@mcp-abap-adt/auth-providers 1.2.0 → 2.2.0

package/dist/auth/oidcBrowserAuth.js

@@ -2,110 +2,28 @@
 /**
  * OIDC browser authorization code flow (capture code)
  */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.startOidcBrowserAuth = startOidcBrowserAuth;
-const net = __importStar(require("node:net"));
+exports.withOidcCallbackServer = void 0;
 const callbackServer_1 = require("./callbackServer");
-const BROWSER_MAP = {
-    chrome: 'chrome',
-    edge: 'msedge',
-    firefox: 'firefox',
-    system: undefined,
-    auto: undefined,
-    headless: null,
-    none: null,
-};
-function isPortAvailable(port) {
-    return new Promise((resolve) => {
-        const server = net.createServer();
-        server.listen(port, () => {
-            server.once('close', () => resolve(true));
-            server.close();
-        });
-        server.on('error', () => resolve(false));
-    });
-}
-async function openBrowserUrl(authorizationUrl, browser, logger) {
-    const browserApp = BROWSER_MAP[browser];
-    if (browserApp === null) {
-        logger?.info('[OIDC] Browser suppressed, open URL manually', {
-            authorizationUrl,
-        });
-        return;
-    }
-    if (browser === 'auto') {
-        try {
-            const openModule = await Promise.resolve().then(() => __importStar(require('open')));
-            const open = openModule.default;
-            await open(authorizationUrl);
-            logger?.info('[OIDC] Browser opened');
-            return;
-        }
-        catch (error) {
-            logger?.warn('[OIDC] Failed to open browser automatically', {
-                error: error instanceof Error ? error.message : String(error),
-            });
-            logger?.info('[OIDC] Open URL manually', { authorizationUrl });
-            return;
-        }
-    }
-    try {
-        const openModule = await Promise.resolve().then(() => __importStar(require('open')));
-        const open = openModule.default;
-        if (browserApp) {
-            await open(authorizationUrl, { app: { name: browserApp } });
-        }
-        else {
-            await open(authorizationUrl);
-        }
-    }
-    catch (error) {
-        logger?.warn('[OIDC] Failed to open browser', {
-            error: error instanceof Error ? error.message : String(error),
-        });
-        logger?.info('[OIDC] Open URL manually', { authorizationUrl });
-    }
-}
 const withOidcCallbackServer = (options, use) => (0, callbackServer_1.runCallbackScope)(options, (app, settle) => {
     app.get('/callback', (req, res) => {
+        // An IdP that declines says so explicitly. That is a finished login,
+        // not a stray request, and it must not wait for the timeout.
+        const { error, error_description, error_uri } = req.query;
+        if (error) {
+            const message = error_description
+                ? `${String(error)}: ${String(error_description)}`
+                : String(error);
+            res.status(400).send(`Authentication failed: ${message}`);
+            settle.err(new Error(`OIDC authentication failed: ${message}` +
+                (error_uri ? ` (${String(error_uri)})` : '')), res);
+            return;
+        }
         const code = req.query.code;
         const state = req.query.state;
         if (!code || typeof code !== 'string') {
-            res.status(400).send('Missing authorization code');
-            settle.err(new Error('Missing authorization code'), res);
+            res.status(400).send('Error: not an authorization callback');
+            settle.ignore('no code and no error in query', res);
             return;
         }
         res
@@ -114,31 +32,4 @@ const withOidcCallbackServer = (options, use) => (0, callbackServer_1.runCallbac
         settle.ok({ code, state: typeof state === 'string' ? state : undefined }, res);
     });
 }, use);
-/**
- * OIDC browser login.
- *
- * The callback socket belongs to the scope: it is released when the scope ends,
- * whatever ends it. Before this, the flow had no timeout at all — an abandoned
- * login never settled and the port was held for the life of the process.
- */
-async function startOidcBrowserAuth(authorizationUrl, browser, logger, port = 3001, timeoutMs = 30 * 1000) {
-    // Pre-check kept for its message: AuthBroker matches /already in use/i to
-    // distinguish a busy port from other failures.
-    const portAvailable = await isPortAvailable(port);
-    if (!portAvailable) {
-        throw new Error(`Port ${port} is already in use. Please specify a different port or free the port.`);
-    }
-    return await withOidcCallbackServer({ port, timeoutMs }, async (server) => {
-        logger?.info('[OIDC] Callback server listening', { port: server.port });
-        const waiting = server.waitForResult();
-        // Not awaited: a launcher that hangs must not delay the timeout or the
-        // release of the port.
-        void openBrowserUrl(authorizationUrl, browser, logger).catch((error) => {
-            logger?.warn('[OIDC] Failed to open browser', {
-                error: error instanceof Error ? error.message : String(error),
-            });
-            logger?.info('[OIDC] Open URL manually', { authorizationUrl });
-        });
-        return await waiting;
-    });
-}
+exports.withOidcCallbackServer = withOidcCallbackServer;

package/dist/auth/oidcDiscovery.d.ts

@@ -1,7 +1,7 @@
 /**
  * OIDC discovery helper
  */
-import type { ILogger } from '@mcp-abap-adt/interfaces';
+import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
 export interface OidcDiscoveryDocument {
     issuer: string;
     authorization_endpoint?: string;

package/dist/auth/oidcDiscovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidcDiscovery.d.ts","sourceRoot":"","sources":["../../src/auth/oidcDiscovery.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAGxD,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAWD,wBAAsB,YAAY,CAChC,oBAAoB,EAAE,MAAM,EAC5B,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,qBAAqB,CAAC,CAkBhC"}
+{"version":3,"file":"oidcDiscovery.d.ts","sourceRoot":"","sources":["../../src/auth/oidcDiscovery.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAG9D,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,cAAc,EAAE,MAAM,CAAC;IACvB,6BAA6B,CAAC,EAAE,MAAM,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAWD,wBAAsB,YAAY,CAChC,oBAAoB,EAAE,MAAM,EAC5B,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,qBAAqB,CAAC,CAkBhC"}

package/dist/auth/oidcToken.d.ts

@@ -1,7 +1,7 @@
 /**
  * OIDC token endpoint helpers
  */
-import type { ILogger } from '@mcp-abap-adt/interfaces';
+import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
 export interface OidcTokenResponse {
     accessToken: string;
     refreshToken?: string;

package/dist/auth/oidcToken.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oidcToken.d.ts","sourceRoot":"","sources":["../../src/auth/oidcToken.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAGxD,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA6BD,wBAAsB,yBAAyB,CAC7C,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,CAoB5B;AAED,wBAAsB,gBAAgB,CACpC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,CAgB5B;AAED,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,2BAA2B,CAC/C,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,0BAA0B,CAAC,CA0BrC;AAED,wBAAsB,gBAAgB,CACpC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,UAAU,EAAE,MAAM,EAClB,QAAQ,GAAE,MAAU,EACpB,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,CA8B5B;AAED,wBAAsB,aAAa,CACjC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,CA6B5B;AAED,wBAAsB,aAAa,CACjC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,YAAY,EAAE,MAAM,EACpB,gBAAgB,EAAE,MAAM,EACxB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,UAAU,CAAC,EAAE,MAAM,EACnB,cAAc,CAAC,EAAE,MAAM,EACvB,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,CAgC5B"}
+{"version":3,"file":"oidcToken.d.ts","sourceRoot":"","sources":["../../src/auth/oidcToken.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAG9D,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AA6BD,wBAAsB,yBAAyB,CAC7C,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,CAoB5B;AAED,wBAAsB,gBAAgB,CACpC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,YAAY,EAAE,MAAM,EACpB,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,CAgB5B;AAED,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,2BAA2B,CAC/C,cAAc,EAAE,MAAM,EACtB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,0BAA0B,CAAC,CA0BrC;AAED,wBAAsB,gBAAgB,CACpC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,UAAU,EAAE,MAAM,EAClB,QAAQ,GAAE,MAAU,EACpB,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,CA8B5B;AAED,wBAAsB,aAAa,CACjC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,CA6B5B;AAED,wBAAsB,aAAa,CACjC,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,YAAY,EAAE,MAAM,EACpB,gBAAgB,EAAE,MAAM,EACxB,KAAK,EAAE,MAAM,GAAG,SAAS,EACzB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,UAAU,CAAC,EAAE,MAAM,EACnB,cAAc,CAAC,EAAE,MAAM,EACvB,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,CAgC5B"}

package/dist/auth/saml2Auth.d.ts

@@ -1,7 +1,7 @@
 /**
  * SAML 2.0 auth helpers
  */
-import type { ILogger } from '@mcp-abap-adt/interfaces';
+import type { CallbackServerFactory } from '@mcp-abap-adt/interfaces-auth';
 export interface Saml2AuthConfig {
     idpSsoUrl: string;
     spEntityId: string;
@@ -10,13 +10,6 @@ export interface Saml2AuthConfig {
     authorizationUrl?: string;
 }
 export declare function buildSamlAuthorizationUrl(config: Saml2AuthConfig): string;
-/**
- * SAML browser login.
- *
- * The callback socket belongs to the scope: it is released when the scope ends,
- * whatever ends it. Before this, the flow had no timeout at all — an abandoned
- * login never settled and the port was held for the life of the process.
- */
-export declare function startSamlBrowserAuth(config: Saml2AuthConfig, browser: string, logger?: ILogger, port?: number, timeoutMs?: number): Promise<string>;
+export declare const withSamlCallbackServer: CallbackServerFactory<string>;
 export declare function parseSamlNotOnOrAfter(samlResponse: string): number | undefined;
 //# sourceMappingURL=saml2Auth.d.ts.map

package/dist/auth/saml2Auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"saml2Auth.d.ts","sourceRoot":"","sources":["../../src/auth/saml2Auth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAIV,OAAO,EACR,MAAM,0BAA0B,CAAC;AAIlC,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AA8CD,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAazE;AA8ED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,OAAO,EAChB,IAAI,GAAE,MAAa,EACnB,SAAS,GAAE,MAAkB,GAC5B,OAAO,CAAC,MAAM,CAAC,CA2BjB;AAED,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,MAAM,GACnB,MAAM,GAAG,SAAS,CAYpB"}
+{"version":3,"file":"saml2Auth.d.ts","sourceRoot":"","sources":["../../src/auth/saml2Auth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,+BAA+B,CAAC;AAIvC,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAyBD,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAazE;AAED,eAAO,MAAM,sBAAsB,EAAE,qBAAqB,CAAC,MAAM,CAgC9D,CAAC;AAEJ,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,MAAM,GACnB,MAAM,GAAG,SAAS,CAYpB"}

package/dist/auth/saml2Auth.js

@@ -2,70 +2,17 @@
 /**
  * SAML 2.0 auth helpers
  */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.withSamlCallbackServer = void 0;
 exports.buildSamlAuthorizationUrl = buildSamlAuthorizationUrl;
-exports.startSamlBrowserAuth = startSamlBrowserAuth;
 exports.parseSamlNotOnOrAfter = parseSamlNotOnOrAfter;
 const node_crypto_1 = require("node:crypto");
-const net = __importStar(require("node:net"));
 const node_zlib_1 = require("node:zlib");
 const express_1 = __importDefault(require("express"));
 const callbackServer_1 = require("./callbackServer");
-const BROWSER_MAP = {
-    chrome: 'chrome',
-    edge: 'msedge',
-    firefox: 'firefox',
-    system: undefined,
-    auto: undefined,
-    headless: null,
-    none: null,
-};
-function isPortAvailable(port) {
-    return new Promise((resolve) => {
-        const server = net.createServer();
-        server.listen(port, () => {
-            server.once('close', () => resolve(true));
-            server.close();
-        });
-        server.on('error', () => resolve(false));
-    });
-}
 function base64Encode(input) {
     return Buffer.isBuffer(input)
         ? input.toString('base64')
@@ -99,59 +46,20 @@ function buildSamlAuthorizationUrl(config) {
         : '';
     return `${config.idpSsoUrl}?SAMLRequest=${samlRequest}${relayState}`;
 }
-async function openBrowserUrl(authorizationUrl, browser, logger) {
-    const browserApp = BROWSER_MAP[browser];
-    if (browserApp === null) {
-        logger?.info('[SAML] Browser suppressed, open URL manually', {
-            authorizationUrl,
-        });
-        return;
-    }
-    if (browser === 'auto') {
-        try {
-            const openModule = await Promise.resolve().then(() => __importStar(require('open')));
-            const open = openModule.default;
-            await open(authorizationUrl);
-            logger?.info('[SAML] Browser opened');
-            return;
-        }
-        catch (error) {
-            logger?.warn('[SAML] Failed to open browser automatically', {
-                error: error instanceof Error ? error.message : String(error),
-            });
-            logger?.info('[SAML] Open URL manually', { authorizationUrl });
-            return;
-        }
-    }
-    try {
-        const openModule = await Promise.resolve().then(() => __importStar(require('open')));
-        const open = openModule.default;
-        if (browserApp) {
-            await open(authorizationUrl, { app: { name: browserApp } });
-        }
-        else {
-            await open(authorizationUrl);
-        }
-    }
-    catch (error) {
-        logger?.warn('[SAML] Failed to open browser', {
-            error: error instanceof Error ? error.message : String(error),
-        });
-        logger?.info('[SAML] Open URL manually', { authorizationUrl });
-    }
-}
 const withSamlCallbackServer = (options, use) => (0, callbackServer_1.runCallbackScope)(options, (app, settle) => {
     app.use(express_1.default.urlencoded({ extended: false, limit: '5mb' }));
     const handle = (samlResponse, res) => {
-        res
-            .status(200)
-            .send('SAML authentication complete. You can close this window.');
+        // The response is decided after the payload is examined. Answering 200
+        // first told a request that carried nothing that it had authenticated.
         if (typeof samlResponse === 'string' && samlResponse) {
+            res
+                .status(200)
+                .send('SAML authentication complete. You can close this window.');
             settle.ok(samlResponse, res);
+            return;
         }
-        else {
-            settle.err(new Error('Missing SAMLResponse'), res);
-        }
+        res.status(400).send('Error: not a SAML assertion callback');
+        settle.ignore('no SAMLResponse in the request', res);
     };
     app.post('/callback', (req, res) => {
         handle(req.body?.SAMLResponse, res);
@@ -160,35 +68,7 @@ const withSamlCallbackServer = (options, use) => (0, callbackServer_1.runCallbac
         handle(req.query.SAMLResponse, res);
     });
 }, use);
-/**
- * SAML browser login.
- *
- * The callback socket belongs to the scope: it is released when the scope ends,
- * whatever ends it. Before this, the flow had no timeout at all — an abandoned
- * login never settled and the port was held for the life of the process.
- */
-async function startSamlBrowserAuth(config, browser, logger, port = 3001, timeoutMs = 30 * 1000) {
-    // Pre-check kept for its message: AuthBroker matches /already in use/i to
-    // distinguish a busy port from other failures.
-    const portAvailable = await isPortAvailable(port);
-    if (!portAvailable) {
-        throw new Error(`Port ${port} is already in use. Please specify a different port or free the port.`);
-    }
-    const authorizationUrl = buildSamlAuthorizationUrl(config);
-    return await withSamlCallbackServer({ port, timeoutMs }, async (server) => {
-        logger?.info('[SAML] Callback server listening', { port: server.port });
-        const waiting = server.waitForResult();
-        // Not awaited: a launcher that hangs must not delay the timeout or the
-        // release of the port.
-        void openBrowserUrl(authorizationUrl, browser, logger).catch((error) => {
-            logger?.warn('[SAML] Failed to open browser', {
-                error: error instanceof Error ? error.message : String(error),
-            });
-            logger?.info('[SAML] Open URL manually', { authorizationUrl });
-        });
-        return await waiting;
-    });
-}
+exports.withSamlCallbackServer = withSamlCallbackServer;
 function parseSamlNotOnOrAfter(samlResponse) {
     try {
         const decoded = Buffer.from(samlResponse, 'base64').toString('utf8');

package/dist/auth/saml2TokenExchange.d.ts

@@ -1,7 +1,7 @@
 /**
  * SAML 2.0 bearer assertion exchange
  */
-import type { ILogger } from '@mcp-abap-adt/interfaces';
+import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
 export interface Saml2TokenExchangeResponse {
     accessToken: string;
     refreshToken?: string;

package/dist/auth/saml2TokenExchange.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"saml2TokenExchange.d.ts","sourceRoot":"","sources":["../../src/auth/saml2TokenExchange.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAGxD,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,0BAA0B,CAAC,CAwCrC"}
+{"version":3,"file":"saml2TokenExchange.d.ts","sourceRoot":"","sources":["../../src/auth/saml2TokenExchange.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAG9D,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,0BAA0B,CAAC,CAwCrC"}

package/dist/errors/TokenProviderErrors.js

@@ -7,7 +7,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BrowserAuthError = exports.ServiceKeyError = exports.SessionDataError = exports.RefreshError = exports.ValidationError = exports.TokenProviderError = void 0;
-const interfaces_1 = require("@mcp-abap-adt/interfaces");
+const interfaces_auth_1 = require("@mcp-abap-adt/interfaces-auth");
 /**
  * Base class for all token provider errors
  */
@@ -27,7 +27,7 @@ exports.TokenProviderError = TokenProviderError;
 class ValidationError extends TokenProviderError {
     missingFields;
     constructor(message, missingFields) {
-        super(message, interfaces_1.TOKEN_PROVIDER_ERROR_CODES.VALIDATION_ERROR);
+        super(message, interfaces_auth_1.TOKEN_PROVIDER_ERROR_CODES.VALIDATION_ERROR);
         this.missingFields = missingFields;
         this.name = 'ValidationError';
         Object.setPrototypeOf(this, ValidationError.prototype);
@@ -40,7 +40,7 @@ exports.ValidationError = ValidationError;
 class RefreshError extends TokenProviderError {
     cause;
     constructor(message, cause) {
-        super(message, interfaces_1.TOKEN_PROVIDER_ERROR_CODES.REFRESH_ERROR);
+        super(message, interfaces_auth_1.TOKEN_PROVIDER_ERROR_CODES.REFRESH_ERROR);
         this.cause = cause;
         this.name = 'RefreshError';
         Object.setPrototypeOf(this, RefreshError.prototype);
@@ -53,7 +53,7 @@ exports.RefreshError = RefreshError;
 class SessionDataError extends TokenProviderError {
     missingFields;
     constructor(message, missingFields) {
-        super(message, interfaces_1.TOKEN_PROVIDER_ERROR_CODES.SESSION_DATA_ERROR);
+        super(message, interfaces_auth_1.TOKEN_PROVIDER_ERROR_CODES.SESSION_DATA_ERROR);
         this.missingFields = missingFields;
         this.name = 'SessionDataError';
         Object.setPrototypeOf(this, SessionDataError.prototype);
@@ -66,7 +66,7 @@ exports.SessionDataError = SessionDataError;
 class ServiceKeyError extends TokenProviderError {
     missingFields;
     constructor(message, missingFields) {
-        super(message, interfaces_1.TOKEN_PROVIDER_ERROR_CODES.SERVICE_KEY_ERROR);
+        super(message, interfaces_auth_1.TOKEN_PROVIDER_ERROR_CODES.SERVICE_KEY_ERROR);
         this.missingFields = missingFields;
         this.name = 'ServiceKeyError';
         Object.setPrototypeOf(this, ServiceKeyError.prototype);
@@ -79,7 +79,7 @@ exports.ServiceKeyError = ServiceKeyError;
 class BrowserAuthError extends TokenProviderError {
     cause;
     constructor(message, cause) {
-        super(message, interfaces_1.TOKEN_PROVIDER_ERROR_CODES.BROWSER_AUTH_ERROR);
+        super(message, interfaces_auth_1.TOKEN_PROVIDER_ERROR_CODES.BROWSER_AUTH_ERROR);
         this.cause = cause;
         this.name = 'BrowserAuthError';
         Object.setPrototypeOf(this, BrowserAuthError.prototype);

package/dist/index.d.ts

@@ -4,9 +4,15 @@
  *
  * Provides token providers
  */
+export { withBrowserCallbackServer } from './auth/callbackServer';
+export type { OidcCallbackResult } from './auth/oidcBrowserAuth';
+export { withOidcCallbackServer } from './auth/oidcBrowserAuth';
+export { withSamlCallbackServer } from './auth/saml2Auth';
 export { BrowserAuthError, RefreshError, ServiceKeyError, SessionDataError, TokenProviderError, ValidationError, } from './errors/TokenProviderErrors';
 export type { AuthorizationCodeProviderConfig, ClientCredentialsProviderConfig, DeviceFlowProviderConfig, OidcBrowserProviderConfig, OidcDeviceFlowProviderConfig, OidcPasswordProviderConfig, OidcTokenExchangeProviderConfig, Saml2BearerProviderConfig, Saml2PureProviderConfig, } from './providers';
 export { AuthorizationCodeProvider, BaseTokenProvider, ClientCredentialsProvider, DeviceFlowProvider, OidcBrowserProvider, OidcDeviceFlowProvider, OidcPasswordProvider, OidcTokenExchangeProvider, Saml2BearerProvider, Saml2PureProvider, } from './providers';
 export { SsoProviderFactory } from './sso/SsoProviderFactory';
 export type { SsoProviderConfig, SsoProviderInstance } from './sso/types';
+export type { BrowserCallbackStrategyOptions, CallbackStrategyOptions, ExternalCodeStrategyOptions, ManualStrategyOptions, StaticCodeStrategyOptions, } from './strategies';
+export { asOidcResult, BrowserCallbackStrategy, browserCallbackStrategy, DEFAULT_CALLBACK_PORT, DEFAULT_LOGIN_TIMEOUT_MS, externalCodeStrategy, manualPasteStrategy, manualSamlResponseStrategy, oidcCallbackStrategy, samlCallbackStrategy, staticCodeStrategy, } from './strategies';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,GAChB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,+BAA+B,EAC/B,+BAA+B,EAC/B,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC5B,0BAA0B,EAC1B,+BAA+B,EAC/B,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,YAAY,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,GAChB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,+BAA+B,EAC/B,+BAA+B,EAC/B,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC5B,0BAA0B,EAC1B,+BAA+B,EAC/B,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC1E,YAAY,EACV,8BAA8B,EAC9B,uBAAuB,EACvB,2BAA2B,EAC3B,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,YAAY,EACZ,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,0BAA0B,EAC1B,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -6,7 +6,14 @@
  * Provides token providers
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SsoProviderFactory = exports.Saml2PureProvider = exports.Saml2BearerProvider = exports.OidcTokenExchangeProvider = exports.OidcPasswordProvider = exports.OidcDeviceFlowProvider = exports.OidcBrowserProvider = exports.DeviceFlowProvider = exports.ClientCredentialsProvider = exports.BaseTokenProvider = exports.AuthorizationCodeProvider = exports.ValidationError = exports.TokenProviderError = exports.SessionDataError = exports.ServiceKeyError = exports.RefreshError = exports.BrowserAuthError = void 0;
+exports.staticCodeStrategy = exports.samlCallbackStrategy = exports.oidcCallbackStrategy = exports.manualSamlResponseStrategy = exports.manualPasteStrategy = exports.externalCodeStrategy = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.DEFAULT_CALLBACK_PORT = exports.browserCallbackStrategy = exports.BrowserCallbackStrategy = exports.asOidcResult = exports.SsoProviderFactory = exports.Saml2PureProvider = exports.Saml2BearerProvider = exports.OidcTokenExchangeProvider = exports.OidcPasswordProvider = exports.OidcDeviceFlowProvider = exports.OidcBrowserProvider = exports.DeviceFlowProvider = exports.ClientCredentialsProvider = exports.BaseTokenProvider = exports.AuthorizationCodeProvider = exports.ValidationError = exports.TokenProviderError = exports.SessionDataError = exports.ServiceKeyError = exports.RefreshError = exports.BrowserAuthError = exports.withSamlCallbackServer = exports.withOidcCallbackServer = exports.withBrowserCallbackServer = void 0;
+// Callback server factories — "take the transport this package gives".
+var callbackServer_1 = require("./auth/callbackServer");
+Object.defineProperty(exports, "withBrowserCallbackServer", { enumerable: true, get: function () { return callbackServer_1.withBrowserCallbackServer; } });
+var oidcBrowserAuth_1 = require("./auth/oidcBrowserAuth");
+Object.defineProperty(exports, "withOidcCallbackServer", { enumerable: true, get: function () { return oidcBrowserAuth_1.withOidcCallbackServer; } });
+var saml2Auth_1 = require("./auth/saml2Auth");
+Object.defineProperty(exports, "withSamlCallbackServer", { enumerable: true, get: function () { return saml2Auth_1.withSamlCallbackServer; } });
 // Errors
 var TokenProviderErrors_1 = require("./errors/TokenProviderErrors");
 Object.defineProperty(exports, "BrowserAuthError", { enumerable: true, get: function () { return TokenProviderErrors_1.BrowserAuthError; } });
@@ -30,3 +37,16 @@ Object.defineProperty(exports, "Saml2PureProvider", { enumerable: true, get: fun
 // SSO factory
 var SsoProviderFactory_1 = require("./sso/SsoProviderFactory");
 Object.defineProperty(exports, "SsoProviderFactory", { enumerable: true, get: function () { return SsoProviderFactory_1.SsoProviderFactory; } });
+// Authorization strategies — or bring your own IAuthorizationStrategy.
+var strategies_1 = require("./strategies");
+Object.defineProperty(exports, "asOidcResult", { enumerable: true, get: function () { return strategies_1.asOidcResult; } });
+Object.defineProperty(exports, "BrowserCallbackStrategy", { enumerable: true, get: function () { return strategies_1.BrowserCallbackStrategy; } });
+Object.defineProperty(exports, "browserCallbackStrategy", { enumerable: true, get: function () { return strategies_1.browserCallbackStrategy; } });
+Object.defineProperty(exports, "DEFAULT_CALLBACK_PORT", { enumerable: true, get: function () { return strategies_1.DEFAULT_CALLBACK_PORT; } });
+Object.defineProperty(exports, "DEFAULT_LOGIN_TIMEOUT_MS", { enumerable: true, get: function () { return strategies_1.DEFAULT_LOGIN_TIMEOUT_MS; } });
+Object.defineProperty(exports, "externalCodeStrategy", { enumerable: true, get: function () { return strategies_1.externalCodeStrategy; } });
+Object.defineProperty(exports, "manualPasteStrategy", { enumerable: true, get: function () { return strategies_1.manualPasteStrategy; } });
+Object.defineProperty(exports, "manualSamlResponseStrategy", { enumerable: true, get: function () { return strategies_1.manualSamlResponseStrategy; } });
+Object.defineProperty(exports, "oidcCallbackStrategy", { enumerable: true, get: function () { return strategies_1.oidcCallbackStrategy; } });
+Object.defineProperty(exports, "samlCallbackStrategy", { enumerable: true, get: function () { return strategies_1.samlCallbackStrategy; } });
+Object.defineProperty(exports, "staticCodeStrategy", { enumerable: true, get: function () { return strategies_1.staticCodeStrategy; } });

package/dist/providers/AuthorizationCodeProvider.d.ts

@@ -4,15 +4,20 @@
  * Uses authorization_code grant type with browser-based OAuth2 flow.
  * Supports pre-built authorization URLs and automatic refresh.
  */
-import type { ILogger, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces';
+import type { IAuthorizationStrategy, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces-auth';
+import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
 import { BaseTokenProvider } from './BaseTokenProvider';
 export interface AuthorizationCodeProviderConfig {
     uaaUrl: string;
     clientId: string;
     clientSecret: string;
+    /** Pre-built authorization URL. Carries its own redirect; see the guard below. */
     authorizationUrl?: string;
-    browser?: string;
-    redirectPort?: number;
+    /**
+     * How the login is conducted. Omitted means a browser callback on the default
+     * port — the package's own transport, which a consumer may replace wholesale.
+     */
+    authorization?: IAuthorizationStrategy<string>;
     accessToken?: string;
     refreshToken?: string;
     logger?: ILogger;

package/dist/providers/AuthorizationCodeProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthorizationCodeProvider.d.ts","sourceRoot":"","sources":["../../src/providers/AuthorizationCodeProvider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAEV,OAAO,EACP,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAKxD,MAAM,WAAW,+BAA+B;IAE9C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IAGrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAG1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IAGtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IAGtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,iBAAiB;IAC9D,OAAO,CAAC,MAAM,CAAkC;gBAEpC,MAAM,EAAE,+BAA+B;IA8D7C,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC;IAIxC,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAoErC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CA0CxD"}
+{"version":3,"file":"AuthorizationCodeProvider.d.ts","sourceRoot":"","sources":["../../src/providers/AuthorizationCodeProvider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,sBAAsB,EACtB,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAGvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAO9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,+BAA+B;IAE9C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IAErB,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAG/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,iBAAiB;IAC9D,OAAO,CAAC,MAAM,CAAkC;gBAEpC,MAAM,EAAE,+BAA+B;IA4D7C,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC;IAIxC,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cA+ErC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CA0CxD"}