@icp-sdk/auth 8.0.0 → 8.0.2

package/dist/esm/client/auth-client.d.ts

@@ -207,10 +207,17 @@ export declare class AuthClient {
      *
      * In `'window'` mode there is no redirect, so this simply runs `produce` and
      * returns its result without persisting anything.
+     *
+     * Mirrors the producer's shape: a synchronous `produce` returns its value
+     * directly, an asynchronous one returns a promise. Awaiting the result is
+     * always safe (`await` on a non-promise is a no-op); the synchronous form lets
+     * a value be memoized where an `await` is not possible, such as in a
+     * constructor.
      * @param produce - Produces the value to journal on the first load.
      * @returns The produced value, or the journaled value on a replay load.
      */
-    memoize<T>(produce: () => T | Promise<T>): Promise<T>;
+    memoize<T>(produce: () => Promise<T>): Promise<T>;
+    memoize<T>(produce: () => T): T;
     /**
      * Clears the stored session and resets the client to an anonymous state.
      *

package/dist/esm/client/auth-client.js

@@ -18,6 +18,13 @@ const KEY_STORAGE_EXPIRATION = 'ic-delegation_expiration';
 // flow is in progress (keyed by a per-flow id) and removed once the delegation
 // is persisted. See AuthClient.#acquireSessionKey.
 const PENDING_KEY_PREFIX = 'ic-auth-pending-key:';
+// The storage backend has no key enumeration, so pending-key slots are tracked
+// explicitly here: an abandoned flow never removes its key, so a later flow
+// prunes expired orphans by slot instead of leaking them forever.
+const PENDING_KEYS_REGISTRY_KEY = 'ic-auth-pending-keys';
+// Past the URL transport's ~10-min flow window the flow can't resume, so a
+// pending key older than this is treated as abandoned.
+const PENDING_KEY_TTL_MS = 10 * 60 * 1000;
 export const OPENID_PROVIDER_URLS = {
     google: 'https://accounts.google.com',
     apple: 'https://appleid.apple.com',
@@ -67,7 +74,14 @@ export class AuthClient {
         this.#urlTransport = transport instanceof UrlTransport ? transport : undefined;
         this.#signer = new Signer({
             transport,
-            derivationOrigin: options.derivationOrigin?.toString(),
+            // Journal the derivation origin so it survives the top-level redirect: the
+            // return load reconstructs this client from a query-less callback URL, so
+            // `options.derivationOrigin` (like the identity provider) is no longer
+            // available — the memoized value replays from the journal instead.
+            // `memoize` returns synchronously for a synchronous producer, so the value
+            // is usable directly here; in the window flow it is a passthrough that runs
+            // the producer without persisting anything.
+            derivationOrigin: this.memoize(() => options.derivationOrigin?.toString()),
         });
         this.#registerDefaultIdleCallback();
         // Eagerly start restoring a previous session from storage.
@@ -109,12 +123,27 @@ export class AuthClient {
      * }
      */
     async signIn(options) {
-        await this.#signer.openChannel();
         const maxTimeToLive = options?.maxTimeToLive ?? DEFAULT_MAX_TIME_TO_LIVE;
         const keyType = this.#options.keyType ?? ECDSA_KEY_LABEL;
-        const { key, pendingKeySlot } = this.#urlTransport
-            ? await this.#ensureSessionKeyForRedirectFlow(this.#urlTransport, keyType)
-            : { key: await this.#ensureSessionKeyForWindowFlow(keyType) };
+        // Start session-key acquisition BEFORE opening the channel, awaiting it only
+        // after. In the redirect flow the acquisition's first `transport.memoize`
+        // runs synchronously when invoked, so its in-flight bump lands in the same
+        // tick `signIn` is called — holding the transport's batch flush from the
+        // very start of the flow rather than only after the `openChannel` await.
+        // Under `Promise.all([signIn, requestAttributes])` this is what keeps a
+        // faster concurrent request from flushing before this flow's delegation
+        // request is buffered.
+        const sessionKeyPromise = this.#urlTransport
+            ? this.#ensureSessionKeyForRedirectFlow(this.#urlTransport, keyType)
+            : this.#ensureSessionKeyForWindowFlow(keyType).then((key) => ({ key }));
+        // The acquisition is started eagerly, before the awaits below. If one of
+        // those throws first, `sessionKeyPromise` is never awaited, so attach a
+        // no-op rejection handler now to keep a later acquisition failure from
+        // surfacing as an unhandled rejection. The `await` below still observes a
+        // rejection and propagates it when reached.
+        void sessionKeyPromise.catch(() => undefined);
+        await this.#signer.openChannel();
+        const { key, pendingKeySlot } = await sessionKeyPromise;
         const delegationChain = await this.#signer.requestDelegation({
             publicKey: key.getPublicKey(),
             targets: options?.targets,
@@ -137,9 +166,17 @@ export class AuthClient {
         await persistChain(this.#storage, this.#chain);
         await persistKey(this.#storage, key);
         // The flow is complete: the delegation is bound to this key and stored, so
-        // the per-flow pending copy is no longer needed.
+        // the per-flow pending copy is no longer needed. Best-effort — the user is
+        // already signed in, so a cleanup failure must not fail signIn(); a later
+        // flow sweeps whatever is left behind.
         if (pendingKeySlot !== undefined) {
-            await this.#storage.remove(pendingKeySlot);
+            try {
+                await this.#storage.remove(pendingKeySlot);
+                await unregisterPendingKey(this.#storage, pendingKeySlot);
+            }
+            catch {
+                // ignore
+            }
         }
         return this.#identity;
     }
@@ -163,12 +200,38 @@ export class AuthClient {
         }
         const keyId = await transport.memoize(() => globalThis.crypto.randomUUID());
         const pendingKeySlot = `${PENDING_KEY_PREFIX}${keyId}`;
-        const restored = await restoreKeyAt(this.#storage, pendingKeySlot);
-        if (restored) {
-            return { key: restored, pendingKeySlot };
+        // Acquire the per-flow key inside a `memoize` producer so the transport
+        // holds its batch flush across the (async) key restore/generate + storage
+        // write. The transport coalesces concurrently issued requests into one
+        // redirect by flushing on a macrotask once no memoize producer is in
+        // flight; without this hold, a faster concurrent request (e.g. the nonce
+        // path of `requestAttributes`) buffers first and trips that flush before
+        // this flow's delegation request — issued only once the key is ready — is
+        // buffered, splitting what should be one redirect into two.
+        //
+        // The key is captured in a closure, not read back after the producer: on
+        // the FIRST load the producer sets `acquired`, so the delegation request
+        // that follows is issued with no intervening storage read — a read there
+        // would re-open the very flush gap this closes. The producer is skipped on
+        // the replay load (its result is journaled), where the key is instead
+        // restored from storage. Only the id is journaled; the key lives in storage.
+        let acquired = null;
+        await transport.memoize(async () => {
+            acquired = await restoreKeyAt(this.#storage, pendingKeySlot);
+            if (acquired === null) {
+                acquired = await generateKey(keyType);
+                // Register before writing the key: if the write then fails, a stray
+                // registry entry is harmless (swept on expiry), whereas a key with no
+                // registry entry would leak un-sweepably.
+                await sweepAndRegisterPendingKey(this.#storage, pendingKeySlot, Date.now());
+                await this.#storage.set(pendingKeySlot, serializeKey(acquired));
+            }
+            return keyId;
+        });
+        const key = acquired ?? (await restoreKeyAt(this.#storage, pendingKeySlot));
+        if (key === null) {
+            throw new Error('Session key missing after acquisition');
         }
-        const key = await generateKey(keyType);
-        await this.#storage.set(pendingKeySlot, serializeKey(key));
         return { key, pendingKeySlot };
     }
     /**
@@ -223,38 +286,7 @@ export class AuthClient {
             throw new Error('Invalid response: data or signature is not valid base64', { cause });
         }
     }
-    /**
-     * Runs and journals a piece of your own async work so its result stays stable
-     * across the `'redirect'` flow.
-     *
-     * In `'redirect'` mode the page unloads on each step and `signIn` /
-     * `requestAttributes` re-run on the return load, so a value you compute on the
-     * first visit (from `location`, a fetch, `crypto`, …) would otherwise be
-     * recomputed — and may differ — on the return. Wrap it in `memoize`: it runs
-     * `produce` once on the first visit, journals the result, and replays that
-     * result on the return load instead of re-running. Use it for a value the
-     * post-flow code depends on, e.g. the URL to navigate to once sign-in
-     * completes:
-     *
-     * ```ts
-     * const next = await authClient.memoize(
-     *   () => new URLSearchParams(location.search).get('next') ?? '/',
-     * );
-     * await authClient.signIn();
-     * location.assign(next); // the value captured before the redirect
-     * ```
-     *
-     * Call `memoize` in a stable order relative to `signIn` / `requestAttributes`
-     * across loads (same order every load — branch only on values recovered from
-     * earlier results), and keep the result JSON-serializable, since the journal
-     * is JSON.
-     *
-     * In `'window'` mode there is no redirect, so this simply runs `produce` and
-     * returns its result without persisting anything.
-     * @param produce - Produces the value to journal on the first load.
-     * @returns The produced value, or the journaled value on a replay load.
-     */
-    async memoize(produce) {
+    memoize(produce) {
         if (this.#urlTransport) {
             return this.#urlTransport.memoize(produce);
         }
@@ -270,12 +302,28 @@ export class AuthClient {
         await deleteStorage(this.#storage);
         this.#identity = new AnonymousIdentity();
         this.#chain = null;
-        if (options.returnTo) {
+        if (options.returnTo !== undefined) {
+            // Navigate exactly as before (pushState, else location.href), but only to
+            // a validated same-origin http(s) target, and feed that validated
+            // `target.href` to both sinks rather than the raw `returnTo`. An invalid
+            // or cross-origin `returnTo` is ignored, so the fallback can no longer be
+            // turned into an open redirect or a `javascript:` execution.
+            let target;
             try {
-                window.history.pushState({}, '', options.returnTo);
+                target = new URL(options.returnTo, window.location.href);
             }
             catch {
-                window.location.href = options.returnTo;
+                target = undefined;
+            }
+            if (target !== undefined &&
+                (target.protocol === 'https:' || target.protocol === 'http:') &&
+                target.origin === window.location.origin) {
+                try {
+                    window.history.pushState({}, '', target.href);
+                }
+                catch {
+                    window.location.href = target.href;
+                }
             }
         }
     }
@@ -330,9 +378,13 @@ export class AuthClient {
     #registerDefaultIdleCallback() {
         const idleOptions = this.#options?.idleOptions;
         if (!idleOptions?.onIdle && !idleOptions?.disableDefaultIdleCallback) {
+            // Invoked without being awaited, so handle the promise here. Reload only
+            // after teardown resolves, and only if it succeeded — a reload before or
+            // without teardown lets #hydrate restore the still-valid session.
             this.idleManager?.registerCallback(() => {
-                this.signOut();
-                location.reload();
+                void this.signOut()
+                    .then(() => location.reload())
+                    .catch(() => { });
             });
         }
     }
@@ -411,6 +463,64 @@ async function restoreKey(storage, keyType) {
         return null;
     }
 }
+// Reads the pending-key registry, dropping malformed entries. The value comes
+// from storage, so guard against corruption: keep only real pending-key slots
+// with a finite expiry (a NaN expiry compares false forever and never sweeps;
+// a foreign slot would make the sweep remove an unrelated storage key).
+async function readPendingRegistry(storage) {
+    const raw = await storage.get(PENDING_KEYS_REGISTRY_KEY);
+    if (typeof raw !== 'string')
+        return [];
+    try {
+        const parsed = JSON.parse(raw);
+        if (!Array.isArray(parsed))
+            return [];
+        return parsed.filter((entry) => {
+            if (typeof entry !== 'object' || entry === null)
+                return false;
+            const { slot, expiresAt } = entry;
+            return (typeof slot === 'string' &&
+                slot.startsWith(PENDING_KEY_PREFIX) &&
+                typeof expiresAt === 'number' &&
+                Number.isFinite(expiresAt));
+        });
+    }
+    catch {
+        return [];
+    }
+}
+async function writePendingRegistry(storage, entries) {
+    if (entries.length === 0) {
+        await storage.remove(PENDING_KEYS_REGISTRY_KEY);
+        return;
+    }
+    await storage.set(PENDING_KEYS_REGISTRY_KEY, JSON.stringify(entries));
+}
+// Removes expired pending-key slots, then registers `slot` with a fresh expiry.
+async function sweepAndRegisterPendingKey(storage, slot, now) {
+    const entries = await readPendingRegistry(storage);
+    const live = [];
+    for (const entry of entries) {
+        if (entry.slot === slot)
+            continue; // re-registered with a fresh expiry below
+        if (entry.expiresAt <= now) {
+            await storage.remove(entry.slot);
+        }
+        else {
+            live.push(entry);
+        }
+    }
+    live.push({ slot, expiresAt: now + PENDING_KEY_TTL_MS });
+    await writePendingRegistry(storage, live);
+}
+// Drops a slot from the pending-key registry once its flow completes.
+async function unregisterPendingKey(storage, slot) {
+    const entries = await readPendingRegistry(storage);
+    const remaining = entries.filter((entry) => entry.slot !== slot);
+    if (remaining.length !== entries.length) {
+        await writePendingRegistry(storage, remaining);
+    }
+}
 /**
  * Loads a session key from a specific storage slot, deserializing by stored
  * shape (`CryptoKeyPair` → ECDSA, JSON string → Ed25519). Unlike

package/dist/esm/client/auth-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-client.js","sourceRoot":"","sources":["../../../src/client/auth-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAoC,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,yBAAyB,GAE1B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,WAAW,EAA2B,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAEL,UAAU,EACV,sBAAsB,EACtB,eAAe,EACf,UAAU,EACV,YAAY,GAEb,MAAM,cAAc,CAAC;AAEtB,MAAM,sBAAsB,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;AACrD,MAAM,gBAAgB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;AACvC,MAAM,oBAAoB,GAAG,sBAAsB,GAAG,gBAAgB,CAAC;AAEvE,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAC5D,MAAM,wBAAwB,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,oBAAoB,CAAC;AAElE,MAAM,eAAe,GAAG,OAAO,CAAC;AAChC,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAGpC,mEAAmE;AACnE,wEAAwE;AACxE,MAAM,sBAAsB,GAAG,0BAA0B,CAAC;AAE1D,4EAA4E;AAC5E,+EAA+E;AAC/E,mDAAmD;AACnD,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AAIlD,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,MAAM,EAAE,6BAA6B;IACrC,KAAK,EAAE,2BAA2B;IAClC,SAAS,EAAE,8CAA8C;CACR,CAAC;AAEpD,MAAM,yBAAyB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAU,CAAC;AAoH/E;;;;;;;;;GASG;AACH,MAAM,OAAO,UAAU;IACrB,SAAS,GAA+B,IAAI,iBAAiB,EAAE,CAAC;IAChE,MAAM,GAA2B,IAAI,CAAC;IACtC,QAAQ,CAAoB;IAC5B,OAAO,CAAS;IAChB,uEAAuE;IACvE,2EAA2E;IAC3E,aAAa,CAA2B;IACxC,QAAQ,CAA0B;IAClC,YAAY,GAAyB,IAAI,CAAC;IAC1C,WAAW,CAA0B;IAErC,YAAY,UAAmC,EAAE;QAC/C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,UAAU,EAAE,CAAC;QAEpD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CACjC,OAAO,CAAC,gBAAgB,EAAE,QAAQ,EAAE,IAAI,yBAAyB,CAClE,CAAC;QACF,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3B,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QAC/F,CAAC;QAED,MAAM,SAAS,GACb,OAAO,CAAC,SAAS,KAAK,UAAU;YAC9B,CAAC,CAAC,IAAI,YAAY,CAAC;gBACf,GAAG,EAAE,mBAAmB,CAAC,QAAQ,EAAE;gBACnC,mEAAmE;gBACnE,iEAAiE;gBACjE,uDAAuD;gBACvD,WAAW,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,QAAQ,EAAE;aAC5E,CAAC;YACJ,CAAC,CAAC,IAAI,oBAAoB,CAAC;gBACvB,GAAG,EAAE,mBAAmB,CAAC,QAAQ,EAAE;gBACnC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;aACnD,CAAC,CAAC;QACT,IAAI,CAAC,aAAa,GAAG,SAAS,YAAY,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAE/E,IAAI,CAAC,OAAO,GAAG,IAAI,MAAM,CAAC;YACxB,SAAS;YACT,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,QAAQ,EAAE;SACvD,CAAC,CAAC;QAEH,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAEpC,2DAA2D;QAC3D,2DAA2D;QAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,eAAe;QACb,6EAA6E;QAC7E,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;QACvC,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QACrD,OAAO,KAAK,GAAG,UAAU,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,MAAM,CAAC,OAAiC;QAC5C,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAEjC,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,IAAI,wBAAwB,CAAC;QACzE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,eAAe,CAAC;QAEzD,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,IAAI,CAAC,aAAa;YAChD,CAAC,CAAC,MAAM,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC;YAC1E,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,IAAI,CAAC,8BAA8B,CAAC,OAAO,CAAC,EAAE,CAAC;QAEhE,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;YAC3D,SAAS,EAAE,GAAG,CAAC,YAAY,EAAE;YAC7B,OAAO,EAAE,OAAO,EAAE,OAAO;YACzB,aAAa;SACd,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC;QAE9B,mEAAmE;QACnE,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC;YACnB,IAAI,CAAC,SAAS,GAAG,yBAAyB,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9E,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,SAAS,GAAG,kBAAkB,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC;YACnD,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACnD,IAAI,CAAC,4BAA4B,EAAE,CAAC;QACtC,CAAC;QAED,gDAAgD;QAChD,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAErC,2EAA2E;QAC3E,iDAAiD;QACjD,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,8EAA8E;IAC9E,uEAAuE;IACvE,4BAA4B;IAC5B,KAAK,CAAC,8BAA8B,CAClC,OAAoB;QAEpB,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,sEAAsE;IACtE,6EAA6E;IAC7E,0EAA0E;IAC1E,8EAA8E;IAC9E,mEAAmE;IACnE,KAAK,CAAC,gCAAgC,CACpC,SAAuB,EACvB,OAAoB;QAEpB,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QAC5E,MAAM,cAAc,GAAG,GAAG,kBAAkB,GAAG,KAAK,EAAE,CAAC;QAEvD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;QACnE,IAAI,QAAQ,EAAE,CAAC;YACb,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,cAAc,EAAE,CAAC;QAC3C,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QACvC,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;IACjC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,KAAK,CAAC,iBAAiB,CAAC,MAGvB;QACC,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa;YACnC,CAAC,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC1F,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE3C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;YAC9C,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE;YAClC,MAAM,EAAE,qBAAqB;YAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE;SAC3D,CAAC,CAAC;QAEH,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,CAAC,MAA6C,CAAC;QACtE,IAAI,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ,IAAI,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC;YACH,OAAO;gBACL,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;gBAC7B,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC;aACxC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,yDAAyD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,KAAK,CAAC,OAAO,CAAI,OAA6B;QAC5C,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,UAAiC,EAAE;QAC/C,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEnC,IAAI,CAAC,SAAS,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACzC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAEnB,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,IAAI,CAAC;gBACH,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC;YAC1C,CAAC;QACH,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,qEAAqE;IACrE,4EAA4E;IAC5E,uEAAuE;IACvE,0BAA0B;IAC1B,KAAK,CAAC,aAAa,CAAC,KAAgC;QAClD,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC;QACjE,IAAI,CAAC,OAAO,CAAC,yBAAyB,GAAG,KAAK,CAAC;QAC/C,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC;QACrB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,CAAC,yBAAyB,GAAG,iBAAiB,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtC,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,uEAAuE;IACvE,sEAAsE;IACtE,iDAAiD;IACjD,KAAK,CAAC,QAAQ;QACZ,MAAM,GAAG,GACP,IAAI,CAAC,QAAQ,CAAC,QAAQ;YACtB,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,eAAe,CAAC,CAAC,CAAC;QAC9E,IAAI,CAAC,GAAG;YAAE,OAAO;QAEjB,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK;YAAE,OAAO;QAEnB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC;YACnB,IAAI,CAAC,SAAS,GAAG,yBAAyB,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,SAAS,GAAG,kBAAkB,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACjE,IAAI,CAAC,4BAA4B,EAAE,CAAC;QACtC,CAAC;IACH,CAAC;IAED,4BAA4B;QAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;QAC/C,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,WAAW,EAAE,0BAA0B,EAAE,CAAC;YACrE,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,GAAG,EAAE;gBACtC,IAAI,CAAC,OAAO,EAAE,CAAC;gBACf,QAAQ,CAAC,MAAM,EAAE,CAAC;YACpB,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,KAAiB;IACjC,IAAI,UAAU,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC;IACD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,YAAY,IAAI,UAAU,IAAI,OAAO,UAAU,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAC9E,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,WAAW,CAAC,OAAoB;IAC7C,IAAI,OAAO,KAAK,iBAAiB,EAAE,CAAC;QAClC,OAAO,kBAAkB,CAAC,QAAQ,EAAE,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,gBAAgB,CAAC,QAAQ,EAAE,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,UAAU,CACvB,OAA0B,EAC1B,GAAmC;IAEnC,MAAM,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,UAAU,CACvB,OAA0B,EAC1B,OAAoB;IAEpB,IAAI,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,CAAC;QACH,wDAAwD;QACxD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,MAAM,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,iEAAiE;QACjE,2CAA2C;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,YAAY,CACzB,OAA0B,EAC1B,UAAkB;IAElB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,CAAC;QACH,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,MAAM,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,GAAmC;IACvD,IAAI,GAAG,YAAY,gBAAgB;QAAE,OAAO,GAAG,CAAC,UAAU,EAAE,CAAC;IAC7D,IAAI,GAAG,YAAY,kBAAkB;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3E,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CAAC,OAA0B,EAAE,KAAsB;IAC5E,MAAM,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAE1E,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,KAAK,MAAM,EAAE,UAAU,EAAE,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAC/C,IAAI,QAAQ,KAAK,IAAI,IAAI,UAAU,CAAC,UAAU,GAAG,QAAQ,EAAE,CAAC;YAC1D,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC;QACnC,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,YAAY,CAAC,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAC,OAA0B;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACtD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAEjD,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjB,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,aAAa,CAAC,OAA0B;IACrD,MAAM,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACtC,MAAM,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAC7C,MAAM,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACjC,YAAY,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;AAClD,CAAC;AAED,8EAA8E;AAC9E,SAAS,iBAAiB;IACxB,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC3D,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,uBAAuB,CACpC,OAA0B,EAC1B,OAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,YAAY,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAErD,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,IAAI,OAAO,KAAK,eAAe;YAAE,OAAO,IAAI,CAAC;QAEzE,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;QACrF,MAAM,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,UAAU,CAAC,CAAC;QACtD,MAAM,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAC7C,MAAM,QAAQ,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC9C,MAAM,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAEvC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,mDAAmD,KAAK,EAAE,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CAGxB,MAGD;IACC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,yBAAyB,CAAC;IACtD,OAAO,IAAI,CAAC,GAAG,CACb,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,QAAQ,IAAI,GAAG,EAAuD,CAC1F,CAAC;AACJ,CAAC"}
+{"version":3,"file":"auth-client.js","sourceRoot":"","sources":["../../../src/client/auth-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAoC,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,kBAAkB,EAClB,iBAAiB,EACjB,yBAAyB,GAE1B,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AACzC,OAAO,EAAE,oBAAoB,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,WAAW,EAA2B,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAEL,UAAU,EACV,sBAAsB,EACtB,eAAe,EACf,UAAU,EACV,YAAY,GAEb,MAAM,cAAc,CAAC;AAEtB,MAAM,sBAAsB,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC;AACrD,MAAM,gBAAgB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;AACvC,MAAM,oBAAoB,GAAG,sBAAsB,GAAG,gBAAgB,CAAC;AAEvE,MAAM,yBAAyB,GAAG,yBAAyB,CAAC;AAC5D,MAAM,wBAAwB,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,oBAAoB,CAAC;AAElE,MAAM,eAAe,GAAG,OAAO,CAAC;AAChC,MAAM,iBAAiB,GAAG,SAAS,CAAC;AAGpC,mEAAmE;AACnE,wEAAwE;AACxE,MAAM,sBAAsB,GAAG,0BAA0B,CAAC;AAE1D,4EAA4E;AAC5E,+EAA+E;AAC/E,mDAAmD;AACnD,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AAElD,+EAA+E;AAC/E,4EAA4E;AAC5E,kEAAkE;AAClE,MAAM,yBAAyB,GAAG,sBAAsB,CAAC;AACzD,2EAA2E;AAC3E,uDAAuD;AACvD,MAAM,kBAAkB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAS1C,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,MAAM,EAAE,6BAA6B;IACrC,KAAK,EAAE,2BAA2B;IAClC,SAAS,EAAE,8CAA8C;CACR,CAAC;AAEpD,MAAM,yBAAyB,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAU,CAAC;AAoH/E;;;;;;;;;GASG;AACH,MAAM,OAAO,UAAU;IACrB,SAAS,GAA+B,IAAI,iBAAiB,EAAE,CAAC;IAChE,MAAM,GAA2B,IAAI,CAAC;IACtC,QAAQ,CAAoB;IAC5B,OAAO,CAAS;IAChB,uEAAuE;IACvE,2EAA2E;IAC3E,aAAa,CAA2B;IACxC,QAAQ,CAA0B;IAClC,YAAY,GAAyB,IAAI,CAAC;IAC1C,WAAW,CAA0B;IAErC,YAAY,UAAmC,EAAE;QAC/C,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC;QACxB,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,UAAU,EAAE,CAAC;QAEpD,MAAM,mBAAmB,GAAG,IAAI,GAAG,CACjC,OAAO,CAAC,gBAAgB,EAAE,QAAQ,EAAE,IAAI,yBAAyB,CAClE,CAAC;QACF,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;YAC3B,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,oBAAoB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC;QAC/F,CAAC;QAED,MAAM,SAAS,GACb,OAAO,CAAC,SAAS,KAAK,UAAU;YAC9B,CAAC,CAAC,IAAI,YAAY,CAAC;gBACf,GAAG,EAAE,mBAAmB,CAAC,QAAQ,EAAE;gBACnC,mEAAmE;gBACnE,iEAAiE;gBACjE,uDAAuD;gBACvD,WAAW,EAAE,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,QAAQ,EAAE;aAC5E,CAAC;YACJ,CAAC,CAAC,IAAI,oBAAoB,CAAC;gBACvB,GAAG,EAAE,mBAAmB,CAAC,QAAQ,EAAE;gBACnC,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;aACnD,CAAC,CAAC;QACT,IAAI,CAAC,aAAa,GAAG,SAAS,YAAY,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAE/E,IAAI,CAAC,OAAO,GAAG,IAAI,MAAM,CAAC;YACxB,SAAS;YACT,2EAA2E;YAC3E,0EAA0E;YAC1E,uEAAuE;YACvE,mEAAmE;YACnE,2EAA2E;YAC3E,4EAA4E;YAC5E,4CAA4C;YAC5C,gBAAgB,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,QAAQ,EAAE,CAAC;SAC3E,CAAC,CAAC;QAEH,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAEpC,2DAA2D;QAC3D,2DAA2D;QAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW;QACf,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,eAAe;QACb,6EAA6E;QAC7E,MAAM,UAAU,GAAG,iBAAiB,EAAE,CAAC;QACvC,IAAI,UAAU,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QACrD,OAAO,KAAK,GAAG,UAAU,CAAC;IAC5B,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,MAAM,CAAC,OAAiC;QAC5C,MAAM,aAAa,GAAG,OAAO,EAAE,aAAa,IAAI,wBAAwB,CAAC;QACzE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,eAAe,CAAC;QAEzD,6EAA6E;QAC7E,0EAA0E;QAC1E,2EAA2E;QAC3E,yEAAyE;QACzE,yEAAyE;QACzE,wEAAwE;QACxE,wEAAwE;QACxE,uBAAuB;QACvB,MAAM,iBAAiB,GAGlB,IAAI,CAAC,aAAa;YACrB,CAAC,CAAC,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC;YACpE,CAAC,CAAC,IAAI,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,uEAAuE;QACvE,0EAA0E;QAC1E,4CAA4C;QAC5C,KAAK,iBAAiB,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAE9C,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QAEjC,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,GAAG,MAAM,iBAAiB,CAAC;QAExD,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC;YAC3D,SAAS,EAAE,GAAG,CAAC,YAAY,EAAE;YAC7B,OAAO,EAAE,OAAO,EAAE,OAAO;YACzB,aAAa;SACd,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC;QAE9B,mEAAmE;QACnE,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC;YACnB,IAAI,CAAC,SAAS,GAAG,yBAAyB,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9E,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,SAAS,GAAG,kBAAkB,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACvE,CAAC;QAED,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE,CAAC;YACnD,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACnD,IAAI,CAAC,4BAA4B,EAAE,CAAC;QACtC,CAAC;QAED,gDAAgD;QAChD,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;QAErC,2EAA2E;QAC3E,2EAA2E;QAC3E,0EAA0E;QAC1E,uCAAuC;QACvC,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;gBAC3C,MAAM,oBAAoB,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;YAC5D,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,8EAA8E;IAC9E,uEAAuE;IACvE,4BAA4B;IAC5B,KAAK,CAAC,8BAA8B,CAClC,OAAoB;QAEpB,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,IAAI,CAAC,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;IAChE,CAAC;IAED,8EAA8E;IAC9E,8EAA8E;IAC9E,8EAA8E;IAC9E,sEAAsE;IACtE,6EAA6E;IAC7E,0EAA0E;IAC1E,8EAA8E;IAC9E,mEAAmE;IACnE,KAAK,CAAC,gCAAgC,CACpC,SAAuB,EACvB,OAAoB;QAEpB,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACzC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACzC,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QAC5E,MAAM,cAAc,GAAG,GAAG,kBAAkB,GAAG,KAAK,EAAE,CAAC;QAEvD,wEAAwE;QACxE,0EAA0E;QAC1E,uEAAuE;QACvE,qEAAqE;QACrE,yEAAyE;QACzE,yEAAyE;QACzE,0EAA0E;QAC1E,4DAA4D;QAC5D,EAAE;QACF,yEAAyE;QACzE,yEAAyE;QACzE,yEAAyE;QACzE,2EAA2E;QAC3E,sEAAsE;QACtE,6EAA6E;QAC7E,IAAI,QAAQ,GAA0C,IAAI,CAAC;QAC3D,MAAM,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;YACjC,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;YAC7D,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,QAAQ,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;gBACtC,oEAAoE;gBACpE,sEAAsE;gBACtE,0CAA0C;gBAC1C,MAAM,0BAA0B,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;gBAC5E,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,cAAc,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;YAClE,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC,CAAC,CAAC;QAEH,MAAM,GAAG,GAAG,QAAQ,IAAI,CAAC,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC,CAAC;QAC5E,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC3D,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC;IACjC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;OAsBG;IACH,KAAK,CAAC,iBAAiB,CAAC,MAGvB;QACC,wEAAwE;QACxE,uEAAuE;QACvE,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa;YACnC,CAAC,CAAC,UAAU,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAC1F,CAAC,CAAC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE3C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;YAC9C,OAAO,EAAE,KAAK;YACd,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE;YAClC,MAAM,EAAE,qBAAqB;YAC7B,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,UAAU,CAAC,EAAE;SAC3D,CAAC,CAAC;QAEH,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,CAAC,MAA6C,CAAC;QACtE,IAAI,OAAO,MAAM,EAAE,IAAI,KAAK,QAAQ,IAAI,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC9E,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC;YACH,OAAO;gBACL,IAAI,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;gBAC7B,SAAS,EAAE,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC;aACxC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,yDAAyD,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IAyCD,OAAO,CAAI,OAA6B;QACtC,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,OAAO,EAAE,CAAC;IACnB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,OAAO,CAAC,UAAiC,EAAE;QAC/C,MAAM,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEnC,IAAI,CAAC,SAAS,GAAG,IAAI,iBAAiB,EAAE,CAAC;QACzC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QAEnB,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnC,0EAA0E;YAC1E,kEAAkE;YAClE,yEAAyE;YACzE,0EAA0E;YAC1E,6DAA6D;YAC7D,IAAI,MAAuB,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YAC3D,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,SAAS,CAAC;YACrB,CAAC;YACD,IACE,MAAM,KAAK,SAAS;gBACpB,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC;gBAC7D,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,CAAC,MAAM,EACxC,CAAC;gBACD,IAAI,CAAC;oBACH,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;gBAChD,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;gBACrC,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,qEAAqE;IACrE,4EAA4E;IAC5E,uEAAuE;IACvE,0BAA0B;IAC1B,KAAK,CAAC,aAAa,CAAC,KAAgC;QAClD,MAAM,KAAK,GAAG,KAAK,EAAE,CAAC;QACtB,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACjC,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,yBAAyB,CAAC;QACjE,IAAI,CAAC,OAAO,CAAC,yBAAyB,GAAG,KAAK,CAAC;QAC/C,IAAI,CAAC;YACH,OAAO,MAAM,KAAK,CAAC;QACrB,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,CAAC,yBAAyB,GAAG,iBAAiB,CAAC;QAC7D,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,KAAK;QACH,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;QACtC,CAAC;QACD,OAAO,IAAI,CAAC,YAAY,CAAC;IAC3B,CAAC;IAED,uEAAuE;IACvE,sEAAsE;IACtE,iDAAiD;IACjD,KAAK,CAAC,QAAQ;QACZ,MAAM,GAAG,GACP,IAAI,CAAC,QAAQ,CAAC,QAAQ;YACtB,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,IAAI,eAAe,CAAC,CAAC,CAAC;QAC9E,IAAI,CAAC,GAAG;YAAE,OAAO;QAEjB,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,KAAK;YAAE,OAAO;QAEnB,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,IAAI,OAAO,IAAI,GAAG,EAAE,CAAC;YACnB,IAAI,CAAC,SAAS,GAAG,yBAAyB,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACxE,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,SAAS,GAAG,kBAAkB,CAAC,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,WAAW,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACjE,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACjE,IAAI,CAAC,4BAA4B,EAAE,CAAC;QACtC,CAAC;IACH,CAAC;IAED,4BAA4B;QAC1B,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC;QAC/C,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,WAAW,EAAE,0BAA0B,EAAE,CAAC;YACrE,yEAAyE;YACzE,yEAAyE;YACzE,kEAAkE;YAClE,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,GAAG,EAAE;gBACtC,KAAK,IAAI,CAAC,OAAO,EAAE;qBAChB,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;qBAC7B,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACrB,CAAC,CAAC,CAAC;QACL,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,SAAS,QAAQ,CAAC,KAAiB;IACjC,IAAI,UAAU,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;QAChE,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC;IACD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,YAAY,IAAI,UAAU,IAAI,OAAO,UAAU,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAC9E,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACpC,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,WAAW,CAAC,OAAoB;IAC7C,IAAI,OAAO,KAAK,iBAAiB,EAAE,CAAC;QAClC,OAAO,kBAAkB,CAAC,QAAQ,EAAE,CAAC;IACvC,CAAC;IACD,OAAO,MAAM,gBAAgB,CAAC,QAAQ,EAAE,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,UAAU,CACvB,OAA0B,EAC1B,GAAmC;IAEnC,MAAM,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,UAAU,CACvB,OAA0B,EAC1B,OAAoB;IAEpB,IAAI,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,CAAC;QACH,wDAAwD;QACxD,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,MAAM,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,mEAAmE;QACnE,iEAAiE;QACjE,2CAA2C;QAC3C,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,8EAA8E;AAC9E,8EAA8E;AAC9E,wEAAwE;AACxE,KAAK,UAAU,mBAAmB,CAAC,OAA0B;IAC3D,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;IACzD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAA4B,EAAE;YACvD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YAC9D,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,KAAwB,CAAC;YACrD,OAAO,CACL,OAAO,IAAI,KAAK,QAAQ;gBACxB,IAAI,CAAC,UAAU,CAAC,kBAAkB,CAAC;gBACnC,OAAO,SAAS,KAAK,QAAQ;gBAC7B,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAC3B,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,OAA0B,EAC1B,OAA0B;IAE1B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,OAAO,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC;QAChD,OAAO;IACT,CAAC;IACD,MAAM,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;AACxE,CAAC;AAED,gFAAgF;AAChF,KAAK,UAAU,0BAA0B,CACvC,OAA0B,EAC1B,IAAY,EACZ,GAAW;IAEX,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,IAAI,GAAsB,EAAE,CAAC;IACnC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI;YAAE,SAAS,CAAC,0CAA0C;QAC7E,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;YAC3B,MAAM,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,GAAG,kBAAkB,EAAE,CAAC,CAAC;IACzD,MAAM,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,sEAAsE;AACtE,KAAK,UAAU,oBAAoB,CAAC,OAA0B,EAAE,IAAY;IAC1E,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IACjE,IAAI,SAAS,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,oBAAoB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,YAAY,CACzB,OAA0B,EAC1B,UAAkB;IAElB,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,CAAC;QACH,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,MAAM,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,GAAmC;IACvD,IAAI,GAAG,YAAY,gBAAgB;QAAE,OAAO,GAAG,CAAC,UAAU,EAAE,CAAC;IAC7D,IAAI,GAAG,YAAY,kBAAkB;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3E,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,YAAY,CAAC,OAA0B,EAAE,KAAsB;IAC5E,MAAM,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAE1E,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,KAAK,MAAM,EAAE,UAAU,EAAE,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;QAC/C,IAAI,QAAQ,KAAK,IAAI,IAAI,UAAU,CAAC,UAAU,GAAG,QAAQ,EAAE,CAAC;YAC1D,QAAQ,GAAG,UAAU,CAAC,UAAU,CAAC;QACnC,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,YAAY,CAAC,OAAO,CAAC,sBAAsB,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAC,OAA0B;IACpD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QACtD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAEjD,MAAM,KAAK,GAAG,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC5C,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC9B,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;YAC7B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACjB,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,aAAa,CAAC,OAA0B;IACrD,MAAM,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACtC,MAAM,OAAO,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;IAC7C,MAAM,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACjC,YAAY,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC;AAClD,CAAC;AAED,8EAA8E;AAC9E,SAAS,iBAAiB;IACxB,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC3D,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,uBAAuB,CACpC,OAA0B,EAC1B,OAAoB;IAEpB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,YAAY,EAAE,CAAC;QACpC,MAAM,UAAU,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;QAErD,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,IAAI,OAAO,KAAK,eAAe;YAAE,OAAO,IAAI,CAAC;QAEzE,OAAO,CAAC,GAAG,CAAC,uEAAuE,CAAC,CAAC;QACrF,MAAM,OAAO,CAAC,GAAG,CAAC,sBAAsB,EAAE,UAAU,CAAC,CAAC;QACtD,MAAM,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,QAAQ,CAAC,CAAC;QAC7C,MAAM,QAAQ,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAC9C,MAAM,QAAQ,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAEvC,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,mDAAmD,KAAK,EAAE,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CAGxB,MAGD;IACC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,yBAAyB,CAAC;IACtD,OAAO,IAAI,CAAC,GAAG,CACb,CAAC,GAAG,EAAE,EAAE,CAAC,UAAU,QAAQ,IAAI,GAAG,EAAuD,CAC1F,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@icp-sdk/auth",
-  "version": "8.0.0",
+  "version": "8.0.2",
   "author": "DFINITY Stiftung <sdk@dfinity.org>",
   "license": "Apache-2.0",
   "description": "Authentication library for Internet Computer web apps",
@@ -42,11 +42,11 @@
     "internet identity"
   ],
   "devDependencies": {
-    "@biomejs/biome": "^2.4.10",
-    "@icp-sdk/core": "^5.2.1",
+    "@biomejs/biome": "^2.5.6",
+    "@icp-sdk/core": "^5.4.0",
     "fake-indexeddb": "^6.2.5",
     "jsdom": "^27.4.0",
-    "publint": "^0.3.18",
+    "publint": "^0.3.22",
     "typescript": "^5.9.3",
     "vitest": "4.0.14"
   },
@@ -54,7 +54,7 @@
     "@icp-sdk/core": "^5"
   },
   "dependencies": {
-    "@icp-sdk/signer": "^5.5.0",
+    "@icp-sdk/signer": "^5.6.1",
     "idb": "^7.1.1"
   },
   "scripts": {

package/src/client/auth-client.ts

@@ -42,6 +42,19 @@ const KEY_STORAGE_EXPIRATION = 'ic-delegation_expiration';
 // is persisted. See AuthClient.#acquireSessionKey.
 const PENDING_KEY_PREFIX = 'ic-auth-pending-key:';
 
+// The storage backend has no key enumeration, so pending-key slots are tracked
+// explicitly here: an abandoned flow never removes its key, so a later flow
+// prunes expired orphans by slot instead of leaking them forever.
+const PENDING_KEYS_REGISTRY_KEY = 'ic-auth-pending-keys';
+// Past the URL transport's ~10-min flow window the flow can't resume, so a
+// pending key older than this is treated as abandoned.
+const PENDING_KEY_TTL_MS = 10 * 60 * 1000;
+
+interface PendingKeyEntry {
+  slot: string;
+  expiresAt: number;
+}
+
 export type OpenIdProvider = 'google' | 'apple' | 'microsoft';
 
 export const OPENID_PROVIDER_URLS = {
@@ -216,7 +229,14 @@ export class AuthClient {
 
     this.#signer = new Signer({
       transport,
-      derivationOrigin: options.derivationOrigin?.toString(),
+      // Journal the derivation origin so it survives the top-level redirect: the
+      // return load reconstructs this client from a query-less callback URL, so
+      // `options.derivationOrigin` (like the identity provider) is no longer
+      // available — the memoized value replays from the journal instead.
+      // `memoize` returns synchronously for a synchronous producer, so the value
+      // is usable directly here; in the window flow it is a passthrough that runs
+      // the producer without persisting anything.
+      derivationOrigin: this.memoize(() => options.derivationOrigin?.toString()),
     });
 
     this.#registerDefaultIdleCallback();
@@ -262,14 +282,33 @@ export class AuthClient {
    * }
    */
   async signIn(options?: AuthClientSignInOptions): Promise<Identity> {
-    await this.#signer.openChannel();
-
     const maxTimeToLive = options?.maxTimeToLive ?? DEFAULT_MAX_TIME_TO_LIVE;
     const keyType = this.#options.keyType ?? ECDSA_KEY_LABEL;
 
-    const { key, pendingKeySlot } = this.#urlTransport
-      ? await this.#ensureSessionKeyForRedirectFlow(this.#urlTransport, keyType)
-      : { key: await this.#ensureSessionKeyForWindowFlow(keyType) };
+    // Start session-key acquisition BEFORE opening the channel, awaiting it only
+    // after. In the redirect flow the acquisition's first `transport.memoize`
+    // runs synchronously when invoked, so its in-flight bump lands in the same
+    // tick `signIn` is called — holding the transport's batch flush from the
+    // very start of the flow rather than only after the `openChannel` await.
+    // Under `Promise.all([signIn, requestAttributes])` this is what keeps a
+    // faster concurrent request from flushing before this flow's delegation
+    // request is buffered.
+    const sessionKeyPromise: Promise<{
+      key: SignIdentity | PartialIdentity;
+      pendingKeySlot?: string;
+    }> = this.#urlTransport
+      ? this.#ensureSessionKeyForRedirectFlow(this.#urlTransport, keyType)
+      : this.#ensureSessionKeyForWindowFlow(keyType).then((key) => ({ key }));
+    // The acquisition is started eagerly, before the awaits below. If one of
+    // those throws first, `sessionKeyPromise` is never awaited, so attach a
+    // no-op rejection handler now to keep a later acquisition failure from
+    // surfacing as an unhandled rejection. The `await` below still observes a
+    // rejection and propagates it when reached.
+    void sessionKeyPromise.catch(() => undefined);
+
+    await this.#signer.openChannel();
+
+    const { key, pendingKeySlot } = await sessionKeyPromise;
 
     const delegationChain = await this.#signer.requestDelegation({
       publicKey: key.getPublicKey(),
@@ -297,9 +336,16 @@ export class AuthClient {
     await persistKey(this.#storage, key);
 
     // The flow is complete: the delegation is bound to this key and stored, so
-    // the per-flow pending copy is no longer needed.
+    // the per-flow pending copy is no longer needed. Best-effort — the user is
+    // already signed in, so a cleanup failure must not fail signIn(); a later
+    // flow sweeps whatever is left behind.
     if (pendingKeySlot !== undefined) {
-      await this.#storage.remove(pendingKeySlot);
+      try {
+        await this.#storage.remove(pendingKeySlot);
+        await unregisterPendingKey(this.#storage, pendingKeySlot);
+      } catch {
+        // ignore
+      }
     }
 
     return this.#identity;
@@ -333,13 +379,39 @@ export class AuthClient {
     const keyId = await transport.memoize(() => globalThis.crypto.randomUUID());
     const pendingKeySlot = `${PENDING_KEY_PREFIX}${keyId}`;
 
-    const restored = await restoreKeyAt(this.#storage, pendingKeySlot);
-    if (restored) {
-      return { key: restored, pendingKeySlot };
-    }
+    // Acquire the per-flow key inside a `memoize` producer so the transport
+    // holds its batch flush across the (async) key restore/generate + storage
+    // write. The transport coalesces concurrently issued requests into one
+    // redirect by flushing on a macrotask once no memoize producer is in
+    // flight; without this hold, a faster concurrent request (e.g. the nonce
+    // path of `requestAttributes`) buffers first and trips that flush before
+    // this flow's delegation request — issued only once the key is ready — is
+    // buffered, splitting what should be one redirect into two.
+    //
+    // The key is captured in a closure, not read back after the producer: on
+    // the FIRST load the producer sets `acquired`, so the delegation request
+    // that follows is issued with no intervening storage read — a read there
+    // would re-open the very flush gap this closes. The producer is skipped on
+    // the replay load (its result is journaled), where the key is instead
+    // restored from storage. Only the id is journaled; the key lives in storage.
+    let acquired: SignIdentity | PartialIdentity | null = null;
+    await transport.memoize(async () => {
+      acquired = await restoreKeyAt(this.#storage, pendingKeySlot);
+      if (acquired === null) {
+        acquired = await generateKey(keyType);
+        // Register before writing the key: if the write then fails, a stray
+        // registry entry is harmless (swept on expiry), whereas a key with no
+        // registry entry would leak un-sweepably.
+        await sweepAndRegisterPendingKey(this.#storage, pendingKeySlot, Date.now());
+        await this.#storage.set(pendingKeySlot, serializeKey(acquired));
+      }
+      return keyId;
+    });
 
-    const key = await generateKey(keyType);
-    await this.#storage.set(pendingKeySlot, serializeKey(key));
+    const key = acquired ?? (await restoreKeyAt(this.#storage, pendingKeySlot));
+    if (key === null) {
+      throw new Error('Session key missing after acquisition');
+    }
     return { key, pendingKeySlot };
   }
 
@@ -430,10 +502,18 @@ export class AuthClient {
    *
    * In `'window'` mode there is no redirect, so this simply runs `produce` and
    * returns its result without persisting anything.
+   *
+   * Mirrors the producer's shape: a synchronous `produce` returns its value
+   * directly, an asynchronous one returns a promise. Awaiting the result is
+   * always safe (`await` on a non-promise is a no-op); the synchronous form lets
+   * a value be memoized where an `await` is not possible, such as in a
+   * constructor.
    * @param produce - Produces the value to journal on the first load.
    * @returns The produced value, or the journaled value on a replay load.
    */
-  async memoize<T>(produce: () => T | Promise<T>): Promise<T> {
+  memoize<T>(produce: () => Promise<T>): Promise<T>;
+  memoize<T>(produce: () => T): T;
+  memoize<T>(produce: () => T | Promise<T>): T | Promise<T> {
     if (this.#urlTransport) {
       return this.#urlTransport.memoize(produce);
     }
@@ -452,11 +532,28 @@ export class AuthClient {
     this.#identity = new AnonymousIdentity();
     this.#chain = null;
 
-    if (options.returnTo) {
+    if (options.returnTo !== undefined) {
+      // Navigate exactly as before (pushState, else location.href), but only to
+      // a validated same-origin http(s) target, and feed that validated
+      // `target.href` to both sinks rather than the raw `returnTo`. An invalid
+      // or cross-origin `returnTo` is ignored, so the fallback can no longer be
+      // turned into an open redirect or a `javascript:` execution.
+      let target: URL | undefined;
       try {
-        window.history.pushState({}, '', options.returnTo);
+        target = new URL(options.returnTo, window.location.href);
       } catch {
-        window.location.href = options.returnTo;
+        target = undefined;
+      }
+      if (
+        target !== undefined &&
+        (target.protocol === 'https:' || target.protocol === 'http:') &&
+        target.origin === window.location.origin
+      ) {
+        try {
+          window.history.pushState({}, '', target.href);
+        } catch {
+          window.location.href = target.href;
+        }
       }
     }
   }
@@ -515,9 +612,13 @@ export class AuthClient {
   #registerDefaultIdleCallback() {
     const idleOptions = this.#options?.idleOptions;
     if (!idleOptions?.onIdle && !idleOptions?.disableDefaultIdleCallback) {
+      // Invoked without being awaited, so handle the promise here. Reload only
+      // after teardown resolves, and only if it succeeded — a reload before or
+      // without teardown lets #hydrate restore the still-valid session.
       this.idleManager?.registerCallback(() => {
-        this.signOut();
-        location.reload();
+        void this.signOut()
+          .then(() => location.reload())
+          .catch(() => {});
       });
     }
   }
@@ -607,6 +708,71 @@ async function restoreKey(
   }
 }
 
+// Reads the pending-key registry, dropping malformed entries. The value comes
+// from storage, so guard against corruption: keep only real pending-key slots
+// with a finite expiry (a NaN expiry compares false forever and never sweeps;
+// a foreign slot would make the sweep remove an unrelated storage key).
+async function readPendingRegistry(storage: AuthClientStorage): Promise<PendingKeyEntry[]> {
+  const raw = await storage.get(PENDING_KEYS_REGISTRY_KEY);
+  if (typeof raw !== 'string') return [];
+  try {
+    const parsed: unknown = JSON.parse(raw);
+    if (!Array.isArray(parsed)) return [];
+    return parsed.filter((entry): entry is PendingKeyEntry => {
+      if (typeof entry !== 'object' || entry === null) return false;
+      const { slot, expiresAt } = entry as PendingKeyEntry;
+      return (
+        typeof slot === 'string' &&
+        slot.startsWith(PENDING_KEY_PREFIX) &&
+        typeof expiresAt === 'number' &&
+        Number.isFinite(expiresAt)
+      );
+    });
+  } catch {
+    return [];
+  }
+}
+
+async function writePendingRegistry(
+  storage: AuthClientStorage,
+  entries: PendingKeyEntry[],
+): Promise<void> {
+  if (entries.length === 0) {
+    await storage.remove(PENDING_KEYS_REGISTRY_KEY);
+    return;
+  }
+  await storage.set(PENDING_KEYS_REGISTRY_KEY, JSON.stringify(entries));
+}
+
+// Removes expired pending-key slots, then registers `slot` with a fresh expiry.
+async function sweepAndRegisterPendingKey(
+  storage: AuthClientStorage,
+  slot: string,
+  now: number,
+): Promise<void> {
+  const entries = await readPendingRegistry(storage);
+  const live: PendingKeyEntry[] = [];
+  for (const entry of entries) {
+    if (entry.slot === slot) continue; // re-registered with a fresh expiry below
+    if (entry.expiresAt <= now) {
+      await storage.remove(entry.slot);
+    } else {
+      live.push(entry);
+    }
+  }
+  live.push({ slot, expiresAt: now + PENDING_KEY_TTL_MS });
+  await writePendingRegistry(storage, live);
+}
+
+// Drops a slot from the pending-key registry once its flow completes.
+async function unregisterPendingKey(storage: AuthClientStorage, slot: string): Promise<void> {
+  const entries = await readPendingRegistry(storage);
+  const remaining = entries.filter((entry) => entry.slot !== slot);
+  if (remaining.length !== entries.length) {
+    await writePendingRegistry(storage, remaining);
+  }
+}
+
 /**
  * Loads a session key from a specific storage slot, deserializing by stored
  * shape (`CryptoKeyPair` → ECDSA, JSON string → Ed25519). Unlike