@mintplayer/ng-spark 22.33.0 → 22.35.0

package/fesm2022/mintplayer-ng-spark-auth-routes.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"mintplayer-ng-spark-auth-routes.mjs","names":[],"sources":["../../auth/routes/src/spark-auth-routes.ts"],"sourcesContent":["import {\n  SPARK_ACCOUNT_OVERVIEW_LINKS,\n  SPARK_AUTH_ROUTE_PATHS,\n  SPARK_EXTERNAL_PROVIDERS,\n  SparkAccountOverviewLink,\n  SparkAuthRouteEntries,\n  SparkAuthRouteEntry,\n  SparkAuthRoutePaths,\n  SparkExternalProviderPresentation,\n} from '@mintplayer/ng-spark/auth/models';\n\nimport { inject } from '@angular/core';\nimport { Router, type CanActivateFn } from '@angular/router';\nimport { sparkAuthGuard } from '@mintplayer/ng-spark/auth/guards';\n\ntype Loader = () => Promise<any>;\n\ninterface Child {\n  path: string;\n  loadComponent?: Loader;\n  canActivate?: CanActivateFn[];\n  children?: [];\n}\n\n/**\n * The passkeys page: the generic persistent-object page of the Authorization library's virtual\n * `Passkeys` type, one per signed-in user, so the id is the fixed `me` (generic passkeys page PRD D1).\n */\nexport const SPARK_PASSKEYS_PAGE_URL = '/po/passkeys/me';\n\n/** Forwards to {@link SPARK_PASSKEYS_PAGE_URL}. */\nconst toPasskeysPage: CanActivateFn = () => inject(Router).parseUrl(SPARK_PASSKEYS_PAGE_URL);\n\n/**\n * The passkeys path: a redirect into the generic page, kept for bookmarks and the account overview's\n * link (PRD D8). A guard rather than `redirectTo`, because Angular refuses `canActivate` beside\n * `redirectTo` and the sign-in guard must still run first: the router acts on the first guard in\n * array order that does not pass, so an anonymous visitor is sent to sign in, not to a 404. An\n * application that supplies its own component for the entry keeps it.\n */\nfunction passkeysChild(entry: SparkAuthRouteEntry | undefined, path: string, guard: CanActivateFn[]): Child {\n  if (typeof entry === 'object' && entry.component) {\n    const component = entry.component;\n    return { path, loadComponent: () => Promise.resolve(component), ...(guard.length ? { canActivate: guard } : {}) };\n  }\n  return { path, canActivate: [...guard, toPasskeysPage], children: [] };\n}\n\n/** The routed path for an entry, independent of how its component is loaded. */\nfunction entryPath(entry: SparkAuthRouteEntry | undefined, defaultPath: string): string {\n  if (entry === undefined) return defaultPath;\n  return typeof entry === 'string' ? entry : entry.path;\n}\n\n/** An explicitly supplied component wins over the library's lazy import. */\nfunction child(entry: SparkAuthRouteEntry | undefined, path: string, defaultLoader: Loader): Child {\n  const component = typeof entry === 'object' && entry.component ? entry.component : undefined;\n  return { path, loadComponent: component ? () => Promise.resolve(component) : defaultLoader };\n}\n\n/**\n * One opt-in group of authentication pages, passed to {@link sparkAuthRoutes}. Constructed only by\n * ng-spark's entry points: `withLocalLogin()`, `withRegistration()`, `withExternalLogin()`,\n * `withPasskeys()` and `withAccount()` here, and `withIdentityProvider()` from\n * `@mintplayer/ng-spark/identity-provider`. That keeps the set of mountable pages a decision this\n * library makes rather than a shape an application invents.\n */\nexport interface SparkAuthRoutesFeature {\n  readonly children: Child[];\n  readonly paths: SparkAuthRoutePaths;\n  readonly providers?: SparkExternalProviderPresentation[];\n  /** Extra links for the account overview (`SPARK_ACCOUNT_OVERVIEW_LINKS`). */\n  readonly accountLinks?: SparkAccountOverviewLink[];\n}\n\n/** Path override for the sign-in landing page. Named to stay clear of the core package's\n * `SparkExternalLoginOptions`, which is about the sign-in *call* rather than the route. */\nexport type SparkExternalLoginRouteOptions = Pick<SparkAuthRouteEntries, 'signIn'>;\n\n/**\n * The routes for Spark's authentication pages.\n *\n * **Nothing is mounted unless a feature asks for it.** Passing no features emits no pages at all —\n * opt-in enforced by construction rather than by a flag, matching `provideHttpClient(withFetch())`\n * and `provideRouter(withComponentInputBinding())`. Before this the pages mounted by default and an\n * application had to opt *out*, so every app shipped a registration form whether or not it wanted\n * one.\n *\n * ```ts\n * sparkAuthRoutes(\n *   withLocalLogin(),\n *   withRegistration(),\n *   withExternalLogin(githubProvider(), facebookProvider()),\n * )\n * ```\n *\n * The `import()` expressions live *inside* each feature. That placement is the point: a bundler\n * decides whether to emit a lazy chunk from whether the `import()` call site is reachable, not from\n * whether the route object referencing it survives — so filtering a children array after the fact\n * would still ship every page. A page nobody opted into has no reachable `import()` at all.\n */\nexport function sparkAuthRoutes(...features: SparkAuthRoutesFeature[]): any[] {\n  const children: Child[] = [];\n  const paths: SparkAuthRoutePaths = {};\n  const externalProviders: SparkExternalProviderPresentation[] = [];\n  const accountLinks: SparkAccountOverviewLink[] = [];\n\n  for (const feature of features) {\n    children.push(...feature.children);\n    Object.assign(paths, feature.paths);\n    if (feature.providers) externalProviders.push(...feature.providers);\n    if (feature.accountLinks) accountLinks.push(...feature.accountLinks);\n  }\n\n  return [\n    {\n      path: '',\n      providers: [\n        { provide: SPARK_AUTH_ROUTE_PATHS, useValue: paths },\n        { provide: SPARK_EXTERNAL_PROVIDERS, useValue: externalProviders },\n        { provide: SPARK_ACCOUNT_OVERVIEW_LINKS, useValue: accountLinks },\n      ],\n      children,\n    },\n  ];\n}\n\n/**\n * Mounts the email/password family: login, two-factor, forgot-password, reset-password.\n *\n * These four are one feature rather than four because they form a star centred on the login page and\n * every template dereferences its siblings unconditionally — removing any proper subset leaves a\n * dangling link. Registration is genuinely separable, and is its own feature.\n *\n * Two-factor belongs here because it is reachable only from the login page's `RequiresTwoFactor`\n * branch and posts to the same `/login` endpoint: it is part of password sign-in, not of\n * authentication in general.\n */\nexport function withLocalLogin(\n  entries?: Pick<SparkAuthRouteEntries, 'login' | 'twoFactor' | 'forgotPassword' | 'resetPassword'>,\n): SparkAuthRoutesFeature {\n  const login = entryPath(entries?.login, 'login');\n  const twoFactor = entryPath(entries?.twoFactor, 'login/two-factor');\n  const forgotPassword = entryPath(entries?.forgotPassword, 'forgot-password');\n  const resetPassword = entryPath(entries?.resetPassword, 'reset-password');\n\n  return {\n    paths: {\n      login: '/' + login,\n      twoFactor: '/' + twoFactor,\n      forgotPassword: '/' + forgotPassword,\n      resetPassword: '/' + resetPassword,\n    },\n    children: [\n      child(entries?.login, login,\n        () => import('@mintplayer/ng-spark/auth/login').then(m => m.SparkLoginComponent)),\n      child(entries?.twoFactor, twoFactor,\n        () => import('@mintplayer/ng-spark/auth/two-factor').then(m => m.SparkTwoFactorComponent)),\n      child(entries?.forgotPassword, forgotPassword,\n        () => import('@mintplayer/ng-spark/auth/forgot-password').then(m => m.SparkForgotPasswordComponent)),\n      child(entries?.resetPassword, resetPassword,\n        () => import('@mintplayer/ng-spark/auth/reset-password').then(m => m.SparkResetPasswordComponent)),\n    ],\n  };\n}\n\n/**\n * Mounts the self-service registration page.\n *\n * Separate from {@link withLocalLogin} because the two decisions genuinely are separate: an\n * application whose accounts are provisioned by an administrator still needs password sign-in and\n * password reset. Mount it only alongside a server whose `SparkLocalCredentials` is `Full` — with\n * `SignInOnly` the endpoint it posts to is not mapped.\n */\nexport function withRegistration(entry?: SparkAuthRouteEntry): SparkAuthRoutesFeature {\n  const register = entryPath(entry, 'register');\n\n  return {\n    paths: { register: '/' + register },\n    children: [\n      child(entry, register,\n        () => import('@mintplayer/ng-spark/auth/register').then(m => m.SparkRegisterComponent)),\n    ],\n  };\n}\n\n/**\n * Mounts the sign-in landing page — a button per external provider the *server* reports.\n *\n * Accepts provider declarations and, in any position, one options object for the page's own path;\n * the two shapes are disjoint, so `withExternalLogin(githubProvider(), facebookProvider())` and\n * `withExternalLogin({ signIn: 'landing' }, githubProvider())` both read naturally.\n *\n * Declaring no providers is valid and useful: the page still renders whatever\n * `GET /spark/auth/capabilities` reports, using default buttons.\n */\nexport function withExternalLogin(\n  ...providersOrOptions: (SparkExternalProviderPresentation | SparkExternalLoginRouteOptions)[]\n): SparkAuthRoutesFeature {\n  const providers = providersOrOptions.filter(isProvider);\n  const options = providersOrOptions.find((p): p is SparkExternalLoginRouteOptions => !isProvider(p));\n  const signIn = entryPath(options?.signIn, 'sign-in');\n\n  return {\n    paths: { signIn: '/' + signIn },\n    providers,\n    children: [\n      child(options?.signIn, signIn,\n        () => import('@mintplayer/ng-spark/auth/sign-in').then(m => m.SparkSignInComponent)),\n    ],\n  };\n}\n\nfunction isProvider(\n  value: SparkExternalProviderPresentation | SparkExternalLoginRouteOptions,\n): value is SparkExternalProviderPresentation {\n  return typeof (value as SparkExternalProviderPresentation).scheme === 'string';\n}\n\n/**\n * Presentation for one provider's button, keyed by the scheme the server reports.\n *\n * The generic form. `githubProvider()` and friends are this with a scheme and an icon filled in —\n * they exist so the common case does not require knowing the scheme string, not because the library\n * has an opinion about which providers exist.\n */\n/**\n * Mounts the passkey management path, which forwards to the generic passkeys page (`/po/passkeys/me`).\n *\n * Independent of every other feature here, and of the server's `SparkLocalCredentials`: a passkey is\n * a passwordless credential, so the applications most likely to want this page are exactly the ones\n * that mount no password pages at all. It pairs with `SparkPasskeys.Enabled` on the server.\n *\n * ⚠️ The page assumes a signed-in user — enrollment adds a credential to an existing account, it\n * cannot create one. Mount it inside the application's authenticated area, or behind\n * `sparkAuthGuard`; the server answers the page with 404 to a visitor who is not signed in.\n */\nexport function withPasskeys(entry?: SparkAuthRouteEntry): SparkAuthRoutesFeature {\n  const passkeys = entryPath(entry, 'passkeys');\n\n  return {\n    paths: { passkeys: '/' + passkeys },\n    children: [passkeysChild(entry, passkeys, [])],\n  };\n}\n\n/** Options for {@link withAccount}: a path/component per page, and the guard of the signed-in pages. */\nexport type SparkAccountRouteOptions =\n  Pick<SparkAuthRouteEntries, 'confirmEmail' | 'account' | 'profile' | 'changePassword' | 'twoFactorSetup' | 'externalLogins' | 'passkeys' | 'personalData'>\n  & {\n    /**\n     * Guards the signed-in pages (everything but confirm-email). Defaults to `[sparkAuthGuard]`,\n     * which waits for the session check so a hard reload does not bounce a signed-in user to the\n     * sign-in page. Pass `[]` when the pages sit under a guarded parent route already.\n     */\n    canActivate?: CanActivateFn[];\n    /**\n     * Pages to leave out, e.g. `['externalLogins']` for an app without external providers or\n     * `['changePassword']` under `SparkLocalCredentials.Disabled` (the endpoint is not mapped there).\n     */\n    exclude?: (keyof Omit<SparkAccountRouteOptions, 'canActivate' | 'exclude'>)[];\n  };\n\n/**\n * Mounts the account pages (#460, D16), each also usable as a standalone component:\n *\n * | page | default path | component |\n * |---|---|---|\n * | confirm email (public; the mail link target) | `confirm-email` | `SparkConfirmEmailComponent` |\n * | overview | `account` | `SparkAccountOverviewComponent` |\n * | profile (user name, email change, mail language, app fields) | `account/profile` | `SparkAccountProfileComponent` |\n * | change / set password | `account/password` | `SparkChangePasswordComponent` |\n * | two-factor (authenticator, recovery codes) | `account/two-factor` | `SparkTwoFactorSetupComponent` |\n * | connected logins | `account/logins` | `SparkExternalLoginsComponent` |\n * | passkeys (forwards to the generic page, `/po/passkeys/me`) | `account/passkeys` | — |\n * | personal data + account deletion | `account/personal-data` | `SparkPersonalDataComponent` |\n *\n * `confirm-email` must stay at the server's `Spark:Auth:Links:ConfirmEmailPath` (default\n * `/confirm-email`), which confirmation mails link to. No path has a parameterised first segment, so the\n * group neither shadows `sparkRoutes()` nor is shadowed by it.\n */\nexport function withAccount(options?: SparkAccountRouteOptions): SparkAuthRoutesFeature {\n  const guard = options?.canActivate ?? [sparkAuthGuard];\n  const excluded = new Set(options?.exclude ?? []);\n  const paths: SparkAuthRoutePaths = {};\n  const children: Child[] = [];\n\n  const add = (key: keyof SparkAccountRouteOptions & keyof SparkAuthRouteEntries, defaultPath: string, loader: Loader, guarded = true) => {\n    if (excluded.has(key as never)) return;\n    const entry = options?.[key] as SparkAuthRouteEntry | undefined;\n    const path = entryPath(entry, defaultPath);\n    paths[key] = '/' + path;\n    const route = child(entry, path, loader);\n    children.push(guarded && guard.length ? { ...route, canActivate: guard } : route);\n  };\n\n  add('confirmEmail', 'confirm-email',\n    () => import('@mintplayer/ng-spark/auth/confirm-email').then(m => m.SparkConfirmEmailComponent), false);\n  add('profile', 'account/profile',\n    () => import('@mintplayer/ng-spark/auth/account').then(m => m.SparkAccountProfileComponent));\n  add('changePassword', 'account/password',\n    () => import('@mintplayer/ng-spark/auth/account').then(m => m.SparkChangePasswordComponent));\n  add('twoFactorSetup', 'account/two-factor',\n    () => import('@mintplayer/ng-spark/auth/account').then(m => m.SparkTwoFactorSetupComponent));\n  add('externalLogins', 'account/logins',\n    () => import('@mintplayer/ng-spark/auth/account').then(m => m.SparkExternalLoginsComponent));\n  if (!excluded.has('passkeys')) {\n    const path = entryPath(options?.passkeys, 'account/passkeys');\n    paths.passkeys = '/' + path;\n    children.push(passkeysChild(options?.passkeys, path, guard));\n  }\n  add('personalData', 'account/personal-data',\n    () => import('@mintplayer/ng-spark/auth/account').then(m => m.SparkPersonalDataComponent));\n  add('account', 'account',\n    () => import('@mintplayer/ng-spark/auth/account').then(m => m.SparkAccountOverviewComponent));\n\n  return { paths, children };\n}\n\nexport function externalProvider(\n  scheme: string,\n  presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>,\n): SparkExternalProviderPresentation {\n  return { scheme, ...presentation };\n}\n\nexport function githubProvider(\n  presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>,\n): SparkExternalProviderPresentation {\n  return externalProvider('GitHub', { iconClass: 'bi bi-github', ...presentation });\n}\n\nexport function googleProvider(\n  presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>,\n): SparkExternalProviderPresentation {\n  return externalProvider('Google', { iconClass: 'bi bi-google', ...presentation });\n}\n\nexport function facebookProvider(\n  presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>,\n): SparkExternalProviderPresentation {\n  return externalProvider('Facebook', { iconClass: 'bi bi-facebook', ...presentation });\n}\n\nexport function microsoftProvider(\n  presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>,\n): SparkExternalProviderPresentation {\n  return externalProvider('Microsoft', { iconClass: 'bi bi-microsoft', ...presentation });\n}\n\n/** X (formerly Twitter) — the server's `spark.AddTwitter()` preset (OAuth 2.0), scheme `Twitter`. */\nexport function twitterProvider(\n  presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>,\n): SparkExternalProviderPresentation {\n  return externalProvider('Twitter', { displayName: 'X', iconClass: 'bi bi-twitter-x', ...presentation });\n}\n\n/** LinkedIn — the server's `spark.AddLinkedIn()` preset (OpenID Connect userinfo), scheme `LinkedIn`. */\nexport function linkedInProvider(\n  presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>,\n): SparkExternalProviderPresentation {\n  return externalProvider('LinkedIn', { iconClass: 'bi bi-linkedin', ...presentation });\n}\n\n/**\n * Any OpenID Connect provider — the client half of the server's OIDC preset\n * (`spark.AddOpenIdConnect(...)`, or a `Spark:Auth:Providers:OpenIdConnect:<scheme>` section). Unlike the named presets the scheme is the\n * application's own choice, so it and the button text are required; `scheme` must equal the server's\n * scheme name exactly.\n */\nexport function oidcProvider(\n  scheme: string,\n  displayName: string,\n  iconClass = 'bi bi-person-badge',\n): SparkExternalProviderPresentation {\n  return externalProvider(scheme, { displayName, iconClass });\n}\n"],"mappings":";;;;AA4BA,MAAa,0BAA0B;AAGvC,MAAM,uBAAsC,OAAO,MAAM,CAAC,CAAC,SAAS,uBAAuB;AAS3F,SAAS,cAAc,OAAwC,MAAc,OAAsB;CACjG,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW;EAChD,MAAM,YAAY,MAAM;EACxB,OAAO;GAAE;GAAM,qBAAqB,QAAQ,QAAQ,SAAS;GAAG,GAAI,MAAM,SAAS,EAAE,aAAa,MAAK,IAAK,CAAA;EAAG;CACjH;CACA,OAAO;EAAE;EAAM,aAAa,CAAC,GAAG,OAAO,cAAc;EAAG,UAAU,CAAA;CAAE;AACtE;AAGA,SAAS,UAAU,OAAwC,aAAmB;CAC5E,IAAI,UAAU,QAAW,OAAO;CAChC,OAAO,OAAO,UAAU,WAAW,QAAQ,MAAM;AACnD;AAGA,SAAS,MAAM,OAAwC,MAAc,eAAqB;CACxF,MAAM,YAAY,OAAO,UAAU,YAAY,MAAM,YAAY,MAAM,YAAY;CACnF,OAAO;EAAE;EAAM,eAAe,kBAAkB,QAAQ,QAAQ,SAAS,IAAI;CAAa;AAC5F;AA2CA,SAAgB,gBAAgB,GAAG,UAAkC;CACnE,MAAM,WAAoB,CAAA;CAC1B,MAAM,QAA6B,CAAA;CACnC,MAAM,oBAAyD,CAAA;CAC/D,MAAM,eAA2C,CAAA;CAEjD,KAAK,MAAM,WAAW,UAAU;EAC9B,SAAS,KAAK,GAAG,QAAQ,QAAQ;EACjC,OAAO,OAAO,OAAO,QAAQ,KAAK;EAClC,IAAI,QAAQ,WAAW,kBAAkB,KAAK,GAAG,QAAQ,SAAS;EAClE,IAAI,QAAQ,cAAc,aAAa,KAAK,GAAG,QAAQ,YAAY;CACrE;CAEA,OAAO,CACL;EACE,MAAM;EACN,WAAW;GACT;IAAE,SAAS;IAAwB,UAAU;GAAK;GAClD;IAAE,SAAS;IAA0B,UAAU;GAAiB;GAChE;IAAE,SAAS;IAA8B,UAAU;GAAY;EAChE;EACD;CACD,CACF;AACH;AAaA,SAAgB,eACd,SAAiG;CAEjG,MAAM,QAAQ,UAAU,SAAS,OAAO,OAAO;CAC/C,MAAM,YAAY,UAAU,SAAS,WAAW,kBAAkB;CAClE,MAAM,iBAAiB,UAAU,SAAS,gBAAgB,iBAAiB;CAC3E,MAAM,gBAAgB,UAAU,SAAS,eAAe,gBAAgB;CAExE,OAAO;EACL,OAAO;GACL,OAAO,MAAM;GACb,WAAW,MAAM;GACjB,gBAAgB,MAAM;GACtB,eAAe,MAAM;EACtB;EACD,UAAU;GACR,MAAM,SAAS,OAAO,aACd,OAAO,kCAAkC,CAAC,MAAK,MAAK,EAAE,mBAAmB,CAAC;GAClF,MAAM,SAAS,WAAW,iBAClB,OAAO,uCAAuC,CAAC,MAAK,MAAK,EAAE,uBAAuB,CAAC;GAC3F,MAAM,SAAS,gBAAgB,sBACvB,OAAO,4CAA4C,CAAC,MAAK,MAAK,EAAE,4BAA4B,CAAC;GACrG,MAAM,SAAS,eAAe,qBACtB,OAAO,2CAA2C,CAAC,MAAK,MAAK,EAAE,2BAA2B,CAAC;EACpG;CACF;AACH;AAUA,SAAgB,iBAAiB,OAA2B;CAC1D,MAAM,WAAW,UAAU,OAAO,UAAU;CAE5C,OAAO;EACL,OAAO,EAAE,UAAU,MAAM,SAAQ;EACjC,UAAU,CACR,MAAM,OAAO,gBACL,OAAO,qCAAqC,CAAC,MAAK,MAAK,EAAE,sBAAsB,CAAC,CACzF;CACF;AACH;AAYA,SAAgB,kBACd,GAAG,oBAA0F;CAE7F,MAAM,YAAY,mBAAmB,OAAO,UAAU;CACtD,MAAM,UAAU,mBAAmB,MAAM,MAA2C,CAAC,WAAW,CAAC,CAAC;CAClG,MAAM,SAAS,UAAU,SAAS,QAAQ,SAAS;CAEnD,OAAO;EACL,OAAO,EAAE,QAAQ,MAAM,OAAM;EAC7B;EACA,UAAU,CACR,MAAM,SAAS,QAAQ,cACf,OAAO,oCAAoC,CAAC,MAAK,MAAK,EAAE,oBAAoB,CAAC,CACtF;CACF;AACH;AAEA,SAAS,WACP,OAAyE;CAEzE,OAAO,OAAQ,MAA4C,WAAW;AACxE;AAoBA,SAAgB,aAAa,OAA2B;CACtD,MAAM,WAAW,UAAU,OAAO,UAAU;CAE5C,OAAO;EACL,OAAO,EAAE,UAAU,MAAM,SAAQ;EACjC,UAAU,CAAC,cAAc,OAAO,UAAU,CAAA,CAAE,CAAC;CAC9C;AACH;AAqCA,SAAgB,YAAY,SAAkC;CAC5D,MAAM,QAAQ,SAAS,eAAe,CAAC,cAAc;CACrD,MAAM,WAAW,IAAI,IAAI,SAAS,WAAW,CAAA,CAAE;CAC/C,MAAM,QAA6B,CAAA;CACnC,MAAM,WAAoB,CAAA;CAE1B,MAAM,OAAO,KAAmE,aAAqB,QAAgB,UAAU,SAAQ;EACrI,IAAI,SAAS,IAAI,GAAY,GAAG;EAChC,MAAM,QAAQ,UAAU;EACxB,MAAM,OAAO,UAAU,OAAO,WAAW;EACzC,MAAM,OAAO,MAAM;EACnB,MAAM,QAAQ,MAAM,OAAO,MAAM,MAAM;EACvC,SAAS,KAAK,WAAW,MAAM,SAAS;GAAE,GAAG;GAAO,aAAa;EAAK,IAAK,KAAK;CAClF;CAEA,IAAI,gBAAgB,uBACZ,OAAO,0CAA0C,CAAC,MAAK,MAAK,EAAE,0BAA0B,GAAG,KAAK;CACxG,IAAI,WAAW,yBACP,OAAO,oCAAoC,CAAC,MAAK,MAAK,EAAE,4BAA4B,CAAC;CAC7F,IAAI,kBAAkB,0BACd,OAAO,oCAAoC,CAAC,MAAK,MAAK,EAAE,4BAA4B,CAAC;CAC7F,IAAI,kBAAkB,4BACd,OAAO,oCAAoC,CAAC,MAAK,MAAK,EAAE,4BAA4B,CAAC;CAC7F,IAAI,kBAAkB,wBACd,OAAO,oCAAoC,CAAC,MAAK,MAAK,EAAE,4BAA4B,CAAC;CAC7F,IAAI,CAAC,SAAS,IAAI,UAAU,GAAG;EAC7B,MAAM,OAAO,UAAU,SAAS,UAAU,kBAAkB;EAC5D,MAAM,WAAW,MAAM;EACvB,SAAS,KAAK,cAAc,SAAS,UAAU,MAAM,KAAK,CAAC;CAC7D;CACA,IAAI,gBAAgB,+BACZ,OAAO,oCAAoC,CAAC,MAAK,MAAK,EAAE,0BAA0B,CAAC;CAC3F,IAAI,WAAW,iBACP,OAAO,oCAAoC,CAAC,MAAK,MAAK,EAAE,6BAA6B,CAAC;CAE9F,OAAO;EAAE;EAAO;CAAQ;AAC1B;AAEA,SAAgB,iBACd,QACA,cAAgE;CAEhE,OAAO;EAAE;EAAQ,GAAG;CAAY;AAClC;AAEA,SAAgB,eACd,cAAgE;CAEhE,OAAO,iBAAiB,UAAU;EAAE,WAAW;EAAgB,GAAG;CAAY,CAAE;AAClF;AAEA,SAAgB,eACd,cAAgE;CAEhE,OAAO,iBAAiB,UAAU;EAAE,WAAW;EAAgB,GAAG;CAAY,CAAE;AAClF;AAEA,SAAgB,iBACd,cAAgE;CAEhE,OAAO,iBAAiB,YAAY;EAAE,WAAW;EAAkB,GAAG;CAAY,CAAE;AACtF;AAEA,SAAgB,kBACd,cAAgE;CAEhE,OAAO,iBAAiB,aAAa;EAAE,WAAW;EAAmB,GAAG;CAAY,CAAE;AACxF;AAGA,SAAgB,gBACd,cAAgE;CAEhE,OAAO,iBAAiB,WAAW;EAAE,aAAa;EAAK,WAAW;EAAmB,GAAG;CAAY,CAAE;AACxG;AAGA,SAAgB,iBACd,cAAgE;CAEhE,OAAO,iBAAiB,YAAY;EAAE,WAAW;EAAkB,GAAG;CAAY,CAAE;AACtF;AAQA,SAAgB,aACd,QACA,aACA,YAAY,sBAAoB;CAEhC,OAAO,iBAAiB,QAAQ;EAAE;EAAa;CAAS,CAAE;AAC5D"}
+{"version":3,"file":"mintplayer-ng-spark-auth-routes.mjs","names":[],"sources":["../../auth/routes/src/spark-auth-routes.ts"],"sourcesContent":["import {\n  SPARK_ACCOUNT_OVERVIEW_LINKS,\n  SPARK_AUTH_ROUTE_PATHS,\n  SPARK_EXTERNAL_PROVIDERS,\n  SparkAccountOverviewLink,\n  SparkAuthRouteEntries,\n  SparkAuthRouteEntry,\n  SparkAuthRoutePaths,\n  SparkExternalProviderPresentation,\n} from '@mintplayer/ng-spark/auth/models';\n\nimport { inject } from '@angular/core';\nimport { Router, type CanActivateFn } from '@angular/router';\nimport { sparkAuthGuard } from '@mintplayer/ng-spark/auth/guards';\n\ntype Loader = () => Promise<any>;\n\ninterface Child {\n  path: string;\n  loadComponent?: Loader;\n  canActivate?: CanActivateFn[];\n  children?: [];\n}\n\n/**\n * The passkeys page: the generic persistent-object page of the Authorization library's virtual\n * `Passkeys` type, one per signed-in user, so the id is the fixed `me` (generic passkeys page PRD D1).\n */\nexport const SPARK_PASSKEYS_PAGE_URL = '/po/passkeys/me';\n\n/** Forwards to {@link SPARK_PASSKEYS_PAGE_URL}. */\nconst toPasskeysPage: CanActivateFn = () => inject(Router).parseUrl(SPARK_PASSKEYS_PAGE_URL);\n\n/**\n * The passkeys path: a redirect into the generic page, kept for bookmarks and the account overview's\n * link (PRD D8). A guard rather than `redirectTo`, because Angular refuses `canActivate` beside\n * `redirectTo` and the sign-in guard must still run first: the router acts on the first guard in\n * array order that does not pass, so an anonymous visitor is sent to sign in, not to a 404. An\n * application that supplies its own component for the entry keeps it.\n */\nfunction passkeysChild(entry: SparkAuthRouteEntry | undefined, path: string, guard: CanActivateFn[]): Child {\n  if (typeof entry === 'object' && entry.component) {\n    const component = entry.component;\n    return { path, loadComponent: () => Promise.resolve(component), ...(guard.length ? { canActivate: guard } : {}) };\n  }\n  return { path, canActivate: [...guard, toPasskeysPage], children: [] };\n}\n\n/** The routed path for an entry, independent of how its component is loaded. */\nfunction entryPath(entry: SparkAuthRouteEntry | undefined, defaultPath: string): string {\n  if (entry === undefined) return defaultPath;\n  return typeof entry === 'string' ? entry : entry.path;\n}\n\n/** An explicitly supplied component wins over the library's lazy import. */\nfunction child(entry: SparkAuthRouteEntry | undefined, path: string, defaultLoader: Loader): Child {\n  const component = typeof entry === 'object' && entry.component ? entry.component : undefined;\n  return { path, loadComponent: component ? () => Promise.resolve(component) : defaultLoader };\n}\n\n/**\n * One opt-in group of authentication pages, passed to {@link sparkAuthRoutes}. Constructed only by\n * ng-spark's entry points: `withLocalLogin()`, `withRegistration()`, `withExternalLogin()`,\n * `withPasskeys()` and `withAccount()` here, and `withIdentityProvider()` from\n * `@mintplayer/ng-spark/identity-provider`. That keeps the set of mountable pages a decision this\n * library makes rather than a shape an application invents.\n */\nexport interface SparkAuthRoutesFeature {\n  readonly children: Child[];\n  readonly paths: SparkAuthRoutePaths;\n  readonly providers?: SparkExternalProviderPresentation[];\n  /** Extra links for the account overview (`SPARK_ACCOUNT_OVERVIEW_LINKS`). */\n  readonly accountLinks?: SparkAccountOverviewLink[];\n}\n\n/** Path override for the sign-in landing page. Named to stay clear of the core package's\n * `SparkExternalLoginOptions`, which is about the sign-in *call* rather than the route. */\nexport type SparkExternalLoginRouteOptions = Pick<SparkAuthRouteEntries, 'signIn'>;\n\n/**\n * The routes for Spark's authentication pages.\n *\n * **Nothing is mounted unless a feature asks for it.** Passing no features emits no pages at all —\n * opt-in enforced by construction rather than by a flag, matching `provideHttpClient(withFetch())`\n * and `provideRouter(withComponentInputBinding())`. Before this the pages mounted by default and an\n * application had to opt *out*, so every app shipped a registration form whether or not it wanted\n * one.\n *\n * ```ts\n * sparkAuthRoutes(\n *   withLocalLogin(),\n *   withRegistration(),\n *   withExternalLogin(githubProvider(), facebookProvider()),\n * )\n * ```\n *\n * The `import()` expressions live *inside* each feature. That placement is the point: a bundler\n * decides whether to emit a lazy chunk from whether the `import()` call site is reachable, not from\n * whether the route object referencing it survives — so filtering a children array after the fact\n * would still ship every page. A page nobody opted into has no reachable `import()` at all.\n */\nexport function sparkAuthRoutes(...features: SparkAuthRoutesFeature[]): any[] {\n  const children: Child[] = [];\n  const paths: SparkAuthRoutePaths = {};\n  const externalProviders: SparkExternalProviderPresentation[] = [];\n  const accountLinks: SparkAccountOverviewLink[] = [];\n\n  for (const feature of features) {\n    children.push(...feature.children);\n    Object.assign(paths, feature.paths);\n    if (feature.providers) externalProviders.push(...feature.providers);\n    if (feature.accountLinks) accountLinks.push(...feature.accountLinks);\n  }\n\n  return [\n    {\n      path: '',\n      providers: [\n        { provide: SPARK_AUTH_ROUTE_PATHS, useValue: paths },\n        { provide: SPARK_EXTERNAL_PROVIDERS, useValue: externalProviders },\n        { provide: SPARK_ACCOUNT_OVERVIEW_LINKS, useValue: accountLinks },\n      ],\n      children,\n    },\n  ];\n}\n\n/**\n * Mounts the email/password family: login, two-factor, forgot-password, reset-password.\n *\n * These four are one feature rather than four because they form a star centred on the login page and\n * every template dereferences its siblings unconditionally — removing any proper subset leaves a\n * dangling link. Registration is genuinely separable, and is its own feature.\n *\n * Two-factor belongs here because it is reachable only from the login page's `RequiresTwoFactor`\n * branch and posts to the same `/login` endpoint: it is part of password sign-in, not of\n * authentication in general.\n */\nexport function withLocalLogin(\n  entries?: Pick<SparkAuthRouteEntries, 'login' | 'twoFactor' | 'forgotPassword' | 'resetPassword'>,\n): SparkAuthRoutesFeature {\n  const login = entryPath(entries?.login, 'login');\n  const twoFactor = entryPath(entries?.twoFactor, 'login/two-factor');\n  const forgotPassword = entryPath(entries?.forgotPassword, 'forgot-password');\n  const resetPassword = entryPath(entries?.resetPassword, 'reset-password');\n\n  return {\n    paths: {\n      login: '/' + login,\n      twoFactor: '/' + twoFactor,\n      forgotPassword: '/' + forgotPassword,\n      resetPassword: '/' + resetPassword,\n    },\n    children: [\n      child(entries?.login, login,\n        () => import('@mintplayer/ng-spark/auth/login').then(m => m.SparkLoginComponent)),\n      child(entries?.twoFactor, twoFactor,\n        () => import('@mintplayer/ng-spark/auth/two-factor').then(m => m.SparkTwoFactorComponent)),\n      child(entries?.forgotPassword, forgotPassword,\n        () => import('@mintplayer/ng-spark/auth/forgot-password').then(m => m.SparkForgotPasswordComponent)),\n      child(entries?.resetPassword, resetPassword,\n        () => import('@mintplayer/ng-spark/auth/reset-password').then(m => m.SparkResetPasswordComponent)),\n    ],\n  };\n}\n\n/**\n * Mounts the self-service registration page.\n *\n * Separate from {@link withLocalLogin} because the two decisions genuinely are separate: an\n * application whose accounts are provisioned by an administrator still needs password sign-in and\n * password reset. Mount it only alongside a server whose `SparkLocalCredentials` is `Full` — with\n * `SignInOnly` the endpoint it posts to is not mapped.\n */\nexport function withRegistration(entry?: SparkAuthRouteEntry): SparkAuthRoutesFeature {\n  const register = entryPath(entry, 'register');\n\n  return {\n    paths: { register: '/' + register },\n    children: [\n      child(entry, register,\n        () => import('@mintplayer/ng-spark/auth/register').then(m => m.SparkRegisterComponent)),\n    ],\n  };\n}\n\n/**\n * Mounts the sign-in landing page — a button per external provider the *server* reports.\n *\n * Accepts provider declarations and, in any position, one options object for the page's own path;\n * the two shapes are disjoint, so `withExternalLogin(githubProvider(), facebookProvider())` and\n * `withExternalLogin({ signIn: 'landing' }, githubProvider())` both read naturally.\n *\n * Declaring no providers is valid and useful: the page still renders whatever\n * `GET /spark/auth/capabilities` reports, using default buttons.\n */\nexport function withExternalLogin(\n  ...providersOrOptions: (SparkExternalProviderPresentation | SparkExternalLoginRouteOptions)[]\n): SparkAuthRoutesFeature {\n  const providers = providersOrOptions.filter(isProvider);\n  const options = providersOrOptions.find((p): p is SparkExternalLoginRouteOptions => !isProvider(p));\n  const signIn = entryPath(options?.signIn, 'sign-in');\n\n  return {\n    paths: { signIn: '/' + signIn },\n    providers,\n    children: [\n      child(options?.signIn, signIn,\n        () => import('@mintplayer/ng-spark/auth/sign-in').then(m => m.SparkSignInComponent)),\n    ],\n  };\n}\n\nfunction isProvider(\n  value: SparkExternalProviderPresentation | SparkExternalLoginRouteOptions,\n): value is SparkExternalProviderPresentation {\n  return typeof (value as SparkExternalProviderPresentation).scheme === 'string';\n}\n\n/**\n * Presentation for one provider's button, keyed by the scheme the server reports.\n *\n * The generic form. `githubProvider()` and friends are this with a scheme and an icon filled in —\n * they exist so the common case does not require knowing the scheme string, not because the library\n * has an opinion about which providers exist.\n */\n/**\n * Mounts the passkey management path, which forwards to the generic passkeys page (`/po/passkeys/me`).\n *\n * Independent of every other feature here, and of the server's `SparkLocalCredentials`: a passkey is\n * a passwordless credential, so the applications most likely to want this page are exactly the ones\n * that mount no password pages at all. It pairs with `SparkPasskeys.Enabled` on the server.\n *\n * ⚠️ The page assumes a signed-in user — enrollment adds a credential to an existing account, it\n * cannot create one. Mount it inside the application's authenticated area, or behind\n * `sparkAuthGuard`; the server answers the page with 404 to a visitor who is not signed in.\n */\nexport function withPasskeys(entry?: SparkAuthRouteEntry): SparkAuthRoutesFeature {\n  const passkeys = entryPath(entry, 'passkeys');\n\n  return {\n    paths: { passkeys: '/' + passkeys },\n    children: [passkeysChild(entry, passkeys, [])],\n  };\n}\n\n/** Options for {@link withAccount}: a path/component per page, and the guard of the signed-in pages. */\nexport type SparkAccountRouteOptions =\n  Pick<SparkAuthRouteEntries, 'confirmEmail' | 'account' | 'profile' | 'changePassword' | 'twoFactorSetup' | 'externalLogins' | 'passkeys' | 'personalData'>\n  & {\n    /**\n     * Guards the signed-in pages (everything but confirm-email). Defaults to `[sparkAuthGuard]`,\n     * which waits for the session check so a hard reload does not bounce a signed-in user to the\n     * sign-in page. Pass `[]` when the pages sit under a guarded parent route already.\n     */\n    canActivate?: CanActivateFn[];\n    /**\n     * Pages to leave out, e.g. `['externalLogins']` for an app without external providers or\n     * `['changePassword']` under `SparkLocalCredentials.Disabled` (the endpoint is not mapped there).\n     */\n    exclude?: (keyof Omit<SparkAccountRouteOptions, 'canActivate' | 'exclude'>)[];\n  };\n\n/**\n * Mounts the account pages (#460, D16), each also usable as a standalone component:\n *\n * | page | default path | component |\n * |---|---|---|\n * | confirm email (public; the mail link target) | `confirm-email` | `SparkConfirmEmailComponent` |\n * | overview | `account` | `SparkAccountOverviewComponent` |\n * | profile (user name, email change, mail language, app fields) | `account/profile` | `SparkAccountProfileComponent` |\n * | change / set password | `account/password` | `SparkChangePasswordComponent` |\n * | two-factor (authenticator, recovery codes) | `account/two-factor` | `SparkTwoFactorSetupComponent` |\n * | connected logins | `account/logins` | `SparkExternalLoginsComponent` |\n * | passkeys (forwards to the generic page, `/po/passkeys/me`) | `account/passkeys` | — |\n * | personal data + account deletion | `account/personal-data` | `SparkPersonalDataComponent` |\n *\n * `confirm-email` must stay at the server's `Spark:Auth:Links:ConfirmEmailPath` (default\n * `/confirm-email`), which confirmation mails link to. No path has a parameterised first segment, so the\n * group neither shadows `sparkRoutes()` nor is shadowed by it.\n */\nexport function withAccount(options?: SparkAccountRouteOptions): SparkAuthRoutesFeature {\n  const guard = options?.canActivate ?? [sparkAuthGuard];\n  const excluded = new Set(options?.exclude ?? []);\n  const paths: SparkAuthRoutePaths = {};\n  const children: Child[] = [];\n\n  const add = (key: keyof SparkAccountRouteOptions & keyof SparkAuthRouteEntries, defaultPath: string, loader: Loader, guarded = true) => {\n    if (excluded.has(key as never)) return;\n    const entry = options?.[key] as SparkAuthRouteEntry | undefined;\n    const path = entryPath(entry, defaultPath);\n    paths[key] = '/' + path;\n    const route = child(entry, path, loader);\n    children.push(guarded && guard.length ? { ...route, canActivate: guard } : route);\n  };\n\n  add('confirmEmail', 'confirm-email',\n    () => import('@mintplayer/ng-spark/auth/confirm-email').then(m => m.SparkConfirmEmailComponent), false);\n  add('profile', 'account/profile',\n    () => import('@mintplayer/ng-spark/auth/account').then(m => m.SparkAccountProfileComponent));\n  add('changePassword', 'account/password',\n    () => import('@mintplayer/ng-spark/auth/account').then(m => m.SparkChangePasswordComponent));\n  add('twoFactorSetup', 'account/two-factor',\n    () => import('@mintplayer/ng-spark/auth/account').then(m => m.SparkTwoFactorSetupComponent));\n  add('externalLogins', 'account/logins',\n    () => import('@mintplayer/ng-spark/auth/account').then(m => m.SparkExternalLoginsComponent));\n  if (!excluded.has('passkeys')) {\n    const path = entryPath(options?.passkeys, 'account/passkeys');\n    paths.passkeys = '/' + path;\n    children.push(passkeysChild(options?.passkeys, path, guard));\n  }\n  add('personalData', 'account/personal-data',\n    () => import('@mintplayer/ng-spark/auth/account').then(m => m.SparkPersonalDataComponent));\n  add('account', 'account',\n    () => import('@mintplayer/ng-spark/auth/account').then(m => m.SparkAccountOverviewComponent));\n\n  return { paths, children };\n}\n\n/** Options for {@link withConnectedAgents}. */\nexport type SparkConnectedAgentsRouteOptions = Pick<SparkAuthRouteEntries, 'agents'> & {\n  /** Guards the page. Defaults to `[sparkAuthGuard]`; pass `[]` under a guarded parent route. */\n  canActivate?: CanActivateFn[];\n};\n\n/**\n * Mounts **Connected applications** (MCP PRD D14) at `account/agents` (`SparkConnectedAgentsComponent`): the AI\n * agents the user connected and their personal access tokens — what each may see, whether it may make changes,\n * when it was last used — with edit, disconnect and \"create token\"; then what other packages contribute. Adds a\n * link to the account overview (`SPARK_ACCOUNT_OVERVIEW_LINKS`).\n *\n * Opt-in, because the page needs the server's `MintPlayer.Spark.Mcp` package: without it\n * `/spark/auth/manage/agents` is not mapped.\n */\nexport function withConnectedAgents(options?: SparkConnectedAgentsRouteOptions): SparkAuthRoutesFeature {\n  const guard = options?.canActivate ?? [sparkAuthGuard];\n  const path = entryPath(options?.agents, 'account/agents');\n  const route = child(options?.agents, path,\n    () => import('@mintplayer/ng-spark/auth/account').then(m => m.SparkConnectedAgentsComponent));\n\n  return {\n    paths: { agents: '/' + path },\n    children: [guard.length ? { ...route, canActivate: guard } : route],\n    accountLinks: [{\n      key: 'agents',\n      path: '/' + path,\n      label: { en: 'Connected applications', fr: 'Applications connectées', nl: 'Gekoppelde toepassingen' },\n    }],\n  };\n}\n\nexport function externalProvider(\n  scheme: string,\n  presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>,\n): SparkExternalProviderPresentation {\n  return { scheme, ...presentation };\n}\n\nexport function githubProvider(\n  presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>,\n): SparkExternalProviderPresentation {\n  return externalProvider('GitHub', { iconClass: 'bi bi-github', ...presentation });\n}\n\nexport function googleProvider(\n  presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>,\n): SparkExternalProviderPresentation {\n  return externalProvider('Google', { iconClass: 'bi bi-google', ...presentation });\n}\n\nexport function facebookProvider(\n  presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>,\n): SparkExternalProviderPresentation {\n  return externalProvider('Facebook', { iconClass: 'bi bi-facebook', ...presentation });\n}\n\nexport function microsoftProvider(\n  presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>,\n): SparkExternalProviderPresentation {\n  return externalProvider('Microsoft', { iconClass: 'bi bi-microsoft', ...presentation });\n}\n\n/** X (formerly Twitter) — the server's `spark.AddTwitter()` preset (OAuth 2.0), scheme `Twitter`. */\nexport function twitterProvider(\n  presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>,\n): SparkExternalProviderPresentation {\n  return externalProvider('Twitter', { displayName: 'X', iconClass: 'bi bi-twitter-x', ...presentation });\n}\n\n/** LinkedIn — the server's `spark.AddLinkedIn()` preset (OpenID Connect userinfo), scheme `LinkedIn`. */\nexport function linkedInProvider(\n  presentation?: Omit<SparkExternalProviderPresentation, 'scheme'>,\n): SparkExternalProviderPresentation {\n  return externalProvider('LinkedIn', { iconClass: 'bi bi-linkedin', ...presentation });\n}\n\n/**\n * Any OpenID Connect provider — the client half of the server's OIDC preset\n * (`spark.AddOpenIdConnect(...)`, or a `Spark:Auth:Providers:OpenIdConnect:<scheme>` section). Unlike the named presets the scheme is the\n * application's own choice, so it and the button text are required; `scheme` must equal the server's\n * scheme name exactly.\n */\nexport function oidcProvider(\n  scheme: string,\n  displayName: string,\n  iconClass = 'bi bi-person-badge',\n): SparkExternalProviderPresentation {\n  return externalProvider(scheme, { displayName, iconClass });\n}\n"],"mappings":";;;;AA4BA,MAAa,0BAA0B;AAGvC,MAAM,uBAAsC,OAAO,MAAM,CAAC,CAAC,SAAS,uBAAuB;AAS3F,SAAS,cAAc,OAAwC,MAAc,OAAsB;CACjG,IAAI,OAAO,UAAU,YAAY,MAAM,WAAW;EAChD,MAAM,YAAY,MAAM;EACxB,OAAO;GAAE;GAAM,qBAAqB,QAAQ,QAAQ,SAAS;GAAG,GAAI,MAAM,SAAS,EAAE,aAAa,MAAK,IAAK,CAAA;EAAG;CACjH;CACA,OAAO;EAAE;EAAM,aAAa,CAAC,GAAG,OAAO,cAAc;EAAG,UAAU,CAAA;CAAE;AACtE;AAGA,SAAS,UAAU,OAAwC,aAAmB;CAC5E,IAAI,UAAU,QAAW,OAAO;CAChC,OAAO,OAAO,UAAU,WAAW,QAAQ,MAAM;AACnD;AAGA,SAAS,MAAM,OAAwC,MAAc,eAAqB;CACxF,MAAM,YAAY,OAAO,UAAU,YAAY,MAAM,YAAY,MAAM,YAAY;CACnF,OAAO;EAAE;EAAM,eAAe,kBAAkB,QAAQ,QAAQ,SAAS,IAAI;CAAa;AAC5F;AA2CA,SAAgB,gBAAgB,GAAG,UAAkC;CACnE,MAAM,WAAoB,CAAA;CAC1B,MAAM,QAA6B,CAAA;CACnC,MAAM,oBAAyD,CAAA;CAC/D,MAAM,eAA2C,CAAA;CAEjD,KAAK,MAAM,WAAW,UAAU;EAC9B,SAAS,KAAK,GAAG,QAAQ,QAAQ;EACjC,OAAO,OAAO,OAAO,QAAQ,KAAK;EAClC,IAAI,QAAQ,WAAW,kBAAkB,KAAK,GAAG,QAAQ,SAAS;EAClE,IAAI,QAAQ,cAAc,aAAa,KAAK,GAAG,QAAQ,YAAY;CACrE;CAEA,OAAO,CACL;EACE,MAAM;EACN,WAAW;GACT;IAAE,SAAS;IAAwB,UAAU;GAAK;GAClD;IAAE,SAAS;IAA0B,UAAU;GAAiB;GAChE;IAAE,SAAS;IAA8B,UAAU;GAAY;EAChE;EACD;CACD,CACF;AACH;AAaA,SAAgB,eACd,SAAiG;CAEjG,MAAM,QAAQ,UAAU,SAAS,OAAO,OAAO;CAC/C,MAAM,YAAY,UAAU,SAAS,WAAW,kBAAkB;CAClE,MAAM,iBAAiB,UAAU,SAAS,gBAAgB,iBAAiB;CAC3E,MAAM,gBAAgB,UAAU,SAAS,eAAe,gBAAgB;CAExE,OAAO;EACL,OAAO;GACL,OAAO,MAAM;GACb,WAAW,MAAM;GACjB,gBAAgB,MAAM;GACtB,eAAe,MAAM;EACtB;EACD,UAAU;GACR,MAAM,SAAS,OAAO,aACd,OAAO,kCAAkC,CAAC,MAAK,MAAK,EAAE,mBAAmB,CAAC;GAClF,MAAM,SAAS,WAAW,iBAClB,OAAO,uCAAuC,CAAC,MAAK,MAAK,EAAE,uBAAuB,CAAC;GAC3F,MAAM,SAAS,gBAAgB,sBACvB,OAAO,4CAA4C,CAAC,MAAK,MAAK,EAAE,4BAA4B,CAAC;GACrG,MAAM,SAAS,eAAe,qBACtB,OAAO,2CAA2C,CAAC,MAAK,MAAK,EAAE,2BAA2B,CAAC;EACpG;CACF;AACH;AAUA,SAAgB,iBAAiB,OAA2B;CAC1D,MAAM,WAAW,UAAU,OAAO,UAAU;CAE5C,OAAO;EACL,OAAO,EAAE,UAAU,MAAM,SAAQ;EACjC,UAAU,CACR,MAAM,OAAO,gBACL,OAAO,qCAAqC,CAAC,MAAK,MAAK,EAAE,sBAAsB,CAAC,CACzF;CACF;AACH;AAYA,SAAgB,kBACd,GAAG,oBAA0F;CAE7F,MAAM,YAAY,mBAAmB,OAAO,UAAU;CACtD,MAAM,UAAU,mBAAmB,MAAM,MAA2C,CAAC,WAAW,CAAC,CAAC;CAClG,MAAM,SAAS,UAAU,SAAS,QAAQ,SAAS;CAEnD,OAAO;EACL,OAAO,EAAE,QAAQ,MAAM,OAAM;EAC7B;EACA,UAAU,CACR,MAAM,SAAS,QAAQ,cACf,OAAO,oCAAoC,CAAC,MAAK,MAAK,EAAE,oBAAoB,CAAC,CACtF;CACF;AACH;AAEA,SAAS,WACP,OAAyE;CAEzE,OAAO,OAAQ,MAA4C,WAAW;AACxE;AAoBA,SAAgB,aAAa,OAA2B;CACtD,MAAM,WAAW,UAAU,OAAO,UAAU;CAE5C,OAAO;EACL,OAAO,EAAE,UAAU,MAAM,SAAQ;EACjC,UAAU,CAAC,cAAc,OAAO,UAAU,CAAA,CAAE,CAAC;CAC9C;AACH;AAqCA,SAAgB,YAAY,SAAkC;CAC5D,MAAM,QAAQ,SAAS,eAAe,CAAC,cAAc;CACrD,MAAM,WAAW,IAAI,IAAI,SAAS,WAAW,CAAA,CAAE;CAC/C,MAAM,QAA6B,CAAA;CACnC,MAAM,WAAoB,CAAA;CAE1B,MAAM,OAAO,KAAmE,aAAqB,QAAgB,UAAU,SAAQ;EACrI,IAAI,SAAS,IAAI,GAAY,GAAG;EAChC,MAAM,QAAQ,UAAU;EACxB,MAAM,OAAO,UAAU,OAAO,WAAW;EACzC,MAAM,OAAO,MAAM;EACnB,MAAM,QAAQ,MAAM,OAAO,MAAM,MAAM;EACvC,SAAS,KAAK,WAAW,MAAM,SAAS;GAAE,GAAG;GAAO,aAAa;EAAK,IAAK,KAAK;CAClF;CAEA,IAAI,gBAAgB,uBACZ,OAAO,0CAA0C,CAAC,MAAK,MAAK,EAAE,0BAA0B,GAAG,KAAK;CACxG,IAAI,WAAW,yBACP,OAAO,oCAAoC,CAAC,MAAK,MAAK,EAAE,4BAA4B,CAAC;CAC7F,IAAI,kBAAkB,0BACd,OAAO,oCAAoC,CAAC,MAAK,MAAK,EAAE,4BAA4B,CAAC;CAC7F,IAAI,kBAAkB,4BACd,OAAO,oCAAoC,CAAC,MAAK,MAAK,EAAE,4BAA4B,CAAC;CAC7F,IAAI,kBAAkB,wBACd,OAAO,oCAAoC,CAAC,MAAK,MAAK,EAAE,4BAA4B,CAAC;CAC7F,IAAI,CAAC,SAAS,IAAI,UAAU,GAAG;EAC7B,MAAM,OAAO,UAAU,SAAS,UAAU,kBAAkB;EAC5D,MAAM,WAAW,MAAM;EACvB,SAAS,KAAK,cAAc,SAAS,UAAU,MAAM,KAAK,CAAC;CAC7D;CACA,IAAI,gBAAgB,+BACZ,OAAO,oCAAoC,CAAC,MAAK,MAAK,EAAE,0BAA0B,CAAC;CAC3F,IAAI,WAAW,iBACP,OAAO,oCAAoC,CAAC,MAAK,MAAK,EAAE,6BAA6B,CAAC;CAE9F,OAAO;EAAE;EAAO;CAAQ;AAC1B;AAiBA,SAAgB,oBAAoB,SAA0C;CAC5E,MAAM,QAAQ,SAAS,eAAe,CAAC,cAAc;CACrD,MAAM,OAAO,UAAU,SAAS,QAAQ,gBAAgB;CACxD,MAAM,QAAQ,MAAM,SAAS,QAAQ,YAC7B,OAAO,oCAAoC,CAAC,MAAK,MAAK,EAAE,6BAA6B,CAAC;CAE9F,OAAO;EACL,OAAO,EAAE,QAAQ,MAAM,KAAI;EAC3B,UAAU,CAAC,MAAM,SAAS;GAAE,GAAG;GAAO,aAAa;EAAK,IAAK,KAAK;EAClE,cAAc,CAAC;GACb,KAAK;GACL,MAAM,MAAM;GACZ,OAAO;IAAE,IAAI;IAA0B,IAAI;IAA2B,IAAI;GAAyB;EACpG,CAAA;CACF;AACH;AAEA,SAAgB,iBACd,QACA,cAAgE;CAEhE,OAAO;EAAE;EAAQ,GAAG;CAAY;AAClC;AAEA,SAAgB,eACd,cAAgE;CAEhE,OAAO,iBAAiB,UAAU;EAAE,WAAW;EAAgB,GAAG;CAAY,CAAE;AAClF;AAEA,SAAgB,eACd,cAAgE;CAEhE,OAAO,iBAAiB,UAAU;EAAE,WAAW;EAAgB,GAAG;CAAY,CAAE;AAClF;AAEA,SAAgB,iBACd,cAAgE;CAEhE,OAAO,iBAAiB,YAAY;EAAE,WAAW;EAAkB,GAAG;CAAY,CAAE;AACtF;AAEA,SAAgB,kBACd,cAAgE;CAEhE,OAAO,iBAAiB,aAAa;EAAE,WAAW;EAAmB,GAAG;CAAY,CAAE;AACxF;AAGA,SAAgB,gBACd,cAAgE;CAEhE,OAAO,iBAAiB,WAAW;EAAE,aAAa;EAAK,WAAW;EAAmB,GAAG;CAAY,CAAE;AACxG;AAGA,SAAgB,iBACd,cAAgE;CAEhE,OAAO,iBAAiB,YAAY;EAAE,WAAW;EAAkB,GAAG;CAAY,CAAE;AACtF;AAQA,SAAgB,aACd,QACA,aACA,YAAY,sBAAoB;CAEhC,OAAO,iBAAiB,QAAQ;EAAE;EAAa;CAAS,CAAE;AAC5D"}