@kensio/yulin 1.16.0 → 1.16.2

package/dist/service/cognito/serve/page/sim-cognito-managed-login.js

@@ -0,0 +1,77 @@
+import { isSimCognitoManagedLoginRequired } from "../../error/sim-cognito-managed-login.error.js";
+import { isSimCognitoOAuthError } from "../../error/sim-cognito-oauth.error.js";
+import { SimCognitoConfirmPage } from "./sim-cognito-confirm-page.js";
+import { SimCognitoForgotPasswordPage } from "./sim-cognito-forgot-password-page.js";
+import { SimCognitoPageForm } from "./sim-cognito-page-form.js";
+import { simCognitoForgotPasswordPath, simCognitoIsLocalSignIn, simCognitoPagePaths, simCognitoResetPasswordPath, simCognitoSignUpPath, } from "./sim-cognito-page-paths.js";
+import { SimCognitoResetPasswordPage } from "./sim-cognito-reset-password-page.js";
+import { SimCognitoPageRequest } from "./sim-cognito-page-request.js";
+import { SimCognitoSignInPage } from "./sim-cognito-sign-in-page.js";
+import { SimCognitoSignUpPage } from "./sim-cognito-sign-up-page.js";
+/**
+ * The pages simulated managed login serves.
+ *
+ * A person reaches the sign-in form at the authorize endpoint, the sign-up
+ * form and the forgotten password form from links on it, and the confirmation
+ * and new password forms from the step before each. Each form carries the
+ * authorize request's own parameters through as hidden inputs, so the sign-in
+ * at the end of it reaches the app client's callback URL the application asked
+ * for.
+ */
+export class SimCognitoManagedLogin {
+    pageRequest = new SimCognitoPageRequest();
+    signInPage = new SimCognitoSignInPage();
+    signUpPage = new SimCognitoSignUpPage();
+    confirmPage = new SimCognitoConfirmPage();
+    forgotPasswordPage = new SimCognitoForgotPasswordPage();
+    resetPasswordPage = new SimCognitoResetPasswordPage();
+    /**
+     * Whether a path is one of the pages served beside the OAuth endpoints.
+     */
+    static servesPage(pathname) {
+        return simCognitoPagePaths.has(pathname);
+    }
+    /**
+     * Answer the page a request reached.
+     */
+    async handlePage(request) {
+        const form = this.formIn(request);
+        switch (request.url.pathname) {
+            case simCognitoSignUpPath: {
+                return await this.signUpPage.handle(form);
+            }
+            case simCognitoForgotPasswordPath: {
+                return await this.forgotPasswordPage.handle(form);
+            }
+            case simCognitoResetPasswordPath: {
+                return await this.resetPasswordPage.handle(form);
+            }
+            default: {
+                return await this.confirmPage.handle(form);
+            }
+        }
+    }
+    /**
+     * Answer a refused authorize request on the sign-in form, where the form is
+     * what real managed login would have answered with.
+     *
+     * A request carrying no credentials gets the empty form. One the person
+     * filled in wrongly gets it back with the refusal on it, because a wrong
+     * password is theirs to correct rather than the application's to be told
+     * about. Every other refusal belongs to the application, and nothing here
+     * answers it.
+     */
+    refusedSignIn(request, parameters, error) {
+        if (isSimCognitoManagedLoginRequired(error)) {
+            return this.signInPage.render(request.pool, parameters);
+        }
+        if (isSimCognitoOAuthError(error) || !simCognitoIsLocalSignIn(parameters)) {
+            return undefined;
+        }
+        return this.signInPage.render(request.pool, parameters, SimCognitoPageForm.messageIn(error));
+    }
+    formIn(request) {
+        return new SimCognitoPageForm(request, this.pageRequest.values(request.serviceRequest, request.url));
+    }
+}
+//# sourceMappingURL=sim-cognito-managed-login.js.map

package/dist/service/cognito/serve/page/sim-cognito-managed-login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-managed-login.js","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-managed-login.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gCAAgC,EAAE,MAAM,gDAAgD,CAAC;AAClG,OAAO,EAAE,sBAAsB,EAAE,MAAM,wCAAwC,CAAC;AAEhF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,4BAA4B,EAAE,MAAM,uCAAuC,CAAC;AACrF,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAEhE,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,mBAAmB,EACnB,2BAA2B,EAC3B,oBAAoB,GACrB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,2BAA2B,EAAE,MAAM,sCAAsC,CAAC;AACnF,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAErE;;;;;;;;;GASG;AACH,MAAM,OAAO,sBAAsB;IAChB,WAAW,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAC1C,UAAU,GAAG,IAAI,oBAAoB,EAAE,CAAC;IACxC,UAAU,GAAG,IAAI,oBAAoB,EAAE,CAAC;IACxC,WAAW,GAAG,IAAI,qBAAqB,EAAE,CAAC;IAC1C,kBAAkB,GAAG,IAAI,4BAA4B,EAAE,CAAC;IACxD,iBAAiB,GAAG,IAAI,2BAA2B,EAAE,CAAC;IAEvE;;OAEG;IACH,MAAM,CAAC,UAAU,CAAC,QAAgB;QAChC,OAAO,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,OAAgC;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAElC,QAAQ,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC7B,KAAK,oBAAoB,EAAE,CAAC;gBAC1B,OAAO,MAAM,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5C,CAAC;YACD,KAAK,4BAA4B,EAAE,CAAC;gBAClC,OAAO,MAAM,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACpD,CAAC;YACD,KAAK,2BAA2B,EAAE,CAAC;gBACjC,OAAO,MAAM,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnD,CAAC;YACD,SAAS,CAAC;gBACR,OAAO,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACH,aAAa,CACX,OAAgC,EAChC,UAAoC,EACpC,KAAc;QAEd,IAAI,gCAAgC,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,sBAAsB,CAAC,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1E,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,OAAO,IAAI,CAAC,UAAU,CAAC,MAAM,CAC3B,OAAO,CAAC,IAAI,EACZ,UAAU,EACV,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,CACpC,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,OAAgC;QAC7C,OAAO,IAAI,kBAAkB,CAC3B,OAAO,EACP,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,EAAE,OAAO,CAAC,GAAG,CAAC,CAC7D,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cognito/serve/page/sim-cognito-page-form.d.ts

@@ -0,0 +1,47 @@
+import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoDomainRequest } from "../sim-cognito-domain-request.js";
+import type { SimCognitoPageParameters } from "./sim-cognito-page-markup.js";
+/**
+ * One request to a page, read as the form it fetched or posted.
+ *
+ * A page is reached with a query string and posted back with a form encoded
+ * body, and both are name and value pairs. Which of the two a value came from
+ * changes nothing about what the page does with it, so a form holds them the
+ * same way and holds the method beside them.
+ */
+export declare class SimCognitoPageForm {
+    /** The authorize parameters this page carries on to the next one. */
+    readonly parameters: SimCognitoPageParameters;
+    private readonly request;
+    private readonly fields;
+    constructor(request: SimCognitoDomainRequest, values: SimCognitoPageParameters);
+    /**
+     * The message a refusal is shown on the page as.
+     */
+    static messageIn(error: unknown): string;
+    /** The pool this page belongs to. */
+    get pool(): SimCognitoUserPool;
+    /** The simulated Cognito scope the operations behind the pages run in. */
+    get cognito(): SimCognitoDomainRequest["cognito"];
+    /** Whether the form was posted rather than fetched. */
+    get isPosted(): boolean;
+    /** The app client the grant this page belongs to was started by. */
+    get clientId(): string | undefined;
+    /** The user this page is about, which is empty until a form named one. */
+    get username(): string;
+    /**
+     * One field the form asked for.
+     */
+    field(name: string): string | undefined;
+    /**
+     * The `SecretHash` a client with a secret needs, and nothing for one
+     * without.
+     *
+     * Managed login computes this on the server rather than asking the browser
+     * for a secret, and so does this.
+     */
+    secretHash(): {
+        SecretHash?: string;
+    };
+}
+//# sourceMappingURL=sim-cognito-page-form.d.ts.map

package/dist/service/cognito/serve/page/sim-cognito-page-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-page-form.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-page-form.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAChF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAG7E;;;;;;;GAOG;AACH,qBAAa,kBAAkB;IAC7B,qEAAqE;IACrE,SAAgB,UAAU,EAAE,wBAAwB,CAAC;IAErD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0B;IAClD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA2B;IAElD,YACE,OAAO,EAAE,uBAAuB,EAChC,MAAM,EAAE,wBAAwB,EAKjC;IAED;;OAEG;IACH,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAMvC;IAED,qCAAqC;IACrC,IAAI,IAAI,IAAI,kBAAkB,CAE7B;IAED,0EAA0E;IAC1E,IAAI,OAAO,IAAI,uBAAuB,CAAC,SAAS,CAAC,CAEhD;IAED,uDAAuD;IACvD,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED,oEAAoE;IACpE,IAAI,QAAQ,IAAI,MAAM,GAAG,SAAS,CAEjC;IAED,0EAA0E;IAC1E,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEtC;IAED;;;;;;OAMG;IACH,UAAU,IAAI;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAcpC;CACF"}

package/dist/service/cognito/serve/page/sim-cognito-page-form.js

@@ -0,0 +1,76 @@
+import { simCognitoSecretHash } from "../../user-pool/auth/sim-cognito-secret-hash.js";
+import { simCognitoCarriedParameters } from "./sim-cognito-page-paths.js";
+/**
+ * One request to a page, read as the form it fetched or posted.
+ *
+ * A page is reached with a query string and posted back with a form encoded
+ * body, and both are name and value pairs. Which of the two a value came from
+ * changes nothing about what the page does with it, so a form holds them the
+ * same way and holds the method beside them.
+ */
+export class SimCognitoPageForm {
+    /** The authorize parameters this page carries on to the next one. */
+    parameters;
+    request;
+    fields;
+    constructor(request, values) {
+        this.request = request;
+        this.fields = values;
+        this.parameters = simCognitoCarriedParameters(values);
+    }
+    /**
+     * The message a refusal is shown on the page as.
+     */
+    static messageIn(error) {
+        if (error instanceof Error) {
+            return error.message;
+        }
+        return "The request was refused";
+    }
+    /** The pool this page belongs to. */
+    get pool() {
+        return this.request.pool;
+    }
+    /** The simulated Cognito scope the operations behind the pages run in. */
+    get cognito() {
+        return this.request.cognito;
+    }
+    /** Whether the form was posted rather than fetched. */
+    get isPosted() {
+        return this.request.serviceRequest.request.method === "POST";
+    }
+    /** The app client the grant this page belongs to was started by. */
+    get clientId() {
+        return this.parameters["client_id"];
+    }
+    /** The user this page is about, which is empty until a form named one. */
+    get username() {
+        return this.fields["username"] ?? "";
+    }
+    /**
+     * One field the form asked for.
+     */
+    field(name) {
+        return Object.entries(this.fields).find(([key]) => key === name)?.[1];
+    }
+    /**
+     * The `SecretHash` a client with a secret needs, and nothing for one
+     * without.
+     *
+     * Managed login computes this on the server rather than asking the browser
+     * for a secret, and so does this.
+     */
+    secretHash() {
+        const { clientId, username } = this;
+        const secret = clientId === undefined
+            ? undefined
+            : this.pool.findClient(clientId)?.secret;
+        // This asks whether the app client has a secret at all, and compares none.
+        // oxlint-disable-next-line security/detect-possible-timing-attacks
+        if (secret === undefined || clientId === undefined) {
+            return {};
+        }
+        return { SecretHash: simCognitoSecretHash(username, clientId, secret) };
+    }
+}
+//# sourceMappingURL=sim-cognito-page-form.js.map

package/dist/service/cognito/serve/page/sim-cognito-page-form.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-page-form.js","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-page-form.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,iDAAiD,CAAC;AAIvF,OAAO,EAAE,2BAA2B,EAAE,MAAM,6BAA6B,CAAC;AAE1E;;;;;;;GAOG;AACH,MAAM,OAAO,kBAAkB;IAC7B,qEAAqE;IACrD,UAAU,CAA2B;IAEpC,OAAO,CAA0B;IACjC,MAAM,CAA2B;IAElD,YACE,OAAgC,EAChC,MAAgC;QAEhC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,UAAU,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACxD,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,SAAS,CAAC,KAAc;QAC7B,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;YAC3B,OAAO,KAAK,CAAC,OAAO,CAAC;QACvB,CAAC;QAED,OAAO,yBAAyB,CAAC;IACnC,CAAC;IAED,qCAAqC;IACrC,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,0EAA0E;IAC1E,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;IAC9B,CAAC;IAED,uDAAuD;IACvD,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC;IAC/D,CAAC;IAED,oEAAoE;IACpE,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC;IAED,0EAA0E;IAC1E,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAY;QAChB,OAAO,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACxE,CAAC;IAED;;;;;;OAMG;IACH,UAAU;QACR,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC;QACpC,MAAM,MAAM,GACV,QAAQ,KAAK,SAAS;YACpB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAE7C,2EAA2E;QAC3E,mEAAmE;QACnE,IAAI,MAAM,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YACnD,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,EAAE,UAAU,EAAE,oBAAoB,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;IAC1E,CAAC;CACF"}

package/dist/service/cognito/serve/page/sim-cognito-page-markup.d.ts

@@ -0,0 +1,69 @@
+/**
+ * The parameters a managed login page carries from one step to the next.
+ *
+ * They are the authorize request's own query string, held as hidden inputs so
+ * that the sign-in at the end of a sign-up reaches the app client's callback
+ * URL with the `state` the application started with.
+ */
+export type SimCognitoPageParameters = Readonly<Record<string, string>>;
+/**
+ * The HTML the simulated managed login pages are built from.
+ *
+ * There is no styling and there is no script. The pages exist so that a
+ * browser in a local development server can complete a sign-up and a sign-in,
+ * and so that a test can post the same forms. Matching what real managed login
+ * looks like would be work no test could tell apart from this.
+ *
+ * Every value that reaches the page goes through `escaped`. A `state` is
+ * whatever the application put in it, and it is written back into a hidden
+ * input, so it is the one piece of this that a page could otherwise be broken
+ * with.
+ */
+export declare class SimCognitoPageMarkup {
+    /**
+     * One page, answered as HTML.
+     */
+    page(title: string, body: string): Response;
+    /**
+     * Send the browser on to the next page of the flow.
+     *
+     * A form post is answered with a 303 so that the browser follows it with a
+     * GET, which is what stops a reload posting the form a second time.
+     */
+    redirect(path: string, parameters: SimCognitoPageParameters): Response;
+    /**
+     * A form posting back to the path it was served from.
+     */
+    form(action: string, body: string): string;
+    /**
+     * One labelled input, with the label naming the field it is for.
+     */
+    field(name: string, label: string, type?: string): string;
+    /**
+     * The parameters this page carries on to the next one.
+     */
+    hidden(parameters: SimCognitoPageParameters): string;
+    /**
+     * A link to another page of the flow, carrying the same parameters.
+     */
+    link(path: string, parameters: SimCognitoPageParameters, text: string): string;
+    /**
+     * What went wrong with the form that was just posted.
+     */
+    message(text: string): string;
+    /**
+     * A submit button, named so that a form with two of them says which was
+     * pressed.
+     *
+     * A button that asks the form to do something other than what its fields
+     * were filled in for skips the browser's own validation, so an empty
+     * required field does not stop it.
+     */
+    submit(name: string, label: string, skipValidation?: boolean): string;
+    /**
+     * A value written into HTML, with the five characters that would otherwise
+     * change what the page means replaced.
+     */
+    escaped(value: string): string;
+}
+//# sourceMappingURL=sim-cognito-page-markup.d.ts.map

package/dist/service/cognito/serve/page/sim-cognito-page-markup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-page-markup.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-page-markup.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,MAAM,wBAAwB,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAUxE;;;;;;;;;;;;GAYG;AACH,qBAAa,oBAAoB;IAC/B;;OAEG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,CAc1C;IAED;;;;;OAKG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,wBAAwB,GAAG,QAAQ,CAOrE;IAED;;OAEG;IACH,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEzC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,SAAS,GAAG,MAAM,CAQxD;IAED;;OAEG;IACH,MAAM,CAAC,UAAU,EAAE,wBAAwB,GAAG,MAAM,CAQnD;IAED;;OAEG;IACH,IAAI,CACF,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,wBAAwB,EACpC,IAAI,EAAE,MAAM,GACX,MAAM,CAIR;IAED;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAE5B;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,UAAQ,GAAG,MAAM,CAMlE;IAED;;;OAGG;IACH,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAI7B;CACF"}

package/dist/service/cognito/serve/page/sim-cognito-page-markup.js

@@ -0,0 +1,111 @@
+const escapes = new Map([
+    ["&", "&"],
+    ["<", "&lt;"],
+    [">", "&gt;"],
+    ['"', "&quot;"],
+    ["'", "&#39;"],
+]);
+/**
+ * The HTML the simulated managed login pages are built from.
+ *
+ * There is no styling and there is no script. The pages exist so that a
+ * browser in a local development server can complete a sign-up and a sign-in,
+ * and so that a test can post the same forms. Matching what real managed login
+ * looks like would be work no test could tell apart from this.
+ *
+ * Every value that reaches the page goes through `escaped`. A `state` is
+ * whatever the application put in it, and it is written back into a hidden
+ * input, so it is the one piece of this that a page could otherwise be broken
+ * with.
+ */
+export class SimCognitoPageMarkup {
+    /**
+     * One page, answered as HTML.
+     */
+    page(title, body) {
+        const html = `<!doctype html>\n<html lang="en">\n<head>\n` +
+            `<meta charset="utf-8">\n<title>${this.escaped(title)}</title>\n` +
+            `</head>\n<body>\n<h1>${this.escaped(title)}</h1>\n${body}\n` +
+            `</body>\n</html>\n`;
+        return new Response(html, {
+            status: 200,
+            headers: {
+                "content-type": "text/html; charset=utf-8",
+                "cache-control": "no-store",
+            },
+        });
+    }
+    /**
+     * Send the browser on to the next page of the flow.
+     *
+     * A form post is answered with a 303 so that the browser follows it with a
+     * GET, which is what stops a reload posting the form a second time.
+     */
+    redirect(path, parameters) {
+        const query = new URLSearchParams(parameters).toString();
+        return new Response(undefined, {
+            status: 303,
+            headers: { location: `${path}?${query}`, "cache-control": "no-store" },
+        });
+    }
+    /**
+     * A form posting back to the path it was served from.
+     */
+    form(action, body) {
+        return `<form method="post" action="${this.escaped(action)}">\n${body}</form>\n`;
+    }
+    /**
+     * One labelled input, with the label naming the field it is for.
+     */
+    field(name, label, type = "text") {
+        const escapedName = this.escaped(name);
+        return (`<p><label for="${escapedName}">${this.escaped(label)}</label>\n` +
+            `<input id="${escapedName}" name="${escapedName}" ` +
+            `type="${this.escaped(type)}" required></p>\n`);
+    }
+    /**
+     * The parameters this page carries on to the next one.
+     */
+    hidden(parameters) {
+        return Object.entries(parameters)
+            .map(([name, value]) => `<input type="hidden" name="${this.escaped(name)}" ` +
+            `value="${this.escaped(value)}">\n`)
+            .join("");
+    }
+    /**
+     * A link to another page of the flow, carrying the same parameters.
+     */
+    link(path, parameters, text) {
+        const query = new URLSearchParams(parameters).toString();
+        return `<p><a href="${this.escaped(`${path}?${query}`)}">${this.escaped(text)}</a></p>\n`;
+    }
+    /**
+     * What went wrong with the form that was just posted.
+     */
+    message(text) {
+        return `<p class="message">${this.escaped(text)}</p>\n`;
+    }
+    /**
+     * A submit button, named so that a form with two of them says which was
+     * pressed.
+     *
+     * A button that asks the form to do something other than what its fields
+     * were filled in for skips the browser's own validation, so an empty
+     * required field does not stop it.
+     */
+    submit(name, label, skipValidation = false) {
+        return (`<p><button type="submit" name="${this.escaped(name)}" ` +
+            `value="${this.escaped(name)}"${skipValidation ? " formnovalidate" : ""}>` +
+            `${this.escaped(label)}</button></p>\n`);
+    }
+    /**
+     * A value written into HTML, with the five characters that would otherwise
+     * change what the page means replaced.
+     */
+    escaped(value) {
+        return value.replaceAll(/[&<>"']/gu, (character) => {
+            return escapes.get(character) ?? character;
+        });
+    }
+}
+//# sourceMappingURL=sim-cognito-page-markup.js.map

package/dist/service/cognito/serve/page/sim-cognito-page-markup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-page-markup.js","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-page-markup.ts"],"names":[],"mappings":"AASA,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC;IACtB,CAAC,GAAG,EAAE,OAAO,CAAC;IACd,CAAC,GAAG,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,QAAQ,CAAC;IACf,CAAC,GAAG,EAAE,OAAO,CAAC;CACf,CAAC,CAAC;AAEH;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,oBAAoB;IAC/B;;OAEG;IACH,IAAI,CAAC,KAAa,EAAE,IAAY;QAC9B,MAAM,IAAI,GACR,6CAA6C;YAC7C,kCAAkC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY;YACjE,wBAAwB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,IAAI,IAAI;YAC7D,oBAAoB,CAAC;QAEvB,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;YACxB,MAAM,EAAE,GAAG;YACX,OAAO,EAAE;gBACP,cAAc,EAAE,0BAA0B;gBAC1C,eAAe,EAAE,UAAU;aAC5B;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,QAAQ,CAAC,IAAY,EAAE,UAAoC;QACzD,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;QAEzD,OAAO,IAAI,QAAQ,CAAC,SAAS,EAAE;YAC7B,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,IAAI,IAAI,KAAK,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE;SACvE,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,IAAI,CAAC,MAAc,EAAE,IAAY;QAC/B,OAAO,+BAA+B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,WAAW,CAAC;IACnF,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAY,EAAE,KAAa,EAAE,IAAI,GAAG,MAAM;QAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAEvC,OAAO,CACL,kBAAkB,WAAW,KAAK,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY;YACjE,cAAc,WAAW,WAAW,WAAW,IAAI;YACnD,SAAS,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAC/C,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,UAAoC;QACzC,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;aAC9B,GAAG,CACF,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAChB,8BAA8B,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI;YACpD,UAAU,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CACtC;aACA,IAAI,CAAC,EAAE,CAAC,CAAC;IACd,CAAC;IAED;;OAEG;IACH,IAAI,CACF,IAAY,EACZ,UAAoC,EACpC,IAAY;QAEZ,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;QAEzD,OAAO,eAAe,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC;IAC5F,CAAC;IAED;;OAEG;IACH,OAAO,CAAC,IAAY;QAClB,OAAO,sBAAsB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC;IAC1D,CAAC;IAED;;;;;;;OAOG;IACH,MAAM,CAAC,IAAY,EAAE,KAAa,EAAE,cAAc,GAAG,KAAK;QACxD,OAAO,CACL,kCAAkC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI;YACxD,UAAU,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,GAAG;YAC1E,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CACxC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,OAAO,CAAC,KAAa;QACnB,OAAO,KAAK,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,EAAE;YACjD,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,SAAS,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/service/cognito/serve/page/sim-cognito-page-paths.d.ts

@@ -0,0 +1,57 @@
+import type { SimCognitoPageParameters } from "./sim-cognito-page-markup.js";
+/**
+ * The path the sign-in form is served at and posts back to.
+ *
+ * Real managed login serves its form at `/login` and sends the browser there
+ * from `/oauth2/authorize`. Here the authorize endpoint answers with the form
+ * itself, so an application's own authorize URL is the whole of what a test
+ * has to know.
+ */
+export declare const simCognitoAuthorizePath = "/oauth2/authorize";
+/**
+ * The path the sign-up form is served at.
+ */
+export declare const simCognitoSignUpPath = "/signup";
+/**
+ * The path the confirmation form is served at.
+ *
+ * Real managed login confirms a sign-up on a page of `/signup` rather than at
+ * a path of its own. This one is separate so that a browser can come back to
+ * it with the code, and a test can reach it without replaying the sign-up.
+ */
+export declare const simCognitoConfirmPath = "/confirm";
+/**
+ * The path the form asking who has forgotten a password is served at.
+ */
+export declare const simCognitoForgotPasswordPath = "/forgotPassword";
+/**
+ * The path the form taking the reset code and the new password is served at.
+ *
+ * Real managed login serves both halves of a reset at these two paths, and
+ * that is where an application's own links to them point.
+ */
+export declare const simCognitoResetPasswordPath = "/confirmForgotPassword";
+/**
+ * The pages served beside the OAuth endpoints.
+ *
+ * The sign-in form is not among them. It is what the authorize endpoint
+ * answers with, so it has no path of its own.
+ */
+export declare const simCognitoPagePaths: ReadonlySet<string>;
+/**
+ * Whether a request signs in one of the pool's own users.
+ *
+ * A request naming no identity provider, or naming `COGNITO`, is the one
+ * managed login answers with its own form, so a refusal from it is shown on
+ * that form. One naming an external provider has no form to be shown on.
+ */
+export declare function simCognitoIsLocalSignIn(values: SimCognitoPageParameters): boolean;
+/**
+ * The authorize parameters out of everything a request carried.
+ *
+ * A form post arrives holding these and the fields the form asked for, and a
+ * page passes on only these, so nothing a person typed becomes part of the
+ * next request's authorize parameters.
+ */
+export declare function simCognitoCarriedParameters(values: SimCognitoPageParameters): SimCognitoPageParameters;
+//# sourceMappingURL=sim-cognito-page-paths.d.ts.map

package/dist/service/cognito/serve/page/sim-cognito-page-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-page-paths.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-page-paths.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAE7E;;;;;;;GAOG;AACH,eAAO,MAAM,uBAAuB,sBAAsB,CAAC;AAE3D;;GAEG;AACH,eAAO,MAAM,oBAAoB,YAAY,CAAC;AAE9C;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,aAAa,CAAC;AAEhD;;GAEG;AACH,eAAO,MAAM,4BAA4B,oBAAoB,CAAC;AAE9D;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,2BAA2B,CAAC;AAEpE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAKlD,CAAC;AAmBH;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAIT;AAED;;;;;;GAMG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,wBAAwB,GAC/B,wBAAwB,CAI1B"}

package/dist/service/cognito/serve/page/sim-cognito-page-paths.js

@@ -0,0 +1,82 @@
+/**
+ * The path the sign-in form is served at and posts back to.
+ *
+ * Real managed login serves its form at `/login` and sends the browser there
+ * from `/oauth2/authorize`. Here the authorize endpoint answers with the form
+ * itself, so an application's own authorize URL is the whole of what a test
+ * has to know.
+ */
+export const simCognitoAuthorizePath = "/oauth2/authorize";
+/**
+ * The path the sign-up form is served at.
+ */
+export const simCognitoSignUpPath = "/signup";
+/**
+ * The path the confirmation form is served at.
+ *
+ * Real managed login confirms a sign-up on a page of `/signup` rather than at
+ * a path of its own. This one is separate so that a browser can come back to
+ * it with the code, and a test can reach it without replaying the sign-up.
+ */
+export const simCognitoConfirmPath = "/confirm";
+/**
+ * The path the form asking who has forgotten a password is served at.
+ */
+export const simCognitoForgotPasswordPath = "/forgotPassword";
+/**
+ * The path the form taking the reset code and the new password is served at.
+ *
+ * Real managed login serves both halves of a reset at these two paths, and
+ * that is where an application's own links to them point.
+ */
+export const simCognitoResetPasswordPath = "/confirmForgotPassword";
+/**
+ * The pages served beside the OAuth endpoints.
+ *
+ * The sign-in form is not among them. It is what the authorize endpoint
+ * answers with, so it has no path of its own.
+ */
+export const simCognitoPagePaths = new Set([
+    simCognitoSignUpPath,
+    simCognitoConfirmPath,
+    simCognitoForgotPasswordPath,
+    simCognitoResetPasswordPath,
+]);
+/**
+ * The authorize parameters every page carries on to the next.
+ *
+ * A sign-up ends in a sign-in, and that sign-in has to reach the app client's
+ * callback URL with the `state` the application started with, so these travel
+ * through each form as hidden inputs.
+ */
+const carriedNames = new Set([
+    "response_type",
+    "client_id",
+    "redirect_uri",
+    "state",
+    "scope",
+    "code_challenge",
+    "code_challenge_method",
+]);
+/**
+ * Whether a request signs in one of the pool's own users.
+ *
+ * A request naming no identity provider, or naming `COGNITO`, is the one
+ * managed login answers with its own form, so a refusal from it is shown on
+ * that form. One naming an external provider has no form to be shown on.
+ */
+export function simCognitoIsLocalSignIn(values) {
+    const named = values["identity_provider"] ?? values["idp_identifier"];
+    return named === undefined || named === "COGNITO";
+}
+/**
+ * The authorize parameters out of everything a request carried.
+ *
+ * A form post arrives holding these and the fields the form asked for, and a
+ * page passes on only these, so nothing a person typed becomes part of the
+ * next request's authorize parameters.
+ */
+export function simCognitoCarriedParameters(values) {
+    return Object.fromEntries(Object.entries(values).filter(([name]) => carriedNames.has(name)));
+}
+//# sourceMappingURL=sim-cognito-page-paths.js.map

package/dist/service/cognito/serve/page/sim-cognito-page-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-page-paths.js","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-page-paths.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,mBAAmB,CAAC;AAE3D;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAE9C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,UAAU,CAAC;AAEhD;;GAEG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,iBAAiB,CAAC;AAE9D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,wBAAwB,CAAC;AAEpE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC;IAC9D,oBAAoB;IACpB,qBAAqB;IACrB,4BAA4B;IAC5B,2BAA2B;CAC5B,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAC3B,eAAe;IACf,WAAW;IACX,cAAc;IACd,OAAO;IACP,OAAO;IACP,gBAAgB;IAChB,uBAAuB;CACxB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAgC;IAEhC,MAAM,KAAK,GAAG,MAAM,CAAC,mBAAmB,CAAC,IAAI,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAEtE,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAgC;IAEhC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAClE,CAAC;AACJ,CAAC"}

package/dist/service/cognito/serve/page/sim-cognito-page-request.d.ts

@@ -0,0 +1,22 @@
+import type { SimAwsServiceRequest } from "../../../../serve/controller/sim-service-controller.js";
+import type { SimCognitoPageParameters } from "./sim-cognito-page-markup.js";
+/**
+ * What a request to a managed login page carried.
+ *
+ * A page is reached with a query string and posted back with a form encoded
+ * body, and both are name and value pairs, so they are read into the same
+ * record. Which of them a value came from changes nothing about what the page
+ * does with it.
+ */
+export declare class SimCognitoPageRequest {
+    /**
+     * The values a request carried, from its body where it has one and from its
+     * query string where it has not.
+     */
+    values(serviceRequest: SimAwsServiceRequest, url: URL): SimCognitoPageParameters;
+    /**
+     * The body as it arrived, which the serving layer buffered.
+     */
+    private body;
+}
+//# sourceMappingURL=sim-cognito-page-request.d.ts.map

package/dist/service/cognito/serve/page/sim-cognito-page-request.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-page-request.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-page-request.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wDAAwD,CAAC;AACnG,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,8BAA8B,CAAC;AAE7E;;;;;;;GAOG;AACH,qBAAa,qBAAqB;IAChC;;;OAGG;IACH,MAAM,CACJ,cAAc,EAAE,oBAAoB,EACpC,GAAG,EAAE,GAAG,GACP,wBAAwB,CAM1B;IAED;;OAEG;IACH,OAAO,CAAC,IAAI;CAOb"}

package/dist/service/cognito/serve/page/sim-cognito-page-request.js

@@ -0,0 +1,30 @@
+/**
+ * What a request to a managed login page carried.
+ *
+ * A page is reached with a query string and posted back with a form encoded
+ * body, and both are name and value pairs, so they are read into the same
+ * record. Which of them a value came from changes nothing about what the page
+ * does with it.
+ */
+export class SimCognitoPageRequest {
+    /**
+     * The values a request carried, from its body where it has one and from its
+     * query string where it has not.
+     */
+    values(serviceRequest, url) {
+        if (serviceRequest.request.method === "GET") {
+            return Object.fromEntries(url.searchParams);
+        }
+        return Object.fromEntries(new URLSearchParams(this.body(serviceRequest)));
+    }
+    /**
+     * The body as it arrived, which the serving layer buffered.
+     */
+    body(serviceRequest) {
+        if (serviceRequest.body === undefined) {
+            return "";
+        }
+        return Buffer.from(serviceRequest.body).toString("utf8");
+    }
+}
+//# sourceMappingURL=sim-cognito-page-request.js.map

package/dist/service/cognito/serve/page/sim-cognito-page-request.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-page-request.js","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-page-request.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAqB;IAChC;;;OAGG;IACH,MAAM,CACJ,cAAoC,EACpC,GAAQ;QAER,IAAI,cAAc,CAAC,OAAO,CAAC,MAAM,KAAK,KAAK,EAAE,CAAC;YAC5C,OAAO,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAC9C,CAAC;QAED,OAAO,MAAM,CAAC,WAAW,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;IAC5E,CAAC;IAED;;OAEG;IACK,IAAI,CAAC,cAAoC;QAC/C,IAAI,cAAc,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC;CACF"}

package/dist/service/cognito/serve/page/sim-cognito-provider-links.d.ts

@@ -0,0 +1,12 @@
+import type { SimCognitoUserPool } from "../../user-pool/sim-cognito-user-pool.js";
+import type { SimCognitoPageMarkup, SimCognitoPageParameters } from "./sim-cognito-page-markup.js";
+/**
+ * One link per identity provider this app client offers, each starting the
+ * federated sign-in the authorize endpoint already answers.
+ *
+ * A provider the client left out of its `SupportedIdentityProviders` is left
+ * off the page, because the authorize request the link would make is one that
+ * endpoint refuses.
+ */
+export declare function simCognitoProviderLinks(markup: SimCognitoPageMarkup, pool: SimCognitoUserPool, parameters: SimCognitoPageParameters): string;
+//# sourceMappingURL=sim-cognito-provider-links.d.ts.map

package/dist/service/cognito/serve/page/sim-cognito-provider-links.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-cognito-provider-links.d.ts","sourceRoot":"","sources":["../../../../../src/service/cognito/serve/page/sim-cognito-provider-links.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,KAAK,EACV,oBAAoB,EACpB,wBAAwB,EACzB,MAAM,8BAA8B,CAAC;AAGtC;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,oBAAoB,EAC5B,IAAI,EAAE,kBAAkB,EACxB,UAAU,EAAE,wBAAwB,GACnC,MAAM,CAiBR"}