@ic-reactor/react 3.12.4 → 3.13.0

package/dist/auth/auth-client-compat.d.ts

@@ -0,0 +1,122 @@
+/**
+ * Bridges IC Reactor's stable authentication options onto whichever
+ * `@icp-sdk/auth` major is installed.
+ *
+ * `@icp-sdk/auth` v9 reshaped the `AuthClient` constructor and v10 moved its
+ * `@icp-sdk/core` peer to `^6`. The *method* surface IC Reactor calls --
+ * `signIn`, `signOut`, `getIdentity`, `isAuthenticated`, `requestAttributes`,
+ * `memoize` -- is byte-identical across v8 and v10, so only the option objects
+ * handed to the constructor and to `signIn` have to be translated.
+ *
+ * The translation lives here rather than in `AuthenticationManager` so that
+ * {@link AuthenticationClientOptions} stays IC Reactor's own contract. Callers
+ * keep writing `identityProvider: "https://id.ai/authorize"` whichever peer
+ * they installed, and the shapes diverge only at the boundary.
+ *
+ * Why both majors: v8 peers `@icp-sdk/core@^5` while IC Reactor needs `^6`, so
+ * a strict `npm install` resolving v8 fails with `ERESOLVE` unless the app adds
+ * an `overrides` block. v10 is the first release whose peer is `^6`, which
+ * removes that workaround -- but pinning v10 alone would break every app
+ * already installed on v8.
+ */
+import type { AuthClientSignInOptions, AuthenticationClientOptions } from "./types.js";
+/**
+ * Which options contract the installed `AuthClient` accepts.
+ *
+ * - `legacy` -- v8. `identityProvider` is a URL; `storage`, `keyType`,
+ *   `idleOptions` and `identity` are constructor options; `signIn` takes
+ *   `targets`.
+ * - `session` -- v9/v10. `identityProvider` is an `{ authorizeUrl, canisterId }`
+ *   pair, credentials moved behind `credentialStorage`, idle moved to the
+ *   identity provider canister, and `signIn` no longer takes `targets`.
+ */
+export type AuthClientFlavor = "legacy" | "session";
+/** The `{ authorizeUrl, canisterId }` pair a v9+ client names a deployment by. */
+export interface SessionIdentityProvider {
+    authorizeUrl: string | URL;
+    canisterId: string;
+}
+/**
+ * Which canister a v9+ client should pair with the configured
+ * `identityProvider` URL, as `AuthenticationManager` works it out.
+ *
+ * - `mainnet`: the URL is mainnet's and nothing overrides the canister, so the
+ *   option is omitted and the client uses mainnet for both halves.
+ * - `pair`: the canister is known, from `internetIdentityId` or because the URL
+ *   is one IC Reactor derived for a local deployment.
+ * - `unknown`: a URL the caller configured with no canister to go with it.
+ */
+export type IdentityProviderPairing = {
+    kind: "mainnet";
+} | {
+    kind: "pair";
+    canisterId: string;
+} | {
+    kind: "unknown";
+};
+/**
+ * Detects the contract from the constructor itself rather than from the
+ * module's exports.
+ *
+ * `getStatus`, `getPrincipal`, `subscribe` and `dispose` were added to
+ * `AuthClient` in v9 and have no v8 counterpart. Reading them off the prototype
+ * beats sniffing the module namespace: a bundler may drop an unreferenced named
+ * export (`IdbStorage`, `IdleManager`) from the namespace object it synthesizes
+ * for a dynamic import, but it never drops a class's own methods.
+ *
+ * Two markers rather than one, because a single name is a coincidence away from
+ * matching some future shim. An unrecognised constructor is treated as `legacy`
+ * -- the shape IC Reactor's own options already mirror, so a wrong guess there
+ * passes the values through untouched instead of rewriting them into a shape
+ * nothing understands.
+ */
+export declare function detectAuthClientFlavor(AuthClient: unknown): AuthClientFlavor;
+/**
+ * Detects the contract of a client the caller built and passed in.
+ *
+ * Such a client never goes through the module loader, so there is no
+ * constructor to hand {@link detectAuthClientFlavor}. The markers are the same
+ * two methods, reached through the instance instead of the prototype.
+ */
+export declare function detectAuthClientInstanceFlavor(client: unknown): AuthClientFlavor;
+/** @internal Test seam -- lets a suite assert the first warning every time. */
+export declare function resetAuthCompatWarnings(): void;
+/**
+ * Translates IC Reactor's constructor options into the installed client's shape.
+ *
+ * On `legacy` the object is already the right shape and is returned as-is,
+ * except for `disableBrowserActivity`. That option exists only on v10, so it is
+ * dropped with a one-time warning rather than handed to a v8 client that
+ * ignores it.
+ *
+ * On `session` the identity provider becomes a pair. The canister is not
+ * derived from the URL, because v9+ is explicit that the origin serving a
+ * ceremony is not a promise about which canister mints there. `pairing` says
+ * which canister goes with the URL. When nothing does, this throws rather than
+ * guessing: a guessed canister sends the delegation calls to a different
+ * deployment than the one the user signs in at, and sign-in fails later with an
+ * error that names neither.
+ *
+ * @param options - IC Reactor's resolved options, in the v8-shaped contract.
+ * @param flavor - The contract the installed client accepts.
+ * @param pairing - Which canister goes with `options.identityProvider`.
+ * @param agentOptions - Options for the agent a v9+ client mints delegations
+ *   with. v8 has no such agent, so a `legacy` client never receives them.
+ */
+export declare function toAuthClientConstructorOptions(options: AuthenticationClientOptions | undefined, flavor: AuthClientFlavor, pairing?: IdentityProviderPairing, agentOptions?: Record<string, unknown>): AuthenticationClientOptions | Record<string, unknown> | undefined;
+/**
+ * Translates `signIn` options into the installed client's shape.
+ *
+ * `targets` is the one that matters. v8 forwards it to restrict the delegation
+ * to named canisters; v9+ removed it, and scoping is decided by the identity
+ * provider against the app's own canister. Passing it to a v9+ client does not
+ * fail -- it is simply ignored, and the delegation that comes back is broader
+ * than the caller asked for. That is a security-relevant difference, so it
+ * warns unconditionally rather than only in development.
+ *
+ * `maxTimeToIdle` goes the other way. It exists only on v10, so a v10 client
+ * receives it, and a v8 client, whose sign-in has no idle limit, gets it
+ * dropped with a one-time warning.
+ */
+export declare function toAuthClientSignInOptions(options: AuthClientSignInOptions | undefined, flavor: AuthClientFlavor): AuthClientSignInOptions | undefined;
+//# sourceMappingURL=auth-client-compat.d.ts.map

package/dist/auth/auth-client-compat.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-client-compat.d.ts","sourceRoot":"","sources":["../../src/auth/auth-client-compat.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,EACV,uBAAuB,EACvB,2BAA2B,EAC5B,MAAM,YAAY,CAAA;AAEnB;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,SAAS,CAAA;AAEnD,kFAAkF;AAClF,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,GAAG,GAAG,CAAA;IAC1B,UAAU,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;;;GASG;AACH,MAAM,MAAM,uBAAuB,GAC/B;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,CAAA;AAEvB;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,OAAO,GAAG,gBAAgB,CAY5E;AAED;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAC5C,MAAM,EAAE,OAAO,GACd,gBAAgB,CAOlB;AA4BD,+EAA+E;AAC/E,wBAAgB,uBAAuB,SAEtC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,2BAA2B,GAAG,SAAS,EAChD,MAAM,EAAE,gBAAgB,EACxB,OAAO,GAAE,uBAA6C,EACtD,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACrC,2BAA2B,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CA2DnE;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,uBAAuB,GAAG,SAAS,EAC5C,MAAM,EAAE,gBAAgB,GACvB,uBAAuB,GAAG,SAAS,CA6BrC"}

package/dist/auth/auth-client-compat.js

@@ -0,0 +1,162 @@
+/**
+ * Detects the contract from the constructor itself rather than from the
+ * module's exports.
+ *
+ * `getStatus`, `getPrincipal`, `subscribe` and `dispose` were added to
+ * `AuthClient` in v9 and have no v8 counterpart. Reading them off the prototype
+ * beats sniffing the module namespace: a bundler may drop an unreferenced named
+ * export (`IdbStorage`, `IdleManager`) from the namespace object it synthesizes
+ * for a dynamic import, but it never drops a class's own methods.
+ *
+ * Two markers rather than one, because a single name is a coincidence away from
+ * matching some future shim. An unrecognised constructor is treated as `legacy`
+ * -- the shape IC Reactor's own options already mirror, so a wrong guess there
+ * passes the values through untouched instead of rewriting them into a shape
+ * nothing understands.
+ */
+export function detectAuthClientFlavor(AuthClient) {
+    const prototype = AuthClient
+        ?.prototype;
+    if (!prototype) {
+        return "legacy";
+    }
+    return typeof prototype.getStatus === "function" &&
+        typeof prototype.getPrincipal === "function"
+        ? "session"
+        : "legacy";
+}
+/**
+ * Detects the contract of a client the caller built and passed in.
+ *
+ * Such a client never goes through the module loader, so there is no
+ * constructor to hand {@link detectAuthClientFlavor}. The markers are the same
+ * two methods, reached through the instance instead of the prototype.
+ */
+export function detectAuthClientInstanceFlavor(client) {
+    const instance = client;
+    return typeof instance?.getStatus === "function" &&
+        typeof instance?.getPrincipal === "function"
+        ? "session"
+        : "legacy";
+}
+/**
+ * Options a `session`-era client drops on the floor, and what replaced them.
+ *
+ * Each is a real capability in v8 with no v9+ constructor equivalent, so the
+ * only honest thing to do is say so rather than pass a key that is ignored.
+ */
+const DROPPED_CONSTRUCTOR_OPTIONS = {
+    storage: "`storage` (an AuthClientStorage) has no v9+ equivalent: credentials moved behind `credentialStorage`, whose store also generates identities and holds a delegation alongside each key, so an AuthClientStorage cannot be adapted into one. Construct the client yourself and pass it as `authClient` to keep a custom store.",
+    keyType: "`keyType` was removed in v9+: the credential store decides the key type, because a store that has to serialise needs an extractable key and one that does not should not hold one.",
+    idleOptions: "`idleOptions` was removed in v9+: the idle timeout belongs to the identity provider canister. Pass `maxTimeToIdle` to `login()` instead, and set `disableBrowserActivity` in the AuthenticationManager options to stop the client watching the browser.",
+    identity: "`identity` was removed from v9+ constructor options: the agent signs as the session rather than as an identity handed in at construction.",
+};
+/** Emits each distinct warning once per process, so a render loop cannot spam. */
+const warned = new Set();
+function warnOnce(key, message) {
+    if (warned.has(key))
+        return;
+    warned.add(key);
+    console.warn(`[ic-reactor] ${message}`);
+}
+/** @internal Test seam -- lets a suite assert the first warning every time. */
+export function resetAuthCompatWarnings() {
+    warned.clear();
+}
+/**
+ * Translates IC Reactor's constructor options into the installed client's shape.
+ *
+ * On `legacy` the object is already the right shape and is returned as-is,
+ * except for `disableBrowserActivity`. That option exists only on v10, so it is
+ * dropped with a one-time warning rather than handed to a v8 client that
+ * ignores it.
+ *
+ * On `session` the identity provider becomes a pair. The canister is not
+ * derived from the URL, because v9+ is explicit that the origin serving a
+ * ceremony is not a promise about which canister mints there. `pairing` says
+ * which canister goes with the URL. When nothing does, this throws rather than
+ * guessing: a guessed canister sends the delegation calls to a different
+ * deployment than the one the user signs in at, and sign-in fails later with an
+ * error that names neither.
+ *
+ * @param options - IC Reactor's resolved options, in the v8-shaped contract.
+ * @param flavor - The contract the installed client accepts.
+ * @param pairing - Which canister goes with `options.identityProvider`.
+ * @param agentOptions - Options for the agent a v9+ client mints delegations
+ *   with. v8 has no such agent, so a `legacy` client never receives them.
+ */
+export function toAuthClientConstructorOptions(options, flavor, pairing = { kind: "unknown" }, agentOptions) {
+    if (!options) {
+        return options;
+    }
+    if (flavor === "legacy") {
+        if (options.disableBrowserActivity === undefined) {
+            return options;
+        }
+        warnOnce("constructor:disableBrowserActivity", "`disableBrowserActivity` needs @icp-sdk/auth v10 and is ignored by v8, which has no equivalent. On v8, `idleOptions` controls idle handling.");
+        const { disableBrowserActivity: _disableBrowserActivity, ...legacy } = options;
+        return legacy;
+    }
+    // Prefixed with `_` because they are destructured only to keep them out of
+    // `carried`: a v9+ constructor has no equivalent for any of them, and the
+    // loop below is what actually reports each one that was set.
+    const { identityProvider, storage: _storage, keyType: _keyType, idleOptions: _idleOptions, identity: _identity, ...carried } = options;
+    for (const [name, explanation] of Object.entries(DROPPED_CONSTRUCTOR_OPTIONS)) {
+        if (options[name] !== undefined) {
+            warnOnce(`constructor:${name}`, explanation);
+        }
+    }
+    const translated = { ...carried };
+    if (agentOptions !== undefined) {
+        translated.agentOptions = agentOptions;
+    }
+    if (identityProvider !== undefined) {
+        if (pairing.kind === "unknown") {
+            throw new Error(`[ic-reactor] identityProvider ${String(identityProvider)} needs internetIdentityId with @icp-sdk/auth v10, which names a provider by its authorize URL and the canister that mints its delegations. Set internetIdentityId to the canister that serves that URL.`);
+        }
+        // An absent option is how v9+ says "both values are mainnet's".
+        if (pairing.kind === "pair") {
+            translated.identityProvider = {
+                authorizeUrl: identityProvider,
+                canisterId: pairing.canisterId,
+            };
+        }
+    }
+    return translated;
+}
+/**
+ * Translates `signIn` options into the installed client's shape.
+ *
+ * `targets` is the one that matters. v8 forwards it to restrict the delegation
+ * to named canisters; v9+ removed it, and scoping is decided by the identity
+ * provider against the app's own canister. Passing it to a v9+ client does not
+ * fail -- it is simply ignored, and the delegation that comes back is broader
+ * than the caller asked for. That is a security-relevant difference, so it
+ * warns unconditionally rather than only in development.
+ *
+ * `maxTimeToIdle` goes the other way. It exists only on v10, so a v10 client
+ * receives it, and a v8 client, whose sign-in has no idle limit, gets it
+ * dropped with a one-time warning.
+ */
+export function toAuthClientSignInOptions(options, flavor) {
+    if (!options) {
+        return options;
+    }
+    if (flavor === "legacy") {
+        if (options.maxTimeToIdle === undefined) {
+            return options;
+        }
+        warnOnce("signIn:maxTimeToIdle", "`maxTimeToIdle` needs @icp-sdk/auth v10 and is ignored by v8, whose sign-in has no idle limit. On v8, set `idleOptions` instead.");
+        const { maxTimeToIdle: _maxTimeToIdle, ...legacy } = options;
+        return legacy;
+    }
+    const { targets, ...carried } = options;
+    if (targets !== undefined) {
+        // Every time, not once: each sign-in that passes `targets` receives a
+        // delegation broader than it asked for, and a warning spent on an earlier
+        // one says nothing about this one.
+        console.warn("[ic-reactor] `targets` was removed in @icp-sdk/auth v9+ and is ignored: the delegation you receive is NOT restricted to those canisters. The identity provider scopes a session to the application canister instead. Remove `targets`, or pin @icp-sdk/auth to ^8 if you depend on canister-scoped delegations.");
+    }
+    return carried;
+}
+//# sourceMappingURL=auth-client-compat.js.map

package/dist/auth/auth-client-compat.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-client-compat.js","sourceRoot":"","sources":["../../src/auth/auth-client-compat.ts"],"names":[],"mappings":"AA2DA;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,sBAAsB,CAAC,UAAmB;IACxD,MAAM,SAAS,GAAI,UAAsD;QACvE,EAAE,SAAS,CAAA;IAEb,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,OAAO,OAAO,SAAS,CAAC,SAAS,KAAK,UAAU;QAC9C,OAAO,SAAS,CAAC,YAAY,KAAK,UAAU;QAC5C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,QAAQ,CAAA;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,8BAA8B,CAC5C,MAAe;IAEf,MAAM,QAAQ,GAAG,MAA6C,CAAA;IAE9D,OAAO,OAAO,QAAQ,EAAE,SAAS,KAAK,UAAU;QAC9C,OAAO,QAAQ,EAAE,YAAY,KAAK,UAAU;QAC5C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,QAAQ,CAAA;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,2BAA2B,GAA2B;IAC1D,OAAO,EACL,8TAA8T;IAChU,OAAO,EACL,oLAAoL;IACtL,WAAW,EACT,yPAAyP;IAC3P,QAAQ,EACN,2IAA2I;CAC9I,CAAA;AAED,kFAAkF;AAClF,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAA;AAEhC,SAAS,QAAQ,CAAC,GAAW,EAAE,OAAe;IAC5C,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAM;IAC3B,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACf,OAAO,CAAC,IAAI,CAAC,gBAAgB,OAAO,EAAE,CAAC,CAAA;AACzC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,uBAAuB;IACrC,MAAM,CAAC,KAAK,EAAE,CAAA;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,8BAA8B,CAC5C,OAAgD,EAChD,MAAwB,EACxB,UAAmC,EAAE,IAAI,EAAE,SAAS,EAAE,EACtD,YAAsC;IAEtC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,IAAI,OAAO,CAAC,sBAAsB,KAAK,SAAS,EAAE,CAAC;YACjD,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,QAAQ,CACN,oCAAoC,EACpC,8IAA8I,CAC/I,CAAA;QACD,MAAM,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,GAAG,MAAM,EAAE,GAClE,OAAO,CAAA;QACT,OAAO,MAAM,CAAA;IACf,CAAC;IAED,2EAA2E;IAC3E,0EAA0E;IAC1E,6DAA6D;IAC7D,MAAM,EACJ,gBAAgB,EAChB,OAAO,EAAE,QAAQ,EACjB,OAAO,EAAE,QAAQ,EACjB,WAAW,EAAE,YAAY,EACzB,QAAQ,EAAE,SAAS,EACnB,GAAG,OAAO,EACX,GAAG,OAAO,CAAA;IAEX,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAC9C,2BAA2B,CAC5B,EAAE,CAAC;QACF,IAAK,OAAmC,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YAC7D,QAAQ,CAAC,eAAe,IAAI,EAAE,EAAE,WAAW,CAAC,CAAA;QAC9C,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAA4B,EAAE,GAAG,OAAO,EAAE,CAAA;IAE1D,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,UAAU,CAAC,YAAY,GAAG,YAAY,CAAA;IACxC,CAAC;IAED,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,iCAAiC,MAAM,CAAC,gBAAgB,CAAC,yMAAyM,CACnQ,CAAA;QACH,CAAC;QACD,gEAAgE;QAChE,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC5B,UAAU,CAAC,gBAAgB,GAAG;gBAC5B,YAAY,EAAE,gBAAgB;gBAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;aACG,CAAA;QACrC,CAAC;IACH,CAAC;IAED,OAAO,UAAU,CAAA;AACnB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAA4C,EAC5C,MAAwB;IAExB,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,OAAO,CAAA;IAChB,CAAC;IAED,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,OAAO,CAAA;QAChB,CAAC;QACD,QAAQ,CACN,sBAAsB,EACtB,kIAAkI,CACnI,CAAA;QACD,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,GAAG,MAAM,EAAE,GAAG,OAAO,CAAA;QAC5D,OAAO,MAAM,CAAA;IACf,CAAC;IAED,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,GAAG,OAAO,CAAA;IAEvC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,sEAAsE;QACtE,0EAA0E;QAC1E,mCAAmC;QACnC,OAAO,CAAC,IAAI,CACV,iTAAiT,CAClT,CAAA;IACH,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/auth/authentication-manager.d.ts

@@ -30,10 +30,29 @@ export declare class AuthenticationManager {
     private authClientConstructor?;
     private authClientConstructorPromise?;
     private authModuleMissing;
+    private authClientFlavor;
     private authClientOptions?;
     private authStateValue;
+    /** See {@link sessionChecked}. */
+    private sessionCheckedValue;
+    private sessionCheckedSubscribers;
+    /** Stops following the current client's session record; see `watchClient()`. */
+    private unwatchClient?;
+    /**
+     * Set when the client's session record changed while an operation of this
+     * manager's own was running; see `followClient()`.
+     */
+    private clientChangedDuringOperation;
+    /** Counts `followClient()` passes, so that only the latest one publishes. */
+    private followRevision;
+    /** Counts `dispose()` calls; see {@link releaseCount}. */
+    private releases;
     private readonly identityProvider?;
+    /** The provider taken from the `ic_env` cookie, when no caller set one. */
+    private readonly envIdentityProvider?;
     private readonly internetIdentityId?;
+    /** Whether `internetIdentityId` came from the caller rather than the cookie. */
+    private readonly internetIdentityIdIsExplicit;
     /**
      * Which authorize path the locally deployed Internet Identity serves, once
      * probed. `undefined` means not probed yet; `null` means it serves no sign-in
@@ -48,6 +67,91 @@ export declare class AuthenticationManager {
     constructor({ clientManager, authClient, identityProvider, internetIdentityId, ...clientOptions }: AuthenticationManagerParameters);
     /** @internal Used by IdentityAttributesManager. */
     get client(): AuthClientLike | undefined;
+    /**
+     * @internal Used by the auth hooks.
+     *
+     * Whether this manager has checked its client for a session: a restore has
+     * settled, whether it found a session, found none or failed, or a sign-in or
+     * sign-out has completed. Until then {@link authState} is the signed-out state
+     * the manager starts in, which says nothing about the session, so the auth
+     * hooks report `isAuthenticating: true` instead.
+     */
+    get sessionChecked(): boolean;
+    /**
+     * @internal Used by the auth hooks.
+     *
+     * Records that the session has been checked, and tells the auth hooks the
+     * first time. A restore that failed counts: waiting on one that will not be
+     * retried would leave the hooks reporting `isAuthenticating: true` for good.
+     */
+    markSessionChecked(): void;
+    /**
+     * @internal Used by the auth hooks.
+     *
+     * How many times {@link dispose} has run. A restore the hooks started
+     * compares it with the count it began with, to tell whether the manager was
+     * released while it ran.
+     */
+    get releaseCount(): number;
+    /**
+     * @internal Used by the auth hooks.
+     *
+     * Calls `callback` once, when {@link sessionChecked} turns true. Nothing else
+     * announces it when the check that settles it publishes no state, as a
+     * restore that failed before it read the client does not.
+     *
+     * @returns An unsubscribe function.
+     */
+    subscribeSessionChecked(callback: () => void): () => void;
+    /**
+     * Releases the `@icp-sdk/auth` client this manager built.
+     *
+     * A v10 client hooks the page when it is built: activity listeners on
+     * `document`, focus and visibility listeners, a watch on the session record
+     * that every tab shares and, once signed in, a refresh timer. Nothing
+     * releases them when the manager is dropped, so a manager built per mount,
+     * as a server-rendered app builds one in its provider, left one live client
+     * behind on each remount. Call this when you discard the manager, from the
+     * cleanup of whatever built it.
+     *
+     * The client is disposed and forgotten, so a later {@link prepareClient},
+     * {@link login}, {@link logout} or restore that needs a client builds a new
+     * one. That keeps it safe in an effect cleanup under React's StrictMode,
+     * which runs the cleanup and then the effect again on the same manager. With
+     * `@icp-sdk/auth` v8 there is nothing to release, and the manager only drops
+     * its reference. A client passed in as `authClient` belongs to the caller: it
+     * is never disposed, and the manager goes on using it, but stops following its
+     * session record until its next {@link prepareClient}, {@link login} or
+     * {@link authenticate}, so that the caller's client does not keep a
+     * discarded manager alive.
+     *
+     * The auth state and the identity on the agent are left as they are. A
+     * restore reading the client when it is released ends without publishing
+     * what it read, and a sign-in or sign-out under way ends with what the
+     * released client reports. A restore `useAuth()` started stops, and
+     * releases any client it built meanwhile, once no `useAuth()` of this
+     * manager is mounted; one mounted later restores again.
+     *
+     * @example
+     * ```tsx
+     * const [authentication] = useState(
+     *   () => new AuthenticationManager({ clientManager })
+     * )
+     * useEffect(() => () => authentication.dispose(), [authentication])
+     * ```
+     */
+    dispose(): void;
+    /**
+     * Subscribes to auth state changes.
+     *
+     * Callbacks run in the order they subscribed, after the state has changed. A
+     * callback that throws does not stop the others; the first error is rethrown
+     * to whatever made the change once they have all run. When a callback itself
+     * changes the state, the newer state is the last each callback hears.
+     *
+     * @param callback - Function called with the new state.
+     * @returns An unsubscribe function.
+     */
     subscribeAuthState(callback: (state: AuthState) => void): () => void;
     /**
      * Preloads the auth module and creates an AuthClient ahead of time.
@@ -76,14 +180,116 @@ export declare class AuthenticationManager {
      */
     getPreparedClient(options?: AuthenticationClientOptions): AuthClientLike | undefined;
     authenticate: () => Promise<Identity | undefined>;
+    private checkSession;
     login: (loginOptions?: AuthenticationSignInOptions) => Promise<void>;
     logout: (options?: {
         returnTo?: string;
     }) => Promise<void>;
     private initializeClient;
+    /**
+     * Makes `client`, which this manager built for `options`, the current one.
+     *
+     * The client it replaces was built here too, for other options: a caller's
+     * `authClient` is never replaced. It was dropped with nothing released, so a
+     * v10 client kept its browser listeners, its state subscription and its
+     * session's refresh timer for the life of the page, one more for each switch
+     * between option sets, such as a one-click sign-in and a plain one (#729).
+     * v10 asks for `dispose()` on a client being discarded, and a new
+     * interaction already takes its signer channel from the old client, so this
+     * adds no failure of its own. A v8 client has nothing to dispose; see
+     * `withSharedIdleCallback()` for the callback it leaves registered.
+     */
+    private installClient;
+    /**
+     * Follows a v10 client's session record, which every tab of the origin
+     * shares.
+     *
+     * The manager learned about the session only through its own calls, while a
+     * v10 client follows the other tabs. After a sign-out in another tab, this
+     * tab's client dropped the session and its manager went on reporting the
+     * user signed in, with the replaced identity on the agent signing calls as
+     * the account the user had left. After a sign-in there as another account,
+     * the manager kept the old account while the client held the new one. When
+     * the old identity's app delegation then lapsed, its mint was refused and
+     * the client removed the record every tab reads, signing the new account out
+     * of every tab (#754). `subscribe()` fires after the record changes, here or
+     * in another tab, and the manager then reads the client again.
+     *
+     * v8 has no notification and never revokes a session, so a v8 client is not
+     * followed.
+     */
+    private watchClient;
+    private stopWatchingClient;
+    /**
+     * Reads the session from `client` after its record changed, and publishes
+     * it when it differs from what this manager holds, as `syncStateFromClient()`
+     * derives it. An error recorded for the session it replaces goes with it.
+     *
+     * An operation of the manager's own, which sets `isAuthenticating`, writes
+     * the record itself and publishes what the client holds when it ends, so a
+     * change during one is read again once it has. So is a change whose read
+     * something else published over.
+     */
+    private followClient;
+    /**
+     * The identity `client` hands out, and whether it vouches for it (see
+     * `vouchesFor()`). Both are read from the same client.
+     */
+    private readClientSession;
+    /**
+     * The session `client` holds, or `undefined` to leave the manager's as it is.
+     *
+     * v10 refuses to hand out an identity while the record names a sign-in it
+     * holds no credential for, as when restoring the account another tab signed
+     * in as failed. The session this manager holds is kept then only while the
+     * record still names its account. One for any other account must not stay
+     * on the agent.
+     */
+    private readFollowedSession;
     /** @internal Used by IdentityAttributesManager. */
     signInOrRecoverIdentity(options?: AuthClientSignInOptions): Promise<Identity>;
     private ensurePreparedClient;
+    /**
+     * Hands the installed client the option shape it actually accepts.
+     *
+     * `authClientOptions` keeps the untranslated values, and `shouldRecreateClient`
+     * compares them with the installed major in mind: two calls that differ only
+     * in a key that major drops count as the same options, so the client is not
+     * rebuilt for them.
+     */
+    private toClientOptions;
+    /**
+     * Options for the agent a v9+ client mints delegations with, off mainnet.
+     *
+     * That client makes its own calls to the Internet Identity canister, through
+     * an agent built from these options alone. Without a root key it checks every
+     * certificate against mainnet's, which a local replica or testnet cannot
+     * satisfy, so sign-in would fail at the first mint. Off mainnet it gets the
+     * replica this app already talks to and fetches that network's root key, the
+     * same trust the app's own agent needs there. When the app passed its own
+     * `agentOptions.rootKey`, which its agent keeps, the minting agent gets that
+     * key instead and verifies against it too. On mainnet nothing is passed, and
+     * the client keeps its defaults.
+     */
+    private sessionAgentOptions;
+    /**
+     * Which canister a v9+ client should pair with `identityProvider`.
+     *
+     * v9+ names a provider by its authorize URL and the canister that mints its
+     * delegations, and nothing about the canister follows from the URL. The
+     * mainnet URL goes with mainnet's canister unless the caller named another.
+     * A canister read from the `ic_env` cookie belongs to a local deployment, so
+     * it never overrides that. Any other URL takes `internetIdentityId`, or the
+     * well-known local canister when the URL is one IC Reactor derived for a
+     * local deployment. A URL the caller set with no canister stays `unknown`.
+     */
+    private identityProviderPairing;
+    /**
+     * Whether `identityProvider` is a local provider IC Reactor chose, from the
+     * `ic_env` cookie or built for the local replica, rather than one a caller
+     * configured.
+     */
+    private isDerivedLocalProvider;
     /**
      * Only rebuild the client when the effective options actually changed.
      *
@@ -100,11 +306,55 @@ export declare class AuthenticationManager {
     /** Whether the shared agent currently signs as the anonymous principal. */
     private agentIsAnonymous;
     /**
-     * End a session whose delegation has lapsed: ask the client to forget it,
-     * put the anonymous identity on the agent -- which also sweeps the previous
-     * user's caller-scoped cache entries and refetches the rest anonymously --
-     * and publish the signed-out state. `signOut` failing changes nothing here:
-     * the delegation is already unusable, and the agent must not keep it.
+     * @internal Used by IdentityAttributesManager.
+     *
+     * Whether the client vouches for `identity`, given what its
+     * `isAuthenticated()` answered.
+     *
+     * A v8 client's answer is not about the identity it holds. It reads the
+     * delegation expiry v8 keeps in the `localStorage` every tab shares, while
+     * `getIdentity()` returns the identity this client restored or signed in
+     * with, and v8 never reads storage again once it has loaded. When the session
+     * lapses and the user signs in again in another tab, that tab writes a new
+     * expiry, and the answer is yes again for the delegation this tab still
+     * holds, which the replica refuses. So a v8 identity whose own delegation
+     * has expired is not vouched for, whatever the answer. Nor is the anonymous
+     * identity, which a v8 client that loaded signed out, or signed out, goes on
+     * handing out once another tab signs in and the answer turns yes. It signs
+     * no one in.
+     *
+     * A v10 client's answer is about the session it holds, and its identity
+     * replaces its short-lived delegation as it ages, so the delegation it holds
+     * can be past its expiry while the session is live. The answer stands alone.
+     */
+    vouchesFor(identity: Identity | null | undefined, isAuthenticated: boolean): boolean;
+    /**
+     * End a session the client no longer vouches for: put the anonymous
+     * identity on the agent -- which also sweeps the previous user's
+     * caller-scoped cache entries and refetches the rest anonymously -- and
+     * publish the signed-out state.
+     *
+     * A v8 client is also asked to forget the session when its
+     * `isAuthenticated()` answered no, since it keeps handing out the lapsed
+     * delegation until `signOut()` runs. That answer reads the expiry kept in
+     * the `localStorage` every tab shares, so it is no only once the session
+     * stored for every tab is over, and v8's `signOut()` takes no lock and
+     * revokes nothing. `signOut` failing changes nothing here: the delegation is
+     * already unusable, and the agent must not keep it. When the answer was yes,
+     * the delegation this tab holds lapsed under a session another tab has
+     * signed in to since, and `signOut()` would delete that session from the
+     * storage every tab shares. The client is left alone, and `vouchesFor()`
+     * keeps the lapsed delegation it goes on handing out off the agent.
+     *
+     * A v10 client is left alone, as `commitSignedOut()` leaves it. Its
+     * `signOut()` ends the sign-in for every tab of the origin: it takes the
+     * sign-in lock from a sign-in another tab has in progress, which then fails,
+     * revokes whatever session the shared store holds, and removes the record
+     * every tab reads. Another tab may have signed in again since this one last
+     * looked, and finding a session over is not the user asking to sign out.
+     * The client already stopped vouching for the session on its own.
+     *
+     * @param isAuthenticated - What the client's `isAuthenticated()` answered.
      */
     private expireSession;
     private syncStateFromClient;
@@ -116,7 +366,39 @@ export declare class AuthenticationManager {
     setAuthenticating(): void;
     /** @internal Used by IdentityAttributesManager. */
     setAuthenticationError(error: Error): void;
+    /** @internal Used by IdentityAttributesManager. */
+    settleAuthenticating(): void;
+    /**
+     * @internal Used by IdentityAttributesManager.
+     *
+     * Signs this manager out after the client lost its session under it, as when
+     * another tab signed out. The client itself is left alone: a v10 sign-out
+     * clears the storage every tab shares and takes the sign-in lock, so it would
+     * also end a sign-in the other tab has made or started since.
+     */
+    commitSignedOut(): void;
     private getDefaultIdentityProvider;
+    /**
+     * Publishes what a check of the session found, then marks the session
+     * checked. In that order, so the auth hooks never take the state before it
+     * for the answer.
+     */
+    private publishSession;
+    /**
+     * Records a change, then tells every subscriber about it.
+     *
+     * Every subscriber is called even when one throws, and the first error is
+     * rethrown once they all have been, so the caller still sees it. A throw
+     * used to end the loop: an app's subscriber registered at module scope comes
+     * before every `useAuth()`, and one that failed on a sign-in left them all
+     * showing `isAuthenticating: true` while the agent signed as the user.
+     *
+     * A subscriber that changes the state again from its callback has told every
+     * subscriber about that newer state, so the loop stops rather than deliver
+     * this older one after it. The list is copied first, so a subscriber added
+     * during the loop is first called for the next change. `ClientManager`
+     * notifies its subscribers the same way.
+     */
     private updateState;
     private loadAuthClientConstructor;
 }

package/dist/auth/authentication-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authentication-manager.d.ts","sourceRoot":"","sources":["../../src/auth/authentication-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAEnD,OAAO,KAAK,EACV,cAAc,EACd,uBAAuB,EACvB,SAAS,EACT,2BAA2B,EAC3B,2BAA2B,EAC5B,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,aAAa,EAAS,MAAM,kBAAkB,CAAA;AAgBvD,MAAM,WAAW,+BAAgC,SAAQ,2BAA2B;IAClF,aAAa,EAAE,aAAa,CAAA;IAC5B;;;OAGG;IACH,UAAU,CAAC,EAAE,cAAc,CAAA;IAC3B,2DAA2D;IAC3D,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B;AAMD;;;;;;;;;GASG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,UAAU,CAAC,CAAgB;IACnC,OAAO,CAAC,WAAW,CAAC,CAA+B;IACnD,OAAO,CAAC,qBAAqB,CAAQ;IACrC,OAAO,CAAC,iBAAiB,CAAI;IAC7B,OAAO,CAAC,oBAAoB,CAAwC;IACpE,OAAO,CAAC,qBAAqB,CAAC,CAAuB;IACrD,OAAO,CAAC,4BAA4B,CAAC,CAEpC;IACD,OAAO,CAAC,iBAAiB,CAAQ;IACjC,OAAO,CAAC,iBAAiB,CAAC,CAA6B;IACvD,OAAO,CAAC,cAAc,CAKrB;IACD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAc;IAChD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAQ;IAC5C;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB,CAAC,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6B;IAClE,SAAgB,aAAa,EAAE,aAAa,CAAA;IAE5C,wCAAwC;IACxC,IAAW,SAAS,IAAI,SAAS,CAEhC;gBAEW,EACV,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,GAAG,aAAa,EACjB,EAAE,+BAA+B;IAsClC,mDAAmD;IACnD,IAAW,MAAM,+BAEhB;IAEM,kBAAkB,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI;IAS9D;;;;;;;OAOG;IACU,aAAa,CAAC,OAAO,CAAC,EAAE,2BAA2B;IAehE;;;;;;OAMG;YACW,wBAAwB;IA2BtC;;;;;;;OAOG;IACI,iBAAiB,CACtB,OAAO,CAAC,EAAE,2BAA2B,GACpC,cAAc,GAAG,SAAS;IAItB,YAAY,QAAa,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAqG5D;IAEM,KAAK,GAAU,eAAe,2BAA2B,mBAwD/D;IAEM,MAAM,GAAU,UAAU;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,mBAuBrD;YAEa,gBAAgB;IAc9B,mDAAmD;IACtC,uBAAuB,CAClC,OAAO,CAAC,EAAE,uBAAuB,GAChC,OAAO,CAAC,QAAQ,CAAC;IAyBpB,OAAO,CAAC,oBAAoB;IAiB5B;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAO5B;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAe5B,2EAA2E;IAC3E,OAAO,CAAC,gBAAgB;IAKxB;;;;;;OAMG;YACW,aAAa;YAgBb,mBAAmB;IAmBjC,mDAAmD;IACtC,YAAY,CAAC,OAAO,CAAC,EAAE,2BAA2B;IAQ/D,mDAAmD;IACtC,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO;IAQxE,mDAAmD;IAC5C,iBAAiB;IAIxB,mDAAmD;IAC5C,sBAAsB,CAAC,KAAK,EAAE,KAAK;IAI1C,OAAO,CAAC,0BAA0B;IA0BlC,OAAO,CAAC,WAAW;YASL,yBAAyB;CAkCxC"}
+{"version":3,"file":"authentication-manager.d.ts","sourceRoot":"","sources":["../../src/auth/authentication-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAGnD,OAAO,KAAK,EACV,cAAc,EACd,uBAAuB,EACvB,SAAS,EACT,2BAA2B,EAC3B,2BAA2B,EAC5B,MAAM,YAAY,CAAA;AACnB,OAAO,EAAE,aAAa,EAAS,MAAM,kBAAkB,CAAA;AAyBvD,MAAM,WAAW,+BAAgC,SAAQ,2BAA2B;IAClF,aAAa,EAAE,aAAa,CAAA;IAC5B;;;OAGG;IACH,UAAU,CAAC,EAAE,cAAc,CAAA;IAC3B,2DAA2D;IAC3D,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAC5B;AAkBD;;;;;;;;;GASG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,UAAU,CAAC,CAAgB;IACnC,OAAO,CAAC,WAAW,CAAC,CAA+B;IACnD,OAAO,CAAC,qBAAqB,CAAQ;IACrC,OAAO,CAAC,iBAAiB,CAAI;IAC7B,OAAO,CAAC,oBAAoB,CAAwC;IACpE,OAAO,CAAC,qBAAqB,CAAC,CAAuB;IACrD,OAAO,CAAC,4BAA4B,CAAC,CAEpC;IACD,OAAO,CAAC,iBAAiB,CAAQ;IACjC,OAAO,CAAC,gBAAgB,CAA6B;IACrD,OAAO,CAAC,iBAAiB,CAAC,CAA6B;IACvD,OAAO,CAAC,cAAc,CAKrB;IACD,kCAAkC;IAClC,OAAO,CAAC,mBAAmB,CAAQ;IACnC,OAAO,CAAC,yBAAyB,CAAwB;IACzD,gFAAgF;IAChF,OAAO,CAAC,aAAa,CAAC,CAAY;IAClC;;;OAGG;IACH,OAAO,CAAC,4BAA4B,CAAQ;IAC5C,6EAA6E;IAC7E,OAAO,CAAC,cAAc,CAAI;IAC1B,0DAA0D;IAC1D,OAAO,CAAC,QAAQ,CAAI;IACpB,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAc;IAChD,2EAA2E;IAC3E,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAc;IACnD,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAQ;IAC5C,gFAAgF;IAChF,OAAO,CAAC,QAAQ,CAAC,4BAA4B,CAAS;IACtD;;;;;OAKG;IACH,OAAO,CAAC,kBAAkB,CAAC,CAAsB;IACjD,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAA6B;IAClE,SAAgB,aAAa,EAAE,aAAa,CAAA;IAE5C,wCAAwC;IACxC,IAAW,SAAS,IAAI,SAAS,CAEhC;gBAEW,EACV,aAAa,EACb,UAAU,EACV,gBAAgB,EAChB,kBAAkB,EAClB,GAAG,aAAa,EACjB,EAAE,+BAA+B;IAiDlC,mDAAmD;IACnD,IAAW,MAAM,+BAEhB;IAED;;;;;;;;OAQG;IACH,IAAW,cAAc,IAAI,OAAO,CAEnC;IAED;;;;;;OAMG;IACI,kBAAkB;IAQzB;;;;;;OAMG;IACH,IAAW,YAAY,IAAI,MAAM,CAEhC;IAED;;;;;;;;OAQG;IACI,uBAAuB,CAAC,QAAQ,EAAE,MAAM,IAAI;IAWnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACI,OAAO,IAAI,IAAI;IActB;;;;;;;;;;OAUG;IACI,kBAAkB,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI;IAc9D;;;;;;;OAOG;IACU,aAAa,CAAC,OAAO,CAAC,EAAE,2BAA2B;IAgBhE;;;;;;OAMG;YACW,wBAAwB;IAuCtC;;;;;;;OAOG;IACI,iBAAiB,CACtB,OAAO,CAAC,EAAE,2BAA2B,GACpC,cAAc,GAAG,SAAS;IAItB,YAAY,QAAa,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAa5D;YAEa,YAAY;IA+HnB,KAAK,GAAU,eAAe,2BAA2B,mBA2D/D;IAEM,MAAM,GAAU,UAAU;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,mBA+DrD;YAEa,gBAAgB;IA0B9B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,aAAa;IAerB;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,WAAW;IAmBnB,OAAO,CAAC,kBAAkB;IAK1B;;;;;;;;;OASG;YACW,YAAY;IA6C1B;;;OAGG;YACW,iBAAiB;IAS/B;;;;;;;;OAQG;YACW,mBAAmB;IA4BjC,mDAAmD;IACtC,uBAAuB,CAClC,OAAO,CAAC,EAAE,uBAAuB,GAChC,OAAO,CAAC,QAAQ,CAAC;IA+BpB,OAAO,CAAC,oBAAoB;IAmB5B;;;;;;;OAOG;IACH,OAAO,CAAC,eAAe;IAWvB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,mBAAmB;IAY3B;;;;;;;;;;OAUG;IACH,OAAO,CAAC,uBAAuB;IAoB/B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IAqB9B;;;;;;OAMG;IACH,OAAO,CAAC,oBAAoB;IAW5B;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAe5B,2EAA2E;IAC3E,OAAO,CAAC,gBAAgB;IAKxB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACI,UAAU,CACf,QAAQ,EAAE,QAAQ,GAAG,IAAI,GAAG,SAAS,EACrC,eAAe,EAAE,OAAO,GACvB,OAAO;IAWV;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;YACW,aAAa;YAkBb,mBAAmB;IAkCjC,mDAAmD;IACtC,YAAY,CAAC,OAAO,CAAC,EAAE,2BAA2B;IAQ/D,mDAAmD;IACtC,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO;IAQxE,mDAAmD;IAC5C,iBAAiB;IAIxB,mDAAmD;IAC5C,sBAAsB,CAAC,KAAK,EAAE,KAAK;IAI1C,mDAAmD;IAC5C,oBAAoB;IAI3B;;;;;;;OAOG;IACI,eAAe;IAetB,OAAO,CAAC,0BAA0B;IA6BlC;;;;OAIG;IACH,OAAO,CAAC,cAAc;IAQtB;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,WAAW;YA+BL,yBAAyB;CAmCxC"}