(await sameEpoch(started, t)))
+                    return session;
+                // OIDC Core 12.2: the same person, for this app, from this application; else the session ends here.
+                if (t.idToken && !sameIdentity(s.it, t.idToken, { issuer, clientId: o.clientId })) {
+                    if (t.refreshToken)
+                        await revokeToken(creds, { token: t.refreshToken, hint: "refresh_token" });
                     await save(null);
                     return null;
                 }
-                return s.exp > now() ? s : null;
+                const it = t.idToken ?? s.it;
+                // The new refresh token goes on the device before anything else is asked: the application has
+                // already rotated the one the device holds, and an app suspended or ended while the profile was on
+                // its way (a phone locked, 7-nov-2026) came back with a token that no longer refreshed.
+                const next = { at: t.accessToken, rt: t.refreshToken ?? s.rt, it, exp: t.expiresAt, u: s.u };
+                // Noted before it is saved: from that moment the session has the new token, and a forced refresh
+                // that arrives while it is being written, or while the profile is read, is answered with it.
+                latest = { to: next.at, at: Date.now() };
+                await save(next);
+                const u = await profile(t.accessToken, readIdToken(it).sub);
+                // Signed out, or signed in again, meanwhile: that stands, and took the token stored above with it.
+                if (started !== epoch || session !== next)
+                    return session;
+                if (!u)
+                    return next;
+                const named = { ...next, u };
+                await save(named);
+                return named;
             }
             finally {
                 refreshing = null;
             }
         })();
-        return refreshing;
+        const done = refreshing;
+        if (force || wait || s.exp <= now())
+            return done;
+        done.catch(() => undefined); // in the background: whoever waits for it sees its error, nobody else
+        return s;
     }
     /** The ID token straight from the token endpoint over TLS (OIDC Core 3.1.3.7): its claims are checked. */
     function checkIdToken(token, nonce) {
@@ -141,11 +244,15 @@ export function createAccountsClient(o) {
         if (c.iss !== issuer || !aud.includes(o.clientId) || c.nonce !== nonce || typeof c.exp !== "number" || c.exp < now() - 5 || typeof c.sub !== "string")
             throw new OAuthError("invalid_id_token", "The ID token is not for this sign-in.");
     }
-    /** A request to the application's native sign-in (no browser); its errors keep the application's code. */
+    /**
+     * A request to the application's native sign-in (no browser); its errors keep the application's code. The code for
+     * the session waits as long as a code exchange (TOKEN_TIMEOUT_MS), and is sent once: the application spends it on
+     * the first request that reaches it, so a second one would only be refused.
+     */
     async function nativeCall(path, body) {
         let res;
         try {
-            res = await fetch(`${issuer}/api/native/${path}`, {
+            res = await (path === "token" ? longest : fetch)(`${issuer}/api/native/${path}`, {
                 method: "POST",
                 headers: { "content-type": "application/json", accept: "application/json" },
                 body: JSON.stringify({ client_id: o.clientId, ...body }),
@@ -156,9 +263,15 @@ export function createAccountsClient(o) {
         }
         const data = (await res.json().catch(() => ({})));
         if (!res.ok) {
-            const code = typeof data.code === "string" ? data.code : typeof data.error === "string" ? data.error : "invalid_response";
+            // A 429 or a 5xx without the application's code (Better Auth's limiter answers {"message": …}) is "not now", with
+            // its Retry-After: too_many_requests (the application's own code for a limit) or temporarily_unavailable.
+            const code = typeof data.code === "string" ? data.code
+                : typeof data.error === "string" ? data.error
+                    : res.status === 429 ? "too_many_requests"
+                        : res.status >= 500 ? "temporarily_unavailable"
+                            : "invalid_response";
             const message = typeof data.message === "string" ? data.message : typeof data.error_description === "string" ? data.error_description : undefined;
-            throw new OAuthError(code, message, res.status);
+            throw new OAuthError(code, message, res.status, retryAfterOf(res.headers));
         }
         return data;
     }
@@ -168,20 +281,57 @@ export function createAccountsClient(o) {
         const r = await nativeCall("email-code", { email });
         return { waitlist: r.waitlist === true };
     }
-    /** Step 2: the code, for the session. Someone new signs up the same way where the application is public. */
+    /**
+     * Step 2: the code, for the session. Someone new signs up the same way where the application is public. A refusal,
+     * a 429, a 5xx or no answer throws and leaves whatever session the device had as it was.
+     */
     async function signInWithEmailCode(email, code) {
+        const started = epoch;
         const nonce = o.crypto.randomString(24);
         const t = await nativeCall("token", { email, code, nonce, resource: o.audience });
         if (typeof t.access_token !== "string")
             throw new OAuthError("invalid_response", "No access token.");
-        if (typeof t.id_token !== "string")
-            throw new OAuthError("invalid_response", "No ID token: the app needs the openid scope.");
-        checkIdToken(t.id_token, nonce);
-        const exp = now() + (typeof t.expires_in === "number" ? t.expires_in : 300);
-        await save({ at: t.access_token, rt: typeof t.refresh_token === "string" ? t.refresh_token : undefined, it: t.id_token, exp, u: await profile(t.access_token) });
+        const tokens = {
+            accessToken: t.access_token,
+            expiresAt: now() + (typeof t.expires_in === "number" ? t.expires_in : 300),
+            ...(typeof t.refresh_token === "string" && { refreshToken: t.refresh_token }),
+            ...(typeof t.id_token === "string" && { idToken: t.id_token }),
+        };
+        return adopt(started, tokens, nonce);
+    }
+    /**
+     * A sign-in's tokens become the device's session. Their ID token has to be for this sign-in; if not, the refresh
+     * token they brought is revoked (it would stay alive on no device). If the person signed out, or signed in again,
+     * while this one was on its way, that stays, and this one's refresh token is revoked too. A new epoch starts: a
+     * refresh of the session before, still on its way, does not bring that one back (E-09).
+     */
+    async function adopt(started, t, nonce) {
+        try {
+            if (!t.idToken)
+                throw new OAuthError("invalid_response", "No ID token: the app needs the openid scope.");
+            checkIdToken(t.idToken, nonce);
+        }
+        catch (e) {
+            if (t.refreshToken)
+                await revokeToken(creds, { token: t.refreshToken, hint: "refresh_token" });
+            throw e;
+        }
+        const u = await profile(t.accessToken, readIdToken(t.idToken).sub);
+        if (!(await sameEpoch(started, t)))
+            return state;
+        epoch++;
+        // The session this one takes the place of ("use another account", an app that signs in again) ends at
+        // the application too, once the new one is on the device: its refresh token would stay alive there, on
+        // no device, for as long as its sign-in (30 days). A refresh of it still on its way revokes what it gets
+        // (sameEpoch); this is for the token already stored, the one a refresh had just saved included.
+        const replaced = session;
+        await save({ at: t.accessToken, rt: t.refreshToken, it: t.idToken, exp: t.expiresAt, u });
+        if (replaced?.rt && replaced.rt !== t.refreshToken)
+            await revokeToken(creds, { token: replaced.rt, hint: "refresh_token" });
         return state;
     }
     async function signIn(prompt) {
+        const started = epoch;
         const verifier = o.crypto.randomString(32);
         const challenge = await o.crypto.sha256Base64Url(verifier);
         const expected = o.crypto.randomString(24);
@@ -202,12 +352,8 @@ export function createAccountsClient(o) {
             throw new OAuthError("invalid_issuer", "The answer did not come from this app's sign-in.");
         if (!q.code)
             throw new OAuthError("invalid_request", "The answer has no code.");
-        const t = await exchangeCode(creds, { code: q.code, redirectUri: o.redirectUri, codeVerifier: verifier, resource: o.audience });
-        if (!t.idToken)
-            throw new OAuthError("invalid_response", "No ID token: the app needs the openid scope.");
-        checkIdToken(t.idToken, nonce);
-        await save({ at: t.accessToken, rt: t.refreshToken, it: t.idToken, exp: t.expiresAt, u: await profile(t.accessToken) });
-        return state;
+        const t = await exchangeCode(codeCreds, { code: q.code, redirectUri: o.redirectUri, codeVerifier: verifier, resource: o.audience });
+        return adopt(started, t, nonce);
     }
     return {
         get state() {
@@ -219,7 +365,7 @@ export function createAccountsClient(o) {
                 listeners.delete(l);
             };
         },
-        /** The session kept on the device, refreshed if needed. */
+        /** The session kept on the device, shown at once; resolves once its refresh, if it was due, has ended. */
         async load() {
             try {
                 const raw = await store.get(key);
@@ -233,7 +379,7 @@ export function createAccountsClient(o) {
             }
             // What the device has, at once (offline, or on a slow network, the app does not wait); then fresh.
             publish();
-            await fresh();
+            await fresh(false, true);
             publish();
             return state;
         },
@@ -244,14 +390,34 @@ export function createAccountsClient(o) {
         signInWithEmailCode,
         /** The same, on "create an account". */
         signUp: () => signIn("create"),
-        /** An access token for your API, refreshed if it is about to expire; null when signed out.
-         * forceRefresh: a new one even if this one still lasts (your API just refused it). */
+        /**
+         * An access token for your API; null when signed out. One about to expire is refreshed: while it still lasts it
+         * is given at once and the refresh goes on in the background; once expired, the call waits for the refresh.
+         * forceRefresh: a new one even if this one still lasts (your API just refused it). Compare-and-refresh: several
+         * refusals of the same token make one refresh, and a token a refresh (forced or not) gave less than 30 s ago is given
+         * again instead of rotating once more. If no new token can be had now (no answer, a 429), it throws an
+         * OAuthError (temporarily_unavailable) and the session stays; it resolves to null only when the session is over.
+         */
         async getToken(opts = {}) {
-            return (await fresh(opts.forceRefresh === true))?.at ?? null;
+            if (opts.forceRefresh !== true)
+                return (await fresh())?.at ?? null;
+            const s = session;
+            if (!s)
+                return null;
+            if (s.at === latest.to && Date.now() - latest.at < FORCE_COOLDOWN_MS)
+                return s.at;
+            await fresh(true);
+            const after = session;
+            if (!after)
+                return null;
+            if (after.at === s.at)
+                throw new OAuthError("temporarily_unavailable", "Could not get a new token now; the person is still signed in. Try again in a moment.", 503, backoff.waiting ? Math.ceil(backoff.waiting / 1000) : undefined);
+            return after.at;
         },
         /** Out here (the refresh token revoked) and, unless told otherwise, on the hosted pages too. */
         async signOut(opts = {}) {
             const s = session;
+            epoch++; // a refresh on its way now will not bring the session back
             await save(null);
             if (s?.rt)
                 await revokeToken(creds, { token: s.rt, hint: "refresh_token" });

package/dist/core.js.map

@@ -1 +1 @@
-{"version":3,"file":"core.js","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,0GAA0G;AAC1G,uGAAuG;AACvG,+DAA+D;AAC/D,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,wBAAwB,EACxB,WAAW,EACX,aAAa,EACb,WAAW,EACX,cAAc,GAGf,MAAM,0BAA0B,CAAC;AA+BlC,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAEhD,iFAAiF;AACjF,SAAS,WAAW,CAAC,CAAwB,EAAE,EAAU;IACvD,MAAM,IAAI,GAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9E,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACxF,CAAC,CAAC;AACJ,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,OAAO,CAAC,OAAgB,EAAE,IAAI,GAAG,IAAI;IACnD,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACjG,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK;YAClB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;YACnI,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE;gBAAE,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC1E,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YACpD,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE;gBAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;YACrD,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;YACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;gBAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,CAAgB;IACnD,MAAM,MAAM,GAAG,wBAAwB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,gBAAgB,IAAI,MAAM,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC;IACtD,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,EAAE,CAAC;IACtE,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,KAAK,GAAkB,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC/F,MAAM,SAAS,GAAG,IAAI,GAAG,EAA8B,CAAC;IAExD,SAAS,OAAO,CAAC,MAAM,GAAG,IAAI;QAC5B,IAAI,IAAI,GAAuB,IAAI,CAAC;QACpC,IAAI,GAAG,GAAkB,IAAI,CAAC;QAC9B,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAClC,IAAI,GAAG,cAAc,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1D,GAAG,GAAG,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACjD,CAAC;QACD,KAAK,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QAC1E,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IACD,KAAK,UAAU,IAAI,CAAC,CAAgB;QAClC,OAAO,GAAG,CAAC,CAAC;QACZ,IAAI,CAAC;YAAE,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;;YAC1C,MAAM,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,KAAK,UAAU,OAAO,CAAC,WAAmB;QACxC,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,IAAI,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACzB,MAAM,CAAC,GAAY,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;YAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QACnD,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,SAAS;YAAE,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC;QAC/E,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI;YAAE,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QAC1D,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO;YAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;QACtE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,sGAAsG;IACtG,IAAI,UAAU,GAAkC,IAAI,CAAC;IACrD,KAAK,UAAU,KAAK,CAAC,KAAK,GAAG,KAAK;QAChC,MAAM,CAAC,GAAG,OAAO,CAAC;QAClB,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,oBAAoB,IAAI,EAAE,CAAC;YAAE,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,IAAI,CAAC,CAAC,GAAG,GAAG,GAAG,EAAE;gBAAE,OAAO,CAAC,CAAC;YAC5B,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,UAAU,KAAK,CAAC,KAAK,IAAI,EAAE;YACzB,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,EAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACpF,MAAM,IAAI,GAAW,EAAE,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1J,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjB,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,uFAAuF;gBACvF,IAAI,CAAC,YAAY,UAAU,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;oBACjE,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;oBACjB,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,OAAO,CAAC,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAClC,CAAC;oBAAS,CAAC;gBACT,UAAU,GAAG,IAAI,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,0GAA0G;IAC1G,SAAS,YAAY,CAAC,KAAa,EAAE,KAAa;QAChD,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,GAAG,GAAG,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;YACnJ,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,uCAAuC,CAAC,CAAC;IACtF,CAAC;IAED,0GAA0G;IAC1G,KAAK,UAAU,UAAU,CAAI,IAA4B,EAAE,IAA6B;QACtF,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,MAAM,eAAe,IAAI,EAAE,EAAE;gBAChD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;aACzD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,UAAU,CAAC,yBAAyB,EAAE,mBAAmB,MAAM,KAAM,CAAW,EAAE,OAAO,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACnH,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;QAC7E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,kBAAkB,CAAC;YAC1H,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;YAClJ,MAAM,IAAI,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,IAAS,CAAC;IACnB,CAAC;IAED;yEACqE;IACrE,KAAK,UAAU,aAAa,CAAC,KAAa;QACxC,MAAM,CAAC,GAAG,MAAM,UAAU,CAAyB,YAAY,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED,4GAA4G;IAC5G,KAAK,UAAU,mBAAmB,CAAC,KAAa,EAAE,IAAY;QAC5D,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,MAAM,UAAU,CAA0B,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3G,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;YAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;QACrG,IAAI,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ;YAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,8CAA8C,CAAC,CAAC;QAC7H,YAAY,CAAC,CAAC,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QAC5E,MAAM,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACjK,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,MAAiB;QACrC,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3K,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;QAC9D,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,CAAC,0BAA0B;QAClE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,6CAA6C,CAAC,CAAC;QAC/G,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACZ,IAAI,CAAC,CAAC,KAAK,KAAK,eAAe;gBAAE,OAAO,KAAK,CAAC;YAC9C,MAAM,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,CAAC,GAAG,KAAK,MAAM;YAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,kDAAkD,CAAC,CAAC;QACjH,IAAI,CAAC,CAAC,CAAC,IAAI;YAAE,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC;QAChF,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChI,IAAI,CAAC,CAAC,CAAC,OAAO;YAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,8CAA8C,CAAC,CAAC;QACzG,YAAY,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/B,MAAM,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QACxH,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO;QACL,IAAI,KAAK;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,SAAS,CAAC,CAA6B;YACrC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACjB,OAAO,GAAG,EAAE;gBACV,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACtB,CAAC,CAAC;QACJ,CAAC;QACD,2DAA2D;QAC3D,KAAK,CAAC,IAAI;YACR,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACjC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;gBACnD,OAAO,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC5G,IAAI,OAAO;oBAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;YACD,mGAAmG;YACnG,OAAO,EAAE,CAAC;YACV,MAAM,KAAK,EAAE,CAAC;YACd,OAAO,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;QACD,2GAA2G;QAC3G,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE;QACtB,8FAA8F;QAC9F,aAAa;QACb,mBAAmB;QACnB,wCAAwC;QACxC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC9B;8FACsF;QACtF,KAAK,CAAC,QAAQ,CAAC,IAAI,GAA+B,EAAE;YAClD,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC;QAC/D,CAAC;QACD,gGAAgG;QAChG,KAAK,CAAC,OAAO,CAAC,IAAI,GAA6B,EAAE;YAC/C,MAAM,CAAC,GAAG,OAAO,CAAC;YAClB,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,IAAI,CAAC,EAAE,EAAE;gBAAE,MAAM,WAAW,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;YAC5E,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK;gBAChC,MAAM,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,qBAAqB,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"core.js","sourceRoot":"","sources":["../src/core.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,0GAA0G;AAC1G,uGAAuG;AACvG,+DAA+D;AAC/D,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,aAAa,EACb,YAAY,EACZ,aAAa,EACb,wBAAwB,EACxB,WAAW,EACX,cAAc,EACd,aAAa,EACb,YAAY,EACZ,WAAW,EACX,YAAY,EACZ,YAAY,EACZ,cAAc,GAIf,MAAM,0BAA0B,CAAC;AAiClC,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAEhD;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAG,KAAK,CAAC;AACnC;;;;;;GAMG;AACH,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,uIAAuI;AACvI,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAEjC,iFAAiF;AACjF,SAAS,WAAW,CAAC,CAAwB,EAAE,EAAU;IACvD,MAAM,IAAI,GAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAC9E,OAAO,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QAC/C,IAAI,EAAE,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1D,OAAO,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;IACxF,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,KAAgB,EAAE,KAAgB;IAC/D,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;QAC3B,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,OAAO,CAAC,OAAgB,EAAE,IAAI,GAAG,IAAI;IACnD,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,GAAG;YACX,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC;YAChD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC/C,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACjG,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK;YAClB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;YACnI,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE;gBAAE,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;YAC1E,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YACpD,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE;gBAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;YACrD,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC;YACjC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;gBAAE,MAAM,OAAO,CAAC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;QAClE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAChC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,CAAC,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;QACpF,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,CAAgB;IACnD,MAAM,MAAM,GAAG,wBAAwB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IAC1D,MAAM,KAAK,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,gBAAgB,IAAI,MAAM,CAAC,CAAC;IACjE,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC;IACtD,kHAAkH;IAClH,kGAAkG;IAClG,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,IAAI,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC/F,MAAM,YAAY,GAAG,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,qBAAqB,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,EAAE,oBAAoB,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;IACrH,MAAM,SAAS,GAAG,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,qBAAqB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;IAC/E,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACjC,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,EAAE,CAAC;IACtE,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,IAAI,KAAK,GAAkB,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC/F,MAAM,SAAS,GAAG,IAAI,GAAG,EAA8B,CAAC;IAExD,SAAS,OAAO,CAAC,MAAM,GAAG,IAAI;QAC5B,IAAI,IAAI,GAAuB,IAAI,CAAC;QACpC,IAAI,GAAG,GAAkB,IAAI,CAAC;QAC9B,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAClC,IAAI,GAAG,cAAc,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,OAAO,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1D,GAAG,GAAG,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QACjD,CAAC;QACD,KAAK,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;QAC1E,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IACtC,CAAC;IACD,0GAA0G;IAC1G,0GAA0G;IAC1G,8FAA8F;IAC9F,IAAI,OAAO,GAAqB,OAAO,CAAC,OAAO,EAAE,CAAC;IAClD,KAAK,UAAU,IAAI,CAAC,CAAgB;QAClC,OAAO,GAAG,CAAC,CAAC;QACZ,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC9F,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,iEAAiE;QACzG,MAAM,KAAK,CAAC;QACZ,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,oFAAoF;IACpF,KAAK,UAAU,OAAO,CAAC,WAAmB,EAAE,GAAW;QACrD,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACnE,IAAI,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACzB,MAAM,CAAC,GAAY,EAAE,CAAC;QACtB,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;YAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QACnD,IAAI,OAAO,CAAC,CAAC,cAAc,KAAK,SAAS;YAAE,CAAC,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC;QAC/E,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI;YAAE,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QAC1D,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO;YAAE,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;QACtE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,4GAA4G;IAC5G,yGAAyG;IACzG,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,2GAA2G;IAC3G,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IACjC,MAAM,SAAS,GAAG,KAAK,EAAE,OAAe,EAAE,CAA4B,EAAE,EAAE;QACxE,IAAI,OAAO,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QACnC,IAAI,CAAC,CAAC,YAAY;YAAE,MAAM,WAAW,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAC/F,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IAEF,4GAA4G;IAC5G,2GAA2G;IAC3G,sDAAsD;IACtD,IAAI,MAAM,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC;IAE/B,sGAAsG;IACtG,IAAI,UAAU,GAAkC,IAAI,CAAC;IACrD;;;;;OAKG;IACH,KAAK,UAAU,KAAK,CAAC,KAAK,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK;QAC9C,MAAM,CAAC,GAAG,OAAO,CAAC;QAClB,IAAI,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACpB,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,oBAAoB,IAAI,EAAE,CAAC;YAAE,OAAO,CAAC,CAAC;QACvE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YACV,IAAI,CAAC,CAAC,GAAG,GAAG,GAAG,EAAE;gBAAE,OAAO,CAAC,CAAC;YAC5B,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,CAAC,OAAO;YAAE,OAAO,CAAC,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACrD,MAAM,OAAO,GAAG,KAAK,CAAC;QACtB,UAAU,KAAK,CAAC,KAAK,IAAI,EAAE;YACzB,IAAI,CAAC;gBACH,IAAI,CAAC,CAAC;gBACN,IAAI,CAAC;oBACH,CAAC,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,EAAE,YAAY,EAAE,CAAC,CAAC,EAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;gBACvF,CAAC;gBAAC,OAAO,CAAC,EAAE,CAAC;oBACX,oGAAoG;oBACpG,4FAA4F;oBAC5F,IAAI,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;wBACpB,IAAI,OAAO,KAAK,KAAK;4BAAE,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;wBACxC,OAAO,OAAO,CAAC;oBACjB,CAAC;oBACD,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAClB,OAAO,CAAC,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAClC,CAAC;gBACD,OAAO,CAAC,SAAS,EAAE,CAAC;gBACpB,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;oBAAE,OAAO,OAAO,CAAC;gBACnD,oGAAoG;gBACpG,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC;oBAClF,IAAI,CAAC,CAAC,YAAY;wBAAE,MAAM,WAAW,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;oBAC/F,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;oBACjB,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,EAAE,CAAC;gBAC7B,8FAA8F;gBAC9F,mGAAmG;gBACnG,wFAAwF;gBACxF,MAAM,IAAI,GAAW,EAAE,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrG,iGAAiG;gBACjG,6FAA6F;gBAC7F,MAAM,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBACzC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjB,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;gBAC5D,mGAAmG;gBACnG,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,IAAI;oBAAE,OAAO,OAAO,CAAC;gBAC1D,IAAI,CAAC,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACpB,MAAM,KAAK,GAAW,EAAE,GAAG,IAAI,EAAE,CAAC,EAAE,CAAC;gBACrC,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;gBAClB,OAAO,KAAK,CAAC;YACf,CAAC;oBAAS,CAAC;gBACT,UAAU,GAAG,IAAI,CAAC;YACpB,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,MAAM,IAAI,GAAG,UAAU,CAAC;QACxB,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QACjD,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,sEAAsE;QACnG,OAAO,CAAC,CAAC;IACX,CAAC;IAED,0GAA0G;IAC1G,SAAS,YAAY,CAAC,KAAa,EAAE,KAAa;QAChD,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,CAAC,GAAG,GAAG,GAAG,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;YACnJ,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,uCAAuC,CAAC,CAAC;IACtF,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,UAAU,CAAI,IAA4B,EAAE,IAA6B;QACtF,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,MAAM,eAAe,IAAI,EAAE,EAAE;gBAC/E,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBAC3E,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;aACzD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,UAAU,CAAC,yBAAyB,EAAE,mBAAmB,MAAM,KAAM,CAAW,EAAE,OAAO,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;QACnH,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;QAC7E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,kHAAkH;YAClH,0GAA0G;YAC1G,MAAM,IAAI,GACR,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;gBACzC,CAAC,CAAC,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK;oBAC7C,CAAC,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,mBAAmB;wBAC1C,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,yBAAyB;4BAC/C,CAAC,CAAC,kBAAkB,CAAC;YACvB,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,iBAAiB,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,CAAC,SAAS,CAAC;YAClJ,MAAM,IAAI,UAAU,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,IAAS,CAAC;IACnB,CAAC;IAED;yEACqE;IACrE,KAAK,UAAU,aAAa,CAAC,KAAa;QACxC,MAAM,CAAC,GAAG,MAAM,UAAU,CAAyB,YAAY,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;IAC3C,CAAC;IAED;;;OAGG;IACH,KAAK,UAAU,mBAAmB,CAAC,KAAa,EAAE,IAAY;QAC5D,MAAM,OAAO,GAAG,KAAK,CAAC;QACtB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,MAAM,UAAU,CAA0B,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC3G,IAAI,OAAO,CAAC,CAAC,YAAY,KAAK,QAAQ;YAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,kBAAkB,CAAC,CAAC;QACrG,MAAM,MAAM,GAAa;YACvB,WAAW,EAAE,CAAC,CAAC,YAAY;YAC3B,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC;YAC1E,GAAG,CAAC,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC;YAC7E,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;SAC/D,CAAC;QACF,OAAO,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IACvC,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,KAAK,CAAC,OAAe,EAAE,CAAW,EAAE,KAAa;QAC9D,IAAI,CAAC;YACH,IAAI,CAAC,CAAC,CAAC,OAAO;gBAAE,MAAM,IAAI,UAAU,CAAC,kBAAkB,EAAE,8CAA8C,CAAC,CAAC;YACzG,YAAY,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,CAAC,YAAY;gBAAE,MAAM,WAAW,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;YAC/F,MAAM,CAAC,CAAC;QACV,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC;QACnE,IAAI,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACjD,KAAK,EAAE,CAAC;QACR,sGAAsG;QACtG,uGAAuG;QACvG,yGAAyG;QACzG,gGAAgG;QAChG,MAAM,QAAQ,GAAG,OAAO,CAAC;QACzB,MAAM,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1F,IAAI,QAAQ,EAAE,EAAE,IAAI,QAAQ,CAAC,EAAE,KAAK,CAAC,CAAC,YAAY;YAAE,MAAM,WAAW,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;QAC5H,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,UAAU,MAAM,CAAC,MAAiB;QACrC,MAAM,OAAO,GAAG,KAAK,CAAC;QACtB,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3K,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;QAC9D,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,CAAC,0BAA0B;QAClE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,CAAC,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,UAAU,CAAC,eAAe,EAAE,6CAA6C,CAAC,CAAC;QAC/G,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YACZ,IAAI,CAAC,CAAC,KAAK,KAAK,eAAe;gBAAE,OAAO,KAAK,CAAC;YAC9C,MAAM,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,CAAC,CAAC,GAAG,KAAK,MAAM;YAAE,MAAM,IAAI,UAAU,CAAC,gBAAgB,EAAE,kDAAkD,CAAC,CAAC;QACjH,IAAI,CAAC,CAAC,CAAC,IAAI;YAAE,MAAM,IAAI,UAAU,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC;QAChF,MAAM,CAAC,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;QACpI,OAAO,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,OAAO;QACL,IAAI,KAAK;YACP,OAAO,KAAK,CAAC;QACf,CAAC;QACD,SAAS,CAAC,CAA6B;YACrC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACjB,OAAO,GAAG,EAAE;gBACV,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YACtB,CAAC,CAAC;QACJ,CAAC;QACD,0GAA0G;QAC1G,KAAK,CAAC,IAAI;YACR,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACjC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC,CAAC,CAAC,IAAI,CAAC;gBACnD,OAAO,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC5G,IAAI,OAAO;oBAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;YACD,mGAAmG;YACnG,OAAO,EAAE,CAAC;YACV,MAAM,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACzB,OAAO,EAAE,CAAC;YACV,OAAO,KAAK,CAAC;QACf,CAAC;QACD,2GAA2G;QAC3G,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE;QACtB,8FAA8F;QAC9F,aAAa;QACb,mBAAmB;QACnB,wCAAwC;QACxC,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC9B;;;;;;;WAOG;QACH,KAAK,CAAC,QAAQ,CAAC,IAAI,GAA+B,EAAE;YAClD,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI;gBAAE,OAAO,CAAC,MAAM,KAAK,EAAE,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC;YACnE,MAAM,CAAC,GAAG,OAAO,CAAC;YAClB,IAAI,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpB,IAAI,CAAC,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,iBAAiB;gBAAE,OAAO,CAAC,CAAC,EAAE,CAAC;YAClF,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YAClB,MAAM,KAAK,GAAG,OAAwB,CAAC;YACvC,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YACxB,IAAI,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE;gBAAE,MAAM,IAAI,UAAU,CAAC,yBAAyB,EAAE,sFAAsF,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACrO,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,CAAC;QACD,gGAAgG;QAChG,KAAK,CAAC,OAAO,CAAC,IAAI,GAA6B,EAAE;YAC/C,MAAM,CAAC,GAAG,OAAO,CAAC;YAClB,KAAK,EAAE,CAAC,CAAC,2DAA2D;YACpE,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,IAAI,CAAC,EAAE,EAAE;gBAAE,MAAM,WAAW,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;YAC5E,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,KAAK,KAAK;gBAChC,MAAM,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,EAAE,qBAAqB,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -2,5 +2,7 @@ import { completeSignIn } from "./expo.js";
 export declare const AccountsProvider: ({ children, publishableKey, clientId, scheme, audience, ephemeral, requestTimeoutMs }: import("./react.js").AccountsProviderProps) => import("react").JSX.Element;
 export { SignedIn, SignedOut, useAuth, useUser, type AccountsProviderProps } from "./react.js";
 export { completeSignIn };
+/** What getToken({ forceRefresh: true }) throws when no new token can be had now (error "temporarily_unavailable"). */
+export { OAuthError } from "@iaurelius/accounts/oidc";
 export type { AccountsState, SessionUser } from "./core.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAsB,cAAc,EAA6C,MAAM,WAAW,CAAC;AAG1G,eAAO,MAAM,gBAAgB,oKAA4G,CAAC;AAC1I,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAC/F,OAAO,EAAE,cAAc,EAAE,CAAC;AAC1B,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAsB,cAAc,EAA6C,MAAM,WAAW,CAAC;AAG1G,eAAO,MAAM,gBAAgB,oKAA4G,CAAC;AAC1I,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAC/F,OAAO,EAAE,cAAc,EAAE,CAAC;AAC1B,uHAAuH;AACvH,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -4,4 +4,6 @@ import { makeProvider } from "./react.js";
 export const AccountsProvider = makeProvider({ storage: secureStorage, browser: authSessionBrowser, crypto: expoCrypto, redirectUriFor });
 export { SignedIn, SignedOut, useAuth, useUser } from "./react.js";
 export { completeSignIn };
+/** What getToken({ forceRefresh: true }) throws when no new token can be had now (error "temporarily_unavailable"). */
+export { OAuthError } from "@iaurelius/accounts/oidc";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1G,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC;AAC1I,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAA8B,MAAM,YAAY,CAAC;AAC/F,OAAO,EAAE,cAAc,EAAE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,UAAU,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1G,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,MAAM,CAAC,MAAM,gBAAgB,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC,CAAC;AAC1I,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAA8B,MAAM,YAAY,CAAC;AAC/F,OAAO,EAAE,cAAc,EAAE,CAAC;AAC1B,uHAAuH;AACvH,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@iaurelius/accounts-expo",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "Accounts by iAurelius for Expo: sign-in on the hosted page in an authentication session, tokens in SecureStore, useAuth() and getToken() that refreshes itself.",
   "keywords": [
     "auth",
@@ -35,7 +35,7 @@
     "typecheck": "tsc -p tsconfig.json --noEmit"
   },
   "dependencies": {
-    "@iaurelius/accounts": "^0.3.0"
+    "@iaurelius/accounts": "^0.4.1"
   },
   "peerDependencies": {
     "expo-crypto": "*",