@icp-sdk/auth 8.0.2 → 9.0.0

package/dist/esm/client/session-delegation.js

@@ -0,0 +1,100 @@
+import { Delegation, DelegationChain } from '@icp-sdk/core/identity';
+import { Principal } from '@icp-sdk/core/principal';
+import { fromBase64, toBase64 } from './base64.js';
+/**
+ * The method Internet Identity answers with a session rather than a long-lived
+ * delegation. Named for its provider because a JSON-RPC method travels over a
+ * transport shared with other signers, unlike a canister method.
+ */
+const SESSION_DELEGATION_METHOD = 'ii_session_delegation';
+/**
+ * The code Internet Identity denies a `prompt: 'none'` request with.
+ *
+ * In ICRC-25's 3xxx user-action range, which is what lets a caller tell a request
+ * that needs a ceremony apart from a transport or protocol failure.
+ */
+const INTERACTION_REQUIRED_CODE = 3002;
+/**
+ * Internet Identity had nothing to answer a silent request from.
+ *
+ * The one denial that is not a failure: it says a ceremony is needed, so the
+ * caller signs in interactively rather than retrying. It is also the only
+ * dependable evidence that a shared record is stale rather than replaced, which
+ * is what lets an origin retract a record it did not write.
+ *
+ * Thrown only for a request that asked not to render anything. An interactive
+ * sign-in that the user abandons is a different outcome and is not this.
+ */
+export class InteractionRequiredError extends Error {
+    /**
+     * Why, where Internet Identity said: `login_required` where it holds no
+     * session, `account_selection_required` where it holds more than one and the
+     * request named none.
+     *
+     * A caller may word its prompt from this and does not have to branch on it, so
+     * it is deliberately a string rather than a union — a value this library does
+     * not know is not a reason to fail.
+     */
+    reason;
+    constructor(message, reason) {
+        super(message);
+        this.name = 'InteractionRequiredError';
+        this.reason = reason;
+    }
+}
+const looksLikeResult = (value) => {
+    const result = value;
+    return (typeof result?.publicKey === 'string' &&
+        Array.isArray(result?.signerDelegation) &&
+        // An empty list builds a chain whose earliest expiry is 0, so it reads as a
+        // session that expired at the epoch rather than as a bad response.
+        result.signerDelegation.length > 0);
+};
+/**
+ * Asks the identity provider for a session, and returns the chain it signed.
+ *
+ * The chain is restricted to the Internet Identity canister, so it is not
+ * something an application can call its own canisters with. It is what app
+ * delegations are minted from.
+ */
+export async function requestSessionDelegation(signer, params) {
+    const response = await signer.sendRequest({
+        jsonrpc: '2.0',
+        id: globalThis.crypto.randomUUID(),
+        method: SESSION_DELEGATION_METHOD,
+        params: {
+            sessionPublicKey: toBase64(params.sessionPublicKey),
+            ...(params.maxTimeToLive === undefined
+                ? {}
+                : { maxTimeToLive: params.maxTimeToLive.toString() }),
+            ...(params.maxTimeToIdle === undefined
+                ? {}
+                : { maxTimeToIdle: params.maxTimeToIdle.toString() }),
+            ...(params.derivationOrigin === undefined
+                ? {}
+                : { icrc95DerivationOrigin: params.derivationOrigin }),
+        },
+    });
+    if ('error' in response) {
+        // The code carries the only thing a caller can act on, and dropping it left
+        // `interaction_required` indistinguishable from a transport failure except by
+        // matching a message this library does not define.
+        if (response.error.code === INTERACTION_REQUIRED_CODE) {
+            const data = response.error.data;
+            const reason = typeof data === 'object' && data !== null && 'reason' in data
+                ? String(data.reason)
+                : undefined;
+            throw new InteractionRequiredError(response.error.message, reason);
+        }
+        throw new Error(response.error.message);
+    }
+    const result = response.result;
+    if (!looksLikeResult(result)) {
+        throw new Error('Invalid session response: missing publicKey, or missing or empty signerDelegation');
+    }
+    return DelegationChain.fromDelegations(result.signerDelegation.map(({ delegation, signature }) => ({
+        delegation: new Delegation(fromBase64(delegation.pubkey), BigInt(delegation.expiration), delegation.targets?.map((target) => Principal.fromText(target))),
+        signature: fromBase64(signature),
+    })), fromBase64(result.publicKey));
+}
+//# sourceMappingURL=session-delegation.js.map

package/dist/esm/client/session-delegation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-delegation.js","sourceRoot":"","sources":["../../../src/client/session-delegation.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEnD;;;;GAIG;AACH,MAAM,yBAAyB,GAAG,uBAAuB,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAEvC;;;;;;;;;;GAUG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD;;;;;;;;OAQG;IACM,MAAM,CAAqB;IAEpC,YAAY,OAAe,EAAE,MAAe;QAC1C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAUD,MAAM,eAAe,GAAG,CAAC,KAAc,EAAoC,EAAE;IAC3E,MAAM,MAAM,GAAG,KAA4C,CAAC;IAC5D,OAAO,CACL,OAAO,MAAM,EAAE,SAAS,KAAK,QAAQ;QACrC,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC;QACvC,4EAA4E;QAC5E,mEAAmE;QACnE,MAAM,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CACnC,CAAC;AACJ,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,MAAc,EACd,MAKC;IAED,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC;QACxC,OAAO,EAAE,KAAK;QACd,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,UAAU,EAAE;QAClC,MAAM,EAAE,yBAAyB;QACjC,MAAM,EAAE;YACN,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,gBAAgB,CAAC;YACnD,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,EAAE,CAAC;YACvD,GAAG,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS;gBACpC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,aAAa,CAAC,QAAQ,EAAE,EAAE,CAAC;YACvD,GAAG,CAAC,MAAM,CAAC,gBAAgB,KAAK,SAAS;gBACvC,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,EAAE,sBAAsB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC;SACzD;KACF,CAAC,CAAC;IAEH,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;QACxB,4EAA4E;QAC5E,8EAA8E;QAC9E,mDAAmD;QACnD,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;YACtD,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;YACjC,MAAM,MAAM,GACV,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,QAAQ,IAAI,IAAI;gBAC3D,CAAC,CAAC,MAAM,CAAE,IAA4B,CAAC,MAAM,CAAC;gBAC9C,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,IAAI,wBAAwB,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;IAC/B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CACb,mFAAmF,CACpF,CAAC;IACJ,CAAC;IAED,OAAO,eAAe,CAAC,eAAe,CACpC,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1D,UAAU,EAAE,IAAI,UAAU,CACxB,UAAU,CAAC,UAAU,CAAC,MAAM,CAAC,EAC7B,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,EAC7B,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAChE;QACD,SAAS,EAAE,UAAU,CAAC,SAAS,CAAwD;KACxF,CAAC,CAAC,EACH,UAAU,CAAC,MAAM,CAAC,SAAS,CAAwB,CACpD,CAAC;AACJ,CAAC"}

package/dist/esm/client/session-identity.d.ts

@@ -0,0 +1,97 @@
+import type { DerEncodedPublicKey, HttpAgentRequest } from '@icp-sdk/core/agent';
+import { DelegationChain, DelegationIdentity } from '@icp-sdk/core/identity';
+import { Principal } from '@icp-sdk/core/principal';
+import { type AppDelegationSource } from './app-delegation-source.js';
+import type { CredentialStorage } from './credential-storage.js';
+export interface SessionIdentityOptions {
+    /** The account's key, which every app delegation is rooted at. */
+    accountKey: DerEncodedPublicKey;
+    /** When the session itself ends. Nothing is minted past this. */
+    sessionExpiresAtMs: number;
+    source: AppDelegationSource;
+    /**
+     * Where the app credential is kept, and what makes the key a mint gets a
+     * delegation for.
+     *
+     * The store is what every tab of the origin reads, so a delegation minted in
+     * one is the delegation the others use.
+     */
+    storage: CredentialStorage;
+    /**
+     * The slot the app credential lives under, and the name of the lock that
+     * serialises minting into it.
+     *
+     * Taken rather than assumed, because the client assigns every name from one
+     * namespace: reaching for the bare constant here would read and write a slot
+     * the client never promotes into, so a namespaced client would mint again on
+     * every load and its sign-out would clear a slot nothing was using.
+     */
+    slot: string;
+    /**
+     * Called once when the session turns out to be gone, so the client can drop
+     * what it holds and tell its subscribers. Ending a session is the client's to
+     * do; this only reports it.
+     */
+    onSessionGone: () => void;
+}
+/**
+ * An identity whose credential is short-lived and replaced under the caller.
+ *
+ * It extends {@link DelegationIdentity} so anything already accepting one accepts
+ * this, and what it presents is an ordinary app delegation. What differs is that
+ * the key and delegation it signs with are replaced as they age, which is why an
+ * agent can hold this object for hours: an agent keeps whatever identity it was
+ * given, so a snapshot of one credential would sign with it until it expired.
+ *
+ * A rotation is invisible to the holder. The principal comes from the account's
+ * key rather than from whatever is current, and a request is signed and its
+ * delegation attached in the same act, so what is already in flight carries a
+ * matching pair however soon the next one arrives.
+ */
+export declare class SessionIdentity extends DelegationIdentity {
+    #private;
+    /**
+     * Builds an identity for a session, resolving the account key it needs.
+     *
+     * The account key cannot be worked out from the session — the session chain is
+     * rooted at the session's own key, and the state carries the account's
+     * principal, which is a hash of the account key rather than the key. So the
+     * only two places one can come from are a credential the store already holds
+     * and a mint, and a caller with neither has to wait for the mint before an
+     * identity exists at all.
+     *
+     * That resolution goes through the same locked read-or-mint every rotation
+     * uses, which is what keeps the app slot to one writer: doing it here, outside
+     * the lock, is how a page load could overwrite a credential a peer tab had just
+     * minted, and it would skip the read that lets this tab adopt that credential
+     * instead of paying for its own.
+     *
+     * The identity comes back already holding what was resolved, so a caller does
+     * not have to refresh it before use.
+     * @param options - As the constructor takes them, less the account key.
+     */
+    static create(options: Omit<SessionIdentityOptions, 'accountKey'> & {
+        expectedAccount?: Principal;
+    }): Promise<SessionIdentity>;
+    constructor(options: SessionIdentityOptions);
+    getDelegation(): DelegationChain;
+    transformRequest(request: HttpAgentRequest): Promise<unknown>;
+    /**
+     * Says somebody is here, and mints now if one is due.
+     *
+     * For a caller that knows the moment is a good one, such as a page load, a tab
+     * coming back to the foreground, or a pointer moving. The caller says when;
+     * this still decides whether, so a credential with plenty of life left costs
+     * no call.
+     *
+     * It is never a no-op, though: being here counts as use, exactly as signing a
+     * request does, so the credential held afterwards has earned the next
+     * rotation. Without that a session bounded by how long it goes unminted would
+     * end under a user who is reading rather than clicking — the delegation would
+     * only ever be replaced in the last {@link PRE_MINT_THRESHOLD_MS} of its life,
+     * and only if a pointer happened to move inside that window.
+     */
+    refresh(): Promise<void>;
+    /** Drops the scheduled refresh. */
+    dispose(): void;
+}

package/dist/esm/client/session-identity.js

@@ -0,0 +1,392 @@
+import { DelegationChain, DelegationIdentity } from '@icp-sdk/core/identity';
+import { Principal } from '@icp-sdk/core/principal';
+import { AccountMismatchError, chainAuthorisesKey, SessionGoneError, SessionUnsupportedError, } from './app-delegation-source.js';
+import { withMintLock } from './app-lock.js';
+/**
+ * How much life a delegation needs left to be handed to a caller. Covers a
+ * request's flight time, because the delegation has to still be valid when the
+ * replica verifies the request it was attached to.
+ */
+const BLOCK_MARGIN_MS = 10_000;
+/**
+ * When a replacement is minted. Covers one mint and nothing more: minting early
+ * discards the rest of a delegation's life, so an active session consumes
+ * lifetime at `ttl / (ttl - threshold)` and every second here costs update calls
+ * on every active session. A refresh is scheduled for this moment rather than
+ * waiting for a request to arrive inside the window, which is what keeps it small.
+ */
+const PRE_MINT_THRESHOLD_MS = 15_000;
+const expiresAtMs = (chain) => Number(chain.delegations.reduce((soonest, { delegation }) => delegation.expiration < soonest ? delegation.expiration : soonest, chain.delegations[0]?.delegation.expiration ?? 0n) / 1000000n);
+const msLeftOf = (chain) => expiresAtMs(chain) - Date.now();
+/** The account a chain is rooted at. */
+const accountOf = (chain) => Principal.selfAuthenticating(new Uint8Array(chain.publicKey));
+/**
+ * Whether a credential may be used for `expected`.
+ *
+ * Two checks at opposite ends of the chain. The leaf must be the key stored
+ * beside it, which is true of any whole record whoever it belongs to. And the
+ * root must be the account the caller names — a credential left by another
+ * account would otherwise decide who this identity is, and requests would go
+ * out as that account and succeed until its delegation expired.
+ *
+ * `expected` is absent only where the caller has no account to name, which is
+ * why a read that cannot check it does not adopt.
+ */
+const isForAccount = (held, expected) => {
+    if (!chainAuthorisesKey(held.chain, held.identity.getPublicKey().toDer()))
+        return false;
+    return expected === undefined || accountOf(held.chain).compareTo(expected) === 'eq';
+};
+/**
+ * Reads what the slot holds, or `undefined` where it holds nothing usable.
+ *
+ * @param evictSpent - Whether a spent record may be removed, which only a caller
+ *   holding the mint lock may do. The store reaches every tab of the origin, so a
+ *   lock-free read that removed what it declined could delete a credential
+ *   another tab minted between the read and the removal.
+ * @param verify - Rejects a credential not rooted at the account already
+ *   established. Absent on the first read of all, where there is no account to
+ *   compare against and the first mint is what establishes one.
+ */
+async function readSlot({ storage, slot, evictSpent, verify, }) {
+    const stored = await storage.get(slot).catch(() => null);
+    if (!stored?.chain)
+        return undefined;
+    // A spent credential goes rather than merely being declined. The state is the
+    // only thing meant to outlive a delegation, and it records who is signed in on
+    // its own, so nothing here is worth keeping once it can no longer sign. This is
+    // what bounds a stored credential at one delegation lifetime with nothing
+    // having to fire — there is no dependable signal for a browser closing.
+    //
+    // Both halves together, because they are one record: the key is the thing that
+    // signs, and a chain without it authorises nothing.
+    if (msLeftOf(stored.chain) <= 0) {
+        if (evictSpent) {
+            // Best effort. A credential that cannot be removed is still one this tab
+            // refuses, so a failure costs tidiness and not correctness.
+            await storage.remove(slot).catch(() => undefined);
+        }
+        return undefined;
+    }
+    const credential = { identity: stored.identity, chain: stored.chain };
+    if (verify !== undefined && !verify(credential))
+        return undefined;
+    return credential;
+}
+/**
+ * The one place an app credential is minted and written.
+ *
+ * Reads the slot under the lock and mints only where what it finds cannot be
+ * used. The lock alone would merely serialise: five tabs waking together would
+ * queue politely and then make five calls one after another. The read inside it
+ * is what turns serialising into suppressing, and it is why the floor is one mint
+ * per origin rather than one per tab.
+ *
+ * Shared by the first acquisition and by every rotation, so both go through the
+ * same lock and the same read. Having a second reader-and-writer outside the lock
+ * is how a load could land on top of a peer's freshly minted credential.
+ */
+async function acquireCredential({ storage, slot, source, lockName, verify, adopt, onGone, }) {
+    return withMintLock(lockName, async (stolen) => {
+        const stored = await readSlot({ storage, slot, evictSpent: true, verify });
+        // Read either way, so a spent record is evicted; adopted only where the
+        // caller could say which account it expects.
+        if (adopt && stored && msLeftOf(stored.chain) > PRE_MINT_THRESHOLD_MS)
+            return stored;
+        const identity = await storage.create();
+        let chain;
+        try {
+            chain = await source.mint(identity.getPublicKey().toDer());
+        }
+        catch (error) {
+            if (error instanceof SessionGoneError)
+                onGone?.();
+            throw error;
+        }
+        const credential = { identity, chain };
+        if (verify !== undefined && !verify(credential)) {
+            throw new AccountMismatchError();
+        }
+        // Checked here, after the calls have returned and before anything is written:
+        // a sign-out elsewhere took the lock away while this was in flight, and it
+        // has already cleared the slot this would write to. Storing now would put a
+        // credential back for a session that has ended.
+        if (stolen.aborted) {
+            onGone?.();
+            throw new SessionGoneError('The session ended while this mint was in flight');
+        }
+        // A credential that cannot be written is still one this tab can use. The cost
+        // of a failed write is that other tabs mint for themselves, which is what
+        // they do without a lock at all — it is not a reason to fail the request that
+        // is waiting on this.
+        await storage.set(slot, credential).catch(() => undefined);
+        return credential;
+    });
+}
+/** Whether a session has enough left that minting against it returns something usable. */
+const sessionHasLifeLeft = (sessionExpiresAtMs) => sessionExpiresAtMs - Date.now() > BLOCK_MARGIN_MS;
+/** The lock a mint is serialised on, or `null` where none is worth taking. */
+const lockNameFor = (storage, slot) => 
+// A store no other tab can read has nothing another tab could adopt, so
+// serialising would spread the mints without preventing any of them.
+storage.shared ? slot : null;
+/**
+ * An identity whose credential is short-lived and replaced under the caller.
+ *
+ * It extends {@link DelegationIdentity} so anything already accepting one accepts
+ * this, and what it presents is an ordinary app delegation. What differs is that
+ * the key and delegation it signs with are replaced as they age, which is why an
+ * agent can hold this object for hours: an agent keeps whatever identity it was
+ * given, so a snapshot of one credential would sign with it until it expired.
+ *
+ * A rotation is invisible to the holder. The principal comes from the account's
+ * key rather than from whatever is current, and a request is signed and its
+ * delegation attached in the same act, so what is already in flight carries a
+ * matching pair however soon the next one arrives.
+ */
+export class SessionIdentity extends DelegationIdentity {
+    #source;
+    #storage;
+    #slot;
+    #onSessionGone;
+    #sessionExpiresAtMs;
+    /** The account every credential must be rooted at, derived once. */
+    #account;
+    /** Reached by the base class's `sign`, so rotating does not change the object. */
+    #held;
+    #inFlight;
+    #currentWasUsed = false;
+    #scheduled;
+    #reportedGone = false;
+    #unsupported;
+    /**
+     * Builds an identity for a session, resolving the account key it needs.
+     *
+     * The account key cannot be worked out from the session — the session chain is
+     * rooted at the session's own key, and the state carries the account's
+     * principal, which is a hash of the account key rather than the key. So the
+     * only two places one can come from are a credential the store already holds
+     * and a mint, and a caller with neither has to wait for the mint before an
+     * identity exists at all.
+     *
+     * That resolution goes through the same locked read-or-mint every rotation
+     * uses, which is what keeps the app slot to one writer: doing it here, outside
+     * the lock, is how a page load could overwrite a credential a peer tab had just
+     * minted, and it would skip the read that lets this tab adopt that credential
+     * instead of paying for its own.
+     *
+     * The identity comes back already holding what was resolved, so a caller does
+     * not have to refresh it before use.
+     * @param options - As the constructor takes them, less the account key.
+     */
+    static async create(options) {
+        if (!sessionHasLifeLeft(options.sessionExpiresAtMs)) {
+            options.onSessionGone();
+            throw new SessionGoneError('The session has expired');
+        }
+        const credential = await acquireCredential({
+            storage: options.storage,
+            slot: options.slot,
+            source: options.source,
+            lockName: lockNameFor(options.storage, options.slot),
+            verify: (candidate) => isForAccount(candidate, options.expectedAccount),
+            // A caller that cannot name the account has nothing to check the slot
+            // against, so it mints rather than trusting what is there: a mint reports
+            // the account, and is the only thing that can establish one.
+            adopt: options.expectedAccount !== undefined,
+            onGone: options.onSessionGone,
+        });
+        const identity = new SessionIdentity({
+            ...options,
+            accountKey: credential.chain.publicKey,
+        });
+        identity.#adopt(credential);
+        return identity;
+    }
+    constructor(options) {
+        const held = {};
+        // The base signs through this, so what it holds can be replaced without the
+        // object an application is holding changing. The account's key is the root of
+        // every app delegation, so an empty chain rooted at it answers getPublicKey()
+        // and getPrincipal() before anything is minted.
+        super({
+            sign: (blob) => {
+                const key = held.current?.identity;
+                if (!key)
+                    throw new Error('This identity holds no delegation yet');
+                return key.sign(blob);
+            },
+        }, DelegationChain.fromDelegations([], options.accountKey));
+        this.#held = held;
+        this.#source = options.source;
+        this.#storage = options.storage;
+        this.#slot = options.slot;
+        this.#onSessionGone = options.onSessionGone;
+        this.#sessionExpiresAtMs = options.sessionExpiresAtMs;
+        this.#account = Principal.selfAuthenticating(new Uint8Array(options.accountKey));
+    }
+    getDelegation() {
+        return this.#held.current?.chain ?? super.getDelegation();
+    }
+    async transformRequest(request) {
+        const credential = await this.#usable();
+        this.#currentWasUsed = true;
+        return DelegationIdentity.fromDelegation(credential.identity, credential.chain).transformRequest(request);
+    }
+    /**
+     * Says somebody is here, and mints now if one is due.
+     *
+     * For a caller that knows the moment is a good one, such as a page load, a tab
+     * coming back to the foreground, or a pointer moving. The caller says when;
+     * this still decides whether, so a credential with plenty of life left costs
+     * no call.
+     *
+     * It is never a no-op, though: being here counts as use, exactly as signing a
+     * request does, so the credential held afterwards has earned the next
+     * rotation. Without that a session bounded by how long it goes unminted would
+     * end under a user who is reading rather than clicking — the delegation would
+     * only ever be replaced in the last {@link PRE_MINT_THRESHOLD_MS} of its life,
+     * and only if a pointer happened to move inside that window.
+     */
+    async refresh() {
+        await this.#refreshIfDue();
+        // After, not before: both branches below can replace what is held, and
+        // adopting resets this.
+        this.#currentWasUsed = true;
+    }
+    async #refreshIfDue() {
+        const current = this.#held.current;
+        if (current && this.#msLeft(current.chain) > PRE_MINT_THRESHOLD_MS)
+            return;
+        if (current === undefined) {
+            // Nothing held yet, so what another tab left is worth having before minting.
+            const stored = await this.#readStored();
+            if (stored && this.#msLeft(stored.chain) > PRE_MINT_THRESHOLD_MS) {
+                this.#adopt(stored);
+                return;
+            }
+        }
+        await this.#mint().catch(() => undefined);
+    }
+    /** Drops the scheduled refresh. */
+    dispose() {
+        clearTimeout(this.#scheduled);
+        this.#scheduled = undefined;
+    }
+    get #lockName() {
+        return lockNameFor(this.#storage, this.#slot);
+    }
+    #isForThisSession(held) {
+        return isForAccount(held, this.#account);
+    }
+    #msLeft(chain) {
+        return expiresAtMs(chain) - Date.now();
+    }
+    /**
+     * The stored credential, where there is one this session may use.
+     *
+     * Whatever another tab minted arrives this way: sharing is a read of the store
+     * rather than a conversation, which works whether the other tabs are running,
+     * frozen, or gone.
+     *
+     * Takes no lock, so it declines a spent record rather than evicting it. The
+     * mint that follows evicts under the lock, per {@link readSlot}.
+     */
+    #readStored() {
+        return readSlot({
+            storage: this.#storage,
+            slot: this.#slot,
+            evictSpent: false,
+            verify: (candidate) => this.#isForThisSession(candidate),
+        });
+    }
+    async #usable() {
+        const current = this.#held.current;
+        if (current) {
+            const left = this.#msLeft(current.chain);
+            if (left > PRE_MINT_THRESHOLD_MS)
+                return current;
+            if (left > BLOCK_MARGIN_MS) {
+                // Enough life to serve this request while a replacement is on its way.
+                void this.#mint().catch(() => undefined);
+                return current;
+            }
+        }
+        return this.#mint();
+    }
+    #mint() {
+        this.#inFlight ??= this.#mintOnce().finally(() => {
+            this.#inFlight = undefined;
+        });
+        return this.#inFlight;
+    }
+    async #mintOnce() {
+        // A session this library cannot act for will answer the same way every time,
+        // so nothing is gained by asking again: the rotation stops and the error
+        // reaches the caller. The record is left alone — the sign-in is alive, and
+        // retracting it would sign every tab on the domain out of it.
+        if (this.#unsupported)
+            throw this.#unsupported;
+        // A delegation lasts min(its ttl, what remains of the session), so minting
+        // against an almost finished session returns one already too short to use,
+        // and refreshing on the delegation alone would mint without end.
+        if (!sessionHasLifeLeft(this.#sessionExpiresAtMs)) {
+            this.#reportGone();
+            throw new SessionGoneError('The session has expired');
+        }
+        let credential;
+        try {
+            credential = await acquireCredential({
+                storage: this.#storage,
+                slot: this.#slot,
+                source: this.#source,
+                lockName: this.#lockName,
+                // Every mint after the first must be rooted at the account already
+                // established: one that is not is a failed mint, never a new principal.
+                verify: (candidate) => this.#isForThisSession(candidate),
+                adopt: true,
+                onGone: () => this.#reportGone(),
+            });
+        }
+        catch (error) {
+            // Latched, and the rotation dropped: asking again would return the same
+            // answer, and a timer that keeps firing for it is a timer that never stops.
+            if (error instanceof SessionUnsupportedError) {
+                this.#unsupported = error;
+                this.dispose();
+            }
+            throw error;
+        }
+        this.#adopt(credential);
+        return credential;
+    }
+    #adopt(credential) {
+        this.#held.current = credential;
+        this.#currentWasUsed = false;
+        this.#schedule(credential.chain);
+    }
+    #schedule(chain) {
+        clearTimeout(this.#scheduled);
+        const delay = this.#msLeft(chain) - PRE_MINT_THRESHOLD_MS;
+        if (delay <= 0)
+            return;
+        this.#scheduled = setTimeout(() => {
+            // Only refresh a credential something used — signing a request, or a
+            // caller saying somebody is here. Each one earns the next refresh and no
+            // more, so an application nobody is using lets its delegation lapse rather
+            // than refreshing for as long as a tab is open.
+            if (this.#currentWasUsed)
+                void this.#mint().catch(() => undefined);
+        }, delay);
+        // Never hold a Node process open for a refresh nobody is waiting on.
+        this.#scheduled.unref?.();
+    }
+    #reportGone() {
+        if (this.#reportedGone)
+            return;
+        this.#reportedGone = true;
+        this.dispose();
+        this.#onSessionGone();
+    }
+}
+//# sourceMappingURL=session-identity.js.map

package/dist/esm/client/session-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-identity.js","sourceRoot":"","sources":["../../../src/client/session-identity.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC7E,OAAO,EAAE,SAAS,EAAE,MAAM,yBAAyB,CAAC;AACpD,OAAO,EACL,oBAAoB,EAEpB,kBAAkB,EAClB,gBAAgB,EAChB,uBAAuB,GACxB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C;;;;GAIG;AACH,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B;;;;;;GAMG;AACH,MAAM,qBAAqB,GAAG,MAAM,CAAC;AAKrC,MAAM,WAAW,GAAG,CAAC,KAAsB,EAAU,EAAE,CACrD,MAAM,CACJ,KAAK,CAAC,WAAW,CAAC,MAAM,CACtB,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAC1B,UAAU,CAAC,UAAU,GAAG,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,EACnE,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,UAAU,IAAI,EAAE,CAClD,GAAG,QAAU,CACf,CAAC;AAEJ,MAAM,QAAQ,GAAG,CAAC,KAAsB,EAAU,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AAErF,wCAAwC;AACxC,MAAM,SAAS,GAAG,CAAC,KAAsB,EAAa,EAAE,CACtD,SAAS,CAAC,kBAAkB,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;AAEhE;;;;;;;;;;;GAWG;AACH,MAAM,YAAY,GAAG,CAAC,IAAU,EAAE,QAA+B,EAAW,EAAE;IAC5E,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACxF,OAAO,QAAQ,KAAK,SAAS,IAAI,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,CAAC;AACtF,CAAC,CAAC;AAEF;;;;;;;;;;GAUG;AACH,KAAK,UAAU,QAAQ,CAAC,EACtB,OAAO,EACP,IAAI,EACJ,UAAU,EACV,MAAM,GAMP;IACC,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,EAAE,KAAK;QAAE,OAAO,SAAS,CAAC;IAErC,8EAA8E;IAC9E,+EAA+E;IAC/E,gFAAgF;IAChF,0EAA0E;IAC1E,wEAAwE;IACxE,EAAE;IACF,+EAA+E;IAC/E,oDAAoD;IACpD,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,IAAI,UAAU,EAAE,CAAC;YACf,yEAAyE;YACzE,4DAA4D;YAC5D,MAAM,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,UAAU,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;IACtE,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC;QAAE,OAAO,SAAS,CAAC;IAClE,OAAO,UAAU,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,iBAAiB,CAAC,EAC/B,OAAO,EACP,IAAI,EACJ,MAAM,EACN,QAAQ,EACR,MAAM,EACN,KAAK,EACL,MAAM,GASP;IACC,OAAO,YAAY,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QAC7C,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3E,wEAAwE;QACxE,6CAA6C;QAC7C,IAAI,KAAK,IAAI,MAAM,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,qBAAqB;YAAE,OAAO,MAAM,CAAC;QAErF,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;QACxC,IAAI,KAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,gBAAgB;gBAAE,MAAM,EAAE,EAAE,CAAC;YAClD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;QACvC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAChD,MAAM,IAAI,oBAAoB,EAAE,CAAC;QACnC,CAAC;QAED,8EAA8E;QAC9E,2EAA2E;QAC3E,4EAA4E;QAC5E,gDAAgD;QAChD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,MAAM,EAAE,EAAE,CAAC;YACX,MAAM,IAAI,gBAAgB,CAAC,iDAAiD,CAAC,CAAC;QAChF,CAAC;QAED,8EAA8E;QAC9E,0EAA0E;QAC1E,8EAA8E;QAC9E,sBAAsB;QACtB,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3D,OAAO,UAAU,CAAC;IACpB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0FAA0F;AAC1F,MAAM,kBAAkB,GAAG,CAAC,kBAA0B,EAAW,EAAE,CACjE,kBAAkB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;AAEpD,8EAA8E;AAC9E,MAAM,WAAW,GAAG,CAAC,OAA0B,EAAE,IAAY,EAAiB,EAAE;AAC9E,wEAAwE;AACxE,qEAAqE;AACrE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAuC/B;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,eAAgB,SAAQ,kBAAkB;IAC5C,OAAO,CAAsB;IAC7B,QAAQ,CAAoB;IAC5B,KAAK,CAAS;IACd,cAAc,CAAa;IAC3B,mBAAmB,CAAS;IACrC,oEAAoE;IAC3D,QAAQ,CAAY;IAC7B,kFAAkF;IACzE,KAAK,CAAqB;IAEnC,SAAS,CAA4B;IACrC,eAAe,GAAG,KAAK,CAAC;IACxB,UAAU,CAA4C;IACtD,aAAa,GAAG,KAAK,CAAC;IACtB,YAAY,CAAsC;IAElD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,MAAM,CAAC,KAAK,CAAC,MAAM,CACjB,OAAqF;QAErF,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;YACpD,OAAO,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,gBAAgB,CAAC,yBAAyB,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC;YACzC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC;YACpD,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,OAAO,CAAC,eAAe,CAAC;YACvE,sEAAsE;YACtE,0EAA0E;YAC1E,6DAA6D;YAC7D,KAAK,EAAE,OAAO,CAAC,eAAe,KAAK,SAAS;YAC5C,MAAM,EAAE,OAAO,CAAC,aAAa;SAC9B,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC;YACnC,GAAG,OAAO;YACV,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,SAAS;SACvC,CAAC,CAAC;QACH,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QAC5B,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,YAAY,OAA+B;QACzC,MAAM,IAAI,GAAuB,EAAE,CAAC;QACpC,4EAA4E;QAC5E,8EAA8E;QAC9E,8EAA8E;QAC9E,gDAAgD;QAChD,KAAK,CACH;YACE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE;gBACb,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC;gBACnC,IAAI,CAAC,GAAG;oBAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;gBACnE,OAAO,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxB,CAAC;SACF,EACD,eAAe,CAAC,eAAe,CAAC,EAAE,EAAE,OAAO,CAAC,UAAU,CAAC,CACxD,CAAC;QACF,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC;QAC9B,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC;QAC1B,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC;QAC5C,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACtD,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC,kBAAkB,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IACnF,CAAC;IAEQ,aAAa;QACpB,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;IAC5D,CAAC;IAEQ,KAAK,CAAC,gBAAgB,CAAC,OAAyB;QACvD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;QACxC,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;QAC5B,OAAO,kBAAkB,CAAC,cAAc,CACtC,UAAU,CAAC,QAAQ,EACnB,UAAU,CAAC,KAAK,CACjB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,OAAO;QACX,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3B,uEAAuE;QACvE,wBAAwB;QACxB,IAAI,CAAC,eAAe,GAAG,IAAI,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QACnC,IAAI,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,qBAAqB;YAAE,OAAO;QAE3E,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,6EAA6E;YAC7E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;YACxC,IAAI,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,qBAAqB,EAAE,CAAC;gBACjE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBACpB,OAAO;YACT,CAAC;QACH,CAAC;QACD,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED,mCAAmC;IACnC,OAAO;QACL,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9B,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC;IAC9B,CAAC;IAED,IAAI,SAAS;QACX,OAAO,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,iBAAiB,CAAC,IAAU;QAC1B,OAAO,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED,OAAO,CAAC,KAAsB;QAC5B,OAAO,WAAW,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzC,CAAC;IAED;;;;;;;;;OASG;IACH,WAAW;QACT,OAAO,QAAQ,CAAC;YACd,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,IAAI,EAAE,IAAI,CAAC,KAAK;YAChB,UAAU,EAAE,KAAK;YACjB,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC;SACzD,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,OAAO;QACX,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QACnC,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,IAAI,GAAG,qBAAqB;gBAAE,OAAO,OAAO,CAAC;YACjD,IAAI,IAAI,GAAG,eAAe,EAAE,CAAC;gBAC3B,uEAAuE;gBACvE,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACzC,OAAO,OAAO,CAAC;YACjB,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;IAED,KAAK;QACH,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YAC/C,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,SAAS;QACb,6EAA6E;QAC7E,yEAAyE;QACzE,2EAA2E;QAC3E,8DAA8D;QAC9D,IAAI,IAAI,CAAC,YAAY;YAAE,MAAM,IAAI,CAAC,YAAY,CAAC;QAE/C,2EAA2E;QAC3E,2EAA2E;QAC3E,iEAAiE;QACjE,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,MAAM,IAAI,gBAAgB,CAAC,yBAAyB,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,UAAgB,CAAC;QACrB,IAAI,CAAC;YACH,UAAU,GAAG,MAAM,iBAAiB,CAAC;gBACnC,OAAO,EAAE,IAAI,CAAC,QAAQ;gBACtB,IAAI,EAAE,IAAI,CAAC,KAAK;gBAChB,MAAM,EAAE,IAAI,CAAC,OAAO;gBACpB,QAAQ,EAAE,IAAI,CAAC,SAAS;gBACxB,mEAAmE;gBACnE,wEAAwE;gBACxE,MAAM,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC;gBACxD,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE;aACjC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,4EAA4E;YAC5E,IAAI,KAAK,YAAY,uBAAuB,EAAE,CAAC;gBAC7C,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC;gBAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACxB,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,MAAM,CAAC,UAAgB;QACrB,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,UAAU,CAAC;QAChC,IAAI,CAAC,eAAe,GAAG,KAAK,CAAC;QAC7B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,SAAS,CAAC,KAAsB;QAC9B,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,qBAAqB,CAAC;QAC1D,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO;QAEvB,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,GAAG,EAAE;YAChC,qEAAqE;YACrE,yEAAyE;YACzE,2EAA2E;YAC3E,gDAAgD;YAChD,IAAI,IAAI,CAAC,eAAe;gBAAE,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACrE,CAAC,EAAE,KAAK,CAAC,CAAC;QAEV,qEAAqE;QACpE,IAAI,CAAC,UAAqC,CAAC,KAAK,EAAE,EAAE,CAAC;IACxD,CAAC;IAED,WAAW;QACT,IAAI,IAAI,CAAC,aAAa;YAAE,OAAO;QAC/B,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC;QAC1B,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,IAAI,CAAC,cAAc,EAAE,CAAC;IACxB,CAAC;CACF"}