@mcp-abap-adt/auth-broker 4.1.0 → 5.0.0

package/dist/clientAuthentication.d.ts

@@ -6,8 +6,9 @@
  * certificate the key store holds, one the secret. Neither falls back to the
  * other; a consumer that wants a fallback composes it, and its order is the
  * consumer's statement. Whatever a strategy throws, the broker turns into a
- * `DestinationConfigError` in fixed words (`resolveClientAuthentication`) —
- * nothing of the thrown value, no `cause`.
+ * `DestinationConfigError` in fixed words (`resolveClientAuthentication`),
+ * carrying the thrown value as auth-errors reads it — never its message, no
+ * `cause`.
  */
 import type { IClientAuthentication } from '@mcp-abap-adt/interfaces-auth';
 import type { IClientCertificate } from '@mcp-abap-adt/interfaces-auth-broker';
@@ -35,6 +36,13 @@ export interface ClientAuthenticationContext {
      * `getClientCertificate`.
      */
     readCertificate(): Promise<IClientCertificate | null>;
+    /**
+     * The build's attempt: aborts when every caller waiting on the build has
+     * gone. A strategy that waits on the network — a loader's
+     * `tlsMaterial()` — ends its wait on it; the broker sets no bound of its
+     * own.
+     */
+    readonly signal: AbortSignal;
 }
 /** The strategy `AuthBrokerConfig.clientAuthentication` takes. */
 export type ClientAuthenticationStrategy = (context: ClientAuthenticationContext) => Promise<IClientAuthentication>;
@@ -43,7 +51,9 @@ export type ClientAuthenticationStrategy = (context: ClientAuthenticationContext
  * `${certUrl}/oauth/token`. The material is handed over as given and checked
  * before the factory answers — auth-providers checks it only on first use, so
  * a malformed, incomplete or expired PEM would otherwise surface only at the
- * first token request, in a provider already built and cached.
+ * first token request, in a provider already built and cached. What
+ * `tlsMaterial()` throws — auth-providers' `client-certificate` failure — is
+ * carried by the guard as auth-errors reads it.
  *
  * Throws "the destination has no client certificate" when the store answers
  * `null` or implements no `getClientCertificate`.
@@ -76,14 +86,19 @@ export declare function contextClient(client: IAuthorizationConfig | null): IAut
 /**
  * The context for one build: the client through `contextClient`;
  * `readCertificate` lazy and memoised — the first call reads, every later one
- * gets the same answer.
+ * gets the same answer; `signal`, the build's attempt.
  */
-export declare function clientAuthenticationContext(destination: string, grant: ClientAuthenticationGrant, client: IAuthorizationConfig | null, read: () => Promise<IClientCertificate | null>): ClientAuthenticationContext;
+export declare function clientAuthenticationContext(destination: string, grant: ClientAuthenticationGrant, client: IAuthorizationConfig | null, read: () => Promise<IClientCertificate | null>, signal: AbortSignal): ClientAuthenticationContext;
 /**
  * Runs the strategy inside the guard. Any throw — the strategy's own, a
  * store's, a malformed PEM — and any answer that is no client authentication
  * becomes a `DestinationConfigError` naming `clientAuthentication`, in fixed
- * words: no `cause`, nothing of the thrown value.
+ * words. A shipped factory's own refusal keeps the broker's words; anything
+ * else is "the clientAuthentication strategy failed", carrying
+ * `readFailure(thrown, 'client-authentication-strategy')` — a provider's
+ * failure (an unusable certificate) as the provider made it, a strategy's own
+ * error only as its classification. No `cause`, no message of the thrown
+ * value.
  */
 export declare function resolveClientAuthentication(strategy: ClientAuthenticationStrategy, context: ClientAuthenticationContext): Promise<IClientAuthentication>;
 /**

package/dist/clientAuthentication.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"clientAuthentication.d.ts","sourceRoot":"","sources":["../src/clientAuthentication.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAOH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAG9E;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GACjC,oBAAoB,GACpB,oBAAoB,GACpB,UAAU,GACV,yBAAyB,GACzB,aAAa,GACb,UAAU,GACV,gBAAgB,GAChB,cAAc,CAAC;AAEnB,4EAA4E;AAC5E,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC7C;;;;OAIG;IACH,eAAe,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;CACvD;AAED,kEAAkE;AAClE,MAAM,MAAM,4BAA4B,GAAG,CACzC,OAAO,EAAE,2BAA2B,KACjC,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAsBpC;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,IAAI,4BAA4B,CAgBxE;AAED,kEAAkE;AAClE,MAAM,WAAW,2BAA2B;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,MAAM,CAAC;CACnC;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,2BAA2B,GACnC,4BAA4B,CAc9B;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,oBAAoB,GAAG,IAAI,GAClC,oBAAoB,GAAG,IAAI,CAO7B;AAmBD;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,yBAAyB,EAChC,MAAM,EAAE,oBAAoB,GAAG,IAAI,EACnC,IAAI,EAAE,MAAM,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,GAC7C,2BAA2B,CAW7B;AAiCD;;;;;GAKG;AACH,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,4BAA4B,EACtC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,qBAAqB,CAAC,CAyBhC;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAiBhC"}
+{"version":3,"file":"clientAuthentication.d.ts","sourceRoot":"","sources":["../src/clientAuthentication.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAOH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAC3E,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAC/E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAG9E;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GACjC,oBAAoB,GACpB,oBAAoB,GACpB,UAAU,GACV,yBAAyB,GACzB,aAAa,GACb,UAAU,GACV,gBAAgB,GAChB,cAAc,CAAC;AAEnB,4EAA4E;AAC5E,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,yBAAyB,CAAC;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAC;IAC7C;;;;OAIG;IACH,eAAe,IAAI,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAAC;IACtD;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED,kEAAkE;AAClE,MAAM,MAAM,4BAA4B,GAAG,CACzC,OAAO,EAAE,2BAA2B,KACjC,OAAO,CAAC,qBAAqB,CAAC,CAAC;AAgCpC;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,IAAI,4BAA4B,CAgBxE;AAED,kEAAkE;AAClE,MAAM,WAAW,2BAA2B;IAC1C;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,MAAM,CAAC;CACnC;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,2BAA2B,GACnC,4BAA4B,CAc9B;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,oBAAoB,GAAG,IAAI,GAClC,oBAAoB,GAAG,IAAI,CAO7B;AAmBD;;;;GAIG;AACH,wBAAgB,2BAA2B,CACzC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,yBAAyB,EAChC,MAAM,EAAE,oBAAoB,GAAG,IAAI,EACnC,IAAI,EAAE,MAAM,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,EAC9C,MAAM,EAAE,WAAW,GAClB,2BAA2B,CAY7B;AAcD;;;;;;;;;;GAUG;AACH,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,4BAA4B,EACtC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,qBAAqB,CAAC,CAkChC;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,2BAA2B,GACnC,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,CAiBhC"}

package/dist/clientAuthentication.js

@@ -7,8 +7,9 @@
  * certificate the key store holds, one the secret. Neither falls back to the
  * other; a consumer that wants a fallback composes it, and its order is the
  * consumer's statement. Whatever a strategy throws, the broker turns into a
- * `DestinationConfigError` in fixed words (`resolveClientAuthentication`) —
- * nothing of the thrown value, no `cause`.
+ * `DestinationConfigError` in fixed words (`resolveClientAuthentication`),
+ * carrying the thrown value as auth-errors reads it — never its message, no
+ * `cause`.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.fromServiceKeyCertificate = fromServiceKeyCertificate;
@@ -17,33 +18,42 @@ exports.contextClient = contextClient;
 exports.clientAuthenticationContext = clientAuthenticationContext;
 exports.resolveClientAuthentication = resolveClientAuthentication;
 exports.clientIdentity = clientIdentity;
+const auth_errors_1 = require("@mcp-abap-adt/auth-errors");
 const auth_providers_1 = require("@mcp-abap-adt/auth-providers");
 const DestinationConfigError_1 = require("./DestinationConfigError");
 const NO_CERTIFICATE = 'the destination has no client certificate';
 const NO_SECRET = 'the destination has no client secret';
 /**
- * A shipped factory's refusal. Module-private, so nothing outside this file
- * can make one — but a consumer composing a factory can catch and alter it,
- * so the guard reads only `missing` and picks the words itself.
+ * The shipped factories' refusals, and what each lacks: recognised by
+ * identity in this module-private map — never by `instanceof` or a property
+ * of the thrown value — so nothing outside this file can make one, and a
+ * consumer that catches and alters one changes nothing the guard reads.
  */
-class ClientUnavailableError extends Error {
-    missing;
-    constructor(missing) {
-        super(missing === 'certificate' ? NO_CERTIFICATE : NO_SECRET);
-        this.missing = missing;
-        this.name = 'ClientUnavailableError';
-    }
+const unavailable = new WeakMap();
+function clientUnavailable(missing) {
+    const error = new Error(missing === 'certificate' ? NO_CERTIFICATE : NO_SECRET);
+    unavailable.set(error, missing);
+    return error;
+}
+/**
+ * `value` without the slashes it ends with, in one backwards pass: linear in
+ * the length, whatever the store answered — no regular expression on a
+ * stored value.
+ */
+function withoutTrailingSlashes(value) {
+    let end = value.length;
+    while (end > 0 && value.charCodeAt(end - 1) === 0x2f)
+        end -= 1;
+    return value.slice(0, end);
 }
-/** The broker's words for auth-providers' CertificateMaterialError, by its flags. */
-const CERTIFICATE_INCOMPLETE = 'the client certificate is incomplete';
-const CERTIFICATE_EXPIRED = 'the client certificate has expired';
-const CERTIFICATE_UNUSABLE = 'the client certificate could not be used';
 /**
  * `tls_client_auth` with the certificate and key the key store holds, against
  * `${certUrl}/oauth/token`. The material is handed over as given and checked
  * before the factory answers — auth-providers checks it only on first use, so
  * a malformed, incomplete or expired PEM would otherwise surface only at the
- * first token request, in a provider already built and cached.
+ * first token request, in a provider already built and cached. What
+ * `tlsMaterial()` throws — auth-providers' `client-certificate` failure — is
+ * carried by the guard as auth-errors reads it.
  *
  * Throws "the destination has no client certificate" when the store answers
  * `null` or implements no `getClientCertificate`.
@@ -52,14 +62,14 @@ function fromServiceKeyCertificate() {
     return async (context) => {
         const certificate = await context.readCertificate();
         if (!certificate) {
-            throw new ClientUnavailableError('certificate');
+            throw clientUnavailable('certificate');
         }
         const authentication = (0, auth_providers_1.tlsClientCertificate)({
             material: { cert: certificate.certificate, key: certificate.key },
-            endpoint: `${certificate.certUrl.replace(/\/+$/, '')}/oauth/token`,
+            endpoint: `${withoutTrailingSlashes(certificate.certUrl)}/oauth/token`,
         });
         if (typeof authentication.tlsMaterial !== 'function') {
-            throw new ClientUnavailableError('certificate');
+            throw clientUnavailable('certificate');
         }
         await authentication.tlsMaterial();
         return authentication;
@@ -80,7 +90,7 @@ function fromServiceKeySecret(options) {
     return async (context) => {
         const secret = context.client?.uaaClientSecret;
         if (typeof secret !== 'string' || secret.length === 0) {
-            throw new ClientUnavailableError('secret');
+            throw clientUnavailable('secret');
         }
         return (0, auth_providers_1.clientSecretBasic)(secret, { encoding });
     };
@@ -118,9 +128,9 @@ function certificateOf(answer) {
 /**
  * The context for one build: the client through `contextClient`;
  * `readCertificate` lazy and memoised — the first call reads, every later one
- * gets the same answer.
+ * gets the same answer; `signal`, the build's attempt.
  */
-function clientAuthenticationContext(destination, grant, client, read) {
+function clientAuthenticationContext(destination, grant, client, read, signal) {
     let certificate;
     return {
         destination,
@@ -130,46 +140,32 @@ function clientAuthenticationContext(destination, grant, client, read) {
             certificate ??= read().then(certificateOf);
             return certificate;
         },
+        signal,
     };
 }
 const FAILED = 'the clientAuthentication strategy failed';
 const REFUSED = 'the clientAuthentication strategy refused';
-/**
- * The fixed words for what a strategy threw. Every word is this module's own:
- * the thrown value only selects among them, through `instanceof` and flags
- * compared with `===` — never a message, never its `words`. Classifying may
- * itself throw (a Proxy, a getter), so it runs in its own try and falls back
- * to the generic words.
- */
-function refusalWords(error) {
-    try {
-        if (error instanceof ClientUnavailableError) {
-            const missing = error.missing;
-            if (missing === 'certificate')
-                return `${REFUSED}: ${NO_CERTIFICATE}`;
-            if (missing === 'secret')
-                return `${REFUSED}: ${NO_SECRET}`;
-            return FAILED;
-        }
-        if (error instanceof auth_providers_1.CertificateMaterialError) {
-            if (error.incomplete === true) {
-                return `${REFUSED}: ${CERTIFICATE_INCOMPLETE}`;
-            }
-            if (error.expired === true)
-                return `${REFUSED}: ${CERTIFICATE_EXPIRED}`;
-            return `${REFUSED}: ${CERTIFICATE_UNUSABLE}`;
-        }
-    }
-    catch {
-        // Fall through: the thrown value could not even be classified.
-    }
-    return FAILED;
+/** A shipped factory's refusal: the broker's own words, by what it lacks. */
+function unavailableWords(error) {
+    if (typeof error !== 'object' || error === null)
+        return undefined;
+    const missing = unavailable.get(error);
+    if (missing === 'certificate')
+        return `${REFUSED}: ${NO_CERTIFICATE}`;
+    if (missing === 'secret')
+        return `${REFUSED}: ${NO_SECRET}`;
+    return undefined;
 }
 /**
  * Runs the strategy inside the guard. Any throw — the strategy's own, a
  * store's, a malformed PEM — and any answer that is no client authentication
  * becomes a `DestinationConfigError` naming `clientAuthentication`, in fixed
- * words: no `cause`, nothing of the thrown value.
+ * words. A shipped factory's own refusal keeps the broker's words; anything
+ * else is "the clientAuthentication strategy failed", carrying
+ * `readFailure(thrown, 'client-authentication-strategy')` — a provider's
+ * failure (an unusable certificate) as the provider made it, a strategy's own
+ * error only as its classification. No `cause`, no message of the thrown
+ * value.
  */
 async function resolveClientAuthentication(strategy, context) {
     let answer;
@@ -183,7 +179,11 @@ async function resolveClientAuthentication(strategy, context) {
                 typeof answer.authenticate === 'function';
     }
     catch (error) {
-        throw new DestinationConfigError_1.DestinationConfigError(context.destination, ['clientAuthentication'], refusalWords(error));
+        const words = unavailableWords(error);
+        if (words !== undefined) {
+            throw new DestinationConfigError_1.DestinationConfigError(context.destination, ['clientAuthentication'], words);
+        }
+        throw new DestinationConfigError_1.DestinationConfigError(context.destination, ['clientAuthentication'], FAILED, (0, auth_errors_1.readFailure)(error, 'client-authentication-strategy'));
     }
     if (!usable) {
         throw new DestinationConfigError_1.DestinationConfigError(context.destination, ['clientAuthentication'], 'the clientAuthentication strategy answered no client authentication');

package/dist/contractShape.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The shape of a contract object as this package has always built it.
+ *
+ * The contract packages (`@mcp-abap-adt/interfaces-auth`, `-auth-broker`,
+ * `-auth-sap`) and `@mcp-abap-adt/auth-providers` declare their optional
+ * fields `?: T`, which under `exactOptionalPropertyTypes` means "absent, never
+ * `undefined`". The broker builds those objects — a provider's configuration,
+ * the session it writes, the client it hands a consumer factory — with an
+ * optional field that has no value present and set to `undefined`
+ * (`refreshToken: undefined`), and a store, a provider or a consumer may
+ * depend on the key being there (`'refreshToken' in config`, `Object.keys`,
+ * `{ ...stored, ...secret }`). The key's presence is behaviour, kept as it was.
+ */
+/** `T` whose optional fields may also hold an explicit `undefined`. */
+export type WithUndefined<T> = {
+    [K in keyof T]: T[K] | (undefined extends T[K] ? undefined : never);
+};
+/**
+ * The contract type of an object built with explicit `undefined`s. The one
+ * assertion between the two shapes: every field still has the contract's
+ * type, and no field is added or dropped.
+ */
+export declare function asContract<T>(value: WithUndefined<T>): T;
+//# sourceMappingURL=contractShape.d.ts.map

package/dist/contractShape.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contractShape.d.ts","sourceRoot":"","sources":["../src/contractShape.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,uEAAuE;AACvE,MAAM,MAAM,aAAa,CAAC,CAAC,IAAI;KAC5B,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,GAAG,KAAK,CAAC;CACpE,CAAC;AAEF;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAExD"}

package/dist/contractShape.js

@@ -0,0 +1,24 @@
+"use strict";
+/**
+ * The shape of a contract object as this package has always built it.
+ *
+ * The contract packages (`@mcp-abap-adt/interfaces-auth`, `-auth-broker`,
+ * `-auth-sap`) and `@mcp-abap-adt/auth-providers` declare their optional
+ * fields `?: T`, which under `exactOptionalPropertyTypes` means "absent, never
+ * `undefined`". The broker builds those objects — a provider's configuration,
+ * the session it writes, the client it hands a consumer factory — with an
+ * optional field that has no value present and set to `undefined`
+ * (`refreshToken: undefined`), and a store, a provider or a consumer may
+ * depend on the key being there (`'refreshToken' in config`, `Object.keys`,
+ * `{ ...stored, ...secret }`). The key's presence is behaviour, kept as it was.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.asContract = asContract;
+/**
+ * The contract type of an object built with explicit `undefined`s. The one
+ * assertion between the two shapes: every field still has the contract's
+ * type, and no field is added or dropped.
+ */
+function asContract(value) {
+    return value;
+}

package/dist/destinations.d.ts

@@ -4,15 +4,30 @@
  * Two fields choose the provider — `authType` and, for `jwt` and `saml`,
  * `grantType` — and nothing else: no field's presence or absence is ever
  * read to pick a row. Both come from the key store's means.
+ *
+ * Every token row takes the consumer's `renewal` (called once per build, with
+ * the destination and its grant) and persists through auth-providers'
+ * `refreshStatePersistence` over the broker's write, governed by the
+ * consumer's `onWriteFailure`; a row built without either is refused naming
+ * it, beside every other missing field, in one error. A failure the broker
+ * reads — the SNC provider's, a validator's, a provider constructor's — is
+ * read through auth-errors (`readFailure`) and carried by the
+ * `DestinationConfigError`, never matched by class.
  */
-import { type IDeviceCodePresenter, type OidcCallbackResult } from '@mcp-abap-adt/auth-providers';
-import type { IAssertionReplayStore, IAuthorizationStrategy, IAuthProvider, IClientAuthentication, ITokenResult } from '@mcp-abap-adt/interfaces-auth';
+import { type IDeviceCodePresenter, type OidcCallbackResult, type PersistedTokens } from '@mcp-abap-adt/auth-providers';
+import type { IAssertionReplayStore, IAuthorizationStrategy, IAuthProvider, IClientAuthentication, IRenewalStrategy } from '@mcp-abap-adt/interfaces-auth';
 import type { DestinationGrant, IConfig, IConnectionConfig } from '@mcp-abap-adt/interfaces-auth-broker';
 import type { IAuthorizationConfig } from '@mcp-abap-adt/interfaces-auth-sap';
 import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
 import { type Binding } from './binding';
 import type { ClientIdentity } from './clientAuthentication';
+import { DestinationConfigError } from './DestinationConfigError';
 type StatedAuthType = NonNullable<IConnectionConfig['authType']>;
+/**
+ * `authType` and `grantType` are a `jwt` / `saml` pair of the closed list —
+ * so neither holds `;` or `/`. Never throws.
+ */
+export declare function isStatedRow(authType: unknown, grant: unknown): grant is DestinationGrant & string;
 /** The stated `authType`, or the error naming it. */
 export declare function statedAuthType(destination: string, means: IConnectionConfig | null): StatedAuthType;
 /** The stated grant of a `jwt` or `saml` destination, or the error naming it. */
@@ -31,25 +46,95 @@ export declare function basicProvider(destination: string, means: IConnectionCon
  * `sncLib` is absent and the user's name taken from the credential when
  * `sncMyName` is, and the provider documents its own `qop` default.
  */
-export declare function sncProvider(destination: string, means: IConnectionConfig, logger: ILogger): IAuthProvider;
+export declare function sncProvider(destination: string, means: IConnectionConfig, logger: ILogger): IAuthProvider & Attachable;
 /**
  * `none` → the credential handed over, from the session: the only way in, so
  * required. Read from the secret alone — the means are not a seed.
  *
  * The broker did not obtain it and cannot obtain it again, so a binding that
- * does not match is refused, never discarded: `issuedFor`
- * must always equal the destination's resource — it is what stops the
- * credential going to another one; `issuedBy` is compared only when the means
- * state an issuer.
+ * does not match is refused, never discarded: `issuedFor` must equal the
+ * destination's resource — it is what stops the credential going to another
+ * one — and `issuedBy` must be exactly the row's record: a credential
+ * handed over with a 4.x binding, or none, is refused until it is written
+ * again with 5.0.0's `bindingOf`.
  */
 export declare function handedOverProvider(destination: string, authType: 'jwt' | 'saml', secret: IConfig | null, binding: Binding): IAuthProvider;
+/** Every grant that obtains a secret: `DestinationGrant` without `'none'`. */
+export type TokenGrant = Exclude<DestinationGrant, 'none'>;
+/**
+ * A provider that has parties: every token provider
+ * (`BaseTokenProvider.attach`) and the SNC one (`SncLogonProvider.attach`).
+ */
+export interface Attachable {
+    attach(signal: AbortSignal): () => void;
+}
+/**
+ * A token row's provider, and the refresh token the builder handed it from
+ * the session — the very value in the provider's config, so what the broker
+ * takes as the refresh token the build owns at its start is what the
+ * provider was given, for every grant, and cannot drift from it:
+ * `client_credentials` is handed none (its row takes no seed), `saml2_pure`
+ * none (it holds cookies), and a build that started with nothing none.
+ */
+export interface RowBuild {
+    /** A token provider: it has parties. */
+    readonly provider: IAuthProvider & Attachable;
+    readonly seededRefreshToken: string | undefined;
+}
+/** How the consumer's `renewal` option is shaped. */
+export type RenewalOption = (destination: string, grant: TokenGrant) => IRenewalStrategy;
+/**
+ * What every token row takes from the broker beside its own data: the
+ * consumer's `renewal` and `onWriteFailure` (each refused by name when
+ * absent) and the broker's one write of the destination's session.
+ */
+export interface TokenRowOptions {
+    renewal: RenewalOption | undefined;
+    onWriteFailure: 'fail' | 'continue' | undefined;
+    /**
+     * One session write for the destination: resolves when it landed, rejects
+     * with the store's error when it did not.
+     */
+    write: (tokens: PersistedTokens) => Promise<void>;
+    logger: ILogger;
+    /**
+     * The consumer's `authDebug === true`, decided once by the broker: every
+     * token provider a row builds is given it.
+     */
+    authDebug: boolean;
+}
+/** `onWriteFailure` as given: `'fail'` or `'continue'`, nothing else. */
+export declare function isWriteFailurePolicy(value: unknown): value is 'fail' | 'continue';
+/**
+ * The consumer options a token row lacks, by name: `renewal` when it is no
+ * function, `onWriteFailure` when it is neither `'fail'` nor `'continue'`.
+ * There is no default for either.
+ */
+export declare function optionsLacking(options: Pick<TokenRowOptions, 'renewal' | 'onWriteFailure'>): string[];
 /** The UAA grants: one client, one token endpoint (`<uaaUrl>/oauth/token`). */
 export type UaaGrant = 'authorization_code' | 'client_credentials' | 'passcode';
 export declare function isUaaGrant(grant: DestinationGrant): grant is UaaGrant;
-/** What a UAA row is built from. */
-export interface UaaRow {
+/**
+ * What a token row's check reads of its client and options. `client`
+ * `undefined` means "not known yet": the consumer's `clientAuthentication`
+ * strategy will tell the client identity, so its fields are not judged.
+ */
+interface ClientCheck {
     destination: string;
+    client: RowClient | null | undefined;
+    /** Whether the client authenticates through the consumer's strategy. */
+    clientAuthenticated: boolean;
+    renewal: RenewalOption | undefined;
+    onWriteFailure: 'fail' | 'continue' | undefined;
+}
+/** What a UAA row's check reads. */
+export interface UaaCheck extends ClientCheck {
     grant: UaaGrant;
+    /** The consumer's `authorization` option. */
+    authorization: ((destination: string, grant: 'authorization_code' | 'passcode') => IAuthorizationStrategy<string>) | undefined;
+}
+/** What a UAA row is built from. */
+export interface UaaRow extends Omit<UaaCheck, 'client' | 'clientAuthenticated'>, TokenRowOptions {
     /**
      * The client: the key store's `getAuthorizationConfig` — or, with a
      * strategy and no secret client, the certificate client's identity.
@@ -62,82 +147,91 @@ export interface UaaRow {
      * client with it and gets no `clientSecret`; absent, 4.0.0's secret.
      */
     clientAuthentication?: IClientAuthentication;
-    /** The consumer's `authorization` option. */
-    authorization: ((destination: string, grant: 'authorization_code' | 'passcode') => IAuthorizationStrategy<string>) | undefined;
-    logger: ILogger;
-    onTokens: (result: ITokenResult) => Promise<void>;
 }
+/**
+ * Every field and option a UAA row lacks, named in one error — or nothing.
+ * `serviceUrl` is not among them: the providers read the client and `uaaUrl`
+ * only. Without a strategy, `uaaClientSecret: ''` is a public client:
+ * `passcode` takes it as no secret; the other two rows' providers require a
+ * secret, so for them `''` is missing.
+ */
+export declare function uaaRefusal(check: UaaCheck): DestinationConfigError | undefined;
 /**
  * `jwt` / `authorization_code` → `AuthorizationCodeProvider`,
  * `client_credentials` → `ClientCredentialsProvider`, `passcode` →
  * `UaaPasscodeProvider`: the client from the key store, the seed from the
- * session (not for `client_credentials`, whose row takes the client alone).
+ * session (not for `client_credentials`, whose row takes the client alone),
+ * the consumer's renewal for this grant, and the broker's persistence.
  *
- * Every field and option the row lacks is named in one error, before the
- * consumer's `authorization` is called. `serviceUrl` is not among them: the
- * providers read the client and `uaaUrl` only. Without a strategy,
- * `uaaClientSecret: ''` is a public client: `passcode` takes it as no secret;
- * the other two rows' providers require a secret, so for them `''` is
- * missing. On the strategy path the client may be a certificate client's
- * identity, which holds no secret field at all (`RowClient`).
- *
- * With the strategy's answer (`clientAuthentication`) no secret is required
- * and none is passed: the provider authenticates its client with the answer.
+ * Every field and option the row lacks is named in one error
+ * (`uaaRefusal`), before the consumer's `authorization` or `renewal` is
+ * called. On the strategy path the client may be a certificate client's
+ * identity, which holds no secret field at all (`RowClient`). With the
+ * strategy's answer (`clientAuthentication`) no secret is required and none
+ * is passed: the provider authenticates its client with the answer.
  */
-export declare function uaaProvider(row: UaaRow): IAuthProvider;
+export declare function uaaProvider(row: UaaRow): RowBuild;
 /** The OIDC grants: a client, and an issuer or explicit endpoints. */
 export type OidcGrant = 'oidc_authorization_code' | 'device_code' | 'password' | 'token_exchange';
 export declare function isOidcGrant(grant: DestinationGrant): grant is OidcGrant;
-/** What an OIDC row is built from. */
-export interface OidcRow {
-    destination: string;
+/** What an OIDC row's check reads. */
+export interface OidcCheck extends ClientCheck {
     grant: OidcGrant;
     means: IConnectionConfig;
+    oidcAuthorization: ((destination: string) => IAuthorizationStrategy<OidcCallbackResult>) | undefined;
+    deviceCodePresenter: ((destination: string) => IDeviceCodePresenter) | undefined;
+}
+/** What an OIDC row is built from. */
+export interface OidcRow extends Omit<OidcCheck, 'client' | 'clientAuthenticated'>, TokenRowOptions {
     /** The client, from the key store's `getAuthorizationConfig`. */
     client: RowClient | null;
     /** The session secret — the seed; `null` when there is none, or it is not bound here. */
     secret: IConfig | null;
     /** The consumer strategy's answer: given, it replaces the secret. */
     clientAuthentication?: IClientAuthentication;
-    oidcAuthorization: ((destination: string) => IAuthorizationStrategy<OidcCallbackResult>) | undefined;
-    deviceCodePresenter: ((destination: string) => IDeviceCodePresenter) | undefined;
-    logger: ILogger;
-    onTokens: (result: ITokenResult) => Promise<void>;
 }
+/**
+ * Every field and option an OIDC row lacks, named in one error — or nothing.
+ * The endpoints: `oidcIssuerUrl`, from which the provider discovers them, or
+ * every explicit endpoint the row uses — without either the error names the
+ * issuer and the endpoints missing.
+ */
+export declare function oidcRefusal(check: OidcCheck): DestinationConfigError | undefined;
 /**
  * `jwt` / `oidc_authorization_code` → `OidcBrowserProvider`, `device_code` →
  * `OidcDeviceFlowProvider`, `password` → `OidcPasswordProvider`,
  * `token_exchange` → `OidcTokenExchangeProvider`: the client id (and secret,
  * `''` being a public client) from the key store's client, the grant's data
- * from its `oidc*` fields, the seed from the session.
+ * from its `oidc*` fields, the seed from the session, the consumer's renewal
+ * for this grant, and the broker's persistence.
  *
- * The endpoints: `oidcIssuerUrl`, from which the provider discovers them, or
- * every explicit endpoint the row uses — without either the error names the
- * issuer and the endpoints missing. Every field and option the row lacks is
- * named in one error, before any collaborator is called. `token_exchange`
- * takes one scope string: the stored scopes joined by a space.
+ * Every field and option the row lacks is named in one error
+ * (`oidcRefusal`), before any collaborator is called. `token_exchange` takes
+ * one scope string: the stored scopes joined by a space.
  */
-export declare function oidcProvider(row: OidcRow): IAuthProvider;
+export declare function oidcProvider(row: OidcRow): RowBuild;
 /** The SAML grants: an identity provider's assertion, validated first. */
 export type SamlGrant = 'saml2_pure' | 'saml2_bearer';
 export declare function isSamlGrant(grant: DestinationGrant): grant is SamlGrant;
-/** What a SAML row is built from. */
-export interface SamlRow {
-    destination: string;
+/** What a SAML row's check reads. */
+export interface SamlCheck extends ClientCheck {
     grant: SamlGrant;
     means: IConnectionConfig;
+    authorization: ((destination: string, grant: SamlGrant) => IAuthorizationStrategy<string>) | undefined;
+    samlCookies: ((destination: string) => (samlResponse: string) => Promise<string>) | undefined;
+    assertionReplayStore: ((destination: string) => IAssertionReplayStore) | undefined;
+}
+/** What a SAML row is built from. */
+export interface SamlRow extends Omit<SamlCheck, 'client' | 'clientAuthenticated'>, TokenRowOptions {
     /** `saml2_bearer`'s client, from the key store; `null` for `saml2_pure`. */
     client: RowClient | null;
     /** The session secret — the seed; `null` when there is none, or it is not bound here. */
     secret: IConfig | null;
     /** `saml2_bearer`: the consumer strategy's answer; given, it replaces the secret. */
     clientAuthentication?: IClientAuthentication;
-    authorization: ((destination: string, grant: SamlGrant) => IAuthorizationStrategy<string>) | undefined;
-    samlCookies: ((destination: string) => (samlResponse: string) => Promise<string>) | undefined;
-    assertionReplayStore: ((destination: string) => IAssertionReplayStore) | undefined;
-    logger: ILogger;
-    onTokens: (result: ITokenResult) => Promise<void>;
 }
+/** Every field and option a SAML row lacks, named in one error — or nothing. */
+export declare function samlRefusal(check: SamlCheck): DestinationConfigError | undefined;
 /**
  * `saml` / `saml2_pure` → `Saml2PureProvider`, `saml2_bearer` →
  * `Saml2BearerProvider`, each validating the assertion before anything uses
@@ -152,13 +246,15 @@ export interface SamlRow {
  * `saml2_bearer` with the stored token, its refresh token and expiry, and
  * takes the client (`uaaUrl`, `uaaClientId`; without a strategy,
  * `uaaClientSecret` `''` a public client; on the strategy path the identity
- * alone, no secret) and `samlTokenUrl` when stated.
+ * alone, no secret) and `samlTokenUrl` when stated. Both take the consumer's
+ * renewal for their grant and the broker's persistence.
  *
- * Every field and option the row lacks is named in one error, before any
- * collaborator is called; so is a `samlClockSkewMs` that is not a whole number
- * of milliseconds, and a certificate the validator cannot read — by name, never
- * the value.
+ * Every field and option the row lacks is named in one error
+ * (`samlRefusal`), before any collaborator is called; so is a
+ * `samlClockSkewMs` that is not a whole number of milliseconds, and a
+ * certificate the validator cannot read — by name, never the value, the
+ * validator's error carried.
  */
-export declare function samlProvider(row: SamlRow): IAuthProvider;
+export declare function samlProvider(row: SamlRow): RowBuild;
 export {};
 //# sourceMappingURL=destinations.d.ts.map

package/dist/destinations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"destinations.d.ts","sourceRoot":"","sources":["../src/destinations.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAML,KAAK,oBAAoB,EAEzB,KAAK,kBAAkB,EAWxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EACV,qBAAqB,EAErB,sBAAsB,EACtB,aAAa,EACb,qBAAqB,EACrB,YAAY,EACb,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EACV,gBAAgB,EAChB,OAAO,EACP,iBAAiB,EAClB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAAE,KAAK,OAAO,EAA4B,MAAM,WAAW,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAG7D,KAAK,cAAc,GAAG,WAAW,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;AAwBjE,qDAAqD;AACrD,wBAAgB,cAAc,CAC5B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,iBAAiB,GAAG,IAAI,GAC9B,cAAc,CAmBhB;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CACzB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,KAAK,GAAG,MAAM,EACxB,KAAK,EAAE,iBAAiB,GACvB,gBAAgB,CAiBlB;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,oBAAoB,GAAG,cAAc,CAAC;AAwD9D,+EAA+E;AAC/E,wBAAgB,aAAa,CAC3B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,iBAAiB,GACvB,aAAa,CAaf;AAUD;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,OAAO,GACd,aAAa,CA0Bf;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,KAAK,GAAG,MAAM,EACxB,MAAM,EAAE,OAAO,GAAG,IAAI,EACtB,OAAO,EAAE,OAAO,GACf,aAAa,CA2Bf;AAED,+EAA+E;AAC/E,MAAM,MAAM,QAAQ,GAAG,oBAAoB,GAAG,oBAAoB,GAAG,UAAU,CAAC;AAEhF,wBAAgB,UAAU,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,IAAI,QAAQ,CAMrE;AAED,oCAAoC;AACpC,MAAM,WAAW,MAAM;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,QAAQ,CAAC;IAChB;;;OAGG;IACH,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB,sEAAsE;IACtE,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,6CAA6C;IAC7C,aAAa,EACT,CAAC,CACC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,oBAAoB,GAAG,UAAU,KACrC,sBAAsB,CAAC,MAAM,CAAC,CAAC,GACpC,SAAS,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CAqEtD;AAyBD,sEAAsE;AACtE,MAAM,MAAM,SAAS,GACjB,yBAAyB,GACzB,aAAa,GACb,UAAU,GACV,gBAAgB,CAAC;AAErB,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,IAAI,SAAS,CAOvE;AAeD,sCAAsC;AACtC,MAAM,WAAW,OAAO;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,iBAAiB,CAAC;IACzB,iEAAiE;IACjE,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB,yFAAyF;IACzF,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB,qEAAqE;IACrE,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,iBAAiB,EACb,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,sBAAsB,CAAC,kBAAkB,CAAC,CAAC,GACrE,SAAS,CAAC;IACd,mBAAmB,EACf,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,oBAAoB,CAAC,GAC/C,SAAS,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,CAyFxD;AAED,0EAA0E;AAC1E,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,cAAc,CAAC;AAEtD,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,IAAI,SAAS,CAEvE;AAED,qCAAqC;AACrC,MAAM,WAAW,OAAO;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,iBAAiB,CAAC;IACzB,4EAA4E;IAC5E,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB,yFAAyF;IACzF,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;IAC7C,aAAa,EACT,CAAC,CACC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,KACb,sBAAsB,CAAC,MAAM,CAAC,CAAC,GACpC,SAAS,CAAC;IACd,WAAW,EACP,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,GACpE,SAAS,CAAC;IACd,oBAAoB,EAChB,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,qBAAqB,CAAC,GAChD,SAAS,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,CAqGxD"}
+{"version":3,"file":"destinations.d.ts","sourceRoot":"","sources":["../src/destinations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,OAAO,EAOL,KAAK,oBAAoB,EAGzB,KAAK,kBAAkB,EAOvB,KAAK,eAAe,EAYrB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EACV,qBAAqB,EAErB,sBAAsB,EACtB,aAAa,EAEb,qBAAqB,EACrB,gBAAgB,EAEjB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EACV,gBAAgB,EAChB,OAAO,EACP,iBAAiB,EAClB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAAE,KAAK,OAAO,EAA4B,MAAM,WAAW,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAE7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,KAAK,cAAc,GAAG,WAAW,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;AAmBjE;;;GAGG;AACH,wBAAgB,WAAW,CACzB,QAAQ,EAAE,OAAO,EACjB,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,gBAAgB,GAAG,MAAM,CAGpC;AA+BD,qDAAqD;AACrD,wBAAgB,cAAc,CAC5B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,iBAAiB,GAAG,IAAI,GAC9B,cAAc,CAmBhB;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CACzB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,KAAK,GAAG,MAAM,EACxB,KAAK,EAAE,iBAAiB,GACvB,gBAAgB,CAiBlB;AAED;;;;GAIG;AACH,MAAM,MAAM,SAAS,GAAG,oBAAoB,GAAG,cAAc,CAAC;AAwD9D,+EAA+E;AAC/E,wBAAgB,aAAa,CAC3B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,iBAAiB,GACvB,aAAa,CAaf;AAUD;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,OAAO,GACd,aAAa,GAAG,UAAU,CAiC5B;AA2BD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,KAAK,GAAG,MAAM,EACxB,MAAM,EAAE,OAAO,GAAG,IAAI,EACtB,OAAO,EAAE,OAAO,GACf,aAAa,CAyBf;AAED,8EAA8E;AAC9E,MAAM,MAAM,UAAU,GAAG,OAAO,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC;AAE3D;;;GAGG;AACH,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,IAAI,CAAC;CACzC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,QAAQ;IACvB,wCAAwC;IACxC,QAAQ,CAAC,QAAQ,EAAE,aAAa,GAAG,UAAU,CAAC;IAC9C,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,SAAS,CAAC;CACjD;AAED,qDAAqD;AACrD,MAAM,MAAM,aAAa,GAAG,CAC1B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,UAAU,KACd,gBAAgB,CAAC;AAEtB;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,aAAa,GAAG,SAAS,CAAC;IACnC,cAAc,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;IAChD;;;OAGG;IACH,KAAK,EAAE,CAAC,MAAM,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,MAAM,EAAE,OAAO,CAAC;IAChB;;;OAGG;IACH,SAAS,EAAE,OAAO,CAAC;CACpB;AAED,yEAAyE;AACzE,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,MAAM,GAAG,UAAU,CAE9B;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,SAAS,GAAG,gBAAgB,CAAC,GAC3D,MAAM,EAAE,CAOV;AA+GD,+EAA+E;AAC/E,MAAM,MAAM,QAAQ,GAAG,oBAAoB,GAAG,oBAAoB,GAAG,UAAU,CAAC;AAEhF,wBAAgB,UAAU,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,IAAI,QAAQ,CAMrE;AAED;;;;GAIG;AACH,UAAU,WAAW;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,SAAS,GAAG,IAAI,GAAG,SAAS,CAAC;IACrC,wEAAwE;IACxE,mBAAmB,EAAE,OAAO,CAAC;IAC7B,OAAO,EAAE,aAAa,GAAG,SAAS,CAAC;IACnC,cAAc,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS,CAAC;CACjD;AAED,oCAAoC;AACpC,MAAM,WAAW,QAAS,SAAQ,WAAW;IAC3C,KAAK,EAAE,QAAQ,CAAC;IAChB,6CAA6C;IAC7C,aAAa,EACT,CAAC,CACC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,oBAAoB,GAAG,UAAU,KACrC,sBAAsB,CAAC,MAAM,CAAC,CAAC,GACpC,SAAS,CAAC;CACf;AAED,oCAAoC;AACpC,MAAM,WAAW,MACf,SAAQ,IAAI,CAAC,QAAQ,EAAE,QAAQ,GAAG,qBAAqB,CAAC,EACtD,eAAe;IACjB;;;OAGG;IACH,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB,sEAAsE;IACtE,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB;;;OAGG;IACH,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;CAC9C;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,KAAK,EAAE,QAAQ,GACd,sBAAsB,GAAG,SAAS,CAyBpC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,CA0FjD;AAyBD,sEAAsE;AACtE,MAAM,MAAM,SAAS,GACjB,yBAAyB,GACzB,aAAa,GACb,UAAU,GACV,gBAAgB,CAAC;AAErB,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,IAAI,SAAS,CAOvE;AAeD,sCAAsC;AACtC,MAAM,WAAW,SAAU,SAAQ,WAAW;IAC5C,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,iBAAiB,CAAC;IACzB,iBAAiB,EACb,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,sBAAsB,CAAC,kBAAkB,CAAC,CAAC,GACrE,SAAS,CAAC;IACd,mBAAmB,EACf,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,oBAAoB,CAAC,GAC/C,SAAS,CAAC;CACf;AAED,sCAAsC;AACtC,MAAM,WAAW,OACf,SAAQ,IAAI,CAAC,SAAS,EAAE,QAAQ,GAAG,qBAAqB,CAAC,EACvD,eAAe;IACjB,iEAAiE;IACjE,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB,yFAAyF;IACzF,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB,qEAAqE;IACrE,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;CAC9C;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,SAAS,GACf,sBAAsB,GAAG,SAAS,CAsCpC;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,CAgHnD;AAED,0EAA0E;AAC1E,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,cAAc,CAAC;AAEtD,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,IAAI,SAAS,CAEvE;AAED,qCAAqC;AACrC,MAAM,WAAW,SAAU,SAAQ,WAAW;IAC5C,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,iBAAiB,CAAC;IACzB,aAAa,EACT,CAAC,CACC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,KACb,sBAAsB,CAAC,MAAM,CAAC,CAAC,GACpC,SAAS,CAAC;IACd,WAAW,EACP,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,GACpE,SAAS,CAAC;IACd,oBAAoB,EAChB,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,qBAAqB,CAAC,GAChD,SAAS,CAAC;CACf;AAED,qCAAqC;AACrC,MAAM,WAAW,OACf,SAAQ,IAAI,CAAC,SAAS,EAAE,QAAQ,GAAG,qBAAqB,CAAC,EACvD,eAAe;IACjB,4EAA4E;IAC5E,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC;IACzB,yFAAyF;IACzF,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;CAC9C;AAED,gFAAgF;AAChF,wBAAgB,WAAW,CACzB,KAAK,EAAE,SAAS,GACf,sBAAsB,GAAG,SAAS,CAkCpC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,QAAQ,CA8GnD"}