npm - @nihplod/sso-sdk - Versions diffs - 1.0.1 → 1.1.0 - Mend

@nihplod/sso-sdk 1.0.1 → 1.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (20) hide show

package/dist/react/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"sources":["../../src/react/index.ts","../../src/react/SsoProvider.tsx","../../src/core/errors.ts","../../src/core/pkce.ts","../../src/core/storage.ts","../../src/core/SsoClient.ts","../../src/react/RequireAuth.tsx","../../src/react/CallbackPage.tsx"],"sourcesContent":["/*\r\n @nihplod/sso-sdk/react\r\n \r\n React 绑定层：SsoProvider Context、useSso Hook、RequireAuth 路由保护、CallbackPage 回调处理。\r\n /\r\n\r\nexport { SsoProvider, useSso } from \"./SsoProvider\";\r\nexport { RequireAuth, withAuth } from \"./RequireAuth\";\r\nexport { CallbackPage } from \"./CallbackPage\";\r\n","/\r\n SsoProvider - React Context Provider\r\n \r\n 包裹子项目根组件，提供全局 SSO 认证状态管理：\r\n * - 自动管理 token 刷新定时器（过期前 60s 静默刷新）\r\n * - 监听 storage 事件实现跨 Tab 同步\r\n * - 提供 useSso() hook\r\n /\r\n\r\n\"use client\";\r\n\r\nimport React, {\r\n createContext,\r\n useContext,\r\n useState,\r\n useEffect,\r\n useCallback,\r\n useRef,\r\n type ReactNode,\r\n} from \"react\";\r\nimport { SsoClient } from \"../core/SsoClient\";\r\nimport { getTokenData, removeTokenData } from \"../core/storage\";\r\nimport type { SsoClientConfig, SsoUser } from \"../core/SsoClient\";\r\n\r\n// ============================================\r\n// Context 类型\r\n// ============================================\r\n\r\nexport interface SsoContextValue {\r\n /* 当前用户信息 /\r\n user: SsoUser \| null;\r\n\r\n /* 是否已认证 /\r\n isAuthenticated: boolean;\r\n\r\n /* 是否正在加载（初始化/刷新中） /\r\n isLoading: boolean;\r\n\r\n /* 发起登录 /\r\n login: (returnUrl?: string) => Promise<void>;\r\n\r\n /* 登出 /\r\n logout: (redirectToSso?: boolean) => Promise<void>;\r\n\r\n /* 刷新用户信息 /\r\n refreshUser: () => Promise<void>;\r\n\r\n /* 获取 access_token（自动刷新过期 token） /\r\n getAccessToken: () => Promise<string \| null>;\r\n\r\n /* SsoClient 实例（高级用法） /\r\n client: SsoClient;\r\n}\r\n\r\nconst SsoContext = createContext<SsoContextValue \| null>(null);\r\n\r\n// ============================================\r\n// Provider Props\r\n// ============================================\r\n\r\nexport interface SsoProviderProps {\r\n /* SSO 客户端配置 /\r\n config: SsoClientConfig;\r\n\r\n /* 子组件 /\r\n children: ReactNode;\r\n\r\n /\r\n 自动刷新阈值（秒）\r\n * access_token 过期前多少秒触发静默刷新。\r\n * 默认 60 秒。\r\n /\r\n refreshThreshold?: number;\r\n\r\n /\r\n API 请求函数（可选）\r\n * 用于在 token 刷新后自动重试失败的 API 请求。\r\n /\r\n onTokenRefreshed?: (token: string) => void;\r\n}\r\n\r\n// 跨 Tab 刷新锁（基于 localStorage + 时间戳，避免多 Tab 同时刷新导致旧 RT 被撤销）\r\nconst REFRESH_LOCK_PREFIX = \"nihplod_sso_refresh_lock:\";\r\nconst LOCK_TTL_MS = 5000;\r\n\r\nfunction lockKey(clientId: string): string {\r\n return REFRESH_LOCK_PREFIX + clientId;\r\n}\r\n\r\nfunction acquireRefreshLock(clientId: string): boolean {\r\n if (typeof localStorage === \"undefined\") return true;\r\n const key = lockKey(clientId);\r\n const now = Date.now();\r\n const raw = localStorage.getItem(key);\r\n if (raw) {\r\n const ts = parseInt(raw, 10);\r\n if (!isNaN(ts) && now - ts < LOCK_TTL_MS) {\r\n return false;\r\n }\r\n }\r\n localStorage.setItem(key, String(now));\r\n return true;\r\n}\r\n\r\nfunction releaseRefreshLock(clientId: string): void {\r\n if (typeof localStorage === \"undefined\") return;\r\n localStorage.removeItem(lockKey(clientId));\r\n}\r\n\r\n// ============================================\r\n// Provider 实现\r\n// ============================================\r\n\r\nexport function SsoProvider({\r\n config,\r\n children,\r\n refreshThreshold = 60,\r\n onTokenRefreshed,\r\n}: SsoProviderProps) {\r\n const [user, setUser] = useState<SsoUser \| null>(null);\r\n const [isLoading, setIsLoading] = useState(true);\r\n const [isAuthenticated, setIsAuthenticated] = useState(false);\r\n const clientRef = useRef(new SsoClient(config));\r\n const refreshTimerRef = useRef<ReturnType<typeof setTimeout> \| null>(null);\r\n const loadedRef = useRef(false);\r\n\r\n const client = clientRef.current;\r\n\r\n // 加载用户信息\r\n const loadUser = useCallback(async () => {\r\n if (!client.isAuthenticated()) {\r\n setUser(null);\r\n setIsAuthenticated(false);\r\n setIsLoading(false);\r\n return;\r\n }\r\n\r\n try {\r\n const u = await client.getUserInfo();\r\n setUser(u);\r\n setIsAuthenticated(true);\r\n } catch {\r\n setUser(null);\r\n setIsAuthenticated(false);\r\n removeTokenData(client.config.clientId);\r\n } finally {\r\n setIsLoading(false);\r\n }\r\n }, [client]);\r\n\r\n // 初始化\r\n useEffect(() => {\r\n if (loadedRef.current) return;\r\n loadedRef.current = true;\r\n\r\n // 检查是否有有效的 token（不发起网络请求）\r\n if (client.isAuthenticated()) {\r\n loadUser();\r\n } else {\r\n setIsLoading(false);\r\n }\r\n }, [client, loadUser]);\r\n\r\n // Token 自动刷新定时器（setTimeout 递归调度，避免 setInterval 堆积）\r\n useEffect(() => {\r\n let active = true;\r\n\r\n const scheduleNextRefresh = () => {\r\n if (!active) return;\r\n\r\n // 清除已有定时器\r\n if (refreshTimerRef.current) {\r\n clearTimeout(refreshTimerRef.current);\r\n refreshTimerRef.current = null;\r\n }\r\n\r\n const tokenData = getTokenData(client.config.clientId);\r\n if (!tokenData) return;\r\n\r\n // 计算距离过期还有多少秒\r\n const remainingSec = (tokenData.expires_at - Date.now()) / 1000;\r\n\r\n if (remainingSec <= 0) {\r\n // 已过期，立即刷新（带锁，避免多 Tab 并发）\r\n if (!acquireRefreshLock(client.config.clientId)) return;\r\n client\r\n .refreshToken()\r\n .then((td) => {\r\n onTokenRefreshed?.(td.access_token);\r\n loadUser();\r\n })\r\n .catch(() => {\r\n // 刷新失败可能是其他 Tab 已刷新；短暂后重新加载本地 token\r\n setTimeout(() => loadUser(), 500);\r\n })\r\n .finally(() => releaseRefreshLock(client.config.clientId));\r\n return;\r\n }\r\n\r\n if (remainingSec <= refreshThreshold) {\r\n // 即将过期，立即刷新（带锁）\r\n if (!acquireRefreshLock(client.config.clientId)) return;\r\n client\r\n .refreshToken()\r\n .then((td) => {\r\n onTokenRefreshed?.(td.access_token);\r\n loadUser();\r\n })\r\n .catch(() => {\r\n setTimeout(() => loadUser(), 500);\r\n })\r\n .finally(() => releaseRefreshLock(client.config.clientId));\r\n return;\r\n }\r\n\r\n // 在过期前 refreshThreshold 秒触发刷新\r\n const delayMs = (remainingSec - refreshThreshold) 1000;\r\n\r\n refreshTimerRef.current = setTimeout(() => {\r\n const td = getTokenData(client.config.clientId);\r\n if (!td) return;\r\n\r\n const secLeft = (td.expires_at - Date.now()) / 1000;\r\n if (secLeft <= refreshThreshold) {\r\n if (!acquireRefreshLock(client.config.clientId)) {\r\n // 其他 Tab 正在刷新，等待 storage 事件同步即可\r\n return;\r\n }\r\n client\r\n .refreshToken()\r\n .then((newTd) => {\r\n onTokenRefreshed?.(newTd.access_token);\r\n loadUser();\r\n })\r\n .catch(() => {\r\n setTimeout(() => loadUser(), 500);\r\n })\r\n .finally(() => releaseRefreshLock(client.config.clientId));\r\n // 刷新后重新调度下一次\r\n scheduleNextRefresh();\r\n }\r\n }, Math.max(delayMs, 1000));\r\n };\r\n\r\n scheduleNextRefresh();\r\n\r\n return () => {\r\n active = false;\r\n if (refreshTimerRef.current) {\r\n clearTimeout(refreshTimerRef.current);\r\n refreshTimerRef.current = null;\r\n }\r\n };\r\n }, [client, loadUser, refreshThreshold, onTokenRefreshed]);\r\n\r\n // 监听 storage 事件实现跨 Tab 同步\r\n useEffect(() => {\r\n const handleStorageChange = (e: StorageEvent) => {\r\n if (\r\n e.key &&\r\n e.key.startsWith(\"nihplod_sso_\") &&\r\n !e.key.startsWith(REFRESH_LOCK_PREFIX)\r\n ) {\r\n loadUser();\r\n }\r\n };\r\n\r\n window.addEventListener(\"storage\", handleStorageChange);\r\n return () => window.removeEventListener(\"storage\", handleStorageChange);\r\n }, [loadUser]);\r\n\r\n // 登录\r\n const login = useCallback(\r\n async (returnUrl?: string) => {\r\n await client.login(returnUrl);\r\n },\r\n [client]\r\n );\r\n\r\n // 登出\r\n const logout = useCallback(\r\n async (redirectToSso: boolean = false) => {\r\n await client.logout(redirectToSso);\r\n setUser(null);\r\n setIsAuthenticated(false);\r\n },\r\n [client]\r\n );\r\n\r\n // 刷新用户信息\r\n const refreshUser = useCallback(async () => {\r\n await loadUser();\r\n }, [loadUser]);\r\n\r\n // 获取 access_token\r\n const getAccessToken = useCallback(async (): Promise<string \| null> => {\r\n return client.getAccessToken();\r\n }, [client]);\r\n\r\n const value: SsoContextValue = {\r\n user,\r\n isAuthenticated,\r\n isLoading,\r\n login,\r\n logout,\r\n refreshUser,\r\n getAccessToken,\r\n client,\r\n };\r\n\r\n return React.createElement(SsoContext.Provider, { value }, children);\r\n}\r\n\r\n// ============================================\r\n// Hook\r\n// ============================================\r\n\r\n/*\r\n useSso Hook\r\n \r\n 在 SsoProvider 内部使用，获取 SSO 认证状态和操作方法。\r\n \r\n @example\r\n * ```tsx\r\n * function MyComponent() {\r\n * const { user, isAuthenticated, login, logout } = useSso();\r\n * if (!isAuthenticated) return <button onClick={() => login()}>登录</button>;\r\n * return <div>欢迎, {user?.nickname}</div>;\r\n * }\r\n * ```\r\n /\r\nexport function useSso(): SsoContextValue {\r\n const ctx = useContext(SsoContext);\r\n if (!ctx) {\r\n throw new Error(\"useSso() 必须在 <SsoProvider> 内部使用\");\r\n }\r\n return ctx;\r\n}\r\n","/\r\n SSO SDK 错误类型\r\n /\r\n\r\n/* SSO 错误码 /\r\nexport type SsoErrorCode =\r\n \| \"invalid_config\"\r\n \| \"state_mismatch\"\r\n \| \"pkce_required\"\r\n \| \"token_request_failed\"\r\n \| \"session_expired\"\r\n \| \"no_refresh_token\"\r\n \| \"userinfo_failed\"\r\n \| \"not_authenticated\"\r\n \| \"sso_server_error\"\r\n \| \"network_error\"\r\n \| \"id_token_invalid\"\r\n \| \"id_token_unsupported_alg\"\r\n \| \"id_token_missing_secret\"\r\n \| \"id_token_invalid_signature\"\r\n \| \"id_token_issuer_mismatch\"\r\n \| \"id_token_audience_mismatch\"\r\n \| \"id_token_expired\"\r\n \| \"id_token_missing_sub\"\r\n \| \"id_token_at_hash_mismatch\";\r\n\r\n/* OAuth 2.0 标准错误码 /\r\nexport type OAuthErrorCode =\r\n \| \"invalid_request\"\r\n \| \"invalid_client\"\r\n \| \"invalid_grant\"\r\n \| \"unauthorized_client\"\r\n \| \"unsupported_grant_type\"\r\n \| \"invalid_scope\"\r\n \| \"access_denied\"\r\n \| \"server_error\"\r\n \| \"rate_limited\";\r\n\r\n/\r\n SSO SDK 自定义错误\r\n /\r\nexport class SsoError extends Error {\r\n public readonly code: SsoErrorCode;\r\n public readonly description: string;\r\n public readonly cause?: unknown;\r\n\r\n constructor(code: SsoErrorCode, description: string, cause?: unknown) {\r\n super(`[SSO SDK] ${code}: ${description}`);\r\n this.name = \"SsoError\";\r\n this.code = code;\r\n this.description = description;\r\n this.cause = cause;\r\n }\r\n}\r\n\r\n/\r\n OAuth 2.0 服务端返回的错误\r\n /\r\nexport class OAuthError extends Error {\r\n public readonly code: OAuthErrorCode;\r\n public readonly description: string;\r\n public readonly uri?: string;\r\n\r\n constructor(\r\n code: OAuthErrorCode,\r\n description: string,\r\n uri?: string\r\n ) {\r\n super(`[OAuth] ${code}: ${description}`);\r\n this.name = \"OAuthError\";\r\n this.code = code;\r\n this.description = description;\r\n this.uri = uri;\r\n }\r\n}\r\n","/\r\n PKCE (Proof Key for Code Exchange) 工具函数\r\n \r\n 实现 RFC 7636 规范：\r\n * - code_verifier: 43-128 字符的随机字符串\r\n * - code_challenge: SHA-256(code_verifier) 的 base64url 编码\r\n \r\n 仅支持 S256 模式，不提供 plain 模式。\r\n /\r\n\r\nconst VALID_CHARS =\r\n \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~\";\r\n\r\n/\r\n 生成密码学安全随机字符串\r\n \r\n 使用拒绝采样法（rejection sampling）避免取模非均匀分布。\r\n * VALID_CHARS 有 66 个字符，Uint8(0-255) 取模会偏向前 58 个字符。\r\n * 丢弃 >=198 的字节值使分布完全均匀（198 = floor(256/66) * 66）。\r\n /\r\nfunction generateRandomString(length: number): string {\r\n const mask = 198; // 66 3，最大均匀取值\r\n let result = \"\";\r\n\r\n while (result.length < length) {\r\n // 一次生成分块避免过小 array 的循环开销\r\n const chunkSize = Math.min(length * 2, 256);\r\n const array = new Uint8Array(chunkSize);\r\n crypto.getRandomValues(array);\r\n\r\n for (let i = 0; i < chunkSize && result.length < length; i++) {\r\n if (array[i] >= mask) continue; // 拒绝采样：丢弃 >=198 的字节\r\n result += VALID_CHARS[array[i] % VALID_CHARS.length];\r\n }\r\n }\r\n\r\n return result;\r\n}\r\n\r\n/*\r\n 生成 code_verifier\r\n \r\n 生成 43-128 字符之间的安全随机字符串，\r\n * 使用 `crypto.getRandomValues` 保证密码学安全性。\r\n \r\n @param length - 长度（默认 64），范围 43-128\r\n /\r\nexport function generateCodeVerifier(length: number = 64): string {\r\n if (length < 43 \|\| length > 128) {\r\n throw new Error(\"code_verifier length must be between 43 and 128\");\r\n }\r\n return generateRandomString(length);\r\n}\r\n\r\n/\r\n 计算 code_challenge (S256)\r\n \r\n 对 code_verifier 进行 SHA-256 哈希，然后进行 base64url 编码。\r\n \r\n @param codeVerifier - PKCE code_verifier\r\n /\r\nexport async function generateCodeChallenge(\r\n codeVerifier: string\r\n): Promise<string> {\r\n const encoder = new TextEncoder();\r\n const data = encoder.encode(codeVerifier);\r\n const hash = await crypto.subtle.digest(\"SHA-256\", data);\r\n\r\n // 转为 base64url（无 padding）\r\n const bytes = new Uint8Array(hash);\r\n let binary = \"\";\r\n for (let i = 0; i < bytes.byteLength; i++) {\r\n binary += String.fromCharCode(bytes[i]);\r\n }\r\n return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\r\n}\r\n\r\n/\r\n 生成 state 参数\r\n \r\n 32 字节 hex 随机字符串，用于 CSRF 防护。\r\n /\r\nexport function generateState(): string {\r\n const array = new Uint8Array(32);\r\n crypto.getRandomValues(array);\r\n return Array.from(array, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\r\n}\r\n","/\n Token 存储抽象层\n \n 默认使用 localStorage，以支持多 Tab 间自动同步 token 并避免并发刷新。\n * 对 XSS 敏感的子项目可通过 setTokenStorage() 注入更安全的自定义实现\n （如内存存储、Service Worker 封装、或带加密的 storage）。\n \n * 多 client 隔离：\n * - token / state / return_url 均支持按 clientId 隔离 key\n * - 不传 clientId 时使用全局 key，保持向后兼容\n /\n\n/* Token 数据 /\nexport interface TokenData {\n access_token: string;\n token_type: string;\n expires_in: number;\n refresh_token: string;\n id_token?: string;\n\n /* Token 签发时间（epoch ms），用于计算过期 /\n issued_at: number;\n\n /* 访问令牌实际过期时间（epoch ms）= issued_at + expires_in * 1000 /\n expires_at: number;\n}\n\n/* 存储接口 /\nexport interface TokenStorage {\n get(key: string): string \| null;\n set(key: string, value: string): void;\n remove(key: string): void;\n}\n\n/* 默认 localStorage/sessionStorage key 前缀 /\nconst STORAGE_PREFIX = \"nihplod_sso_\";\n\n/* 常量 key 名称 /\nconst TOKEN_KEY = \"token\";\nconst VERIFIER_KEY_PREFIX = \"pkce_verifier_\";\nconst STATE_KEY = \"oauth_state\";\nconst RETURN_URL_KEY = \"return_url\";\n\nfunction buildKey(base: string, clientId?: string): string {\n return clientId ? `${base}:${clientId}` : base;\n}\n\n/\n 内存存储适配器（Public Client 浏览器默认）\n \n 安全优势：\n * - refresh_token 不落盘，XSS 无法窃取长期凭证。\n * - 页面刷新后用户需重新授权，符合纯前端 Public Client 的安全模型。\n \n 代价：多 Tab 间不会自动同步 token；SDK 内部已用锁机制避免并发刷新。\n /\nfunction createMemoryStorageAdapter(): TokenStorage {\n const store = new Map<string, string>();\n return {\n get(key: string) {\n return store.get(key) ?? null;\n },\n set(key: string, value: string) {\n store.set(key, value);\n },\n remove(key: string) {\n store.delete(key);\n },\n };\n}\n\nconst memoryStorageAdapter = createMemoryStorageAdapter();\n\n/\n 浏览器 localStorage 实现\n \n 适用于：\n * - Next.js BFF / Confidential Client（refresh_token 不直接暴露给浏览器）。\n * - 需要多 Tab 共享 token 的场景。\n \n 注意：Public Client 在浏览器中直接存储 refresh_token 会增加 XSS 风险，\n * 建议改用内存存储或 Service Worker 封装。\n /\nconst localStorageAdapter: TokenStorage = {\n get(key: string) {\n if (typeof localStorage === \"undefined\") return null;\n return localStorage.getItem(STORAGE_PREFIX + key);\n },\n set(key: string, value: string) {\n if (typeof localStorage === \"undefined\") return;\n localStorage.setItem(STORAGE_PREFIX + key, value);\n },\n remove(key: string) {\n if (typeof localStorage === \"undefined\") return;\n localStorage.removeItem(STORAGE_PREFIX + key);\n },\n};\n\n/\n 创建安全存储实现\n \n @param options.persist 是否持久化到 localStorage。默认 false（内存存储）。\n * - Confidential/BFF 子项目可设为 true。\n * - Public Client 在浏览器中建议保持 false。\n /\nexport function createSecureStorage(options: { persist?: boolean } = {}): TokenStorage {\n return options.persist ? localStorageAdapter : memoryStorageAdapter;\n}\n\nlet _storage: TokenStorage = memoryStorageAdapter;\n\n/\n 设置自定义存储实现\n /\nexport function setTokenStorage(storage: TokenStorage): void {\n _storage = storage;\n}\n\n/\n 获取当前存储实现\n /\nexport function getTokenStorage(): TokenStorage {\n return _storage;\n}\n\n// ============================================\n// Token 存取\n// ============================================\n\nexport function saveTokenData(data: TokenData, clientId?: string): void {\n _storage.set(buildKey(TOKEN_KEY, clientId), JSON.stringify(data));\n}\n\nexport function getTokenData(clientId?: string): TokenData \| null {\n const raw = _storage.get(buildKey(TOKEN_KEY, clientId));\n if (!raw) return null;\n try {\n return JSON.parse(raw) as TokenData;\n } catch {\n return null;\n }\n}\n\nexport function removeTokenData(clientId?: string): void {\n _storage.remove(buildKey(TOKEN_KEY, clientId));\n}\n\n// ============================================\n// PKCE 临时数据存取\n// ============================================\n\nexport function savePkceVerifier(clientId: string, verifier: string): void {\n _storage.set(VERIFIER_KEY_PREFIX + clientId, verifier);\n}\n\nexport function getPkceVerifier(clientId: string): string \| null {\n return _storage.get(VERIFIER_KEY_PREFIX + clientId);\n}\n\nexport function removePkceVerifier(clientId: string): void {\n _storage.remove(VERIFIER_KEY_PREFIX + clientId);\n}\n\n// ============================================\n// State 参数存取\n// ============================================\n\nexport function saveOAuthState(state: string, clientId?: string): void {\n _storage.set(buildKey(STATE_KEY, clientId), state);\n}\n\nexport function getOAuthState(clientId?: string): string \| null {\n return _storage.get(buildKey(STATE_KEY, clientId));\n}\n\nexport function removeOAuthState(clientId?: string): void {\n _storage.remove(buildKey(STATE_KEY, clientId));\n}\n\n// ============================================\n// 返回 URL 存取\n// ============================================\n\nexport function saveReturnUrl(url: string, clientId?: string): void {\n _storage.set(buildKey(RETURN_URL_KEY, clientId), url);\n}\n\nexport function getReturnUrl(clientId?: string): string \| null {\n return _storage.get(buildKey(RETURN_URL_KEY, clientId));\n}\n\nexport function removeReturnUrl(clientId?: string): void {\n _storage.remove(buildKey(RETURN_URL_KEY, clientId));\n}\n\n// ============================================\n// 清理所有 SSO 数据\n// ============================================\n\nexport function clearAllSsoData(clientId?: string): void {\n if (clientId) {\n removeTokenData(clientId);\n removeOAuthState(clientId);\n removeReturnUrl(clientId);\n removePkceVerifier(clientId);\n return;\n }\n\n removeTokenData();\n removeOAuthState();\n removeReturnUrl();\n\n // 清理所有 PKCE verifier（遍历已知前缀，localStorage key 可枚举）\n if (typeof localStorage !== \"undefined\") {\n const prefix = STORAGE_PREFIX + VERIFIER_KEY_PREFIX;\n for (let i = 0; i < localStorage.length; i++) {\n const key = localStorage.key(i);\n if (key?.startsWith(prefix)) {\n _storage.remove(key.slice(STORAGE_PREFIX.length));\n }\n }\n }\n}\n\n/\n 清理指定 clientId 列表的 PKCE verifier\n \n 适用于非浏览器环境或已知 clientId 场景。\n /\nexport function clearVerifiersForClients(clientIds: string[]): void {\n for (const clientId of clientIds) {\n _storage.remove(VERIFIER_KEY_PREFIX + clientId);\n }\n}\n","/\r\n SSO Client 核心类\r\n \r\n 封装完整的 OAuth 2.0 授权码 + PKCE S256 流程：\r\n * - login(): 发起授权请求\r\n * - handleCallback(): 处理回调，交换 token\r\n * - refreshToken(): 刷新 access token（原子轮换）\r\n * - getUserInfo(): 获取用户信息\r\n * - logout(): 登出\r\n * - isAuthenticated(): 检查认证状态\r\n /\r\n\r\nimport { SsoError } from \"./errors\";\r\nimport {\r\n generateCodeVerifier,\r\n generateCodeChallenge,\r\n generateState,\r\n} from \"./pkce\";\r\nimport {\r\n saveTokenData,\r\n getTokenData,\r\n removeTokenData,\r\n savePkceVerifier,\r\n getPkceVerifier,\r\n removePkceVerifier,\r\n saveOAuthState,\r\n getOAuthState,\r\n removeOAuthState,\r\n saveReturnUrl,\r\n getReturnUrl,\r\n removeReturnUrl,\r\n clearAllSsoData,\r\n type TokenData,\r\n} from \"./storage\";\r\n\r\n// ============================================\r\n// ID Token 验证辅助函数（浏览器原生 Web Crypto）\r\n// ============================================\r\n\r\nfunction base64UrlDecode(input: string): Uint8Array {\r\n const base64 = input.replace(/-/g, \"+\").replace(/_/g, \"/\");\r\n const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), \"=\");\r\n const binary = atob(padded);\r\n const bytes = new Uint8Array(binary.length);\r\n for (let i = 0; i < binary.length; i++) {\r\n bytes[i] = binary.charCodeAt(i);\r\n }\r\n return bytes;\r\n}\r\n\r\n/* 解码 JWT payload（不验证签名） /\r\nfunction decodeJwtPayload(token: string): Record<string, unknown> \| null {\r\n try {\r\n const parts = token.split(\".\");\r\n if (parts.length !== 3) return null;\r\n const json = new TextDecoder().decode(base64UrlDecode(parts[1]));\r\n return JSON.parse(json) as Record<string, unknown>;\r\n } catch {\r\n return null;\r\n }\r\n}\r\n\r\n/* 解码 JWT header /\r\nfunction decodeJwtHeader(token: string): Record<string, unknown> \| null {\r\n try {\r\n const parts = token.split(\".\");\r\n if (parts.length !== 3) return null;\r\n const json = new TextDecoder().decode(base64UrlDecode(parts[0]));\r\n return JSON.parse(json) as Record<string, unknown>;\r\n } catch {\r\n return null;\r\n }\r\n}\r\n\r\n/* 标准化 issuer/base URL，去除末尾斜杠 /\r\nfunction normalizeIssuer(url: string): string {\r\n return url.replace(/\\/+$/, \"\");\r\n}\r\n\r\ninterface JwksKey {\r\n kty: string;\r\n kid?: string;\r\n alg?: string;\r\n use?: string;\r\n n?: string;\r\n e?: string;\r\n x5c?: string[];\r\n}\r\n\r\ninterface Jwks {\r\n keys: JwksKey[];\r\n}\r\n\r\nlet cachedJwks: { baseUrl: string; jwks: Jwks; fetchedAt: number } \| null = null;\r\nconst JWKS_CACHE_TTL_MS = 5 60 * 1000;\r\n\r\n/** 从 SSO 中心拉取 JWKS /\r\nasync function fetchJwks(baseUrl: string): Promise<Jwks \| null> {\r\n const now = Date.now();\r\n if (cachedJwks && cachedJwks.baseUrl === baseUrl && now - cachedJwks.fetchedAt < JWKS_CACHE_TTL_MS) {\r\n return cachedJwks.jwks;\r\n }\r\n\r\n try {\r\n const res = await fetch(`${baseUrl}/api/oauth/jwks`);\r\n if (!res.ok) return null;\r\n const jwks = (await res.json()) as Jwks;\r\n cachedJwks = { baseUrl, jwks, fetchedAt: now };\r\n return jwks;\r\n } catch {\r\n return null;\r\n }\r\n}\r\n\r\n/* 计算 OIDC at_hash（access_token SHA-256 前 128bit base64url） /\r\nasync function computeAtHash(accessToken: string): Promise<string> {\r\n const hash = await crypto.subtle.digest(\r\n \"SHA-256\",\r\n new TextEncoder().encode(accessToken)\r\n );\r\n const bytes = new Uint8Array(hash);\r\n const half = bytes.slice(0, bytes.length / 2);\r\n let binary = \"\";\r\n for (const b of half) {\r\n binary += String.fromCharCode(b);\r\n }\r\n return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\r\n}\r\n\r\n/* 使用 RS256 公钥验证 ID Token 签名 /\r\nasync function verifyRs256(token: string, jwk: JwksKey): Promise<boolean> {\r\n try {\r\n const [headerB64, payloadB64, signature] = token.split(\".\");\r\n if (!signature \|\| !jwk.n \|\| !jwk.e) return false;\r\n\r\n const cryptoKey = await crypto.subtle.importKey(\r\n \"jwk\",\r\n { kty: \"RSA\", n: jwk.n, e: jwk.e, alg: \"RS256\", ext: false },\r\n { name: \"RSASSA-PKCS1-v1_5\", hash: \"SHA-256\" },\r\n false,\r\n [\"verify\"]\r\n );\r\n\r\n const signatureBytes = base64UrlDecode(signature);\r\n const data = new TextEncoder().encode(`${headerB64}.${payloadB64}`);\r\n return await crypto.subtle.verify(\r\n \"RSASSA-PKCS1-v1_5\",\r\n cryptoKey,\r\n signatureBytes as unknown as BufferSource,\r\n data as unknown as BufferSource\r\n );\r\n } catch {\r\n return false;\r\n }\r\n}\r\n\r\n/* 验证 ID Token（iss、aud、exp、sub、签名、at_hash） /\r\nasync function validateIdToken(\r\n idToken: string,\r\n expectedIssuer: string,\r\n expectedClientId: string,\r\n accessToken: string\r\n) {\r\n const header = decodeJwtHeader(idToken);\r\n if (!header) {\r\n throw new SsoError(\"id_token_invalid\", \"ID Token 格式错误\");\r\n }\r\n\r\n const alg = header.alg;\r\n if (typeof alg !== \"string\" \|\| (alg !== \"RS256\" && alg !== \"HS256\")) {\r\n throw new SsoError(\"id_token_unsupported_alg\", `不支持的 ID Token 签名算法: ${alg}`);\r\n }\r\n\r\n // RS256：通过 JWKS 验证签名\r\n if (alg === \"RS256\") {\r\n const jwks = await fetchJwks(normalizeIssuer(expectedIssuer));\r\n if (!jwks) {\r\n throw new SsoError(\"id_token_invalid_signature\", \"无法获取 JWKS 验证 ID Token 签名\");\r\n }\r\n const kid = typeof header.kid === \"string\" ? header.kid : undefined;\r\n const key = jwks.keys.find(\r\n (k) =>\r\n k.kty === \"RSA\" &&\r\n k.alg === \"RS256\" &&\r\n k.use === \"sig\" &&\r\n (kid ? k.kid === kid : true)\r\n );\r\n if (!key) {\r\n throw new SsoError(\"id_token_invalid_signature\", \"JWKS 中未找到匹配的 RS256 公钥\");\r\n }\r\n const validSig = await verifyRs256(idToken, key);\r\n if (!validSig) {\r\n throw new SsoError(\"id_token_invalid_signature\", \"ID Token 签名验证失败\");\r\n }\r\n }\r\n\r\n // HS256：对称密钥无法安全分发给 Public Client，因此仅校验声明、不校验签名。\r\n // Confidential Client 如确需验证签名，应迁移到 RS256。\r\n if (alg === \"HS256\") {\r\n // eslint-disable-next-line no-console\r\n console.warn(\r\n \"[SSO SDK] ID Token 使用 HS256 签名，Public Client 无法安全验证签名。\" +\r\n \"建议主站配置 JWT_ID_TOKEN_PRIVATE_KEY / JWT_ID_TOKEN_PUBLIC_KEY 启用 RS256。\"\r\n );\r\n }\r\n\r\n const payload = decodeJwtPayload(idToken);\r\n if (!payload) {\r\n throw new SsoError(\"id_token_invalid\", \"ID Token payload 解析失败\");\r\n }\r\n\r\n const normalizedExpectedIssuer = normalizeIssuer(expectedIssuer);\r\n const tokenIssuer = typeof payload.iss === \"string\" ? normalizeIssuer(payload.iss) : \"\";\r\n if (tokenIssuer !== normalizedExpectedIssuer) {\r\n throw new SsoError(\"id_token_issuer_mismatch\", \"ID Token issuer 不匹配\");\r\n }\r\n if (\r\n payload.aud !== expectedClientId &&\r\n !((payload.aud as string[] \| undefined)?.includes(expectedClientId))\r\n ) {\r\n throw new SsoError(\"id_token_audience_mismatch\", \"ID Token audience 不匹配\");\r\n }\r\n if (typeof payload.exp === \"number\" && Date.now() >= payload.exp 1000) {\r\n throw new SsoError(\"id_token_expired\", \"ID Token 已过期\");\r\n }\r\n if (typeof payload.sub !== \"string\" \|\| !payload.sub) {\r\n throw new SsoError(\"id_token_missing_sub\", \"ID Token 缺少 sub\");\r\n }\r\n\r\n // 校验 at_hash：确保 ID Token 与当前 access_token 绑定\r\n if (typeof payload.at_hash === \"string\" && payload.at_hash) {\r\n const actual = await computeAtHash(accessToken);\r\n if (actual !== payload.at_hash) {\r\n throw new SsoError(\"id_token_at_hash_mismatch\", \"ID Token at_hash 不匹配\");\r\n }\r\n }\r\n\r\n return { sub: payload.sub };\r\n}\r\n\r\n// ============================================\r\n// 类型定义\r\n// ============================================\r\n\r\n/** SSO 客户端配置 /\r\nexport interface SsoClientConfig {\r\n /* OAuth Client ID（从管理后台获取） /\r\n clientId: string;\r\n\r\n /* OAuth Client Secret（从管理后台获取）\r\n \r\n ⚠️ 安全提醒：client_secret 不应暴露在前端代码中。\r\n * 对于浏览器端 SPA（Public Client），应省略此字段；SDK 会使用 PKCE 完成授权，\r\n * 且 token 端点不会发送 client_secret。\r\n * 对于 BFF/Next.js 等 Confidential Client，可传入 client_secret。\r\n /\r\n clientSecret?: string;\r\n\r\n /* 回调 URL（必须与注册的 redirect_uri 完全一致） /\r\n redirectUri: string;\r\n\r\n /* SSO 中心地址，如 \"https://nihplod.cn\" /\r\n ssoBaseUrl: string;\r\n\r\n /* 请求的 scope（空格分隔），如 \"openid profile phone\" /\r\n scopes?: string;\r\n}\r\n\r\n/* 用户信息 /\r\nexport interface SsoUser {\r\n sub: string;\r\n nickname?: string;\r\n avatar?: string;\r\n phone?: string;\r\n membership_level?: string;\r\n total_points?: number;\r\n}\r\n\r\n/* Token 响应 /\r\nexport interface TokenResponse {\r\n access_token: string;\r\n token_type: string;\r\n expires_in: number;\r\n refresh_token: string;\r\n id_token?: string;\r\n}\r\n\r\n/* OIDC Discovery 文档 /\r\nexport interface OidcDiscovery {\r\n issuer: string;\r\n authorization_endpoint: string;\r\n token_endpoint: string;\r\n userinfo_endpoint: string;\r\n jwks_uri: string;\r\n introspection_endpoint: string;\r\n revocation_endpoint?: string;\r\n end_session_endpoint?: string;\r\n scopes_supported: string[];\r\n response_types_supported: string[];\r\n grant_types_supported: string[];\r\n code_challenge_methods_supported: string[];\r\n}\r\n\r\n// ============================================\r\n// SsoClient\r\n// ============================================\r\n\r\nexport class SsoClient {\r\n public readonly config: SsoClientConfig;\r\n private _discovery: OidcDiscovery \| null = null;\r\n private _discoveryFetchedAt: number = 0;\r\n private _refreshLock: Promise<TokenData> \| null = null;\r\n\r\n /* Discovery 文档缓存 TTL（5 分钟） /\r\n private static readonly DISCOVERY_TTL_MS = 5 60 * 1000;\r\n\r\n /** Discovery fetch 超时（10 秒） /\r\n private static readonly DISCOVERY_TIMEOUT_MS = 10000;\r\n\r\n constructor(config: SsoClientConfig) {\r\n if (!config.clientId) throw new SsoError(\"invalid_config\", \"clientId 不能为空\");\r\n if (!config.redirectUri) throw new SsoError(\"invalid_config\", \"redirectUri 不能为空\");\r\n if (!config.ssoBaseUrl) throw new SsoError(\"invalid_config\", \"ssoBaseUrl 不能为空\");\r\n\r\n // 规范化 ssoBaseUrl：移除末尾斜杠\r\n const base = config.ssoBaseUrl.replace(/\\/+$/, \"\");\r\n this.config = { ...config, ssoBaseUrl: base };\r\n }\r\n\r\n // ============================================\r\n // 内部方法\r\n // ============================================\r\n\r\n /\r\n 获取 OIDC Discovery 文档（带缓存 + 超时）\r\n \r\n 缓存 5 分钟，超时 10 秒。\r\n * 失败时返回 null（上层调用方回退到硬编码默认端点）。\r\n /\r\n private async _getDiscovery(): Promise<OidcDiscovery \| null> {\r\n const now = Date.now();\r\n\r\n // 命中缓存且未过期\r\n if (\r\n this._discovery &&\r\n now - this._discoveryFetchedAt < SsoClient.DISCOVERY_TTL_MS\r\n ) {\r\n return this._discovery;\r\n }\r\n\r\n const url = `${this.config.ssoBaseUrl}/api/oauth/.well-known/openid-configuration`;\r\n\r\n try {\r\n const controller = new AbortController();\r\n const timeoutId = setTimeout(\r\n () => controller.abort(),\r\n SsoClient.DISCOVERY_TIMEOUT_MS\r\n );\r\n\r\n const res = await fetch(url, { signal: controller.signal });\r\n clearTimeout(timeoutId);\r\n\r\n if (!res.ok) {\r\n console.warn(\r\n `[SSO SDK] OIDC Discovery 请求失败: HTTP ${res.status}, 回退到默认端点`\r\n );\r\n return null;\r\n }\r\n\r\n this._discovery = (await res.json()) as OidcDiscovery;\r\n this._discoveryFetchedAt = now;\r\n return this._discovery;\r\n } catch (err) {\r\n console.warn(\r\n `[SSO SDK] OIDC Discovery 请求异常: ${err instanceof Error ? err.message : String(err)}, 回退到默认端点`\r\n );\r\n // 不清空已有缓存（即使过期也优于无数据）\r\n return this._discovery \|\| null;\r\n }\r\n }\r\n\r\n /* 获取 authorize 端点 URL（优先 Discovery，回退默认） /\r\n private async _getAuthorizeEndpoint(): Promise<string> {\r\n const d = await this._getDiscovery();\r\n if (d) return d.authorization_endpoint;\r\n return `${this.config.ssoBaseUrl}/api/oauth/authorize`;\r\n }\r\n\r\n /* 获取 token 端点 URL（优先 Discovery，回退默认） /\r\n private async _getTokenEndpoint(): Promise<string> {\r\n const d = await this._getDiscovery();\r\n if (d) return d.token_endpoint;\r\n return `${this.config.ssoBaseUrl}/api/oauth/token`;\r\n }\r\n\r\n /* 获取 userinfo 端点 URL（优先 Discovery，回退默认） /\r\n private async _getUserinfoEndpoint(): Promise<string> {\r\n const d = await this._getDiscovery();\r\n if (d) return d.userinfo_endpoint;\r\n return `${this.config.ssoBaseUrl}/api/oauth/userinfo`;\r\n }\r\n\r\n // ============================================\r\n // 公共 API\r\n // ============================================\r\n\r\n /\r\n 发起 SSO 登录\r\n \r\n 生成 PKCE code_verifier/code_challenge 和 state 参数，\r\n * 构建 authorize URL，通过 302 跳转到 SSO 登录页。\r\n \r\n @param returnUrl - 登录成功后的返回地址（可选，保存到 sessionStorage）\r\n /\r\n async login(returnUrl?: string): Promise<void> {\r\n const verifier = generateCodeVerifier();\r\n const challenge = await generateCodeChallenge(verifier);\r\n const state = generateState();\r\n\r\n // 保存 PKCE verifier 和 state 到 sessionStorage\r\n savePkceVerifier(this.config.clientId, verifier);\r\n saveOAuthState(state, this.config.clientId);\r\n\r\n if (returnUrl) {\r\n saveReturnUrl(returnUrl);\r\n }\r\n\r\n // 构建 authorize URL\r\n const authorizeEndpoint = await this._getAuthorizeEndpoint();\r\n const params = new URLSearchParams();\r\n params.set(\"response_type\", \"code\");\r\n params.set(\"client_id\", this.config.clientId);\r\n params.set(\"redirect_uri\", this.config.redirectUri);\r\n params.set(\"scope\", this.config.scopes \|\| \"openid profile\");\r\n params.set(\"state\", state);\r\n params.set(\"code_challenge\", challenge);\r\n params.set(\"code_challenge_method\", \"S256\");\r\n\r\n // 跳转\r\n window.location.href = `${authorizeEndpoint}?${params.toString()}`;\r\n }\r\n\r\n /\r\n 构建登录 URL（不跳转，返回 URL 字符串）\r\n \r\n 适用于需要手动处理跳转的场景。\r\n /\r\n async getLoginUrl(returnUrl?: string): Promise<string> {\r\n const verifier = generateCodeVerifier();\r\n const challenge = await generateCodeChallenge(verifier);\r\n const state = generateState();\r\n\r\n savePkceVerifier(this.config.clientId, verifier);\r\n saveOAuthState(state, this.config.clientId);\r\n // 统一使用全局 returnUrl key，与 login() / CallbackPage 保持一致\r\n if (returnUrl) saveReturnUrl(returnUrl);\r\n\r\n const authorizeEndpoint = await this._getAuthorizeEndpoint();\r\n const params = new URLSearchParams();\r\n params.set(\"response_type\", \"code\");\r\n params.set(\"client_id\", this.config.clientId);\r\n params.set(\"redirect_uri\", this.config.redirectUri);\r\n params.set(\"scope\", this.config.scopes \|\| \"openid profile\");\r\n params.set(\"state\", state);\r\n params.set(\"code_challenge\", challenge);\r\n params.set(\"code_challenge_method\", \"S256\");\r\n\r\n return `${authorizeEndpoint}?${params.toString()}`;\r\n }\r\n\r\n /\r\n 处理 OAuth 回调\r\n \r\n 解析回调 URL，校验 state 参数，用授权码交换 token。\r\n * 成功后 token 自动保存到 sessionStorage。\r\n \r\n @param callbackUrl - 完整的回调 URL（window.location.href）\r\n * @returns TokenData 或 null\r\n /\r\n async handleCallback(\r\n callbackUrl: string\r\n ): Promise<TokenData> {\r\n const url = new URL(callbackUrl);\r\n const params = url.searchParams;\r\n\r\n // 检查错误\r\n const error = params.get(\"error\");\r\n if (error) {\r\n const desc = params.get(\"error_description\") \|\| error;\r\n throw new SsoError(\"token_request_failed\", `授权失败: ${desc}`);\r\n }\r\n\r\n const code = params.get(\"code\");\r\n const returnedState = params.get(\"state\");\r\n\r\n if (!code) {\r\n throw new SsoError(\"token_request_failed\", \"回调 URL 中缺少 authorization code\");\r\n }\r\n\r\n // 校验 state 参数（CSRF 防护）\r\n const savedState = getOAuthState(this.config.clientId);\r\n if (!savedState \|\| savedState !== returnedState) {\r\n removeOAuthState(this.config.clientId);\r\n throw new SsoError(\r\n \"state_mismatch\",\r\n \"State 参数不匹配，可能存在 CSRF 攻击\"\r\n );\r\n }\r\n removeOAuthState(this.config.clientId);\r\n\r\n // 获取 code_verifier\r\n const verifier = getPkceVerifier(this.config.clientId);\r\n if (!verifier) {\r\n throw new SsoError(\r\n \"pkce_required\",\r\n \"code_verifier 不存在（可能已过期或来自其他标签页）\"\r\n );\r\n }\r\n removePkceVerifier(this.config.clientId);\r\n\r\n // 交换 token\r\n const tokenEndpoint = await this._getTokenEndpoint();\r\n const body = new URLSearchParams();\r\n body.set(\"grant_type\", \"authorization_code\");\r\n body.set(\"code\", code);\r\n body.set(\"code_verifier\", verifier);\r\n body.set(\"client_id\", this.config.clientId);\r\n body.set(\"redirect_uri\", this.config.redirectUri);\r\n if (this.config.clientSecret) {\r\n body.set(\"client_secret\", this.config.clientSecret);\r\n }\r\n\r\n let res: Response;\r\n try {\r\n res = await fetch(tokenEndpoint, {\r\n method: \"POST\",\r\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\r\n body: body.toString(),\r\n });\r\n } catch (err) {\r\n throw new SsoError(\"network_error\", \"网络请求失败\", err);\r\n }\r\n\r\n if (!res.ok) {\r\n let errData: Record<string, unknown> = {};\r\n try { errData = await res.json(); } catch { / ignore / }\r\n throw new SsoError(\r\n \"token_request_failed\",\r\n (errData.error_description as string) \|\| `Token 请求失败: HTTP ${res.status}`\r\n );\r\n }\r\n\r\n const data: TokenResponse = await res.json();\r\n\r\n // OIDC：验证 ID Token 签名、基本声明及 at_hash\r\n if (data.id_token) {\r\n try {\r\n await validateIdToken(\r\n data.id_token,\r\n this.config.ssoBaseUrl,\r\n this.config.clientId,\r\n data.access_token\r\n );\r\n } catch (err) {\r\n // 验证失败：不保存任何 token，防止伪造 ID Token\r\n removeTokenData(this.config.clientId);\r\n throw err;\r\n }\r\n }\r\n\r\n const now = Date.now();\r\n const tokenData: TokenData = {\r\n access_token: data.access_token,\r\n token_type: data.token_type,\r\n expires_in: data.expires_in,\r\n refresh_token: data.refresh_token,\r\n id_token: data.id_token,\r\n issued_at: now,\r\n expires_at: now + data.expires_in 1000,\r\n };\r\n\r\n saveTokenData(tokenData, this.config.clientId);\r\n return tokenData;\r\n }\r\n\r\n /*\r\n 刷新 Access Token\r\n \r\n 使用 refresh_token 换取新的 access_token。\r\n * 采用互斥锁防止并发刷新。\r\n * 支持 Refresh Token 原子轮换。\r\n /\r\n async refreshToken(): Promise<TokenData> {\r\n // 互斥锁：避免并发刷新\r\n if (this._refreshLock) return this._refreshLock;\r\n\r\n this._refreshLock = this._doRefreshToken();\r\n try {\r\n return await this._refreshLock;\r\n } finally {\r\n this._refreshLock = null;\r\n }\r\n }\r\n\r\n private async _doRefreshToken(): Promise<TokenData> {\r\n const current = getTokenData(this.config.clientId);\r\n if (!current?.refresh_token) {\r\n throw new SsoError(\"no_refresh_token\", \"没有可用的 refresh_token\");\r\n }\r\n\r\n const tokenEndpoint = await this._getTokenEndpoint();\r\n const body = new URLSearchParams();\r\n body.set(\"grant_type\", \"refresh_token\");\r\n body.set(\"refresh_token\", current.refresh_token);\r\n body.set(\"client_id\", this.config.clientId);\r\n if (this.config.clientSecret) {\r\n body.set(\"client_secret\", this.config.clientSecret);\r\n }\r\n\r\n let res: Response;\r\n try {\r\n res = await fetch(tokenEndpoint, {\r\n method: \"POST\",\r\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\r\n body: body.toString(),\r\n });\r\n } catch (err) {\r\n throw new SsoError(\"network_error\", \"刷新 Token 网络请求失败\", err);\r\n }\r\n\r\n if (!res.ok) {\r\n let errData: Record<string, unknown> = {};\r\n try { errData = await res.json(); } catch { / ignore / }\r\n const errorCode = (errData.error as string) \|\| \"\";\r\n // invalid_grant 表示 refresh_token 已被撤销或过期，应清除本地登录态\r\n if (errorCode === \"invalid_grant\" \|\| res.status === 401) {\r\n removeTokenData(this.config.clientId);\r\n }\r\n throw new SsoError(\r\n errorCode === \"invalid_grant\" ? \"session_expired\" : \"token_request_failed\",\r\n (errData.error_description as string) \|\| `刷新 Token 失败: HTTP ${res.status}`\r\n );\r\n }\r\n\r\n const data: TokenResponse = await res.json();\r\n const now = Date.now();\r\n const tokenData: TokenData = {\r\n access_token: data.access_token,\r\n token_type: data.token_type,\r\n expires_in: data.expires_in,\r\n refresh_token: data.refresh_token,\r\n id_token: data.id_token,\r\n issued_at: now,\r\n expires_at: now + data.expires_in 1000,\r\n };\r\n\r\n saveTokenData(tokenData, this.config.clientId);\r\n return tokenData;\r\n }\r\n\r\n /*\r\n 获取用户信息\r\n \r\n 若 access_token 已过期则自动刷新后再请求。\r\n /\r\n async getUserInfo(): Promise<SsoUser> {\r\n let tokenData = getTokenData(this.config.clientId);\r\n\r\n if (!tokenData) {\r\n throw new SsoError(\"not_authenticated\", \"未登录\");\r\n }\r\n\r\n // 若已过期，先刷新\r\n if (Date.now() >= tokenData.expires_at) {\r\n tokenData = await this.refreshToken();\r\n }\r\n\r\n const userinfoEndpoint = await this._getUserinfoEndpoint();\r\n\r\n let res: Response;\r\n try {\r\n res = await fetch(userinfoEndpoint, {\r\n headers: {\r\n Authorization: `Bearer ${tokenData.access_token}`,\r\n },\r\n });\r\n } catch (err) {\r\n throw new SsoError(\"network_error\", \"获取用户信息网络请求失败\", err);\r\n }\r\n\r\n if (!res.ok) {\r\n if (res.status === 401) {\r\n removeTokenData(this.config.clientId);\r\n throw new SsoError(\"not_authenticated\", \"Token 已失效\");\r\n }\r\n throw new SsoError(\r\n \"userinfo_failed\",\r\n `获取用户信息失败: HTTP ${res.status}`\r\n );\r\n }\r\n\r\n return (await res.json()) as SsoUser;\r\n }\r\n\r\n /\r\n 获取当前 access_token\r\n \r\n 若已过期则自动刷新。用于子项目自行发起 API 请求时获取 Bearer token。\r\n * 若无 token 返回 null；若刷新失败则抛出错误（与 getUserInfo 行为一致）。\r\n /\r\n async getAccessToken(): Promise<string \| null> {\r\n let tokenData = getTokenData(this.config.clientId);\r\n if (!tokenData) return null;\r\n\r\n if (Date.now() >= tokenData.expires_at) {\r\n tokenData = await this.refreshToken();\r\n }\r\n\r\n return tokenData.access_token;\r\n }\r\n\r\n /\r\n 检查是否已认证（不发起网络请求）\r\n \r\n 仅检查本地是否存在未过期的 access_token。\r\n /\r\n isAuthenticated(): boolean {\r\n const tokenData = getTokenData(this.config.clientId);\r\n if (!tokenData) return false;\r\n return Date.now() < tokenData.expires_at;\r\n }\r\n\r\n /\r\n 登出\r\n \r\n 清除本地所有 token 和临时数据，并尝试撤销服务端 refresh_token。\r\n * @param redirectToSso - 是否重定向到 SSO 登出页（默认 false）\r\n /\r\n async logout(redirectToSso: boolean = false): Promise<void> {\r\n // 获取 refresh_token 用于服务端撤销（需在 clearAllSsoData 之前）\r\n const tokenData = getTokenData(this.config.clientId);\r\n const refreshToken = tokenData?.refresh_token;\r\n const idTokenHint = tokenData?.id_token;\r\n\r\n clearAllSsoData(this.config.clientId);\r\n\r\n // 尝试调用服务端 token revocation 端点（best-effort）\r\n // 仅 Confidential Client 携带 client_secret；Public Client 不传 secret。\r\n if (refreshToken && this.config.clientId) {\r\n try {\r\n const discovery = await this._getDiscovery();\r\n const revokeUrl =\r\n discovery?.revocation_endpoint \|\|\r\n `${this.config.ssoBaseUrl}/api/oauth/revoke`;\r\n const revokeBody = new URLSearchParams({\r\n token: refreshToken,\r\n token_type_hint: \"refresh_token\",\r\n client_id: this.config.clientId,\r\n });\r\n if (this.config.clientSecret) {\r\n revokeBody.set(\"client_secret\", this.config.clientSecret);\r\n }\r\n await fetch(revokeUrl, {\r\n method: \"POST\",\r\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\r\n body: revokeBody.toString(),\r\n });\r\n } catch {\r\n // 撤销失败不影响本地登出（best-effort）\r\n }\r\n }\r\n\r\n if (redirectToSso) {\r\n // OIDC RP-Initiated Logout：携带 client_id / post_logout_redirect_uri / id_token_hint / state\r\n const discovery = await this._getDiscovery();\r\n const endSessionEndpoint =\r\n discovery?.end_session_endpoint \|\| `${this.config.ssoBaseUrl}/logout`;\r\n const logoutUrl = new URL(endSessionEndpoint);\r\n logoutUrl.searchParams.set(\"client_id\", this.config.clientId);\r\n if (this.config.redirectUri) {\r\n logoutUrl.searchParams.set(\r\n \"post_logout_redirect_uri\",\r\n this.config.redirectUri\r\n );\r\n }\r\n if (idTokenHint) {\r\n logoutUrl.searchParams.set(\"id_token_hint\", idTokenHint);\r\n }\r\n const state = generateState();\r\n logoutUrl.searchParams.set(\"state\", state);\r\n window.location.href = logoutUrl.toString();\r\n }\r\n }\r\n\r\n /\r\n 获取 OIDC Discovery 文档\r\n \r\n 用于调试和获取 SSO 中心完整配置。\r\n * 可能返回 null（当 Discovery 端点不可达且无缓存时）。\r\n /\r\n async getDiscovery(): Promise<OidcDiscovery \| null> {\r\n return this._getDiscovery();\r\n }\r\n}\r\n","/\r\n RequireAuth / withAuth — 路由保护组件\r\n \r\n 用法：\r\n * - <RequireAuth> 包裹需要登录才能访问的路由\r\n * - withAuth(Component) HOC 包装单个页面组件\r\n /\r\n\r\n\"use client\";\r\n\r\nimport React, { useEffect, useRef, type ComponentType } from \"react\";\r\nimport { useSso } from \"./SsoProvider\";\r\n\r\n// ============================================\r\n// RequireAuth 组件\r\n// ============================================\r\n\r\nexport interface RequireAuthProps {\r\n /* 子组件（受保护的内容） /\r\n children: React.ReactNode;\r\n\r\n /* 未登录时的回退内容（默认显示加载中） /\r\n fallback?: React.ReactNode;\r\n\r\n /* 是否在检测到未登录时自动发起登录跳转 /\r\n autoLogin?: boolean;\r\n}\r\n\r\n/\r\n 路由保护组件\r\n \r\n 未登录时自动触发登录跳转或显示回退内容。\r\n \r\n @example\r\n * ```tsx\r\n * <RequireAuth>\r\n * <Dashboard />\r\n * </RequireAuth>\r\n * ```\r\n /\r\nexport function RequireAuth({\r\n children,\r\n fallback,\r\n autoLogin = true,\r\n}: RequireAuthProps) {\r\n const { isAuthenticated, isLoading, login } = useSso();\r\n const loginTriggeredRef = useRef(false);\r\n\r\n useEffect(() => {\r\n if (!isLoading && !isAuthenticated && autoLogin && !loginTriggeredRef.current) {\r\n loginTriggeredRef.current = true;\r\n const currentPath = window.location.pathname + window.location.search;\r\n login(currentPath);\r\n }\r\n }, [isLoading, isAuthenticated, autoLogin, login]);\r\n\r\n if (isLoading) {\r\n return (\r\n fallback \|\| React.createElement(\"div\", null, \"正在验证登录状态...\")\r\n );\r\n }\r\n\r\n if (!isAuthenticated) {\r\n if (fallback) return React.createElement(React.Fragment, null, fallback);\r\n return React.createElement(\"div\", null, \"请先登录\");\r\n }\r\n\r\n return React.createElement(React.Fragment, null, children);\r\n}\r\n\r\n// ============================================\r\n// withAuth HOC\r\n// ============================================\r\n\r\n/\r\n 高阶组件：包装页面组件，要求认证后才能访问\r\n \r\n @example\r\n * ```tsx\r\n * function DashboardPage() { return <div>Dashboard</div>; }\r\n * export default withAuth(DashboardPage);\r\n * ```\r\n /\r\nexport function withAuth<P extends object>(\r\n Component: ComponentType<P>\r\n): ComponentType<P> {\r\n const displayName =\r\n Component.displayName \|\| Component.name \|\| \"Component\";\r\n\r\n function WrappedComponent(props: P) {\r\n return React.createElement(\r\n RequireAuth,\r\n null,\r\n React.createElement(Component, props)\r\n );\r\n }\r\n\r\n WrappedComponent.displayName = `withAuth(${displayName})`;\r\n return WrappedComponent;\r\n}\r\n","/\r\n CallbackPage — 通用 OAuth 回调页面组件\r\n \r\n 子项目只需在回调路由渲染此组件即可完成 code → token 交换。\r\n * 交换成功后自动跳转到 returnUrl 或首页。\r\n \r\n @example\r\n * ```tsx\r\n * // 在回调页面路由中：\r\n * import { CallbackPage } from \"@nihplod/sso-sdk/react\";\r\n * export default function AuthCallback() {\r\n * return <CallbackPage />;\r\n * }\r\n * ```\r\n */\r\n\r\n\"use client\";\r\n\r\nimport React, { useEffect, useState } from \"react\";\r\nimport { useSso } from \"./SsoProvider\";\r\nimport { getReturnUrl, removeReturnUrl } from \"../core/storage\";\r\nimport { SsoError } from \"../core/errors\";\r\n\r\nexport function CallbackPage() {\r\n const { client, refreshUser } = useSso();\r\n const [error, setError] = useState<string \| null>(null);\r\n const [processing, setProcessing] = useState(true);\r\n\r\n useEffect(() => {\r\n let cancelled = false;\r\n\r\n async function handleCallback() {\r\n try {\r\n await client.handleCallback(window.location.href);\r\n\r\n if (cancelled) return;\r\n\r\n // 刷新用户信息\r\n await refreshUser();\r\n\r\n // 跳转到 returnUrl 或首页\r\n const returnUrl = getReturnUrl();\r\n removeReturnUrl();\r\n window.location.href = returnUrl \|\| \"/\";\r\n } catch (err) {\r\n if (cancelled) return;\r\n if (err instanceof SsoError) {\r\n // SsoError 携带 code + description，可直接展示\r\n setError(err.description \|\| `SSO 错误 (${err.code})`);\r\n } else if (err instanceof TypeError && err.message.includes(\"fetch\")) {\r\n // 网络错误：断网、DNS 失败、CORS 等\r\n setError(\"网络连接失败，请检查网络后重试\");\r\n } else if (err instanceof Error) {\r\n setError(`登录回调处理失败: ${err.message}`);\r\n } else {\r\n setError(\"登录回调处理失败，请重试\");\r\n }\r\n setProcessing(false);\r\n }\r\n }\r\n\r\n handleCallback();\r\n\r\n return () => { cancelled = true; };\r\n }, [client, refreshUser]);\r\n\r\n if (error) {\r\n return React.createElement(\r\n \"div\",\r\n {\r\n style: {\r\n display: \"flex\",\r\n flexDirection: \"column\",\r\n alignItems: \"center\",\r\n justifyContent: \"center\",\r\n minHeight: \"100vh\",\r\n fontFamily: \"system-ui, sans-serif\",\r\n },\r\n },\r\n React.createElement(\r\n \"p\",\r\n { style: { color: \"#dc2626\", marginBottom: \"1rem\" } },\r\n error\r\n ),\r\n React.createElement(\r\n \"a\",\r\n { href: \"/\", style: { color: \"#2563eb\", textDecoration: \"underline\" } },\r\n \"返回首页\"\r\n )\r\n );\r\n }\r\n\r\n if (processing) {\r\n return React.createElement(\r\n \"div\",\r\n {\r\n style: {\r\n display: \"flex\",\r\n alignItems: \"center\",\r\n justifyContent: \"center\",\r\n minHeight: \"100vh\",\r\n fontFamily: \"system-ui, sans-serif\",\r\n },\r\n },\r\n React.createElement(\"p\", null, \"正在处理登录回调...\")\r\n );\r\n }\r\n\r\n return null;\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACWA,mBAQO;;;ACsBA,IAAM,WAAN,cAAuB,MAAM;AAAA,EAKlC,YAAY,MAAoB,aAAqB,OAAiB;AACpE,UAAM,aAAa,IAAI,KAAK,WAAW,EAAE;AACzC,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,cAAc;AACnB,SAAK,QAAQ;AAAA,EACf;AACF;;;AC3CA,IAAM,cACJ;AASF,SAAS,qBAAqB,QAAwB;AACpD,QAAM,OAAO;AACb,MAAI,SAAS;AAEb,SAAO,OAAO,SAAS,QAAQ;AAE7B,UAAM,YAAY,KAAK,IAAI,SAAS,GAAG,GAAG;AAC1C,UAAM,QAAQ,IAAI,WAAW,SAAS;AACtC,WAAO,gBAAgB,KAAK;AAE5B,aAAS,IAAI,GAAG,IAAI,aAAa,OAAO,SAAS,QAAQ,KAAK;AAC5D,UAAI,MAAM,CAAC,KAAK,KAAM;AACtB,gBAAU,YAAY,MAAM,CAAC,IAAI,YAAY,MAAM;AAAA,IACrD;AAAA,EACF;AAEA,SAAO;AACT;AAUO,SAAS,qBAAqB,SAAiB,IAAY;AAChE,MAAI,SAAS,MAAM,SAAS,KAAK;AAC/B,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,SAAO,qBAAqB,MAAM;AACpC;AASA,eAAsB,sBACpB,cACiB;AACjB,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,YAAY;AACxC,QAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AAGvD,QAAM,QAAQ,IAAI,WAAW,IAAI;AACjC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,YAAY,KAAK;AACzC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC/E;AAOO,SAAS,gBAAwB;AACtC,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC1E;;;ACnDA,IAAM,iBAAiB;AAGvB,IAAM,YAAY;AAClB,IAAM,sBAAsB;AAC5B,IAAM,YAAY;AAClB,IAAM,iBAAiB;AAEvB,SAAS,SAAS,MAAc,UAA2B;AACzD,SAAO,WAAW,GAAG,IAAI,IAAI,QAAQ,KAAK;AAC5C;AAWA,SAAS,6BAA2C;AAClD,QAAM,QAAQ,oBAAI,IAAoB;AACtC,SAAO;AAAA,IACL,IAAI,KAAa;AACf,aAAO,MAAM,IAAI,GAAG,KAAK;AAAA,IAC3B;AAAA,IACA,IAAI,KAAa,OAAe;AAC9B,YAAM,IAAI,KAAK,KAAK;AAAA,IACtB;AAAA,IACA,OAAO,KAAa;AAClB,YAAM,OAAO,GAAG;AAAA,IAClB;AAAA,EACF;AACF;AAEA,IAAM,uBAAuB,2BAA2B;AAsCxD,IAAI,WAAyB;AAoBtB,SAAS,cAAc,MAAiB,UAAyB;AACtE,WAAS,IAAI,SAAS,WAAW,QAAQ,GAAG,KAAK,UAAU,IAAI,CAAC;AAClE;AAEO,SAAS,aAAa,UAAqC;AAChE,QAAM,MAAM,SAAS,IAAI,SAAS,WAAW,QAAQ,CAAC;AACtD,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AACF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,gBAAgB,UAAyB;AACvD,WAAS,OAAO,SAAS,WAAW,QAAQ,CAAC;AAC/C;AAMO,SAAS,iBAAiB,UAAkB,UAAwB;AACzE,WAAS,IAAI,sBAAsB,UAAU,QAAQ;AACvD;AAEO,SAAS,gBAAgB,UAAiC;AAC/D,SAAO,SAAS,IAAI,sBAAsB,QAAQ;AACpD;AAEO,SAAS,mBAAmB,UAAwB;AACzD,WAAS,OAAO,sBAAsB,QAAQ;AAChD;AAMO,SAAS,eAAe,OAAe,UAAyB;AACrE,WAAS,IAAI,SAAS,WAAW,QAAQ,GAAG,KAAK;AACnD;AAEO,SAAS,cAAc,UAAkC;AAC9D,SAAO,SAAS,IAAI,SAAS,WAAW,QAAQ,CAAC;AACnD;AAEO,SAAS,iBAAiB,UAAyB;AACxD,WAAS,OAAO,SAAS,WAAW,QAAQ,CAAC;AAC/C;AAMO,SAAS,cAAc,KAAa,UAAyB;AAClE,WAAS,IAAI,SAAS,gBAAgB,QAAQ,GAAG,GAAG;AACtD;AAEO,SAAS,aAAa,UAAkC;AAC7D,SAAO,SAAS,IAAI,SAAS,gBAAgB,QAAQ,CAAC;AACxD;AAEO,SAAS,gBAAgB,UAAyB;AACvD,WAAS,OAAO,SAAS,gBAAgB,QAAQ,CAAC;AACpD;AAMO,SAAS,gBAAgB,UAAyB;AACvD,MAAI,UAAU;AACZ,oBAAgB,QAAQ;AACxB,qBAAiB,QAAQ;AACzB,oBAAgB,QAAQ;AACxB,uBAAmB,QAAQ;AAC3B;AAAA,EACF;AAEA,kBAAgB;AAChB,mBAAiB;AACjB,kBAAgB;AAGhB,MAAI,OAAO,iBAAiB,aAAa;AACvC,UAAM,SAAS,iBAAiB;AAChC,aAAS,IAAI,GAAG,IAAI,aAAa,QAAQ,KAAK;AAC5C,YAAM,MAAM,aAAa,IAAI,CAAC;AAC9B,UAAI,KAAK,WAAW,MAAM,GAAG;AAC3B,iBAAS,OAAO,IAAI,MAAM,eAAe,MAAM,CAAC;AAAA,MAClD;AAAA,IACF;AAAA,EACF;AACF;;;ACvLA,SAAS,gBAAgB,OAA2B;AAClD,QAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACzD,QAAM,SAAS,OAAO,OAAO,OAAO,UAAW,IAAK,OAAO,SAAS,KAAM,GAAI,GAAG;AACjF,QAAM,SAAS,KAAK,MAAM;AAC1B,QAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,UAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AAAA,EAChC;AACA,SAAO;AACT;AAGA,SAAS,iBAAiB,OAA+C;AACvE,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,gBAAgB,MAAM,CAAC,CAAC,CAAC;AAC/D,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,gBAAgB,OAA+C;AACtE,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,gBAAgB,MAAM,CAAC,CAAC,CAAC;AAC/D,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,gBAAgB,KAAqB;AAC5C,SAAO,IAAI,QAAQ,QAAQ,EAAE;AAC/B;AAgBA,IAAI,aAAwE;AAC5E,IAAM,oBAAoB,IAAI,KAAK;AAGnC,eAAe,UAAU,SAAuC;AAC9D,QAAM,MAAM,KAAK,IAAI;AACrB,MAAI,cAAc,WAAW,YAAY,WAAW,MAAM,WAAW,YAAY,mBAAmB;AAClG,WAAO,WAAW;AAAA,EACpB;AAEA,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,GAAG,OAAO,iBAAiB;AACnD,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,iBAAa,EAAE,SAAS,MAAM,WAAW,IAAI;AAC7C,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAe,cAAc,aAAsC;AACjE,QAAM,OAAO,MAAM,OAAO,OAAO;AAAA,IAC/B;AAAA,IACA,IAAI,YAAY,EAAE,OAAO,WAAW;AAAA,EACtC;AACA,QAAM,QAAQ,IAAI,WAAW,IAAI;AACjC,QAAM,OAAO,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;AAC5C,MAAI,SAAS;AACb,aAAW,KAAK,MAAM;AACpB,cAAU,OAAO,aAAa,CAAC;AAAA,EACjC;AACA,SAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC/E;AAGA,eAAe,YAAY,OAAe,KAAgC;AACxE,MAAI;AACF,UAAM,CAAC,WAAW,YAAY,SAAS,IAAI,MAAM,MAAM,GAAG;AAC1D,QAAI,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,IAAI,EAAG,QAAO;AAE3C,UAAM,YAAY,MAAM,OAAO,OAAO;AAAA,MACpC;AAAA,MACA,EAAE,KAAK,OAAO,GAAG,IAAI,GAAG,GAAG,IAAI,GAAG,KAAK,SAAS,KAAK,MAAM;AAAA,MAC3D,EAAE,MAAM,qBAAqB,MAAM,UAAU;AAAA,MAC7C;AAAA,MACA,CAAC,QAAQ;AAAA,IACX;AAEA,UAAM,iBAAiB,gBAAgB,SAAS;AAChD,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,GAAG,SAAS,IAAI,UAAU,EAAE;AAClE,WAAO,MAAM,OAAO,OAAO;AAAA,MACzB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAe,gBACb,SACA,gBACA,kBACA,aACA;AACA,QAAM,SAAS,gBAAgB,OAAO;AACtC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,SAAS,oBAAoB,mCAAe;AAAA,EACxD;AAEA,QAAM,MAAM,OAAO;AACnB,MAAI,OAAO,QAAQ,YAAa,QAAQ,WAAW,QAAQ,SAAU;AACnE,UAAM,IAAI,SAAS,4BAA4B,+DAAuB,GAAG,EAAE;AAAA,EAC7E;AAGA,MAAI,QAAQ,SAAS;AACnB,UAAM,OAAO,MAAM,UAAU,gBAAgB,cAAc,CAAC;AAC5D,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,SAAS,8BAA8B,kEAA0B;AAAA,IAC7E;AACA,UAAM,MAAM,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM;AAC1D,UAAM,MAAM,KAAK,KAAK;AAAA,MACpB,CAAC,MACC,EAAE,QAAQ,SACV,EAAE,QAAQ,WACV,EAAE,QAAQ,UACT,MAAM,EAAE,QAAQ,MAAM;AAAA,IAC3B;AACA,QAAI,CAAC,KAAK;AACR,YAAM,IAAI,SAAS,8BAA8B,oEAAuB;AAAA,IAC1E;AACA,UAAM,WAAW,MAAM,YAAY,SAAS,GAAG;AAC/C,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,SAAS,8BAA8B,+CAAiB;AAAA,IACpE;AAAA,EACF;AAIA,MAAI,QAAQ,SAAS;AAEnB,YAAQ;AAAA,MACN;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,UAAU,iBAAiB,OAAO;AACxC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,SAAS,oBAAoB,2CAAuB;AAAA,EAChE;AAEA,QAAM,2BAA2B,gBAAgB,cAAc;AAC/D,QAAM,cAAc,OAAO,QAAQ,QAAQ,WAAW,gBAAgB,QAAQ,GAAG,IAAI;AACrF,MAAI,gBAAgB,0BAA0B;AAC5C,UAAM,IAAI,SAAS,4BAA4B,oCAAqB;AAAA,EACtE;AACA,MACE,QAAQ,QAAQ,oBAChB,CAAG,QAAQ,KAA8B,SAAS,gBAAgB,GAClE;AACA,UAAM,IAAI,SAAS,8BAA8B,sCAAuB;AAAA,EAC1E;AACA,MAAI,OAAO,QAAQ,QAAQ,YAAY,KAAK,IAAI,KAAK,QAAQ,MAAM,KAAM;AACvE,UAAM,IAAI,SAAS,oBAAoB,6BAAc;AAAA,EACvD;AACA,MAAI,OAAO,QAAQ,QAAQ,YAAY,CAAC,QAAQ,KAAK;AACnD,UAAM,IAAI,SAAS,wBAAwB,2BAAiB;AAAA,EAC9D;AAGA,MAAI,OAAO,QAAQ,YAAY,YAAY,QAAQ,SAAS;AAC1D,UAAM,SAAS,MAAM,cAAc,WAAW;AAC9C,QAAI,WAAW,QAAQ,SAAS;AAC9B,YAAM,IAAI,SAAS,6BAA6B,qCAAsB;AAAA,IACxE;AAAA,EACF;AAEA,SAAO,EAAE,KAAK,QAAQ,IAAI;AAC5B;AAqEO,IAAM,aAAN,MAAM,WAAU;AAAA,EAYrB,YAAY,QAAyB;AAVrC,SAAQ,aAAmC;AAC3C,SAAQ,sBAA8B;AACtC,SAAQ,eAA0C;AAShD,QAAI,CAAC,OAAO,SAAU,OAAM,IAAI,SAAS,kBAAkB,mCAAe;AAC1E,QAAI,CAAC,OAAO,YAAa,OAAM,IAAI,SAAS,kBAAkB,sCAAkB;AAChF,QAAI,CAAC,OAAO,WAAY,OAAM,IAAI,SAAS,kBAAkB,qCAAiB;AAG9E,UAAM,OAAO,OAAO,WAAW,QAAQ,QAAQ,EAAE;AACjD,SAAK,SAAS,EAAE,GAAG,QAAQ,YAAY,KAAK;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAc,gBAA+C;AAC3D,UAAM,MAAM,KAAK,IAAI;AAGrB,QACE,KAAK,cACL,MAAM,KAAK,sBAAsB,WAAU,kBAC3C;AACA,aAAO,KAAK;AAAA,IACd;AAEA,UAAM,MAAM,GAAG,KAAK,OAAO,UAAU;AAErC,QAAI;AACF,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,YAAY;AAAA,QAChB,MAAM,WAAW,MAAM;AAAA,QACvB,WAAU;AAAA,MACZ;AAEA,YAAM,MAAM,MAAM,MAAM,KAAK,EAAE,QAAQ,WAAW,OAAO,CAAC;AAC1D,mBAAa,SAAS;AAEtB,UAAI,CAAC,IAAI,IAAI;AACX,gBAAQ;AAAA,UACN,2DAAuC,IAAI,MAAM;AAAA,QACnD;AACA,eAAO;AAAA,MACT;AAEA,WAAK,aAAc,MAAM,IAAI,KAAK;AAClC,WAAK,sBAAsB;AAC3B,aAAO,KAAK;AAAA,IACd,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,sDAAkC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MACpF;AAEA,aAAO,KAAK,cAAc;AAAA,IAC5B;AAAA,EACF;AAAA;AAAA,EAGA,MAAc,wBAAyC;AACrD,UAAM,IAAI,MAAM,KAAK,cAAc;AACnC,QAAI,EAAG,QAAO,EAAE;AAChB,WAAO,GAAG,KAAK,OAAO,UAAU;AAAA,EAClC;AAAA;AAAA,EAGA,MAAc,oBAAqC;AACjD,UAAM,IAAI,MAAM,KAAK,cAAc;AACnC,QAAI,EAAG,QAAO,EAAE;AAChB,WAAO,GAAG,KAAK,OAAO,UAAU;AAAA,EAClC;AAAA;AAAA,EAGA,MAAc,uBAAwC;AACpD,UAAM,IAAI,MAAM,KAAK,cAAc;AACnC,QAAI,EAAG,QAAO,EAAE;AAChB,WAAO,GAAG,KAAK,OAAO,UAAU;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,MAAM,MAAM,WAAmC;AAC7C,UAAM,WAAW,qBAAqB;AACtC,UAAM,YAAY,MAAM,sBAAsB,QAAQ;AACtD,UAAM,QAAQ,cAAc;AAG5B,qBAAiB,KAAK,OAAO,UAAU,QAAQ;AAC/C,mBAAe,OAAO,KAAK,OAAO,QAAQ;AAE1C,QAAI,WAAW;AACb,oBAAc,SAAS;AAAA,IACzB;AAGA,UAAM,oBAAoB,MAAM,KAAK,sBAAsB;AAC3D,UAAM,SAAS,IAAI,gBAAgB;AACnC,WAAO,IAAI,iBAAiB,MAAM;AAClC,WAAO,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC5C,WAAO,IAAI,gBAAgB,KAAK,OAAO,WAAW;AAClD,WAAO,IAAI,SAAS,KAAK,OAAO,UAAU,gBAAgB;AAC1D,WAAO,IAAI,SAAS,KAAK;AACzB,WAAO,IAAI,kBAAkB,SAAS;AACtC,WAAO,IAAI,yBAAyB,MAAM;AAG1C,WAAO,SAAS,OAAO,GAAG,iBAAiB,IAAI,OAAO,SAAS,CAAC;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,YAAY,WAAqC;AACrD,UAAM,WAAW,qBAAqB;AACtC,UAAM,YAAY,MAAM,sBAAsB,QAAQ;AACtD,UAAM,QAAQ,cAAc;AAE5B,qBAAiB,KAAK,OAAO,UAAU,QAAQ;AAC/C,mBAAe,OAAO,KAAK,OAAO,QAAQ;AAE1C,QAAI,UAAW,eAAc,SAAS;AAEtC,UAAM,oBAAoB,MAAM,KAAK,sBAAsB;AAC3D,UAAM,SAAS,IAAI,gBAAgB;AACnC,WAAO,IAAI,iBAAiB,MAAM;AAClC,WAAO,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC5C,WAAO,IAAI,gBAAgB,KAAK,OAAO,WAAW;AAClD,WAAO,IAAI,SAAS,KAAK,OAAO,UAAU,gBAAgB;AAC1D,WAAO,IAAI,SAAS,KAAK;AACzB,WAAO,IAAI,kBAAkB,SAAS;AACtC,WAAO,IAAI,yBAAyB,MAAM;AAE1C,WAAO,GAAG,iBAAiB,IAAI,OAAO,SAAS,CAAC;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,eACJ,aACoB;AACpB,UAAM,MAAM,IAAI,IAAI,WAAW;AAC/B,UAAM,SAAS,IAAI;AAGnB,UAAM,QAAQ,OAAO,IAAI,OAAO;AAChC,QAAI,OAAO;AACT,YAAM,OAAO,OAAO,IAAI,mBAAmB,KAAK;AAChD,YAAM,IAAI,SAAS,wBAAwB,6BAAS,IAAI,EAAE;AAAA,IAC5D;AAEA,UAAM,OAAO,OAAO,IAAI,MAAM;AAC9B,UAAM,gBAAgB,OAAO,IAAI,OAAO;AAExC,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,SAAS,wBAAwB,wDAA+B;AAAA,IAC5E;AAGA,UAAM,aAAa,cAAc,KAAK,OAAO,QAAQ;AACrD,QAAI,CAAC,cAAc,eAAe,eAAe;AAC/C,uBAAiB,KAAK,OAAO,QAAQ;AACrC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,qBAAiB,KAAK,OAAO,QAAQ;AAGrC,UAAM,WAAW,gBAAgB,KAAK,OAAO,QAAQ;AACrD,QAAI,CAAC,UAAU;AACb,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,uBAAmB,KAAK,OAAO,QAAQ;AAGvC,UAAM,gBAAgB,MAAM,KAAK,kBAAkB;AACnD,UAAM,OAAO,IAAI,gBAAgB;AACjC,SAAK,IAAI,cAAc,oBAAoB;AAC3C,SAAK,IAAI,QAAQ,IAAI;AACrB,SAAK,IAAI,iBAAiB,QAAQ;AAClC,SAAK,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC1C,SAAK,IAAI,gBAAgB,KAAK,OAAO,WAAW;AAChD,QAAI,KAAK,OAAO,cAAc;AAC5B,WAAK,IAAI,iBAAiB,KAAK,OAAO,YAAY;AAAA,IACpD;AAEA,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,MAAM,eAAe;AAAA,QAC/B,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,QAC/D,MAAM,KAAK,SAAS;AAAA,MACtB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,IAAI,SAAS,iBAAiB,wCAAU,GAAG;AAAA,IACnD;AAEA,QAAI,CAAC,IAAI,IAAI;AACX,UAAI,UAAmC,CAAC;AACxC,UAAI;AAAE,kBAAU,MAAM,IAAI,KAAK;AAAA,MAAG,QAAQ;AAAA,MAAe;AACzD,YAAM,IAAI;AAAA,QACR;AAAA,QACC,QAAQ,qBAAgC,wCAAoB,IAAI,MAAM;AAAA,MACzE;AAAA,IACF;AAEA,UAAM,OAAsB,MAAM,IAAI,KAAK;AAG3C,QAAI,KAAK,UAAU;AACjB,UAAI;AACF,cAAM;AAAA,UACJ,KAAK;AAAA,UACL,KAAK,OAAO;AAAA,UACZ,KAAK,OAAO;AAAA,UACZ,KAAK;AAAA,QACP;AAAA,MACF,SAAS,KAAK;AAEZ,wBAAgB,KAAK,OAAO,QAAQ;AACpC,cAAM;AAAA,MACR;AAAA,IACF;AAEA,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,YAAuB;AAAA,MAC3B,cAAc,KAAK;AAAA,MACnB,YAAY,KAAK;AAAA,MACjB,YAAY,KAAK;AAAA,MACjB,eAAe,KAAK;AAAA,MACpB,UAAU,KAAK;AAAA,MACf,WAAW;AAAA,MACX,YAAY,MAAM,KAAK,aAAa;AAAA,IACtC;AAEA,kBAAc,WAAW,KAAK,OAAO,QAAQ;AAC7C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,eAAmC;AAEvC,QAAI,KAAK,aAAc,QAAO,KAAK;AAEnC,SAAK,eAAe,KAAK,gBAAgB;AACzC,QAAI;AACF,aAAO,MAAM,KAAK;AAAA,IACpB,UAAE;AACA,WAAK,eAAe;AAAA,IACtB;AAAA,EACF;AAAA,EAEA,MAAc,kBAAsC;AAClD,UAAM,UAAU,aAAa,KAAK,OAAO,QAAQ;AACjD,QAAI,CAAC,SAAS,eAAe;AAC3B,YAAM,IAAI,SAAS,oBAAoB,8CAAqB;AAAA,IAC9D;AAEA,UAAM,gBAAgB,MAAM,KAAK,kBAAkB;AACnD,UAAM,OAAO,IAAI,gBAAgB;AACjC,SAAK,IAAI,cAAc,eAAe;AACtC,SAAK,IAAI,iBAAiB,QAAQ,aAAa;AAC/C,SAAK,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC1C,QAAI,KAAK,OAAO,cAAc;AAC5B,WAAK,IAAI,iBAAiB,KAAK,OAAO,YAAY;AAAA,IACpD;AAEA,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,MAAM,eAAe;AAAA,QAC/B,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,QAC/D,MAAM,KAAK,SAAS;AAAA,MACtB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,IAAI,SAAS,iBAAiB,2DAAmB,GAAG;AAAA,IAC5D;AAEA,QAAI,CAAC,IAAI,IAAI;AACX,UAAI,UAAmC,CAAC;AACxC,UAAI;AAAE,kBAAU,MAAM,IAAI,KAAK;AAAA,MAAG,QAAQ;AAAA,MAAe;AACzD,YAAM,YAAa,QAAQ,SAAoB;AAE/C,UAAI,cAAc,mBAAmB,IAAI,WAAW,KAAK;AACvD,wBAAgB,KAAK,OAAO,QAAQ;AAAA,MACtC;AACA,YAAM,IAAI;AAAA,QACR,cAAc,kBAAkB,oBAAoB;AAAA,QACnD,QAAQ,qBAAgC,yCAAqB,IAAI,MAAM;AAAA,MAC1E;AAAA,IACF;AAEA,UAAM,OAAsB,MAAM,IAAI,KAAK;AAC3C,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,YAAuB;AAAA,MAC3B,cAAc,KAAK;AAAA,MACnB,YAAY,KAAK;AAAA,MACjB,YAAY,KAAK;AAAA,MACjB,eAAe,KAAK;AAAA,MACpB,UAAU,KAAK;AAAA,MACf,WAAW;AAAA,MACX,YAAY,MAAM,KAAK,aAAa;AAAA,IACtC;AAEA,kBAAc,WAAW,KAAK,OAAO,QAAQ;AAC7C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,cAAgC;AACpC,QAAI,YAAY,aAAa,KAAK,OAAO,QAAQ;AAEjD,QAAI,CAAC,WAAW;AACd,YAAM,IAAI,SAAS,qBAAqB,oBAAK;AAAA,IAC/C;AAGA,QAAI,KAAK,IAAI,KAAK,UAAU,YAAY;AACtC,kBAAY,MAAM,KAAK,aAAa;AAAA,IACtC;AAEA,UAAM,mBAAmB,MAAM,KAAK,qBAAqB;AAEzD,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,MAAM,kBAAkB;AAAA,QAClC,SAAS;AAAA,UACP,eAAe,UAAU,UAAU,YAAY;AAAA,QACjD;AAAA,MACF,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,IAAI,SAAS,iBAAiB,4EAAgB,GAAG;AAAA,IACzD;AAEA,QAAI,CAAC,IAAI,IAAI;AACX,UAAI,IAAI,WAAW,KAAK;AACtB,wBAAgB,KAAK,OAAO,QAAQ;AACpC,cAAM,IAAI,SAAS,qBAAqB,0BAAW;AAAA,MACrD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA,0DAAkB,IAAI,MAAM;AAAA,MAC9B;AAAA,IACF;AAEA,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,iBAAyC;AAC7C,QAAI,YAAY,aAAa,KAAK,OAAO,QAAQ;AACjD,QAAI,CAAC,UAAW,QAAO;AAEvB,QAAI,KAAK,IAAI,KAAK,UAAU,YAAY;AACtC,kBAAY,MAAM,KAAK,aAAa;AAAA,IACtC;AAEA,WAAO,UAAU;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,kBAA2B;AACzB,UAAM,YAAY,aAAa,KAAK,OAAO,QAAQ;AACnD,QAAI,CAAC,UAAW,QAAO;AACvB,WAAO,KAAK,IAAI,IAAI,UAAU;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAO,gBAAyB,OAAsB;AAE1D,UAAM,YAAY,aAAa,KAAK,OAAO,QAAQ;AACnD,UAAM,eAAe,WAAW;AAChC,UAAM,cAAc,WAAW;AAE/B,oBAAgB,KAAK,OAAO,QAAQ;AAIpC,QAAI,gBAAgB,KAAK,OAAO,UAAU;AACxC,UAAI;AACF,cAAM,YAAY,MAAM,KAAK,cAAc;AAC3C,cAAM,YACJ,WAAW,uBACX,GAAG,KAAK,OAAO,UAAU;AAC3B,cAAM,aAAa,IAAI,gBAAgB;AAAA,UACrC,OAAO;AAAA,UACP,iBAAiB;AAAA,UACjB,WAAW,KAAK,OAAO;AAAA,QACzB,CAAC;AACD,YAAI,KAAK,OAAO,cAAc;AAC5B,qBAAW,IAAI,iBAAiB,KAAK,OAAO,YAAY;AAAA,QAC1D;AACA,cAAM,MAAM,WAAW;AAAA,UACrB,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,UAC/D,MAAM,WAAW,SAAS;AAAA,QAC5B,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,QAAI,eAAe;AAEjB,YAAM,YAAY,MAAM,KAAK,cAAc;AAC3C,YAAM,qBACJ,WAAW,wBAAwB,GAAG,KAAK,OAAO,UAAU;AAC9D,YAAM,YAAY,IAAI,IAAI,kBAAkB;AAC5C,gBAAU,aAAa,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC5D,UAAI,KAAK,OAAO,aAAa;AAC3B,kBAAU,aAAa;AAAA,UACrB;AAAA,UACA,KAAK,OAAO;AAAA,QACd;AAAA,MACF;AACA,UAAI,aAAa;AACf,kBAAU,aAAa,IAAI,iBAAiB,WAAW;AAAA,MACzD;AACA,YAAM,QAAQ,cAAc;AAC5B,gBAAU,aAAa,IAAI,SAAS,KAAK;AACzC,aAAO,SAAS,OAAO,UAAU,SAAS;AAAA,IAC5C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,eAA8C;AAClD,WAAO,KAAK,cAAc;AAAA,EAC5B;AACF;AAAA;AAhfa,WAOa,mBAAmB,IAAI,KAAK;AAAA;AAPzC,WAUa,uBAAuB;AAV1C,IAAM,YAAN;;;AJ7PP,IAAM,iBAAa,4BAAsC,IAAI;AA4B7D,IAAM,sBAAsB;AAC5B,IAAM,cAAc;AAEpB,SAAS,QAAQ,UAA0B;AACzC,SAAO,sBAAsB;AAC/B;AAEA,SAAS,mBAAmB,UAA2B;AACrD,MAAI,OAAO,iBAAiB,YAAa,QAAO;AAChD,QAAM,MAAM,QAAQ,QAAQ;AAC5B,QAAM,MAAM,KAAK,IAAI;AACrB,QAAM,MAAM,aAAa,QAAQ,GAAG;AACpC,MAAI,KAAK;AACP,UAAM,KAAK,SAAS,KAAK,EAAE;AAC3B,QAAI,CAAC,MAAM,EAAE,KAAK,MAAM,KAAK,aAAa;AACxC,aAAO;AAAA,IACT;AAAA,EACF;AACA,eAAa,QAAQ,KAAK,OAAO,GAAG,CAAC;AACrC,SAAO;AACT;AAEA,SAAS,mBAAmB,UAAwB;AAClD,MAAI,OAAO,iBAAiB,YAAa;AACzC,eAAa,WAAW,QAAQ,QAAQ,CAAC;AAC3C;AAMO,SAAS,YAAY;AAAA,EAC1B;AAAA,EACA;AAAA,EACA,mBAAmB;AAAA,EACnB;AACF,GAAqB;AACnB,QAAM,CAAC,MAAM,OAAO,QAAI,uBAAyB,IAAI;AACrD,QAAM,CAAC,WAAW,YAAY,QAAI,uBAAS,IAAI;AAC/C,QAAM,CAAC,iBAAiB,kBAAkB,QAAI,uBAAS,KAAK;AAC5D,QAAM,gBAAY,qBAAO,IAAI,UAAU,MAAM,CAAC;AAC9C,QAAM,sBAAkB,qBAA6C,IAAI;AACzE,QAAM,gBAAY,qBAAO,KAAK;AAE9B,QAAM,SAAS,UAAU;AAGzB,QAAM,eAAW,0BAAY,YAAY;AACvC,QAAI,CAAC,OAAO,gBAAgB,GAAG;AAC7B,cAAQ,IAAI;AACZ,yBAAmB,KAAK;AACxB,mBAAa,KAAK;AAClB;AAAA,IACF;AAEA,QAAI;AACF,YAAM,IAAI,MAAM,OAAO,YAAY;AACnC,cAAQ,CAAC;AACT,yBAAmB,IAAI;AAAA,IACzB,QAAQ;AACN,cAAQ,IAAI;AACZ,yBAAmB,KAAK;AACxB,sBAAgB,OAAO,OAAO,QAAQ;AAAA,IACxC,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,MAAM,CAAC;AAGX,8BAAU,MAAM;AACd,QAAI,UAAU,QAAS;AACvB,cAAU,UAAU;AAGpB,QAAI,OAAO,gBAAgB,GAAG;AAC5B,eAAS;AAAA,IACX,OAAO;AACL,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,QAAQ,QAAQ,CAAC;AAGrB,8BAAU,MAAM;AACd,QAAI,SAAS;AAEb,UAAM,sBAAsB,MAAM;AAChC,UAAI,CAAC,OAAQ;AAGb,UAAI,gBAAgB,SAAS;AAC3B,qBAAa,gBAAgB,OAAO;AACpC,wBAAgB,UAAU;AAAA,MAC5B;AAEA,YAAM,YAAY,aAAa,OAAO,OAAO,QAAQ;AACrD,UAAI,CAAC,UAAW;AAGhB,YAAM,gBAAgB,UAAU,aAAa,KAAK,IAAI,KAAK;AAE3D,UAAI,gBAAgB,GAAG;AAErB,YAAI,CAAC,mBAAmB,OAAO,OAAO,QAAQ,EAAG;AACjD,eACG,aAAa,EACb,KAAK,CAAC,OAAO;AACZ,6BAAmB,GAAG,YAAY;AAClC,mBAAS;AAAA,QACX,CAAC,EACA,MAAM,MAAM;AAEX,qBAAW,MAAM,SAAS,GAAG,GAAG;AAAA,QAClC,CAAC,EACA,QAAQ,MAAM,mBAAmB,OAAO,OAAO,QAAQ,CAAC;AAC3D;AAAA,MACF;AAEA,UAAI,gBAAgB,kBAAkB;AAEpC,YAAI,CAAC,mBAAmB,OAAO,OAAO,QAAQ,EAAG;AACjD,eACG,aAAa,EACb,KAAK,CAAC,OAAO;AACZ,6BAAmB,GAAG,YAAY;AAClC,mBAAS;AAAA,QACX,CAAC,EACA,MAAM,MAAM;AACX,qBAAW,MAAM,SAAS,GAAG,GAAG;AAAA,QAClC,CAAC,EACA,QAAQ,MAAM,mBAAmB,OAAO,OAAO,QAAQ,CAAC;AAC3D;AAAA,MACF;AAGA,YAAM,WAAW,eAAe,oBAAoB;AAEpD,sBAAgB,UAAU,WAAW,MAAM;AACzC,cAAM,KAAK,aAAa,OAAO,OAAO,QAAQ;AAC9C,YAAI,CAAC,GAAI;AAET,cAAM,WAAW,GAAG,aAAa,KAAK,IAAI,KAAK;AAC/C,YAAI,WAAW,kBAAkB;AAC/B,cAAI,CAAC,mBAAmB,OAAO,OAAO,QAAQ,GAAG;AAE/C;AAAA,UACF;AACA,iBACG,aAAa,EACb,KAAK,CAAC,UAAU;AACf,+BAAmB,MAAM,YAAY;AACrC,qBAAS;AAAA,UACX,CAAC,EACA,MAAM,MAAM;AACX,uBAAW,MAAM,SAAS,GAAG,GAAG;AAAA,UAClC,CAAC,EACA,QAAQ,MAAM,mBAAmB,OAAO,OAAO,QAAQ,CAAC;AAE3D,8BAAoB;AAAA,QACtB;AAAA,MACF,GAAG,KAAK,IAAI,SAAS,GAAI,CAAC;AAAA,IAC5B;AAEA,wBAAoB;AAEpB,WAAO,MAAM;AACX,eAAS;AACT,UAAI,gBAAgB,SAAS;AAC3B,qBAAa,gBAAgB,OAAO;AACpC,wBAAgB,UAAU;AAAA,MAC5B;AAAA,IACF;AAAA,EACF,GAAG,CAAC,QAAQ,UAAU,kBAAkB,gBAAgB,CAAC;AAGzD,8BAAU,MAAM;AACd,UAAM,sBAAsB,CAAC,MAAoB;AAC/C,UACE,EAAE,OACF,EAAE,IAAI,WAAW,cAAc,KAC/B,CAAC,EAAE,IAAI,WAAW,mBAAmB,GACrC;AACA,iBAAS;AAAA,MACX;AAAA,IACF;AAEA,WAAO,iBAAiB,WAAW,mBAAmB;AACtD,WAAO,MAAM,OAAO,oBAAoB,WAAW,mBAAmB;AAAA,EACxE,GAAG,CAAC,QAAQ,CAAC;AAGb,QAAM,YAAQ;AAAA,IACZ,OAAO,cAAuB;AAC5B,YAAM,OAAO,MAAM,SAAS;AAAA,IAC9B;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AAGA,QAAM,aAAS;AAAA,IACb,OAAO,gBAAyB,UAAU;AACxC,YAAM,OAAO,OAAO,aAAa;AACjC,cAAQ,IAAI;AACZ,yBAAmB,KAAK;AAAA,IAC1B;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AAGA,QAAM,kBAAc,0BAAY,YAAY;AAC1C,UAAM,SAAS;AAAA,EACjB,GAAG,CAAC,QAAQ,CAAC;AAGb,QAAM,qBAAiB,0BAAY,YAAoC;AACrE,WAAO,OAAO,eAAe;AAAA,EAC/B,GAAG,CAAC,MAAM,CAAC;AAEX,QAAM,QAAyB;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,SAAO,aAAAA,QAAM,cAAc,WAAW,UAAU,EAAE,MAAM,GAAG,QAAQ;AACrE;AAoBO,SAAS,SAA0B;AACxC,QAAM,UAAM,yBAAW,UAAU;AACjC,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,oEAAiC;AAAA,EACnD;AACA,SAAO;AACT;;;AKvUA,IAAAC,gBAA6D;AA8BtD,SAAS,YAAY;AAAA,EAC1B;AAAA,EACA;AAAA,EACA,YAAY;AACd,GAAqB;AACnB,QAAM,EAAE,iBAAiB,WAAW,MAAM,IAAI,OAAO;AACrD,QAAM,wBAAoB,sBAAO,KAAK;AAEtC,+BAAU,MAAM;AACd,QAAI,CAAC,aAAa,CAAC,mBAAmB,aAAa,CAAC,kBAAkB,SAAS;AAC7E,wBAAkB,UAAU;AAC5B,YAAM,cAAc,OAAO,SAAS,WAAW,OAAO,SAAS;AAC/D,YAAM,WAAW;AAAA,IACnB;AAAA,EACF,GAAG,CAAC,WAAW,iBAAiB,WAAW,KAAK,CAAC;AAEjD,MAAI,WAAW;AACb,WACE,YAAY,cAAAC,QAAM,cAAc,OAAO,MAAM,qDAAa;AAAA,EAE9D;AAEA,MAAI,CAAC,iBAAiB;AACpB,QAAI,SAAU,QAAO,cAAAA,QAAM,cAAc,cAAAA,QAAM,UAAU,MAAM,QAAQ;AACvE,WAAO,cAAAA,QAAM,cAAc,OAAO,MAAM,0BAAM;AAAA,EAChD;AAEA,SAAO,cAAAA,QAAM,cAAc,cAAAA,QAAM,UAAU,MAAM,QAAQ;AAC3D;AAeO,SAAS,SACd,WACkB;AAClB,QAAM,cACJ,UAAU,eAAe,UAAU,QAAQ;AAE7C,WAAS,iBAAiB,OAAU;AAClC,WAAO,cAAAA,QAAM;AAAA,MACX;AAAA,MACA;AAAA,MACA,cAAAA,QAAM,cAAc,WAAW,KAAK;AAAA,IACtC;AAAA,EACF;AAEA,mBAAiB,cAAc,YAAY,WAAW;AACtD,SAAO;AACT;;;ACjFA,IAAAC,gBAA2C;AAKpC,SAAS,eAAe;AAC7B,QAAM,EAAE,QAAQ,YAAY,IAAI,OAAO;AACvC,QAAM,CAAC,OAAO,QAAQ,QAAI,wBAAwB,IAAI;AACtD,QAAM,CAAC,YAAY,aAAa,QAAI,wBAAS,IAAI;AAEjD,+BAAU,MAAM;AACd,QAAI,YAAY;AAEhB,mBAAe,iBAAiB;AAC9B,UAAI;AACF,cAAM,OAAO,eAAe,OAAO,SAAS,IAAI;AAEhD,YAAI,UAAW;AAGf,cAAM,YAAY;AAGlB,cAAM,YAAY,aAAa;AAC/B,wBAAgB;AAChB,eAAO,SAAS,OAAO,aAAa;AAAA,MACtC,SAAS,KAAK;AACZ,YAAI,UAAW;AACf,YAAI,eAAe,UAAU;AAE3B,mBAAS,IAAI,eAAe,qBAAW,IAAI,IAAI,GAAG;AAAA,QACpD,WAAW,eAAe,aAAa,IAAI,QAAQ,SAAS,OAAO,GAAG;AAEpE,mBAAS,4FAAiB;AAAA,QAC5B,WAAW,eAAe,OAAO;AAC/B,mBAAS,qDAAa,IAAI,OAAO,EAAE;AAAA,QACrC,OAAO;AACL,mBAAS,0EAAc;AAAA,QACzB;AACA,sBAAc,KAAK;AAAA,MACrB;AAAA,IACF;AAEA,mBAAe;AAEf,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAM;AAAA,EACnC,GAAG,CAAC,QAAQ,WAAW,CAAC;AAExB,MAAI,OAAO;AACT,WAAO,cAAAC,QAAM;AAAA,MACX;AAAA,MACA;AAAA,QACE,OAAO;AAAA,UACL,SAAS;AAAA,UACT,eAAe;AAAA,UACf,YAAY;AAAA,UACZ,gBAAgB;AAAA,UAChB,WAAW;AAAA,UACX,YAAY;AAAA,QACd;AAAA,MACF;AAAA,MACA,cAAAA,QAAM;AAAA,QACJ;AAAA,QACA,EAAE,OAAO,EAAE,OAAO,WAAW,cAAc,OAAO,EAAE;AAAA,QACpD;AAAA,MACF;AAAA,MACA,cAAAA,QAAM;AAAA,QACJ;AAAA,QACA,EAAE,MAAM,KAAK,OAAO,EAAE,OAAO,WAAW,gBAAgB,YAAY,EAAE;AAAA,QACtE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,MAAI,YAAY;AACd,WAAO,cAAAA,QAAM;AAAA,MACX;AAAA,MACA;AAAA,QACE,OAAO;AAAA,UACL,SAAS;AAAA,UACT,YAAY;AAAA,UACZ,gBAAgB;AAAA,UAChB,WAAW;AAAA,UACX,YAAY;AAAA,QACd;AAAA,MACF;AAAA,MACA,cAAAA,QAAM,cAAc,KAAK,MAAM,qDAAa;AAAA,IAC9C;AAAA,EACF;AAEA,SAAO;AACT;","names":["React","import_react","React","import_react","React"]}
1	+ {"version":3,"sources":["../../src/react/index.ts","../../src/react/SsoProvider.tsx","../../src/core/errors.ts","../../src/core/pkce.ts","../../src/core/storage.ts","../../src/core/security.ts","../../src/core/id-token.ts","../../src/core/SsoClient.ts","../../src/react/RequireAuth.tsx","../../src/react/CallbackPage.tsx"],"sourcesContent":["/*\r\n @nihplod/sso-sdk/react\r\n \r\n React 绑定层：SsoProvider Context、useSso Hook、RequireAuth 路由保护、CallbackPage 回调处理。\r\n /\r\n\r\nexport { SsoProvider, useSso } from \"./SsoProvider\";\r\nexport { RequireAuth, withAuth } from \"./RequireAuth\";\r\nexport { CallbackPage } from \"./CallbackPage\";\r\n","/\r\n SsoProvider - React Context Provider\r\n \r\n 包裹子项目根组件，提供全局 SSO 认证状态管理：\r\n * - 自动管理 token 刷新定时器（过期前 60s 静默刷新）\r\n * - 监听 storage 事件实现跨 Tab 同步\r\n * - 提供 useSso() hook\r\n /\r\n\r\n\"use client\";\r\n\r\nimport React, {\r\n createContext,\r\n useContext,\r\n useState,\r\n useEffect,\r\n useCallback,\r\n useRef,\r\n type ReactNode,\r\n} from \"react\";\r\nimport { SsoClient } from \"../core/SsoClient\";\r\nimport { getTokenData, removeTokenData } from \"../core/storage\";\r\nimport type { TokenData } from \"../core/storage\";\r\nimport type { SsoClientConfig, SsoUser } from \"../core/SsoClient\";\r\n\r\n// ============================================\r\n// Context 类型\r\n// ============================================\r\n\r\nexport interface SsoContextValue {\r\n /* 当前用户信息 /\r\n user: SsoUser \| null;\r\n\r\n /* 是否已认证 /\r\n isAuthenticated: boolean;\r\n\r\n /* 是否正在加载（初始化/刷新中） /\r\n isLoading: boolean;\r\n\r\n /* 发起登录（同页重定向） /\r\n login: (returnUrl?: string) => Promise<void>;\r\n\r\n /* 弹窗模式登录（保持当前页面状态不丢失） /\r\n loginPopup: (options?: { returnUrl?: string; width?: number; height?: number }) => Promise<TokenData>;\r\n\r\n /* 登出 /\r\n logout: (redirectToSso?: boolean) => Promise<void>;\r\n\r\n /* 刷新用户信息 /\r\n refreshUser: () => Promise<void>;\r\n\r\n /* 获取 access_token（自动刷新过期 token） /\r\n getAccessToken: () => Promise<string \| null>;\r\n\r\n /* SsoClient 实例（高级用法） /\r\n client: SsoClient;\r\n}\r\n\r\nconst SsoContext = createContext<SsoContextValue \| null>(null);\r\n\r\n// ============================================\r\n// Provider Props\r\n// ============================================\r\n\r\nexport interface SsoProviderProps {\r\n /* SSO 客户端配置 /\r\n config: SsoClientConfig;\r\n\r\n /* 子组件 /\r\n children: ReactNode;\r\n\r\n /\r\n 自动刷新阈值（秒）\r\n * access_token 过期前多少秒触发静默刷新。\r\n * 默认 60 秒。\r\n /\r\n refreshThreshold?: number;\r\n\r\n /\r\n API 请求函数（可选）\r\n * 用于在 token 刷新后自动重试失败的 API 请求。\r\n /\r\n onTokenRefreshed?: (token: string) => void;\r\n}\r\n\r\n// 跨 Tab 刷新锁（基于 localStorage + 时间戳，避免多 Tab 同时刷新导致旧 RT 被撤销）\r\nconst REFRESH_LOCK_PREFIX = \"nihplod_sso_refresh_lock:\";\r\nconst LOCK_TTL_MS = 5000;\r\n\r\n// 本 Tab 持有的锁 token（用于释放时校验所有权，避免误删其他 Tab 的锁）\r\nconst ownedLocks = new Map<string, string>();\r\n\r\nfunction lockKey(clientId: string): string {\r\n return REFRESH_LOCK_PREFIX + clientId;\r\n}\r\n\r\n/\r\n 尝试获取跨 Tab 刷新锁。\r\n \r\n 权衡说明：localStorage 没有原子的 check-and-set，多 Tab 并发时无法完全避免\r\n * 竞态（两个 Tab 同毫秒通过存在性检查后都写入）。这里采用「写入唯一 token 后\r\n * 立刻 read-back 校验」将竞态窗口缩到最小；残余的双刷新风险由 SSO 服务端\r\n * refresh_token 轮换宽限期兜底，属于可接受权衡。\r\n /\r\nfunction acquireRefreshLock(clientId: string): boolean {\r\n if (typeof localStorage === \"undefined\") return true;\r\n const key = lockKey(clientId);\r\n const now = Date.now();\r\n const raw = localStorage.getItem(key);\r\n if (raw) {\r\n const ts = parseInt(raw, 10);\r\n if (!isNaN(ts) && now - ts < LOCK_TTL_MS) {\r\n return false;\r\n }\r\n }\r\n const token = `${now}:${Math.random().toString(36).slice(2)}`;\r\n localStorage.setItem(key, token);\r\n // read-back：若读回的不是自己写入的值，说明其他 Tab 并发抢锁成功\r\n if (localStorage.getItem(key) !== token) return false;\r\n ownedLocks.set(clientId, token);\r\n return true;\r\n}\r\n\r\nfunction releaseRefreshLock(clientId: string): void {\r\n if (typeof localStorage === \"undefined\") return;\r\n const owned = ownedLocks.get(clientId);\r\n ownedLocks.delete(clientId);\r\n // 仅当锁仍归本 Tab 所有时才删除，避免误删其他 Tab 新获取的锁\r\n if (owned && localStorage.getItem(lockKey(clientId)) === owned) {\r\n localStorage.removeItem(lockKey(clientId));\r\n }\r\n}\r\n\r\n/\r\n 在跨 Tab 互斥锁下执行静默刷新。\r\n \r\n 优先使用 Web Locks API（navigator.locks）实现浏览器级真互斥：\r\n * 拿到锁的 Tab 执行刷新；其他 Tab 以 ifAvailable 模式拿到 null lock\r\n * 直接返回，等待 storage 事件同步刷新结果。navigator.locks 不存在\r\n * 或调用异常（如隐私模式禁用）时回退 localStorage 锁逻辑。\r\n \r\n @returns true 表示本 Tab 持锁执行了刷新；false 表示未抢到锁（其他 Tab 正在刷新）\r\n \r\n 注意：task 必须自行消化内部异常（不得向外抛出），以便\r\n * navigator.locks.request 的 reject 可安全视为锁 API 故障并回退。\r\n /\r\nexport async function withRefreshLock(clientId: string, task: () => Promise<void>): Promise<boolean> {\r\n if (\r\n typeof navigator !== \"undefined\" &&\r\n typeof navigator.locks?.request === \"function\"\r\n ) {\r\n try {\r\n let ran = false;\r\n await navigator.locks.request(\r\n `nihplod_sso_refresh_${clientId}`,\r\n { ifAvailable: true },\r\n async (lock) => {\r\n if (!lock) return;\r\n ran = true;\r\n await task();\r\n }\r\n );\r\n return ran;\r\n } catch {\r\n // Web Locks API 故障，回退 localStorage 锁\r\n }\r\n }\r\n\r\n if (!acquireRefreshLock(clientId)) return false;\r\n try {\r\n await task();\r\n return true;\r\n } finally {\r\n releaseRefreshLock(clientId);\r\n }\r\n}\r\n\r\n// ============================================\r\n// Provider 实现\r\n// ============================================\r\n\r\nexport function SsoProvider({\r\n config,\r\n children,\r\n refreshThreshold = 60,\r\n onTokenRefreshed,\r\n}: SsoProviderProps) {\r\n const [user, setUser] = useState<SsoUser \| null>(null);\r\n const [isLoading, setIsLoading] = useState(true);\r\n const [isAuthenticated, setIsAuthenticated] = useState(false);\r\n // 实例用 useState 懒初始化保持稳定引用（避免渲染期读取 ref）\r\n const [client] = useState(() => new SsoClient(config));\r\n const refreshTimerRef = useRef<ReturnType<typeof setTimeout> \| null>(null);\r\n const loadedRef = useRef(false);\r\n\r\n // 加载用户信息\r\n const loadUser = useCallback(async () => {\r\n // 以「本地存在 token 数据」为准而非 isAuthenticated()：\r\n // access_token 已过期时 getTokenData 仍返回数据（保留 refresh_token），\r\n // getUserInfo 内部会自动刷新恢复会话，避免过期即丢登录态。\r\n const tokenData = getTokenData(client.config.clientId);\r\n if (!tokenData) {\r\n setUser(null);\r\n setIsAuthenticated(false);\r\n setIsLoading(false);\r\n return;\r\n }\r\n\r\n try {\r\n const u = await client.getUserInfo();\r\n setUser(u);\r\n setIsAuthenticated(true);\r\n } catch {\r\n setUser(null);\r\n setIsAuthenticated(false);\r\n removeTokenData(client.config.clientId);\r\n } finally {\r\n setIsLoading(false);\r\n }\r\n }, [client]);\r\n\r\n // 初始化（微任务延迟，避免 effect 内同步 setState）\r\n useEffect(() => {\r\n if (loadedRef.current) return;\r\n loadedRef.current = true;\r\n\r\n Promise.resolve().then(() => {\r\n // 本地存在 token 数据即尝试加载（过期 token 会在 loadUser 内自动刷新）\r\n if (getTokenData(client.config.clientId)) {\r\n loadUser();\r\n } else {\r\n setIsLoading(false);\r\n }\r\n });\r\n }, [client, loadUser]);\r\n\r\n // Token 自动刷新定时器（setTimeout 递归调度，避免 setInterval 堆积）\r\n useEffect(() => {\r\n let active = true;\r\n\r\n // 跨 Tab 互斥下的静默刷新：拿到锁的 Tab 执行刷新，\r\n // 刷新失败可能是其他 Tab 已刷新，短暂后重新加载本地 token\r\n const attemptRefresh = () =>\r\n withRefreshLock(client.config.clientId, async () => {\r\n try {\r\n const td = await client.refreshToken();\r\n onTokenRefreshed?.(td.access_token);\r\n loadUser();\r\n } catch {\r\n setTimeout(() => loadUser(), 500);\r\n }\r\n });\r\n\r\n const scheduleNextRefresh = () => {\r\n if (!active) return;\r\n\r\n // 清除已有定时器\r\n if (refreshTimerRef.current) {\r\n clearTimeout(refreshTimerRef.current);\r\n refreshTimerRef.current = null;\r\n }\r\n\r\n const tokenData = getTokenData(client.config.clientId);\r\n if (!tokenData) return;\r\n\r\n // 计算距离过期还有多少秒\r\n const remainingSec = (tokenData.expires_at - Date.now()) / 1000;\r\n\r\n if (remainingSec <= 0) {\r\n // 已过期，立即刷新（带锁，避免多 Tab 并发）\r\n void attemptRefresh();\r\n return;\r\n }\r\n\r\n if (remainingSec <= refreshThreshold) {\r\n // 即将过期，立即刷新（带锁）\r\n void attemptRefresh();\r\n return;\r\n }\r\n\r\n // 在过期前 refreshThreshold 秒触发刷新\r\n const delayMs = (remainingSec - refreshThreshold) 1000;\r\n\r\n refreshTimerRef.current = setTimeout(() => {\r\n if (!active) return;\r\n const td = getTokenData(client.config.clientId);\r\n if (!td) return;\r\n\r\n const secLeft = (td.expires_at - Date.now()) / 1000;\r\n if (secLeft <= refreshThreshold) {\r\n void attemptRefresh().then((didRefresh) => {\r\n // 未抢到锁（其他 Tab 正在刷新）时不重新调度，等待 storage 事件同步\r\n if (didRefresh) scheduleNextRefresh();\r\n });\r\n }\r\n }, Math.max(delayMs, 1000));\r\n };\r\n\r\n scheduleNextRefresh();\r\n\r\n return () => {\r\n active = false;\r\n if (refreshTimerRef.current) {\r\n clearTimeout(refreshTimerRef.current);\r\n refreshTimerRef.current = null;\r\n }\r\n };\r\n }, [client, loadUser, refreshThreshold, onTokenRefreshed]);\r\n\r\n // 监听 storage 事件实现跨 Tab 同步\r\n useEffect(() => {\r\n const handleStorageChange = (e: StorageEvent) => {\r\n if (\r\n e.key &&\r\n e.key.startsWith(\"nihplod_sso_\") &&\r\n !e.key.startsWith(REFRESH_LOCK_PREFIX)\r\n ) {\r\n loadUser();\r\n }\r\n };\r\n\r\n window.addEventListener(\"storage\", handleStorageChange);\r\n return () => window.removeEventListener(\"storage\", handleStorageChange);\r\n }, [loadUser]);\r\n\r\n // 登录\r\n const login = useCallback(\r\n async (returnUrl?: string) => {\r\n await client.login(returnUrl);\r\n },\r\n [client]\r\n );\r\n\r\n // 弹窗模式登录\r\n const loginPopup = useCallback(\r\n async (options?: { returnUrl?: string; width?: number; height?: number }) => {\r\n const tokenData = await client.loginPopup(options);\r\n await loadUser();\r\n return tokenData;\r\n },\r\n [client, loadUser]\r\n );\r\n\r\n // 登出\r\n const logout = useCallback(\r\n async (redirectToSso: boolean = false) => {\r\n await client.logout(redirectToSso);\r\n setUser(null);\r\n setIsAuthenticated(false);\r\n },\r\n [client]\r\n );\r\n\r\n // 刷新用户信息\r\n const refreshUser = useCallback(async () => {\r\n await loadUser();\r\n }, [loadUser]);\r\n\r\n // 获取 access_token\r\n const getAccessToken = useCallback(async (): Promise<string \| null> => {\r\n return client.getAccessToken();\r\n }, [client]);\r\n\r\n const value: SsoContextValue = {\r\n user,\r\n isAuthenticated,\r\n isLoading,\r\n login,\r\n loginPopup,\r\n logout,\r\n refreshUser,\r\n getAccessToken,\r\n client,\r\n };\r\n\r\n return React.createElement(SsoContext.Provider, { value }, children);\r\n}\r\n\r\n// ============================================\r\n// Hook\r\n// ============================================\r\n\r\n/*\r\n useSso Hook\r\n \r\n 在 SsoProvider 内部使用，获取 SSO 认证状态和操作方法。\r\n \r\n @example\r\n * ```tsx\r\n * function MyComponent() {\r\n * const { user, isAuthenticated, login, logout } = useSso();\r\n * if (!isAuthenticated) return <button onClick={() => login()}>登录</button>;\r\n * return <div>欢迎, {user?.nickname}</div>;\r\n * }\r\n * ```\r\n /\r\nexport function useSso(): SsoContextValue {\r\n const ctx = useContext(SsoContext);\r\n if (!ctx) {\r\n throw new Error(\"useSso() 必须在 <SsoProvider> 内部使用\");\r\n }\r\n return ctx;\r\n}\r\n","/\r\n SSO SDK 错误类型\r\n /\r\n\r\n/* SSO 错误码 /\r\nexport type SsoErrorCode =\r\n \| \"invalid_config\"\r\n \| \"state_mismatch\"\r\n \| \"pkce_required\"\r\n \| \"token_request_failed\"\r\n \| \"session_expired\"\r\n \| \"no_refresh_token\"\r\n \| \"userinfo_failed\"\r\n \| \"not_authenticated\"\r\n \| \"authorization_code_expired\"\r\n \| \"authorization_code_used\"\r\n \| \"client_disabled\"\r\n \| \"user_denied_authorization\"\r\n \| \"account_disabled\"\r\n \| \"sso_server_error\"\r\n \| \"rate_limited\"\r\n \| \"network_error\"\r\n \| \"popup_blocked\"\r\n \| \"popup_closed\"\r\n \| \"id_token_invalid\"\r\n \| \"id_token_unsupported_alg\"\r\n \| \"id_token_hs256_unsupported\"\r\n \| \"id_token_missing_secret\"\r\n \| \"id_token_invalid_signature\"\r\n \| \"id_token_issuer_mismatch\"\r\n \| \"id_token_audience_mismatch\"\r\n \| \"id_token_expired\"\r\n \| \"id_token_missing_sub\"\r\n \| \"id_token_at_hash_mismatch\";\r\n\r\n/\r\n 将 OAuth 2.0 服务端 error 字段映射到 SsoErrorCode\r\n \r\n @param oauthError 服务端返回的 error 字段\r\n * @param context 调用上下文：\"token_exchange\"（授权码换 token）或 \"refresh\"（刷新）。\r\n * invalid_grant 在换 token 场景多为授权码过期/已用，在刷新场景多为会话失效，\r\n * 需按上下文细化映射。\r\n /\r\nexport function mapOAuthErrorToSsoCode(\r\n oauthError: string,\r\n context: \"token_exchange\" \| \"refresh\" = \"token_exchange\"\r\n): SsoErrorCode {\r\n switch (oauthError) {\r\n case \"invalid_grant\":\r\n // 刷新场景的 invalid_grant 表示 refresh_token 已撤销/过期（调用方另会清除本地登录态）\r\n return context === \"refresh\" ? \"session_expired\" : \"authorization_code_expired\";\r\n case \"invalid_client\":\r\n return \"client_disabled\";\r\n case \"access_denied\":\r\n return \"user_denied_authorization\";\r\n case \"server_error\":\r\n return \"sso_server_error\";\r\n case \"rate_limited\":\r\n // 限流是独立的可重试错误，不应误报为 network_error\r\n return \"rate_limited\";\r\n case \"invalid_scope\":\r\n case \"invalid_request\":\r\n case \"unauthorized_client\":\r\n case \"unsupported_grant_type\":\r\n default:\r\n return \"token_request_failed\";\r\n }\r\n}\r\n\r\n/\r\n SSO SDK 自定义错误\r\n /\r\nexport class SsoError extends Error {\r\n public readonly code: SsoErrorCode;\r\n public readonly description: string;\r\n public readonly cause?: unknown;\r\n\r\n constructor(code: SsoErrorCode, description: string, cause?: unknown) {\r\n super(`[SSO SDK] ${code}: ${description}`);\r\n this.name = \"SsoError\";\r\n this.code = code;\r\n this.description = description;\r\n this.cause = cause;\r\n }\r\n}\r\n\r\n/\r\n OAuth 2.0 协议层错误（RFC 6749 §5.2）\r\n \r\n 用于表示服务端原样返回的 OAuth 错误（error / error_description / error_uri），\r\n * 与 SDK 语义的 SsoError 区分。\r\n /\r\nexport class OAuthError extends Error {\r\n public readonly code: string;\r\n public readonly description: string;\r\n public readonly uri?: string;\r\n\r\n constructor(code: string, description: string, uri?: string) {\r\n super(`[OAuth] ${code}: ${description}`);\r\n this.name = \"OAuthError\";\r\n this.code = code;\r\n this.description = description;\r\n this.uri = uri;\r\n }\r\n}\r\n","/\r\n PKCE (Proof Key for Code Exchange) 工具函数\r\n \r\n 实现 RFC 7636 规范：\r\n * - code_verifier: 43-128 字符的随机字符串\r\n * - code_challenge: SHA-256(code_verifier) 的 base64url 编码\r\n \r\n 仅支持 S256 模式，不提供 plain 模式。\r\n /\r\n\r\nconst VALID_CHARS =\r\n \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-._~\";\r\n\r\n/\r\n 生成密码学安全随机字符串\r\n \r\n 使用拒绝采样法（rejection sampling）避免取模非均匀分布。\r\n * VALID_CHARS 有 66 个字符，Uint8(0-255) 取模会偏向前 58 个字符。\r\n * 丢弃 >=198 的字节值使分布完全均匀（198 = floor(256/66) * 66）。\r\n /\r\nfunction generateRandomString(length: number): string {\r\n const mask = 198; // 66 3，最大均匀取值\r\n let result = \"\";\r\n\r\n while (result.length < length) {\r\n // 一次生成分块避免过小 array 的循环开销\r\n const chunkSize = Math.min(length * 2, 256);\r\n const array = new Uint8Array(chunkSize);\r\n crypto.getRandomValues(array);\r\n\r\n for (let i = 0; i < chunkSize && result.length < length; i++) {\r\n if (array[i] >= mask) continue; // 拒绝采样：丢弃 >=198 的字节\r\n result += VALID_CHARS[array[i] % VALID_CHARS.length];\r\n }\r\n }\r\n\r\n return result;\r\n}\r\n\r\n/*\r\n 生成 code_verifier\r\n \r\n 生成 43-128 字符之间的安全随机字符串，\r\n * 使用 `crypto.getRandomValues` 保证密码学安全性。\r\n \r\n @param length - 长度（默认 64），范围 43-128\r\n /\r\nexport function generateCodeVerifier(length: number = 64): string {\r\n if (length < 43 \|\| length > 128) {\r\n throw new Error(\"code_verifier length must be between 43 and 128\");\r\n }\r\n return generateRandomString(length);\r\n}\r\n\r\n/\r\n 计算 code_challenge (S256)\r\n \r\n 对 code_verifier 进行 SHA-256 哈希，然后进行 base64url 编码。\r\n \r\n @param codeVerifier - PKCE code_verifier\r\n /\r\nexport async function generateCodeChallenge(\r\n codeVerifier: string\r\n): Promise<string> {\r\n const encoder = new TextEncoder();\r\n const data = encoder.encode(codeVerifier);\r\n const hash = await crypto.subtle.digest(\"SHA-256\", data);\r\n\r\n // 转为 base64url（无 padding）\r\n const bytes = new Uint8Array(hash);\r\n let binary = \"\";\r\n for (let i = 0; i < bytes.byteLength; i++) {\r\n binary += String.fromCharCode(bytes[i]);\r\n }\r\n return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\r\n}\r\n\r\n/\r\n 生成 state 参数\r\n \r\n 32 字节 hex 随机字符串，用于 CSRF 防护。\r\n /\r\nexport function generateState(): string {\r\n const array = new Uint8Array(32);\r\n crypto.getRandomValues(array);\r\n return Array.from(array, (b) => b.toString(16).padStart(2, \"0\")).join(\"\");\r\n}\r\n","/\n Token 存储抽象层\n \n 分两类存储：\n * - Token 数据：默认使用内存存储，Public Client 浏览器中 refresh_token 不落盘，\n * XSS 无法窃取长期凭证。对需要多 Tab 共享 token 或 BFF/Confidential Client 场景，\n * 可通过 setTokenStorage() 注入 localStorage 实现（如 createSecureStorage({ persist: true })）。\n * - 临时数据（PKCE verifier / state / returnUrl / popup nonce）：必须跨整页重定向存活\n * （login() 会 302 跳转到 SSO 中心再回来），因此默认写入 sessionStorage；\n * SSR 等无 sessionStorage 环境自动降级为内存 Map。\n \n 多 client 隔离：\n * - token / state / return_url 均支持按 clientId 隔离 key\n * - 不传 clientId 时使用全局 key，保持向后兼容\n /\n\n/* Token 数据 /\nexport interface TokenData {\n access_token: string;\n token_type: string;\n expires_in: number;\n refresh_token: string;\n id_token?: string;\n\n /* Token 签发时间（epoch ms），用于计算过期 /\n issued_at: number;\n\n /* 访问令牌实际过期时间（epoch ms）= issued_at + expires_in * 1000 /\n expires_at: number;\n}\n\n/* 存储接口 /\nexport interface TokenStorage {\n get(key: string): string \| null;\n set(key: string, value: string): void;\n remove(key: string): void;\n}\n\n/* 默认 localStorage/sessionStorage key 前缀 /\nconst STORAGE_PREFIX = \"nihplod_sso_\";\n\n/* 常量 key 名称 /\nconst TOKEN_KEY = \"token\";\nconst VERIFIER_KEY_PREFIX = \"pkce_verifier_\";\nconst STATE_KEY = \"oauth_state\";\nconst RETURN_URL_KEY = \"return_url\";\n\nfunction buildKey(base: string, clientId?: string): string {\n return clientId ? `${base}:${clientId}` : base;\n}\n\n/\n 内存存储适配器（Public Client 浏览器默认）\n \n 安全优势：\n * - refresh_token 不落盘，XSS 无法窃取长期凭证。\n * - 页面刷新后用户需重新授权，符合纯前端 Public Client 的安全模型。\n \n 代价：多 Tab 间不会自动同步 token；SDK 内部已用锁机制避免并发刷新。\n /\nfunction createMemoryStorageAdapter(): TokenStorage {\n const store = new Map<string, string>();\n return {\n get(key: string) {\n return store.get(key) ?? null;\n },\n set(key: string, value: string) {\n store.set(key, value);\n },\n remove(key: string) {\n store.delete(key);\n },\n };\n}\n\nconst memoryStorageAdapter = createMemoryStorageAdapter();\n\n/\n 浏览器 localStorage 实现\n \n 适用于：\n * - Next.js BFF / Confidential Client（refresh_token 不直接暴露给浏览器）。\n * - 需要多 Tab 共享 token 的场景。\n \n 注意：Public Client 在浏览器中直接存储 refresh_token 会增加 XSS 风险，\n * 建议改用内存存储或 Service Worker 封装。\n /\nconst localStorageAdapter: TokenStorage = {\n get(key: string) {\n if (typeof localStorage === \"undefined\") return null;\n return localStorage.getItem(STORAGE_PREFIX + key);\n },\n set(key: string, value: string) {\n if (typeof localStorage === \"undefined\") return;\n try {\n localStorage.setItem(STORAGE_PREFIX + key, value);\n } catch (err) {\n // QuotaExceededError 等写入失败不应中断登录流程\n console.warn(\n `[SSO SDK] localStorage 写入失败（${err instanceof Error ? err.name : String(err)}），数据未持久化`\n );\n }\n },\n remove(key: string) {\n if (typeof localStorage === \"undefined\") return;\n localStorage.removeItem(STORAGE_PREFIX + key);\n },\n};\n\n/\n 浏览器 sessionStorage 实现（临时数据专用）\n \n PKCE verifier / state / returnUrl / popup nonce 必须跨整页重定向存活\n * （login() 跳转到 SSO 中心后回调页面仍需读取），不能放模块级内存；\n * sessionStorage 在整页跳转后保留，且随标签页关闭自动清除，恰好匹配其生命周期。\n * SSR / 隐私模式写入失败时降级为内存 Map，保证不抛异常。\n /\nfunction createSessionStorageAdapter(): TokenStorage {\n const fallback = new Map<string, string>();\n return {\n get(key: string) {\n if (typeof sessionStorage !== \"undefined\") {\n return sessionStorage.getItem(STORAGE_PREFIX + key) ?? fallback.get(key) ?? null;\n }\n return fallback.get(key) ?? null;\n },\n set(key: string, value: string) {\n if (typeof sessionStorage === \"undefined\") {\n fallback.set(key, value);\n return;\n }\n try {\n sessionStorage.setItem(STORAGE_PREFIX + key, value);\n } catch {\n // 隐私模式等场景写入失败时降级到内存\n fallback.set(key, value);\n }\n },\n remove(key: string) {\n fallback.delete(key);\n if (typeof sessionStorage === \"undefined\") return;\n sessionStorage.removeItem(STORAGE_PREFIX + key);\n },\n };\n}\n\n/* 临时数据存储（跨整页重定向存活），独立于 token 存储，不受 setTokenStorage() 影响 /\nconst _transient: TokenStorage = createSessionStorageAdapter();\n\n/\n 创建存储实现\n \n @param options.persist 是否持久化到 localStorage。默认 false（内存存储）。\n * ⚠️ 安全警告：persist=true 会将 refresh_token 明文写入 localStorage，\n * 任何 XSS 均可在不被检测的情况下读取。仅在 BFF/Confidential Client\n * 且 refresh_token 不直接暴露给浏览器的场景下使用。\n * - Confidential/BFF 子项目可设为 true。\n * - Public Client 在浏览器中应保持 false（默认）。\n /\nexport function createSecureStorage(options: { persist?: boolean } = {}): TokenStorage {\n return options.persist ? localStorageAdapter : memoryStorageAdapter;\n}\n\nlet _storage: TokenStorage = memoryStorageAdapter;\n\n/\n 设置自定义存储实现\n /\nexport function setTokenStorage(storage: TokenStorage): void {\n _storage = storage;\n}\n\n/\n 获取当前存储实现\n /\nexport function getTokenStorage(): TokenStorage {\n return _storage;\n}\n\n// ============================================\n// Token 存取\n// ============================================\n\nexport function saveTokenData(data: TokenData, clientId?: string): void {\n _storage.set(buildKey(TOKEN_KEY, clientId), JSON.stringify(data));\n}\n\nexport function getTokenData(clientId?: string): TokenData \| null {\n const raw = _storage.get(buildKey(TOKEN_KEY, clientId));\n if (!raw) return null;\n try {\n // 过期不物理删除：refresh_token 通常比 access_token 长寿，\n // 删除会同时丢弃 refresh_token 使刷新路径失效。\n // 是否过期由调用方依据 expires_at 判断（isAuthenticated / getUserInfo 等）。\n return JSON.parse(raw) as TokenData;\n } catch {\n return null;\n }\n}\n\nexport function removeTokenData(clientId?: string): void {\n _storage.remove(buildKey(TOKEN_KEY, clientId));\n}\n\n// ============================================\n// PKCE 临时数据存取（transient：sessionStorage，跨整页重定向存活）\n// ============================================\n\nexport function savePkceVerifier(clientId: string, verifier: string): void {\n _transient.set(VERIFIER_KEY_PREFIX + clientId, verifier);\n}\n\nexport function getPkceVerifier(clientId: string): string \| null {\n return _transient.get(VERIFIER_KEY_PREFIX + clientId);\n}\n\nexport function removePkceVerifier(clientId: string): void {\n _transient.remove(VERIFIER_KEY_PREFIX + clientId);\n}\n\n// ============================================\n// State 参数存取（transient）\n// ============================================\n\nexport function saveOAuthState(state: string, clientId?: string): void {\n _transient.set(buildKey(STATE_KEY, clientId), state);\n}\n\nexport function getOAuthState(clientId?: string): string \| null {\n return _transient.get(buildKey(STATE_KEY, clientId));\n}\n\nexport function removeOAuthState(clientId?: string): void {\n _transient.remove(buildKey(STATE_KEY, clientId));\n}\n\n// ============================================\n// 返回 URL 存取（transient）\n// ============================================\n\nexport function saveReturnUrl(url: string, clientId?: string): void {\n _transient.set(buildKey(RETURN_URL_KEY, clientId), url);\n}\n\nexport function getReturnUrl(clientId?: string): string \| null {\n return _transient.get(buildKey(RETURN_URL_KEY, clientId));\n}\n\nexport function removeReturnUrl(clientId?: string): void {\n _transient.remove(buildKey(RETURN_URL_KEY, clientId));\n}\n\n// ============================================\n// 清理所有 SSO 数据\n// ============================================\n\nexport function clearAllSsoData(clientId?: string): void {\n if (clientId) {\n removeTokenData(clientId);\n removeOAuthState(clientId);\n removeReturnUrl(clientId);\n removePkceVerifier(clientId);\n // popup nonce 复用 verifier key 空间（`${clientId}_popup_nonce`）\n removePkceVerifier(`${clientId}_popup_nonce`);\n return;\n }\n\n removeTokenData();\n removeOAuthState();\n removeReturnUrl();\n\n // 清理所有 PKCE verifier：当前版本存于 sessionStorage，同时清 localStorage 中可能的旧版本残留\n const prefix = STORAGE_PREFIX + VERIFIER_KEY_PREFIX;\n const stores = [\n typeof sessionStorage !== \"undefined\" ? sessionStorage : null,\n typeof localStorage !== \"undefined\" ? localStorage : null,\n ];\n for (const store of stores) {\n if (!store) continue;\n const keys: string[] = [];\n for (let i = 0; i < store.length; i++) {\n const key = store.key(i);\n if (key?.startsWith(prefix)) keys.push(key);\n }\n for (const key of keys) {\n _transient.remove(key.slice(STORAGE_PREFIX.length));\n store.removeItem(key);\n }\n }\n}\n\n/\n 清理指定 clientId 列表的 PKCE verifier\n \n 适用于非浏览器环境或已知 clientId 场景。\n /\nexport function clearVerifiersForClients(clientIds: string[]): void {\n for (const clientId of clientIds) {\n _transient.remove(VERIFIER_KEY_PREFIX + clientId);\n }\n}\n","/\n 安全相关小工具：returnUrl 开放重定向校验、常量时间字符串比较\n /\n\n/\n 校验 returnUrl 是否可信（防开放重定向）。\n * 仅允许：相对路径（且不以 // 开头）或与 currentOrigin 完全同源的绝对 URL。\n /\nexport function isTrustedReturnUrl(url: string, currentOrigin: string): boolean {\n if (!url) return false;\n if (url.startsWith(\"/\") && !url.startsWith(\"//\")) return true;\n try {\n return new URL(url).origin === currentOrigin;\n } catch {\n return false;\n }\n}\n\n/\n 常量时间字符串比较（避免 state / at_hash / nonce 等机密值的时序侧信道）。\n * 长度不同也执行完整循环，不提前返回。\n /\nexport function timingSafeEqualString(a: string, b: string): boolean {\n const ba = new TextEncoder().encode(a);\n const bb = new TextEncoder().encode(b);\n if (ba.length === 0 \|\| bb.length === 0) return ba.length === bb.length;\n const len = Math.max(ba.length, bb.length);\n let diff = ba.length ^ bb.length;\n for (let i = 0; i < len; i++) {\n diff \|= ba[i % ba.length] ^ bb[i % bb.length];\n }\n return diff === 0;\n}\n","/\n ID Token 验证工具（浏览器 / Edge Runtime 通用）\n \n 提取 SsoClient 与 Next.js callback 中重复的 ID Token 校验逻辑，\n * 包括 base64url 解码、JWKS 获取、RS256 签名验证、at_hash 计算等。\n /\n\nimport { SsoError } from \"./errors\";\nimport { timingSafeEqualString } from \"./security\";\n\n// 运行时 crypto.subtle 检测：现代浏览器 / Edge Runtime / Node 20+ 均提供全局 crypto\nconst _crypto: Pick<Crypto, \"subtle\"> \| null =\n typeof crypto !== \"undefined\" && (crypto as Crypto).subtle ? (crypto as Crypto) : null;\n\nfunction getCrypto(): Crypto \| null {\n return (_crypto as Crypto \| null) ?? null;\n}\n\nexport interface JwksKey {\n kty: string;\n kid?: string;\n alg?: string;\n use?: string;\n n?: string;\n e?: string;\n x5c?: string[];\n}\n\nexport interface Jwks {\n keys: JwksKey[];\n}\n\nexport interface ValidateIdTokenResult {\n sub: string;\n}\n\nexport interface ValidateIdTokenOptions {\n /\n 发现 SSO 中心已启用 RS256 时，是否拒绝 HS256 ID Token。\n * 默认 true：只要 JWKS 中存在 RS256 签名密钥，就拒绝 HS256（安全推荐）。\n /\n rejectHs256WhenRs256Available?: boolean;\n}\n\nfunction base64UrlDecode(input: string): Uint8Array {\n const base64 = input.replace(/-/g, \"+\").replace(/_/g, \"/\");\n const padded = base64.padEnd(base64.length + ((4 - (base64.length % 4)) % 4), \"=\");\n const binary = atob(padded);\n const bytes = new Uint8Array(binary.length);\n for (let i = 0; i < binary.length; i++) {\n bytes[i] = binary.charCodeAt(i);\n }\n return bytes;\n}\n\n/* 解码 JWT payload（不验证签名） /\nexport function decodeJwtPayload(token: string): Record<string, unknown> \| null {\n try {\n const parts = token.split(\".\");\n if (parts.length !== 3) return null;\n const json = new TextDecoder().decode(base64UrlDecode(parts[1]));\n return JSON.parse(json) as Record<string, unknown>;\n } catch {\n return null;\n }\n}\n\n/* 解码 JWT header /\nexport function decodeJwtHeader(token: string): Record<string, unknown> \| null {\n try {\n const parts = token.split(\".\");\n if (parts.length !== 3) return null;\n const json = new TextDecoder().decode(base64UrlDecode(parts[0]));\n return JSON.parse(json) as Record<string, unknown>;\n } catch {\n return null;\n }\n}\n\n/* 标准化 issuer/base URL，去除末尾斜杠 /\nfunction normalizeIssuer(url: string): string {\n return url.replace(/\\/+$/, \"\");\n}\n\n/* OIDC Discovery 文档（仅取本模块关心的字段） /\ninterface OidcDiscoveryDoc {\n issuer?: string;\n jwks_uri?: string;\n}\n\nlet cachedJwks: { baseUrl: string; jwks: Jwks; fetchedAt: number } \| null = null;\nlet cachedDiscovery: { baseUrl: string; doc: OidcDiscoveryDoc \| null; fetchedAt: number } \| null = null;\nconst JWKS_CACHE_TTL_MS = 5 60 * 1000;\n\n/** 拉取 OIDC Discovery 文档（带内存缓存；失败返回 null 不抛错） /\nasync function fetchDiscoveryDoc(baseUrl: string): Promise<OidcDiscoveryDoc \| null> {\n const now = Date.now();\n if (cachedDiscovery && cachedDiscovery.baseUrl === baseUrl && now - cachedDiscovery.fetchedAt < JWKS_CACHE_TTL_MS) {\n return cachedDiscovery.doc;\n }\n\n try {\n const res = await fetch(`${baseUrl}/api/oauth/.well-known/openid-configuration`);\n const doc = res.ok ? ((await res.json()) as OidcDiscoveryDoc) : null;\n cachedDiscovery = { baseUrl, doc, fetchedAt: now };\n return doc;\n } catch {\n cachedDiscovery = { baseUrl, doc: null, fetchedAt: now };\n return null;\n }\n}\n\nexport interface FetchJwksOptions {\n /\n 绕过内存缓存与浏览器 HTTP 缓存（cache: \"no-cache\"）强制重取 JWKS，\n * 并同步刷新模块级缓存。用于密钥轮换后 kid 失配的自愈重试。\n /\n forceRefresh?: boolean;\n}\n\n/* 从 SSO 中心拉取 JWKS（带内存缓存；优先 Discovery 的 jwks_uri，回退硬编码路径） /\nexport async function fetchJwks(baseUrl: string, options: FetchJwksOptions = {}): Promise<Jwks \| null> {\n const now = Date.now();\n if (!options.forceRefresh && cachedJwks && cachedJwks.baseUrl === baseUrl && now - cachedJwks.fetchedAt < JWKS_CACHE_TTL_MS) {\n return cachedJwks.jwks;\n }\n\n const discovery = await fetchDiscoveryDoc(baseUrl);\n const jwksUri = discovery?.jwks_uri \|\| `${baseUrl}/api/oauth/jwks`;\n\n try {\n const res = await fetch(jwksUri, options.forceRefresh ? { cache: \"no-cache\" } : undefined);\n if (!res.ok) return null;\n const jwks = (await res.json()) as Jwks;\n cachedJwks = { baseUrl, jwks, fetchedAt: now };\n return jwks;\n } catch {\n return null;\n }\n}\n\n/* 清空 JWKS / Discovery 内存缓存（测试与密钥轮换场景使用） /\nexport function clearIdTokenCaches(): void {\n cachedJwks = null;\n cachedDiscovery = null;\n}\n\n/* 使用 RS256 公钥验证 ID Token 签名 /\nexport async function verifyRs256Signature(token: string, jwk: JwksKey): Promise<boolean> {\n try {\n const [headerB64, payloadB64, signature] = token.split(\".\");\n if (!signature \|\| !jwk.n \|\| !jwk.e) return false;\n\n const c = getCrypto();\n if (!c) return false;\n\n const cryptoKey = await c.subtle.importKey(\n \"jwk\",\n { kty: \"RSA\", n: jwk.n, e: jwk.e, alg: \"RS256\", ext: false },\n { name: \"RSASSA-PKCS1-v1_5\", hash: \"SHA-256\" },\n false,\n [\"verify\"]\n );\n\n const signatureBytes = base64UrlDecode(signature);\n const data = new TextEncoder().encode(`${headerB64}.${payloadB64}`);\n return await c.subtle.verify(\n \"RSASSA-PKCS1-v1_5\",\n cryptoKey,\n signatureBytes as unknown as BufferSource,\n data as unknown as BufferSource\n );\n } catch {\n return false;\n }\n}\n\n/* 计算 OIDC at_hash（access_token SHA-256 前 128bit base64url） /\nexport async function computeAtHash(accessToken: string): Promise<string> {\n const c = getCrypto();\n if (!c) return \"\";\n const hash = await c.subtle.digest(\"SHA-256\", new TextEncoder().encode(accessToken));\n const bytes = new Uint8Array(hash);\n const half = bytes.slice(0, bytes.length / 2);\n let binary = \"\";\n for (const b of half) {\n binary += String.fromCharCode(b);\n }\n return btoa(binary).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\n/* 验证 ID Token（iss、aud、exp、iat、azp、sub、签名、at_hash） /\nexport async function validateIdToken(\n idToken: string,\n accessToken: string,\n expectedIssuer: string,\n expectedClientId: string,\n options: ValidateIdTokenOptions = {}\n): Promise<ValidateIdTokenResult> {\n const { rejectHs256WhenRs256Available = true } = options;\n\n const header = decodeJwtHeader(idToken);\n if (!header) {\n throw new SsoError(\"id_token_invalid\", \"ID Token 格式错误\");\n }\n\n const alg = header.alg;\n if (typeof alg !== \"string\" \|\| (alg !== \"RS256\" && alg !== \"HS256\")) {\n throw new SsoError(\"id_token_unsupported_alg\", `不支持的 ID Token 签名算法: ${alg}`);\n }\n\n const baseUrl = normalizeIssuer(expectedIssuer);\n // issuer 以 Discovery 文档的 issuer 为准（防伪站伪造 iss 通过校验），回退调用方传入值\n const discovery = await fetchDiscoveryDoc(baseUrl);\n const normalizedIssuer = normalizeIssuer(discovery?.issuer \|\| baseUrl);\n\n // RS256：通过 JWKS 验证签名\n if (alg === \"RS256\") {\n const jwks = await fetchJwks(baseUrl);\n if (!jwks) {\n throw new SsoError(\"id_token_invalid_signature\", \"无法获取 JWKS 验证 ID Token 签名\");\n }\n const kid = typeof header.kid === \"string\" ? header.kid : undefined;\n // 有 kid 时精确匹配；无 kid 时逐个尝试所有 RS256 签名公钥\n const matchCandidates = (set: Jwks) =>\n set.keys.filter(\n (k) =>\n k.kty === \"RSA\" &&\n k.alg === \"RS256\" &&\n k.use === \"sig\" &&\n (kid ? k.kid === kid : true)\n );\n const verifyAny = async (keys: JwksKey[]): Promise<boolean> => {\n for (const key of keys) {\n if (await verifyRs256Signature(idToken, key)) return true;\n }\n return false;\n };\n\n let candidates = matchCandidates(jwks);\n let validSig = candidates.length > 0 ? await verifyAny(candidates) : false;\n\n // 密钥轮换自愈：按 kid 过滤无候选，或所有候选验签失败时，\n // 可能是本地 JWKS 缓存陈旧 —— 强制重取一次 JWKS 后重试，仍失败才抛错\n if (candidates.length === 0 \|\| !validSig) {\n const freshJwks = await fetchJwks(baseUrl, { forceRefresh: true });\n if (freshJwks) {\n candidates = matchCandidates(freshJwks);\n validSig = candidates.length > 0 ? await verifyAny(candidates) : false;\n }\n }\n\n if (candidates.length === 0) {\n throw new SsoError(\"id_token_invalid_signature\", \"JWKS 中未找到匹配的 RS256 公钥\");\n }\n if (!validSig) {\n throw new SsoError(\"id_token_invalid_signature\", \"ID Token 签名验证失败\");\n }\n }\n\n // HS256：对称密钥无法安全分发给 Public Client / BFF。\n // SDK 拒绝 HS256 ID Token：主站需配置 RS256 密钥对以启用安全验证。\n if (alg === \"HS256\") {\n if (rejectHs256WhenRs256Available) {\n const jwks = await fetchJwks(baseUrl);\n const hasRs256 = jwks?.keys?.some((k) => k.alg === \"RS256\" && k.use === \"sig\");\n if (hasRs256) {\n throw new SsoError(\"id_token_unsupported_alg\", \"SSO 中心已配置 RS256，拒绝 HS256 ID Token\");\n }\n }\n throw new SsoError(\n \"id_token_hs256_unsupported\",\n \"ID Token 使用 HS256 对称签名，SDK 无法安全验证。\" +\n \"请联系管理员在 SSO 主站配置 RS256 密钥对（JWT_ID_TOKEN_PRIVATE_KEY / JWT_ID_TOKEN_PUBLIC_KEY）后重新签发。\"\n );\n }\n\n const payload = decodeJwtPayload(idToken);\n if (!payload) {\n throw new SsoError(\"id_token_invalid\", \"ID Token payload 解析失败\");\n }\n\n const tokenIssuer = typeof payload.iss === \"string\" ? normalizeIssuer(payload.iss) : \"\";\n if (tokenIssuer !== normalizedIssuer) {\n throw new SsoError(\"id_token_issuer_mismatch\", \"ID Token issuer 不匹配\");\n }\n\n // aud 校验：单值或数组包含 clientId；多 aud 时按 OIDC Core §3.1.3.7 要求 azp 必须等于 clientId\n const aud = payload.aud;\n const audList = Array.isArray(aud) ? aud : typeof aud === \"string\" ? [aud] : [];\n if (!audList.includes(expectedClientId)) {\n throw new SsoError(\"id_token_audience_mismatch\", \"ID Token audience 不匹配\");\n }\n if (audList.length > 1 && payload.azp !== expectedClientId) {\n throw new SsoError(\"id_token_audience_mismatch\", \"ID Token 多 audience 时 azp 必须为当前 client\");\n }\n\n // exp 必需且不得过期\n if (typeof payload.exp !== \"number\") {\n throw new SsoError(\"id_token_invalid\", \"ID Token 缺少 exp 声明\");\n }\n if (Date.now() >= payload.exp 1000) {\n throw new SsoError(\"id_token_expired\", \"ID Token 已过期\");\n }\n\n // iat 不得在未来（允许 60s clock skew）\n if (typeof payload.iat === \"number\" && payload.iat * 1000 > Date.now() + 60_000) {\n throw new SsoError(\"id_token_invalid\", \"ID Token iat 在未来，疑似伪造或时钟异常\");\n }\n\n if (typeof payload.sub !== \"string\" \|\| !payload.sub) {\n throw new SsoError(\"id_token_missing_sub\", \"ID Token 缺少 sub\");\n }\n\n // 校验 at_hash：确保 ID Token 与当前 access_token 绑定（常量时间比较）\n if (typeof payload.at_hash === \"string\" && payload.at_hash) {\n const actual = await computeAtHash(accessToken);\n if (!timingSafeEqualString(actual, payload.at_hash)) {\n throw new SsoError(\"id_token_at_hash_mismatch\", \"ID Token at_hash 不匹配\");\n }\n }\n\n return { sub: payload.sub };\n}\n","/*\r\n SSO Client 核心类\r\n \r\n 封装完整的 OAuth 2.0 授权码 + PKCE S256 流程：\r\n * - login(): 发起授权请求\r\n * - handleCallback(): 处理回调，交换 token\r\n * - refreshToken(): 刷新 access token（原子轮换）\r\n * - getUserInfo(): 获取用户信息\r\n * - logout(): 登出\r\n * - isAuthenticated(): 检查认证状态\r\n /\r\n\r\nimport { SsoError, mapOAuthErrorToSsoCode } from \"./errors\";\r\nimport {\r\n generateCodeVerifier,\r\n generateCodeChallenge,\r\n generateState,\r\n} from \"./pkce\";\r\nimport {\r\n saveTokenData,\r\n getTokenData,\r\n removeTokenData,\r\n savePkceVerifier,\r\n getPkceVerifier,\r\n removePkceVerifier,\r\n saveOAuthState,\r\n getOAuthState,\r\n removeOAuthState,\r\n saveReturnUrl,\r\n clearAllSsoData,\r\n type TokenData,\r\n} from \"./storage\";\r\nimport { validateIdToken } from \"./id-token\";\r\nimport { isTrustedReturnUrl, timingSafeEqualString } from \"./security\";\r\n\r\n// ============================================\r\n// 类型定义\r\n// ============================================\r\n\r\n/* SSO 客户端配置 /\r\nexport interface SsoClientConfig {\r\n /* OAuth Client ID（从管理后台获取） /\r\n clientId: string;\r\n\r\n /* OAuth Client Secret（从管理后台获取）\r\n \r\n ⚠️ 安全提醒：client_secret 不应暴露在前端代码中。\r\n * 对于浏览器端 SPA（Public Client），应省略此字段；SDK 会使用 PKCE 完成授权，\r\n * 且 token 端点不会发送 client_secret。\r\n * 对于 BFF/Next.js 等 Confidential Client，可传入 client_secret。\r\n /\r\n clientSecret?: string;\r\n\r\n /* 回调 URL（必须与注册的 redirect_uri 完全一致） /\r\n redirectUri: string;\r\n\r\n /* SSO 中心地址，如 \"https://nihplod.cn\" /\r\n ssoBaseUrl: string;\r\n\r\n /* 请求的 scope（空格分隔），如 \"openid profile phone\" /\r\n scopes?: string;\r\n\r\n /* RP-Initiated Logout 返回地址（可选）。不传时回退到 redirectUri /\r\n postLogoutRedirectUri?: string;\r\n}\r\n\r\n/* 用户信息 /\r\nexport interface SsoUser {\r\n sub: string;\r\n nickname?: string;\r\n avatar?: string;\r\n phone?: string;\r\n membership_level?: string;\r\n total_points?: number;\r\n}\r\n\r\n/* Token 响应 /\r\nexport interface TokenResponse {\r\n access_token: string;\r\n token_type: string;\r\n expires_in: number;\r\n refresh_token: string;\r\n id_token?: string;\r\n}\r\n\r\n/* OIDC Discovery 文档 /\r\nexport interface OidcDiscovery {\r\n issuer: string;\r\n authorization_endpoint: string;\r\n token_endpoint: string;\r\n userinfo_endpoint: string;\r\n jwks_uri: string;\r\n introspection_endpoint: string;\r\n revocation_endpoint?: string;\r\n end_session_endpoint?: string;\r\n scopes_supported: string[];\r\n response_types_supported: string[];\r\n grant_types_supported: string[];\r\n code_challenge_methods_supported: string[];\r\n}\r\n\r\n// ============================================\r\n// SsoClient\r\n// ============================================\r\n\r\nexport class SsoClient {\r\n public readonly config: SsoClientConfig;\r\n private _discovery: OidcDiscovery \| null = null;\r\n private _discoveryFetchedAt: number = 0;\r\n private _refreshLock: Promise<TokenData> \| null = null;\r\n\r\n /* Discovery 文档缓存 TTL（5 分钟） /\r\n private static readonly DISCOVERY_TTL_MS = 5 60 * 1000;\r\n\r\n /** Discovery fetch 超时（10 秒） /\r\n private static readonly DISCOVERY_TIMEOUT_MS = 10000;\r\n\r\n constructor(config: SsoClientConfig) {\r\n if (!config.clientId) throw new SsoError(\"invalid_config\", \"clientId 不能为空\");\r\n if (!config.redirectUri) throw new SsoError(\"invalid_config\", \"redirectUri 不能为空\");\r\n if (!config.ssoBaseUrl) throw new SsoError(\"invalid_config\", \"ssoBaseUrl 不能为空\");\r\n\r\n // 规范化 ssoBaseUrl：移除末尾斜杠\r\n const base = config.ssoBaseUrl.replace(/\\/+$/, \"\");\r\n this.config = { ...config, ssoBaseUrl: base };\r\n }\r\n\r\n // ============================================\r\n // 内部方法\r\n // ============================================\r\n\r\n /\r\n 获取 OIDC Discovery 文档（带缓存 + 超时）\r\n \r\n 缓存 5 分钟，超时 10 秒。\r\n * 失败时返回 null（上层调用方回退到硬编码默认端点）。\r\n /\r\n private async _getDiscovery(): Promise<OidcDiscovery \| null> {\r\n const now = Date.now();\r\n\r\n // 命中缓存且未过期\r\n if (\r\n this._discovery &&\r\n now - this._discoveryFetchedAt < SsoClient.DISCOVERY_TTL_MS\r\n ) {\r\n return this._discovery;\r\n }\r\n\r\n const url = `${this.config.ssoBaseUrl}/api/oauth/.well-known/openid-configuration`;\r\n\r\n try {\r\n const controller = new AbortController();\r\n const timeoutId = setTimeout(\r\n () => controller.abort(),\r\n SsoClient.DISCOVERY_TIMEOUT_MS\r\n );\r\n\r\n const res = await fetch(url, { signal: controller.signal });\r\n clearTimeout(timeoutId);\r\n\r\n if (!res.ok) {\r\n console.warn(\r\n `[SSO SDK] OIDC Discovery 请求失败: HTTP ${res.status}, 回退到默认端点`\r\n );\r\n return null;\r\n }\r\n\r\n this._discovery = (await res.json()) as OidcDiscovery;\r\n this._discoveryFetchedAt = now;\r\n return this._discovery;\r\n } catch (err) {\r\n console.warn(\r\n `[SSO SDK] OIDC Discovery 请求异常: ${err instanceof Error ? err.message : String(err)}, 回退到默认端点`\r\n );\r\n // 不清空已有缓存（即使过期也优于无数据）\r\n return this._discovery \|\| null;\r\n }\r\n }\r\n\r\n /* 获取 authorize 端点 URL（优先 Discovery，回退默认） /\r\n private async _getAuthorizeEndpoint(): Promise<string> {\r\n const d = await this._getDiscovery();\r\n if (d) return d.authorization_endpoint;\r\n return `${this.config.ssoBaseUrl}/api/oauth/authorize`;\r\n }\r\n\r\n /* 获取 token 端点 URL（优先 Discovery，回退默认） /\r\n private async _getTokenEndpoint(): Promise<string> {\r\n const d = await this._getDiscovery();\r\n if (d) return d.token_endpoint;\r\n return `${this.config.ssoBaseUrl}/api/oauth/token`;\r\n }\r\n\r\n /* 获取 userinfo 端点 URL（优先 Discovery，回退默认） /\r\n private async _getUserinfoEndpoint(): Promise<string> {\r\n const d = await this._getDiscovery();\r\n if (d) return d.userinfo_endpoint;\r\n return `${this.config.ssoBaseUrl}/api/oauth/userinfo`;\r\n }\r\n\r\n /\r\n 开放重定向防护：仅保存相对路径或与当前页面同源的 returnUrl，\r\n * 其余（如 https://evil.com）忽略并告警，防止回调后跳转到钓鱼站点。\r\n /\r\n private _saveReturnUrlIfTrusted(returnUrl: string): void {\r\n if (isTrustedReturnUrl(returnUrl, window.location.origin)) {\r\n saveReturnUrl(returnUrl);\r\n } else {\r\n console.warn(`[SSO SDK] returnUrl 未通过同源校验，已忽略: ${returnUrl}`);\r\n }\r\n }\r\n\r\n // ============================================\r\n // 公共 API\r\n // ============================================\r\n\r\n /\r\n 发起 SSO 登录\r\n \r\n 生成 PKCE code_verifier/code_challenge 和 state 参数，\r\n * 构建 authorize URL，通过 302 跳转到 SSO 登录页。\r\n \r\n @param returnUrl - 登录成功后的返回地址（可选，保存到 sessionStorage；\r\n * 仅允许相对路径或同源绝对 URL，否则忽略并告警）\r\n /\r\n async login(returnUrl?: string): Promise<void> {\r\n const verifier = generateCodeVerifier();\r\n const challenge = await generateCodeChallenge(verifier);\r\n const state = generateState();\r\n\r\n // 保存 PKCE verifier 和 state 到 sessionStorage（整页重定向后仍可读取）\r\n savePkceVerifier(this.config.clientId, verifier);\r\n saveOAuthState(state, this.config.clientId);\r\n\r\n if (returnUrl) {\r\n this._saveReturnUrlIfTrusted(returnUrl);\r\n }\r\n\r\n // 构建 authorize URL\r\n const authorizeEndpoint = await this._getAuthorizeEndpoint();\r\n const params = new URLSearchParams();\r\n params.set(\"response_type\", \"code\");\r\n params.set(\"client_id\", this.config.clientId);\r\n params.set(\"redirect_uri\", this.config.redirectUri);\r\n params.set(\"scope\", this.config.scopes \|\| \"openid profile\");\r\n params.set(\"state\", state);\r\n params.set(\"code_challenge\", challenge);\r\n params.set(\"code_challenge_method\", \"S256\");\r\n\r\n // 跳转\r\n window.location.href = `${authorizeEndpoint}?${params.toString()}`;\r\n }\r\n\r\n /\r\n 构建登录 URL（不跳转，返回 URL 字符串）\r\n \r\n 适用于需要手动处理跳转的场景。\r\n /\r\n async getLoginUrl(returnUrl?: string): Promise<string> {\r\n const verifier = generateCodeVerifier();\r\n const challenge = await generateCodeChallenge(verifier);\r\n const state = generateState();\r\n\r\n savePkceVerifier(this.config.clientId, verifier);\r\n saveOAuthState(state, this.config.clientId);\r\n // 统一使用全局 returnUrl key，与 login() / CallbackPage 保持一致\r\n if (returnUrl) this._saveReturnUrlIfTrusted(returnUrl);\r\n\r\n const authorizeEndpoint = await this._getAuthorizeEndpoint();\r\n const params = new URLSearchParams();\r\n params.set(\"response_type\", \"code\");\r\n params.set(\"client_id\", this.config.clientId);\r\n params.set(\"redirect_uri\", this.config.redirectUri);\r\n params.set(\"scope\", this.config.scopes \|\| \"openid profile\");\r\n params.set(\"state\", state);\r\n params.set(\"code_challenge\", challenge);\r\n params.set(\"code_challenge_method\", \"S256\");\r\n\r\n return `${authorizeEndpoint}?${params.toString()}`;\r\n }\r\n\r\n /\r\n 弹窗模式 SSO 登录\r\n \r\n 打开一个小窗口进行登录，认证完成后窗口自动关闭，\r\n * 主页面不丢失状态（适用于 SPA 中需要保持表单/浏览上下文的场景）。\r\n \r\n 流程：\r\n * 1. window.open() 打开授权 URL 到弹窗\r\n * 2. 用户在弹窗中完成登录\r\n * 3. 弹窗加载 CallbackPage 时检测到 window.opener，通过 postMessage 回传回调 URL\r\n * 4. 主页面收到消息后调用 handleCallback() 交换 token\r\n * 5. 弹窗自动关闭\r\n \r\n @param options - 弹窗配置\r\n * @param options.returnUrl - 登录成功后的返回地址\r\n * @param options.width - 弹窗宽度（默认 480）\r\n * @param options.height - 弹窗高度（默认 640）\r\n * @returns TokenData\r\n \r\n @example\r\n * ```typescript\r\n * const client = new SsoClient({ clientId: \"xxx\", redirectUri: \"https://myapp.com/callback\", ssoBaseUrl: \"https://nihplod.cn\" });\r\n * try {\r\n * const tokenData = await client.loginPopup({ returnUrl: \"/dashboard\" });\r\n * console.log(\"登录成功\", tokenData);\r\n * } catch (err) {\r\n * if (err instanceof SsoError && err.code === \"popup_blocked\") {\r\n * // 弹窗被拦截，回退到同页重定向\r\n * await client.login(\"/dashboard\");\r\n * }\r\n * }\r\n * ```\r\n /\r\n async loginPopup(\r\n options: { returnUrl?: string; width?: number; height?: number } = {}\r\n ): Promise<TokenData> {\r\n const verifier = generateCodeVerifier();\r\n const challenge = await generateCodeChallenge(verifier);\r\n const state = generateState();\r\n const popupNonce = generateState(); // 独立的 nonce 用于 postMessage 来源验证\r\n\r\n savePkceVerifier(this.config.clientId, verifier);\r\n saveOAuthState(state, this.config.clientId);\r\n // 保存 popup nonce 到 sessionStorage，用于 postMessage 校验\r\n savePkceVerifier(`${this.config.clientId}_popup_nonce`, popupNonce);\r\n\r\n if (options.returnUrl) {\r\n this._saveReturnUrlIfTrusted(options.returnUrl);\r\n }\r\n\r\n const authorizeEndpoint = await this._getAuthorizeEndpoint();\r\n const params = new URLSearchParams();\r\n params.set(\"response_type\", \"code\");\r\n params.set(\"client_id\", this.config.clientId);\r\n params.set(\"redirect_uri\", this.config.redirectUri);\r\n params.set(\"scope\", this.config.scopes \|\| \"openid profile\");\r\n params.set(\"state\", state);\r\n params.set(\"code_challenge\", challenge);\r\n params.set(\"code_challenge_method\", \"S256\");\r\n // 弹窗 nonce：回调页通过 postMessage 回传，主窗口校验防伪造\r\n params.set(\"popup_nonce\", popupNonce);\r\n\r\n const width = options.width \|\| 480;\r\n const height = options.height \|\| 640;\r\n const left = Math.max(0, (window.screen.width - width) / 2);\r\n const top = Math.max(0, (window.screen.height - height) / 2);\r\n\r\n const popupFeatures = [\r\n `width=${width}`,\r\n `height=${height}`,\r\n `left=${Math.round(left)}`,\r\n `top=${Math.round(top)}`,\r\n \"resizable=yes\",\r\n \"scrollbars=yes\",\r\n \"status=yes\",\r\n ].join(\",\");\r\n\r\n const popup = window.open(\r\n `${authorizeEndpoint}?${params.toString()}`,\r\n \"nihplod_sso_popup\",\r\n popupFeatures\r\n );\r\n\r\n if (!popup) {\r\n removePkceVerifier(this.config.clientId);\r\n removeOAuthState(this.config.clientId);\r\n removePkceVerifier(`${this.config.clientId}_popup_nonce`);\r\n throw new SsoError(\r\n \"popup_blocked\",\r\n \"弹窗被浏览器拦截，请允许弹窗后重试\"\r\n );\r\n }\r\n\r\n // 计算 redirect_uri 的 origin，用于 postMessage 来源校验\r\n const redirectUriOrigin = new URL(this.config.redirectUri).origin;\r\n\r\n try {\r\n // 聚焦弹窗\r\n popup.focus();\r\n\r\n return await new Promise<TokenData>((resolve, reject) => {\r\n let completed = false;\r\n\r\n const handleMessage = (event: MessageEvent) => {\r\n if (completed) return;\r\n // 校验消息来源：必须来自 redirect_uri 对应的子项目 origin（回调页运行位置）\r\n if (event.origin !== redirectUriOrigin) return;\r\n if (!event.data \|\| event.data.type !== \"nihplod_sso_popup_callback\") return;\r\n if (!event.data.callbackUrl) return;\r\n\r\n // 校验 popup nonce：防止伪造的 postMessage（fail-closed：本地 nonce 缺失同样拒绝）\r\n const savedNonce = getPkceVerifier(`${this.config.clientId}_popup_nonce`);\r\n if (!savedNonce \|\| !timingSafeEqualString(event.data.nonce ?? \"\", savedNonce)) return;\r\n removePkceVerifier(`${this.config.clientId}_popup_nonce`);\r\n\r\n completed = true;\r\n cleanup();\r\n\r\n if (popup && !popup.closed) {\r\n popup.close();\r\n }\r\n\r\n this.handleCallback(event.data.callbackUrl)\r\n .then(resolve)\r\n .catch(reject);\r\n };\r\n\r\n const pollTimer = setInterval(() => {\r\n if (popup.closed) {\r\n if (!completed) {\r\n completed = true;\r\n cleanup();\r\n reject(\r\n new SsoError(\r\n \"popup_closed\",\r\n \"登录窗口已关闭\"\r\n )\r\n );\r\n }\r\n }\r\n }, 500);\r\n\r\n const cleanup = () => {\r\n clearInterval(pollTimer);\r\n window.removeEventListener(\"message\", handleMessage);\r\n removePkceVerifier(`${this.config.clientId}_popup_nonce`);\r\n };\r\n\r\n window.addEventListener(\"message\", handleMessage);\r\n });\r\n } catch (err) {\r\n removePkceVerifier(this.config.clientId);\r\n removeOAuthState(this.config.clientId);\r\n removePkceVerifier(`${this.config.clientId}_popup_nonce`);\r\n throw err;\r\n }\r\n }\r\n\r\n /\r\n 处理 OAuth 回调\r\n \r\n 解析回调 URL，校验 state 参数，用授权码交换 token。\r\n * 成功后 token 自动保存到 token 存储（默认内存，可通过 setTokenStorage 定制）。\r\n \r\n @param callbackUrl - 完整的回调 URL（window.location.href）\r\n * @returns TokenData 或 null\r\n /\r\n async handleCallback(\r\n callbackUrl: string\r\n ): Promise<TokenData> {\r\n const url = new URL(callbackUrl);\r\n const params = url.searchParams;\r\n\r\n // 检查错误\r\n const error = params.get(\"error\");\r\n if (error) {\r\n const desc = params.get(\"error_description\") \|\| error;\r\n throw new SsoError(\"token_request_failed\", `授权失败: ${desc}`);\r\n }\r\n\r\n const code = params.get(\"code\");\r\n const returnedState = params.get(\"state\");\r\n\r\n if (!code) {\r\n throw new SsoError(\"token_request_failed\", \"回调 URL 中缺少 authorization code\");\r\n }\r\n\r\n // 校验 state 参数（CSRF 防护，常量时间比较）\r\n const savedState = getOAuthState(this.config.clientId);\r\n if (!savedState \|\| !timingSafeEqualString(savedState, returnedState ?? \"\")) {\r\n // state 不匹配：state 与 verifier 一并清除，避免残留半套临时数据\r\n removeOAuthState(this.config.clientId);\r\n removePkceVerifier(this.config.clientId);\r\n throw new SsoError(\r\n \"state_mismatch\",\r\n \"State 参数不匹配，可能存在 CSRF 攻击\"\r\n );\r\n }\r\n\r\n // 获取 code_verifier\r\n const verifier = getPkceVerifier(this.config.clientId);\r\n if (!verifier) {\r\n throw new SsoError(\r\n \"pkce_required\",\r\n \"code_verifier 不存在（可能已过期或来自其他标签页）\"\r\n );\r\n }\r\n\r\n // 交换 token\r\n const tokenEndpoint = await this._getTokenEndpoint();\r\n const body = new URLSearchParams();\r\n body.set(\"grant_type\", \"authorization_code\");\r\n body.set(\"code\", code);\r\n body.set(\"code_verifier\", verifier);\r\n body.set(\"client_id\", this.config.clientId);\r\n body.set(\"redirect_uri\", this.config.redirectUri);\r\n if (this.config.clientSecret) {\r\n body.set(\"client_secret\", this.config.clientSecret);\r\n }\r\n\r\n let res: Response;\r\n try {\r\n res = await fetch(tokenEndpoint, {\r\n method: \"POST\",\r\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\r\n body: body.toString(),\r\n });\r\n } catch (err) {\r\n throw new SsoError(\"network_error\", \"网络请求失败\", err);\r\n }\r\n\r\n if (!res.ok) {\r\n let errData: Record<string, unknown> = {};\r\n try { errData = await res.json(); } catch { / ignore / }\r\n const serverError = (errData.error as string) \|\| \"\";\r\n throw new SsoError(\r\n mapOAuthErrorToSsoCode(serverError),\r\n (errData.error_description as string) \|\| `Token 请求失败: HTTP ${res.status}`\r\n );\r\n }\r\n\r\n // 先解析响应体，成功后再清除 state 和 verifier：\r\n // 若 JSON 畸形导致解析抛错，保留 state/verifier 允许用户重试回调\r\n const data: TokenResponse = await res.json();\r\n\r\n // Token 交换成功后清除 state 和 verifier（一次性临时数据）\r\n removeOAuthState(this.config.clientId);\r\n removePkceVerifier(this.config.clientId);\r\n\r\n // OIDC：验证 ID Token 签名、基本声明及 at_hash\r\n if (data.id_token) {\r\n try {\r\n await validateIdToken(\r\n data.id_token,\r\n data.access_token,\r\n this.config.ssoBaseUrl,\r\n this.config.clientId\r\n );\r\n } catch (err) {\r\n // 验证失败：不保存任何 token，防止伪造 ID Token\r\n removeTokenData(this.config.clientId);\r\n throw err;\r\n }\r\n }\r\n\r\n const now = Date.now();\r\n const tokenData: TokenData = {\r\n access_token: data.access_token,\r\n token_type: data.token_type,\r\n expires_in: data.expires_in,\r\n refresh_token: data.refresh_token,\r\n id_token: data.id_token,\r\n issued_at: now,\r\n expires_at: now + data.expires_in 1000,\r\n };\r\n\r\n saveTokenData(tokenData, this.config.clientId);\r\n return tokenData;\r\n }\r\n\r\n /*\r\n 刷新 Access Token\r\n \r\n 使用 refresh_token 换取新的 access_token。\r\n * 采用互斥锁防止并发刷新。\r\n * 支持 Refresh Token 原子轮换。\r\n /\r\n async refreshToken(): Promise<TokenData> {\r\n // 互斥锁：避免并发刷新\r\n if (this._refreshLock) return this._refreshLock;\r\n\r\n this._refreshLock = this._doRefreshToken();\r\n try {\r\n return await this._refreshLock;\r\n } finally {\r\n this._refreshLock = null;\r\n }\r\n }\r\n\r\n private async _doRefreshToken(): Promise<TokenData> {\r\n const current = getTokenData(this.config.clientId);\r\n if (!current?.refresh_token) {\r\n throw new SsoError(\"no_refresh_token\", \"没有可用的 refresh_token\");\r\n }\r\n\r\n const tokenEndpoint = await this._getTokenEndpoint();\r\n const body = new URLSearchParams();\r\n body.set(\"grant_type\", \"refresh_token\");\r\n body.set(\"refresh_token\", current.refresh_token);\r\n body.set(\"client_id\", this.config.clientId);\r\n if (this.config.clientSecret) {\r\n body.set(\"client_secret\", this.config.clientSecret);\r\n }\r\n\r\n let res: Response \| null = null;\r\n let lastErr: unknown;\r\n for (let attempt = 0; attempt < 2; attempt++) {\r\n try {\r\n res = await fetch(tokenEndpoint, {\r\n method: \"POST\",\r\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\r\n body: body.toString(),\r\n });\r\n lastErr = null;\r\n break;\r\n } catch (err) {\r\n lastErr = err;\r\n if (attempt < 1) await new Promise((r) => setTimeout(r, 1000));\r\n }\r\n }\r\n if (lastErr \|\| !res) {\r\n throw new SsoError(\"network_error\", \"刷新 Token 网络请求失败\", lastErr);\r\n }\r\n\r\n if (!res.ok) {\r\n let errData: Record<string, unknown> = {};\r\n try { errData = await res.json(); } catch { / ignore / }\r\n const errorCode = (errData.error as string) \|\| \"\";\r\n // invalid_grant 表示 refresh_token 已被撤销或过期，应清除本地登录态\r\n if (errorCode === \"invalid_grant\" \|\| res.status === 401) {\r\n removeTokenData(this.config.clientId);\r\n }\r\n throw new SsoError(\r\n mapOAuthErrorToSsoCode(errorCode, \"refresh\"),\r\n (errData.error_description as string) \|\| `刷新 Token 失败: HTTP ${res.status}`\r\n );\r\n }\r\n\r\n const data: TokenResponse = await res.json();\r\n\r\n if (data.id_token) {\r\n try {\r\n await validateIdToken(\r\n data.id_token,\r\n data.access_token,\r\n this.config.ssoBaseUrl,\r\n this.config.clientId\r\n );\r\n } catch (err) {\r\n removeTokenData(this.config.clientId);\r\n throw err;\r\n }\r\n }\r\n\r\n const now = Date.now();\r\n const tokenData: TokenData = {\r\n access_token: data.access_token,\r\n token_type: data.token_type,\r\n expires_in: data.expires_in,\r\n // RFC 6749 §6：刷新响应可省略 refresh_token，此时沿用旧值\r\n refresh_token: data.refresh_token \|\| current.refresh_token,\r\n id_token: data.id_token,\r\n issued_at: now,\r\n expires_at: now + data.expires_in 1000,\r\n };\r\n\r\n saveTokenData(tokenData, this.config.clientId);\r\n return tokenData;\r\n }\r\n\r\n /*\r\n 获取用户信息\r\n \r\n 若 access_token 已过期则自动刷新后再请求。\r\n /\r\n async getUserInfo(): Promise<SsoUser> {\r\n let tokenData = getTokenData(this.config.clientId);\r\n\r\n if (!tokenData) {\r\n throw new SsoError(\"not_authenticated\", \"未登录\");\r\n }\r\n\r\n // 若已过期，先刷新\r\n if (Date.now() >= tokenData.expires_at) {\r\n tokenData = await this.refreshToken();\r\n }\r\n\r\n const userinfoEndpoint = await this._getUserinfoEndpoint();\r\n\r\n let res: Response;\r\n try {\r\n res = await fetch(userinfoEndpoint, {\r\n headers: {\r\n Authorization: `Bearer ${tokenData.access_token}`,\r\n },\r\n });\r\n } catch (err) {\r\n throw new SsoError(\"network_error\", \"获取用户信息网络请求失败\", err);\r\n }\r\n\r\n if (!res.ok) {\r\n if (res.status === 401) {\r\n removeTokenData(this.config.clientId);\r\n throw new SsoError(\"not_authenticated\", \"Token 已失效\");\r\n }\r\n throw new SsoError(\r\n \"userinfo_failed\",\r\n `获取用户信息失败: HTTP ${res.status}`\r\n );\r\n }\r\n\r\n return (await res.json()) as SsoUser;\r\n }\r\n\r\n /\r\n 获取当前 access_token\r\n \r\n 若已过期则自动刷新。用于子项目自行发起 API 请求时获取 Bearer token。\r\n * 若无 token 返回 null；若刷新失败则抛出错误（与 getUserInfo 行为一致）。\r\n /\r\n async getAccessToken(): Promise<string \| null> {\r\n let tokenData = getTokenData(this.config.clientId);\r\n if (!tokenData) return null;\r\n\r\n if (Date.now() >= tokenData.expires_at) {\r\n tokenData = await this.refreshToken();\r\n }\r\n\r\n return tokenData.access_token;\r\n }\r\n\r\n /\r\n 检查是否已认证（不发起网络请求）\r\n \r\n 仅检查本地是否存在未过期的 access_token。\r\n /\r\n isAuthenticated(): boolean {\r\n const tokenData = getTokenData(this.config.clientId);\r\n if (!tokenData) return false;\r\n return Date.now() < tokenData.expires_at;\r\n }\r\n\r\n /\r\n 登出\r\n \r\n 清除本地所有 token 和临时数据，并尝试撤销服务端 refresh_token。\r\n * @param redirectToSso - 是否重定向到 SSO 登出页（默认 false）\r\n /\r\n async logout(redirectToSso: boolean = false): Promise<void> {\r\n // 获取 refresh_token 用于服务端撤销（需在 clearAllSsoData 之前）\r\n const tokenData = getTokenData(this.config.clientId);\r\n const refreshToken = tokenData?.refresh_token;\r\n const idTokenHint = tokenData?.id_token;\r\n\r\n clearAllSsoData(this.config.clientId);\r\n\r\n // 尝试调用服务端 token revocation 端点（best-effort）\r\n // 仅 Confidential Client 携带 client_secret；Public Client 不传 secret。\r\n if (refreshToken && this.config.clientId) {\r\n try {\r\n const discovery = await this._getDiscovery();\r\n const revokeUrl =\r\n discovery?.revocation_endpoint \|\|\r\n `${this.config.ssoBaseUrl}/api/oauth/revoke`;\r\n const revokeBody = new URLSearchParams({\r\n token: refreshToken,\r\n token_type_hint: \"refresh_token\",\r\n client_id: this.config.clientId,\r\n });\r\n if (this.config.clientSecret) {\r\n revokeBody.set(\"client_secret\", this.config.clientSecret);\r\n }\r\n await fetch(revokeUrl, {\r\n method: \"POST\",\r\n headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\r\n body: revokeBody.toString(),\r\n });\r\n } catch {\r\n // 撤销失败不影响本地登出（best-effort）\r\n }\r\n }\r\n\r\n if (redirectToSso) {\r\n // OIDC RP-Initiated Logout：携带 client_id / post_logout_redirect_uri / id_token_hint / state\r\n const discovery = await this._getDiscovery();\r\n const endSessionEndpoint =\r\n discovery?.end_session_endpoint \|\| `${this.config.ssoBaseUrl}/api/oauth/end-session`;\r\n const logoutUrl = new URL(endSessionEndpoint);\r\n logoutUrl.searchParams.set(\"client_id\", this.config.clientId);\r\n const postLogoutUri = this.config.postLogoutRedirectUri \|\| this.config.redirectUri;\r\n if (postLogoutUri) {\r\n logoutUrl.searchParams.set(\r\n \"post_logout_redirect_uri\",\r\n postLogoutUri\r\n );\r\n }\r\n if (idTokenHint) {\r\n logoutUrl.searchParams.set(\"id_token_hint\", idTokenHint);\r\n }\r\n const state = generateState();\r\n logoutUrl.searchParams.set(\"state\", state);\r\n window.location.href = logoutUrl.toString();\r\n }\r\n }\r\n\r\n /\r\n 获取 OIDC Discovery 文档\r\n \r\n 用于调试和获取 SSO 中心完整配置。\r\n * 可能返回 null（当 Discovery 端点不可达且无缓存时）。\r\n /\r\n async getDiscovery(): Promise<OidcDiscovery \| null> {\r\n return this._getDiscovery();\r\n }\r\n}\r\n","/\r\n RequireAuth / withAuth — 路由保护组件\r\n \r\n 用法：\r\n * - <RequireAuth> 包裹需要登录才能访问的路由\r\n * - withAuth(Component) HOC 包装单个页面组件\r\n /\r\n\r\n\"use client\";\r\n\r\nimport React, { useEffect, useRef, type ComponentType } from \"react\";\r\nimport { useSso } from \"./SsoProvider\";\r\n\r\n// ============================================\r\n// RequireAuth 组件\r\n// ============================================\r\n\r\nexport interface RequireAuthProps {\r\n /* 子组件（受保护的内容） /\r\n children: React.ReactNode;\r\n\r\n /* 未登录时的回退内容（默认显示加载中） /\r\n fallback?: React.ReactNode;\r\n\r\n /* 是否在检测到未登录时自动发起登录跳转 /\r\n autoLogin?: boolean;\r\n\r\n /\r\n 是否使用弹窗模式登录（保持当前页面状态不丢失）\r\n \r\n 仅在 autoLogin=true 时生效。弹窗被拦截时自动回退到同页重定向。\r\n /\r\n usePopup?: boolean;\r\n}\r\n\r\n/\r\n 路由保护组件\r\n \r\n 未登录时自动触发登录跳转或显示回退内容。\r\n \r\n @example\r\n * ```tsx\r\n * // 弹窗模式：不中断用户当前操作\r\n * <RequireAuth autoLogin usePopup>\r\n * <Dashboard />\r\n * </RequireAuth>\r\n * ```\r\n /\r\nexport function RequireAuth({\r\n children,\r\n fallback,\r\n autoLogin = true,\r\n usePopup = false,\r\n}: RequireAuthProps) {\r\n const { isAuthenticated, isLoading, login, loginPopup } = useSso();\r\n const loginTriggeredRef = useRef(false);\r\n\r\n useEffect(() => {\r\n if (!isLoading && !isAuthenticated && autoLogin && !loginTriggeredRef.current) {\r\n loginTriggeredRef.current = true;\r\n const currentPath = window.location.pathname + window.location.search;\r\n\r\n if (usePopup) {\r\n loginPopup({ returnUrl: currentPath }).catch((err) => {\r\n // 弹窗被拦截时回退到同页重定向\r\n if ((err as { code?: string }).code === \"popup_blocked\") {\r\n login(currentPath);\r\n }\r\n });\r\n } else {\r\n login(currentPath);\r\n }\r\n }\r\n }, [isLoading, isAuthenticated, autoLogin, usePopup, login, loginPopup]);\r\n\r\n if (isLoading) {\r\n return (\r\n fallback \|\| React.createElement(\"div\", null, \"正在验证登录状态...\")\r\n );\r\n }\r\n\r\n if (!isAuthenticated) {\r\n if (fallback) return React.createElement(React.Fragment, null, fallback);\r\n return React.createElement(\"div\", null, \"请先登录\");\r\n }\r\n\r\n return React.createElement(React.Fragment, null, children);\r\n}\r\n\r\n// ============================================\r\n// withAuth HOC\r\n// ============================================\r\n\r\n/\r\n 高阶组件：包装页面组件，要求认证后才能访问\r\n \r\n @example\r\n * ```tsx\r\n * function DashboardPage() { return <div>Dashboard</div>; }\r\n * export default withAuth(DashboardPage);\r\n * ```\r\n /\r\nexport function withAuth<P extends object>(\r\n Component: ComponentType<P>\r\n): ComponentType<P> {\r\n const displayName =\r\n Component.displayName \|\| Component.name \|\| \"Component\";\r\n\r\n function WrappedComponent(props: P) {\r\n return React.createElement(\r\n RequireAuth,\r\n null,\r\n React.createElement(Component, props)\r\n );\r\n }\r\n\r\n WrappedComponent.displayName = `withAuth(${displayName})`;\r\n return WrappedComponent;\r\n}\r\n","/\r\n CallbackPage — 通用 OAuth 回调页面组件\r\n \r\n 子项目只需在回调路由渲染此组件即可完成 code → token 交换。\r\n * 交换成功后自动跳转到 returnUrl 或首页。\r\n \r\n @example\r\n * ```tsx\r\n * // 在回调页面路由中：\r\n * import { CallbackPage } from \"@nihplod/sso-sdk/react\";\r\n * export default function AuthCallback() {\r\n * return <CallbackPage />;\r\n * }\r\n * ```\r\n */\r\n\r\n\"use client\";\r\n\r\nimport React, { useEffect, useState } from \"react\";\r\nimport { useSso } from \"./SsoProvider\";\r\nimport { getReturnUrl, removeReturnUrl } from \"../core/storage\";\r\nimport { isTrustedReturnUrl } from \"../core/security\";\r\nimport { SsoError } from \"../core/errors\";\r\n\r\nexport function CallbackPage() {\r\n const { client, refreshUser } = useSso();\r\n const [error, setError] = useState<string \| null>(null);\r\n const [processing, setProcessing] = useState(true);\r\n\r\n useEffect(() => {\r\n // 弹窗模式：通过 postMessage 将回调 URL 传回主窗口，不自行处理\r\n if (window.opener && !window.opener.closed) {\r\n const nonce = new URL(window.location.href).searchParams.get(\"popup_nonce\");\r\n // opener 与弹窗同源时可直接读 origin；跨源访问会抛 SecurityError，回退到当前 origin\r\n let targetOrigin = window.location.origin;\r\n try {\r\n targetOrigin = window.opener.location.origin;\r\n } catch {\r\n // 跨源 opener：使用当前 origin（postMessage 会校验，不会泄露给第三方）\r\n }\r\n window.opener.postMessage(\r\n { type: \"nihplod_sso_popup_callback\", callbackUrl: window.location.href, nonce: nonce \|\| undefined },\r\n targetOrigin\r\n );\r\n // 微任务延迟，避免 effect 内同步 setState\r\n Promise.resolve().then(() => setProcessing(false));\r\n return;\r\n }\r\n\r\n let cancelled = false;\r\n\r\n async function handleCallback() {\r\n try {\r\n await client.handleCallback(window.location.href);\r\n\r\n if (cancelled) return;\r\n\r\n // 刷新用户信息\r\n await refreshUser();\r\n\r\n // 跳转到 returnUrl 或首页（开放重定向防护：仅相对路径或同源）\r\n const returnUrl = getReturnUrl();\r\n removeReturnUrl();\r\n window.location.href =\r\n returnUrl && isTrustedReturnUrl(returnUrl, window.location.origin)\r\n ? returnUrl\r\n : \"/\";\r\n } catch (err) {\r\n if (cancelled) return;\r\n if (err instanceof SsoError) {\r\n // SsoError 携带 code + description，可直接展示\r\n setError(err.description \|\| `SSO 错误 (${err.code})`);\r\n } else if (err instanceof TypeError && err.message.includes(\"fetch\")) {\r\n // 网络错误：断网、DNS 失败、CORS 等\r\n setError(\"网络连接失败，请检查网络后重试\");\r\n } else if (err instanceof Error) {\r\n setError(`登录回调处理失败: ${err.message}`);\r\n } else {\r\n setError(\"登录回调处理失败，请重试\");\r\n }\r\n setProcessing(false);\r\n }\r\n }\r\n\r\n handleCallback();\r\n\r\n return () => { cancelled = true; };\r\n }, [client, refreshUser]);\r\n\r\n if (error) {\r\n return React.createElement(\r\n \"div\",\r\n {\r\n style: {\r\n display: \"flex\",\r\n flexDirection: \"column\",\r\n alignItems: \"center\",\r\n justifyContent: \"center\",\r\n minHeight: \"100vh\",\r\n fontFamily: \"system-ui, sans-serif\",\r\n },\r\n },\r\n React.createElement(\r\n \"p\",\r\n { style: { color: \"#dc2626\", marginBottom: \"1rem\" } },\r\n error\r\n ),\r\n React.createElement(\r\n \"a\",\r\n { href: \"/\", style: { color: \"#2563eb\", textDecoration: \"underline\" } },\r\n \"返回首页\"\r\n )\r\n );\r\n }\r\n\r\n if (processing) {\r\n return React.createElement(\r\n \"div\",\r\n {\r\n style: {\r\n display: \"flex\",\r\n alignItems: \"center\",\r\n justifyContent: \"center\",\r\n minHeight: \"100vh\",\r\n fontFamily: \"system-ui, sans-serif\",\r\n },\r\n },\r\n React.createElement(\"p\", null, \"正在处理登录回调...\")\r\n );\r\n }\r\n\r\n return null;\r\n}\r\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACWA,mBAQO;;;ACwBA,SAAS,uBACd,YACA,UAAwC,kBAC1B;AACd,UAAQ,YAAY;AAAA,IAClB,KAAK;AAEH,aAAO,YAAY,YAAY,oBAAoB;AAAA,IACrD,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAEH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL;AACE,aAAO;AAAA,EACX;AACF;AAKO,IAAM,WAAN,cAAuB,MAAM;AAAA,EAKlC,YAAY,MAAoB,aAAqB,OAAiB;AACpE,UAAM,aAAa,IAAI,KAAK,WAAW,EAAE;AACzC,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,cAAc;AACnB,SAAK,QAAQ;AAAA,EACf;AACF;;;AC1EA,IAAM,cACJ;AASF,SAAS,qBAAqB,QAAwB;AACpD,QAAM,OAAO;AACb,MAAI,SAAS;AAEb,SAAO,OAAO,SAAS,QAAQ;AAE7B,UAAM,YAAY,KAAK,IAAI,SAAS,GAAG,GAAG;AAC1C,UAAM,QAAQ,IAAI,WAAW,SAAS;AACtC,WAAO,gBAAgB,KAAK;AAE5B,aAAS,IAAI,GAAG,IAAI,aAAa,OAAO,SAAS,QAAQ,KAAK;AAC5D,UAAI,MAAM,CAAC,KAAK,KAAM;AACtB,gBAAU,YAAY,MAAM,CAAC,IAAI,YAAY,MAAM;AAAA,IACrD;AAAA,EACF;AAEA,SAAO;AACT;AAUO,SAAS,qBAAqB,SAAiB,IAAY;AAChE,MAAI,SAAS,MAAM,SAAS,KAAK;AAC/B,UAAM,IAAI,MAAM,iDAAiD;AAAA,EACnE;AACA,SAAO,qBAAqB,MAAM;AACpC;AASA,eAAsB,sBACpB,cACiB;AACjB,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,YAAY;AACxC,QAAM,OAAO,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AAGvD,QAAM,QAAQ,IAAI,WAAW,IAAI;AACjC,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,YAAY,KAAK;AACzC,cAAU,OAAO,aAAa,MAAM,CAAC,CAAC;AAAA,EACxC;AACA,SAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC/E;AAOO,SAAS,gBAAwB;AACtC,QAAM,QAAQ,IAAI,WAAW,EAAE;AAC/B,SAAO,gBAAgB,KAAK;AAC5B,SAAO,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAAE,KAAK,EAAE;AAC1E;;;AC/CA,IAAM,iBAAiB;AAGvB,IAAM,YAAY;AAClB,IAAM,sBAAsB;AAC5B,IAAM,YAAY;AAClB,IAAM,iBAAiB;AAEvB,SAAS,SAAS,MAAc,UAA2B;AACzD,SAAO,WAAW,GAAG,IAAI,IAAI,QAAQ,KAAK;AAC5C;AAWA,SAAS,6BAA2C;AAClD,QAAM,QAAQ,oBAAI,IAAoB;AACtC,SAAO;AAAA,IACL,IAAI,KAAa;AACf,aAAO,MAAM,IAAI,GAAG,KAAK;AAAA,IAC3B;AAAA,IACA,IAAI,KAAa,OAAe;AAC9B,YAAM,IAAI,KAAK,KAAK;AAAA,IACtB;AAAA,IACA,OAAO,KAAa;AAClB,YAAM,OAAO,GAAG;AAAA,IAClB;AAAA,EACF;AACF;AAEA,IAAM,uBAAuB,2BAA2B;AA0CxD,SAAS,8BAA4C;AACnD,QAAM,WAAW,oBAAI,IAAoB;AACzC,SAAO;AAAA,IACL,IAAI,KAAa;AACf,UAAI,OAAO,mBAAmB,aAAa;AACzC,eAAO,eAAe,QAAQ,iBAAiB,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK;AAAA,MAC9E;AACA,aAAO,SAAS,IAAI,GAAG,KAAK;AAAA,IAC9B;AAAA,IACA,IAAI,KAAa,OAAe;AAC9B,UAAI,OAAO,mBAAmB,aAAa;AACzC,iBAAS,IAAI,KAAK,KAAK;AACvB;AAAA,MACF;AACA,UAAI;AACF,uBAAe,QAAQ,iBAAiB,KAAK,KAAK;AAAA,MACpD,QAAQ;AAEN,iBAAS,IAAI,KAAK,KAAK;AAAA,MACzB;AAAA,IACF;AAAA,IACA,OAAO,KAAa;AAClB,eAAS,OAAO,GAAG;AACnB,UAAI,OAAO,mBAAmB,YAAa;AAC3C,qBAAe,WAAW,iBAAiB,GAAG;AAAA,IAChD;AAAA,EACF;AACF;AAGA,IAAM,aAA2B,4BAA4B;AAgB7D,IAAI,WAAyB;AAoBtB,SAAS,cAAc,MAAiB,UAAyB;AACtE,WAAS,IAAI,SAAS,WAAW,QAAQ,GAAG,KAAK,UAAU,IAAI,CAAC;AAClE;AAEO,SAAS,aAAa,UAAqC;AAChE,QAAM,MAAM,SAAS,IAAI,SAAS,WAAW,QAAQ,CAAC;AACtD,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI;AAIF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,gBAAgB,UAAyB;AACvD,WAAS,OAAO,SAAS,WAAW,QAAQ,CAAC;AAC/C;AAMO,SAAS,iBAAiB,UAAkB,UAAwB;AACzE,aAAW,IAAI,sBAAsB,UAAU,QAAQ;AACzD;AAEO,SAAS,gBAAgB,UAAiC;AAC/D,SAAO,WAAW,IAAI,sBAAsB,QAAQ;AACtD;AAEO,SAAS,mBAAmB,UAAwB;AACzD,aAAW,OAAO,sBAAsB,QAAQ;AAClD;AAMO,SAAS,eAAe,OAAe,UAAyB;AACrE,aAAW,IAAI,SAAS,WAAW,QAAQ,GAAG,KAAK;AACrD;AAEO,SAAS,cAAc,UAAkC;AAC9D,SAAO,WAAW,IAAI,SAAS,WAAW,QAAQ,CAAC;AACrD;AAEO,SAAS,iBAAiB,UAAyB;AACxD,aAAW,OAAO,SAAS,WAAW,QAAQ,CAAC;AACjD;AAMO,SAAS,cAAc,KAAa,UAAyB;AAClE,aAAW,IAAI,SAAS,gBAAgB,QAAQ,GAAG,GAAG;AACxD;AAEO,SAAS,aAAa,UAAkC;AAC7D,SAAO,WAAW,IAAI,SAAS,gBAAgB,QAAQ,CAAC;AAC1D;AAEO,SAAS,gBAAgB,UAAyB;AACvD,aAAW,OAAO,SAAS,gBAAgB,QAAQ,CAAC;AACtD;AAMO,SAAS,gBAAgB,UAAyB;AACvD,MAAI,UAAU;AACZ,oBAAgB,QAAQ;AACxB,qBAAiB,QAAQ;AACzB,oBAAgB,QAAQ;AACxB,uBAAmB,QAAQ;AAE3B,uBAAmB,GAAG,QAAQ,cAAc;AAC5C;AAAA,EACF;AAEA,kBAAgB;AAChB,mBAAiB;AACjB,kBAAgB;AAGhB,QAAM,SAAS,iBAAiB;AAChC,QAAM,SAAS;AAAA,IACb,OAAO,mBAAmB,cAAc,iBAAiB;AAAA,IACzD,OAAO,iBAAiB,cAAc,eAAe;AAAA,EACvD;AACA,aAAW,SAAS,QAAQ;AAC1B,QAAI,CAAC,MAAO;AACZ,UAAM,OAAiB,CAAC;AACxB,aAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,YAAM,MAAM,MAAM,IAAI,CAAC;AACvB,UAAI,KAAK,WAAW,MAAM,EAAG,MAAK,KAAK,GAAG;AAAA,IAC5C;AACA,eAAW,OAAO,MAAM;AACtB,iBAAW,OAAO,IAAI,MAAM,eAAe,MAAM,CAAC;AAClD,YAAM,WAAW,GAAG;AAAA,IACtB;AAAA,EACF;AACF;;;ACzRO,SAAS,mBAAmB,KAAa,eAAgC;AAC9E,MAAI,CAAC,IAAK,QAAO;AACjB,MAAI,IAAI,WAAW,GAAG,KAAK,CAAC,IAAI,WAAW,IAAI,EAAG,QAAO;AACzD,MAAI;AACF,WAAO,IAAI,IAAI,GAAG,EAAE,WAAW;AAAA,EACjC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMO,SAAS,sBAAsB,GAAW,GAAoB;AACnE,QAAM,KAAK,IAAI,YAAY,EAAE,OAAO,CAAC;AACrC,QAAM,KAAK,IAAI,YAAY,EAAE,OAAO,CAAC;AACrC,MAAI,GAAG,WAAW,KAAK,GAAG,WAAW,EAAG,QAAO,GAAG,WAAW,GAAG;AAChE,QAAM,MAAM,KAAK,IAAI,GAAG,QAAQ,GAAG,MAAM;AACzC,MAAI,OAAO,GAAG,SAAS,GAAG;AAC1B,WAAS,IAAI,GAAG,IAAI,KAAK,KAAK;AAC5B,YAAQ,GAAG,IAAI,GAAG,MAAM,IAAI,GAAG,IAAI,GAAG,MAAM;AAAA,EAC9C;AACA,SAAO,SAAS;AAClB;;;ACrBA,IAAM,UACJ,OAAO,WAAW,eAAgB,OAAkB,SAAU,SAAoB;AAEpF,SAAS,YAA2B;AAClC,SAAQ,WAA6B;AACvC;AA4BA,SAAS,gBAAgB,OAA2B;AAClD,QAAM,SAAS,MAAM,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACzD,QAAM,SAAS,OAAO,OAAO,OAAO,UAAW,IAAK,OAAO,SAAS,KAAM,GAAI,GAAG;AACjF,QAAM,SAAS,KAAK,MAAM;AAC1B,QAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,WAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,UAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AAAA,EAChC;AACA,SAAO;AACT;AAGO,SAAS,iBAAiB,OAA+C;AAC9E,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,gBAAgB,MAAM,CAAC,CAAC,CAAC;AAC/D,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,gBAAgB,OAA+C;AAC7E,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,gBAAgB,MAAM,CAAC,CAAC,CAAC;AAC/D,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,gBAAgB,KAAqB;AAC5C,SAAO,IAAI,QAAQ,QAAQ,EAAE;AAC/B;AAQA,IAAI,aAAwE;AAC5E,IAAI,kBAA+F;AACnG,IAAM,oBAAoB,IAAI,KAAK;AAGnC,eAAe,kBAAkB,SAAmD;AAClF,QAAM,MAAM,KAAK,IAAI;AACrB,MAAI,mBAAmB,gBAAgB,YAAY,WAAW,MAAM,gBAAgB,YAAY,mBAAmB;AACjH,WAAO,gBAAgB;AAAA,EACzB;AAEA,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,GAAG,OAAO,6CAA6C;AAC/E,UAAM,MAAM,IAAI,KAAO,MAAM,IAAI,KAAK,IAA0B;AAChE,sBAAkB,EAAE,SAAS,KAAK,WAAW,IAAI;AACjD,WAAO;AAAA,EACT,QAAQ;AACN,sBAAkB,EAAE,SAAS,KAAK,MAAM,WAAW,IAAI;AACvD,WAAO;AAAA,EACT;AACF;AAWA,eAAsB,UAAU,SAAiB,UAA4B,CAAC,GAAyB;AACrG,QAAM,MAAM,KAAK,IAAI;AACrB,MAAI,CAAC,QAAQ,gBAAgB,cAAc,WAAW,YAAY,WAAW,MAAM,WAAW,YAAY,mBAAmB;AAC3H,WAAO,WAAW;AAAA,EACpB;AAEA,QAAM,YAAY,MAAM,kBAAkB,OAAO;AACjD,QAAM,UAAU,WAAW,YAAY,GAAG,OAAO;AAEjD,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,SAAS,QAAQ,eAAe,EAAE,OAAO,WAAW,IAAI,MAAS;AACzF,QAAI,CAAC,IAAI,GAAI,QAAO;AACpB,UAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,iBAAa,EAAE,SAAS,MAAM,WAAW,IAAI;AAC7C,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AASA,eAAsB,qBAAqB,OAAe,KAAgC;AACxF,MAAI;AACF,UAAM,CAAC,WAAW,YAAY,SAAS,IAAI,MAAM,MAAM,GAAG;AAC1D,QAAI,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,IAAI,EAAG,QAAO;AAE3C,UAAM,IAAI,UAAU;AACpB,QAAI,CAAC,EAAG,QAAO;AAEf,UAAM,YAAY,MAAM,EAAE,OAAO;AAAA,MAC/B;AAAA,MACA,EAAE,KAAK,OAAO,GAAG,IAAI,GAAG,GAAG,IAAI,GAAG,KAAK,SAAS,KAAK,MAAM;AAAA,MAC3D,EAAE,MAAM,qBAAqB,MAAM,UAAU;AAAA,MAC7C;AAAA,MACA,CAAC,QAAQ;AAAA,IACX;AAEA,UAAM,iBAAiB,gBAAgB,SAAS;AAChD,UAAM,OAAO,IAAI,YAAY,EAAE,OAAO,GAAG,SAAS,IAAI,UAAU,EAAE;AAClE,WAAO,MAAM,EAAE,OAAO;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAsB,cAAc,aAAsC;AACxE,QAAM,IAAI,UAAU;AACpB,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,OAAO,MAAM,EAAE,OAAO,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,WAAW,CAAC;AACnF,QAAM,QAAQ,IAAI,WAAW,IAAI;AACjC,QAAM,OAAO,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC;AAC5C,MAAI,SAAS;AACb,aAAW,KAAK,MAAM;AACpB,cAAU,OAAO,aAAa,CAAC;AAAA,EACjC;AACA,SAAO,KAAK,MAAM,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC/E;AAGA,eAAsB,gBACpB,SACA,aACA,gBACA,kBACA,UAAkC,CAAC,GACH;AAChC,QAAM,EAAE,gCAAgC,KAAK,IAAI;AAEjD,QAAM,SAAS,gBAAgB,OAAO;AACtC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,SAAS,oBAAoB,mCAAe;AAAA,EACxD;AAEA,QAAM,MAAM,OAAO;AACnB,MAAI,OAAO,QAAQ,YAAa,QAAQ,WAAW,QAAQ,SAAU;AACnE,UAAM,IAAI,SAAS,4BAA4B,+DAAuB,GAAG,EAAE;AAAA,EAC7E;AAEA,QAAM,UAAU,gBAAgB,cAAc;AAE9C,QAAM,YAAY,MAAM,kBAAkB,OAAO;AACjD,QAAM,mBAAmB,gBAAgB,WAAW,UAAU,OAAO;AAGrE,MAAI,QAAQ,SAAS;AACnB,UAAM,OAAO,MAAM,UAAU,OAAO;AACpC,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,SAAS,8BAA8B,kEAA0B;AAAA,IAC7E;AACA,UAAM,MAAM,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM;AAE1D,UAAM,kBAAkB,CAAC,QACvB,IAAI,KAAK;AAAA,MACP,CAAC,MACC,EAAE,QAAQ,SACV,EAAE,QAAQ,WACV,EAAE,QAAQ,UACT,MAAM,EAAE,QAAQ,MAAM;AAAA,IAC3B;AACF,UAAM,YAAY,OAAO,SAAsC;AAC7D,iBAAW,OAAO,MAAM;AACtB,YAAI,MAAM,qBAAqB,SAAS,GAAG,EAAG,QAAO;AAAA,MACvD;AACA,aAAO;AAAA,IACT;AAEA,QAAI,aAAa,gBAAgB,IAAI;AACrC,QAAI,WAAW,WAAW,SAAS,IAAI,MAAM,UAAU,UAAU,IAAI;AAIrE,QAAI,WAAW,WAAW,KAAK,CAAC,UAAU;AACxC,YAAM,YAAY,MAAM,UAAU,SAAS,EAAE,cAAc,KAAK,CAAC;AACjE,UAAI,WAAW;AACb,qBAAa,gBAAgB,SAAS;AACtC,mBAAW,WAAW,SAAS,IAAI,MAAM,UAAU,UAAU,IAAI;AAAA,MACnE;AAAA,IACF;AAEA,QAAI,WAAW,WAAW,GAAG;AAC3B,YAAM,IAAI,SAAS,8BAA8B,oEAAuB;AAAA,IAC1E;AACA,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,SAAS,8BAA8B,+CAAiB;AAAA,IACpE;AAAA,EACF;AAIA,MAAI,QAAQ,SAAS;AACnB,QAAI,+BAA+B;AACjC,YAAM,OAAO,MAAM,UAAU,OAAO;AACpC,YAAM,WAAW,MAAM,MAAM,KAAK,CAAC,MAAM,EAAE,QAAQ,WAAW,EAAE,QAAQ,KAAK;AAC7E,UAAI,UAAU;AACZ,cAAM,IAAI,SAAS,4BAA4B,2EAAmC;AAAA,MACpF;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IAEF;AAAA,EACF;AAEA,QAAM,UAAU,iBAAiB,OAAO;AACxC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,SAAS,oBAAoB,2CAAuB;AAAA,EAChE;AAEA,QAAM,cAAc,OAAO,QAAQ,QAAQ,WAAW,gBAAgB,QAAQ,GAAG,IAAI;AACrF,MAAI,gBAAgB,kBAAkB;AACpC,UAAM,IAAI,SAAS,4BAA4B,oCAAqB;AAAA,EACtE;AAGA,QAAM,MAAM,QAAQ;AACpB,QAAM,UAAU,MAAM,QAAQ,GAAG,IAAI,MAAM,OAAO,QAAQ,WAAW,CAAC,GAAG,IAAI,CAAC;AAC9E,MAAI,CAAC,QAAQ,SAAS,gBAAgB,GAAG;AACvC,UAAM,IAAI,SAAS,8BAA8B,sCAAuB;AAAA,EAC1E;AACA,MAAI,QAAQ,SAAS,KAAK,QAAQ,QAAQ,kBAAkB;AAC1D,UAAM,IAAI,SAAS,8BAA8B,2EAAwC;AAAA,EAC3F;AAGA,MAAI,OAAO,QAAQ,QAAQ,UAAU;AACnC,UAAM,IAAI,SAAS,oBAAoB,wCAAoB;AAAA,EAC7D;AACA,MAAI,KAAK,IAAI,KAAK,QAAQ,MAAM,KAAM;AACpC,UAAM,IAAI,SAAS,oBAAoB,6BAAc;AAAA,EACvD;AAGA,MAAI,OAAO,QAAQ,QAAQ,YAAY,QAAQ,MAAM,MAAO,KAAK,IAAI,IAAI,KAAQ;AAC/E,UAAM,IAAI,SAAS,oBAAoB,6FAA4B;AAAA,EACrE;AAEA,MAAI,OAAO,QAAQ,QAAQ,YAAY,CAAC,QAAQ,KAAK;AACnD,UAAM,IAAI,SAAS,wBAAwB,2BAAiB;AAAA,EAC9D;AAGA,MAAI,OAAO,QAAQ,YAAY,YAAY,QAAQ,SAAS;AAC1D,UAAM,SAAS,MAAM,cAAc,WAAW;AAC9C,QAAI,CAAC,sBAAsB,QAAQ,QAAQ,OAAO,GAAG;AACnD,YAAM,IAAI,SAAS,6BAA6B,qCAAsB;AAAA,IACxE;AAAA,EACF;AAEA,SAAO,EAAE,KAAK,QAAQ,IAAI;AAC5B;;;AC1NO,IAAM,aAAN,MAAM,WAAU;AAAA,EAYrB,YAAY,QAAyB;AAVrC,SAAQ,aAAmC;AAC3C,SAAQ,sBAA8B;AACtC,SAAQ,eAA0C;AAShD,QAAI,CAAC,OAAO,SAAU,OAAM,IAAI,SAAS,kBAAkB,mCAAe;AAC1E,QAAI,CAAC,OAAO,YAAa,OAAM,IAAI,SAAS,kBAAkB,sCAAkB;AAChF,QAAI,CAAC,OAAO,WAAY,OAAM,IAAI,SAAS,kBAAkB,qCAAiB;AAG9E,UAAM,OAAO,OAAO,WAAW,QAAQ,QAAQ,EAAE;AACjD,SAAK,SAAS,EAAE,GAAG,QAAQ,YAAY,KAAK;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAYA,MAAc,gBAA+C;AAC3D,UAAM,MAAM,KAAK,IAAI;AAGrB,QACE,KAAK,cACL,MAAM,KAAK,sBAAsB,WAAU,kBAC3C;AACA,aAAO,KAAK;AAAA,IACd;AAEA,UAAM,MAAM,GAAG,KAAK,OAAO,UAAU;AAErC,QAAI;AACF,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,YAAY;AAAA,QAChB,MAAM,WAAW,MAAM;AAAA,QACvB,WAAU;AAAA,MACZ;AAEA,YAAM,MAAM,MAAM,MAAM,KAAK,EAAE,QAAQ,WAAW,OAAO,CAAC;AAC1D,mBAAa,SAAS;AAEtB,UAAI,CAAC,IAAI,IAAI;AACX,gBAAQ;AAAA,UACN,2DAAuC,IAAI,MAAM;AAAA,QACnD;AACA,eAAO;AAAA,MACT;AAEA,WAAK,aAAc,MAAM,IAAI,KAAK;AAClC,WAAK,sBAAsB;AAC3B,aAAO,KAAK;AAAA,IACd,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,sDAAkC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MACpF;AAEA,aAAO,KAAK,cAAc;AAAA,IAC5B;AAAA,EACF;AAAA;AAAA,EAGA,MAAc,wBAAyC;AACrD,UAAM,IAAI,MAAM,KAAK,cAAc;AACnC,QAAI,EAAG,QAAO,EAAE;AAChB,WAAO,GAAG,KAAK,OAAO,UAAU;AAAA,EAClC;AAAA;AAAA,EAGA,MAAc,oBAAqC;AACjD,UAAM,IAAI,MAAM,KAAK,cAAc;AACnC,QAAI,EAAG,QAAO,EAAE;AAChB,WAAO,GAAG,KAAK,OAAO,UAAU;AAAA,EAClC;AAAA;AAAA,EAGA,MAAc,uBAAwC;AACpD,UAAM,IAAI,MAAM,KAAK,cAAc;AACnC,QAAI,EAAG,QAAO,EAAE;AAChB,WAAO,GAAG,KAAK,OAAO,UAAU;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,wBAAwB,WAAyB;AACvD,QAAI,mBAAmB,WAAW,OAAO,SAAS,MAAM,GAAG;AACzD,oBAAc,SAAS;AAAA,IACzB,OAAO;AACL,cAAQ,KAAK,2FAAoC,SAAS,EAAE;AAAA,IAC9D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAeA,MAAM,MAAM,WAAmC;AAC7C,UAAM,WAAW,qBAAqB;AACtC,UAAM,YAAY,MAAM,sBAAsB,QAAQ;AACtD,UAAM,QAAQ,cAAc;AAG5B,qBAAiB,KAAK,OAAO,UAAU,QAAQ;AAC/C,mBAAe,OAAO,KAAK,OAAO,QAAQ;AAE1C,QAAI,WAAW;AACb,WAAK,wBAAwB,SAAS;AAAA,IACxC;AAGA,UAAM,oBAAoB,MAAM,KAAK,sBAAsB;AAC3D,UAAM,SAAS,IAAI,gBAAgB;AACnC,WAAO,IAAI,iBAAiB,MAAM;AAClC,WAAO,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC5C,WAAO,IAAI,gBAAgB,KAAK,OAAO,WAAW;AAClD,WAAO,IAAI,SAAS,KAAK,OAAO,UAAU,gBAAgB;AAC1D,WAAO,IAAI,SAAS,KAAK;AACzB,WAAO,IAAI,kBAAkB,SAAS;AACtC,WAAO,IAAI,yBAAyB,MAAM;AAG1C,WAAO,SAAS,OAAO,GAAG,iBAAiB,IAAI,OAAO,SAAS,CAAC;AAAA,EAClE;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,YAAY,WAAqC;AACrD,UAAM,WAAW,qBAAqB;AACtC,UAAM,YAAY,MAAM,sBAAsB,QAAQ;AACtD,UAAM,QAAQ,cAAc;AAE5B,qBAAiB,KAAK,OAAO,UAAU,QAAQ;AAC/C,mBAAe,OAAO,KAAK,OAAO,QAAQ;AAE1C,QAAI,UAAW,MAAK,wBAAwB,SAAS;AAErD,UAAM,oBAAoB,MAAM,KAAK,sBAAsB;AAC3D,UAAM,SAAS,IAAI,gBAAgB;AACnC,WAAO,IAAI,iBAAiB,MAAM;AAClC,WAAO,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC5C,WAAO,IAAI,gBAAgB,KAAK,OAAO,WAAW;AAClD,WAAO,IAAI,SAAS,KAAK,OAAO,UAAU,gBAAgB;AAC1D,WAAO,IAAI,SAAS,KAAK;AACzB,WAAO,IAAI,kBAAkB,SAAS;AACtC,WAAO,IAAI,yBAAyB,MAAM;AAE1C,WAAO,GAAG,iBAAiB,IAAI,OAAO,SAAS,CAAC;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAmCA,MAAM,WACJ,UAAmE,CAAC,GAChD;AACpB,UAAM,WAAW,qBAAqB;AACtC,UAAM,YAAY,MAAM,sBAAsB,QAAQ;AACtD,UAAM,QAAQ,cAAc;AAC5B,UAAM,aAAa,cAAc;AAEjC,qBAAiB,KAAK,OAAO,UAAU,QAAQ;AAC/C,mBAAe,OAAO,KAAK,OAAO,QAAQ;AAE1C,qBAAiB,GAAG,KAAK,OAAO,QAAQ,gBAAgB,UAAU;AAElE,QAAI,QAAQ,WAAW;AACrB,WAAK,wBAAwB,QAAQ,SAAS;AAAA,IAChD;AAEA,UAAM,oBAAoB,MAAM,KAAK,sBAAsB;AAC3D,UAAM,SAAS,IAAI,gBAAgB;AACnC,WAAO,IAAI,iBAAiB,MAAM;AAClC,WAAO,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC5C,WAAO,IAAI,gBAAgB,KAAK,OAAO,WAAW;AAClD,WAAO,IAAI,SAAS,KAAK,OAAO,UAAU,gBAAgB;AAC1D,WAAO,IAAI,SAAS,KAAK;AACzB,WAAO,IAAI,kBAAkB,SAAS;AACtC,WAAO,IAAI,yBAAyB,MAAM;AAE1C,WAAO,IAAI,eAAe,UAAU;AAEpC,UAAM,QAAQ,QAAQ,SAAS;AAC/B,UAAM,SAAS,QAAQ,UAAU;AACjC,UAAM,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,QAAQ,SAAS,CAAC;AAC1D,UAAM,MAAM,KAAK,IAAI,IAAI,OAAO,OAAO,SAAS,UAAU,CAAC;AAE3D,UAAM,gBAAgB;AAAA,MACpB,SAAS,KAAK;AAAA,MACd,UAAU,MAAM;AAAA,MAChB,QAAQ,KAAK,MAAM,IAAI,CAAC;AAAA,MACxB,OAAO,KAAK,MAAM,GAAG,CAAC;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,GAAG;AAEV,UAAM,QAAQ,OAAO;AAAA,MACnB,GAAG,iBAAiB,IAAI,OAAO,SAAS,CAAC;AAAA,MACzC;AAAA,MACA;AAAA,IACF;AAEA,QAAI,CAAC,OAAO;AACV,yBAAmB,KAAK,OAAO,QAAQ;AACvC,uBAAiB,KAAK,OAAO,QAAQ;AACrC,yBAAmB,GAAG,KAAK,OAAO,QAAQ,cAAc;AACxD,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAGA,UAAM,oBAAoB,IAAI,IAAI,KAAK,OAAO,WAAW,EAAE;AAE3D,QAAI;AAEF,YAAM,MAAM;AAEZ,aAAO,MAAM,IAAI,QAAmB,CAAC,SAAS,WAAW;AACvD,YAAI,YAAY;AAEhB,cAAM,gBAAgB,CAAC,UAAwB;AAC7C,cAAI,UAAW;AAEf,cAAI,MAAM,WAAW,kBAAmB;AACxC,cAAI,CAAC,MAAM,QAAQ,MAAM,KAAK,SAAS,6BAA8B;AACrE,cAAI,CAAC,MAAM,KAAK,YAAa;AAG7B,gBAAM,aAAa,gBAAgB,GAAG,KAAK,OAAO,QAAQ,cAAc;AACxE,cAAI,CAAC,cAAc,CAAC,sBAAsB,MAAM,KAAK,SAAS,IAAI,UAAU,EAAG;AAC/E,6BAAmB,GAAG,KAAK,OAAO,QAAQ,cAAc;AAExD,sBAAY;AACZ,kBAAQ;AAER,cAAI,SAAS,CAAC,MAAM,QAAQ;AAC1B,kBAAM,MAAM;AAAA,UACd;AAEA,eAAK,eAAe,MAAM,KAAK,WAAW,EACvC,KAAK,OAAO,EACZ,MAAM,MAAM;AAAA,QACjB;AAEA,cAAM,YAAY,YAAY,MAAM;AAClC,cAAI,MAAM,QAAQ;AAChB,gBAAI,CAAC,WAAW;AACd,0BAAY;AACZ,sBAAQ;AACR;AAAA,gBACE,IAAI;AAAA,kBACF;AAAA,kBACA;AAAA,gBACF;AAAA,cACF;AAAA,YACF;AAAA,UACF;AAAA,QACF,GAAG,GAAG;AAEN,cAAM,UAAU,MAAM;AACpB,wBAAc,SAAS;AACvB,iBAAO,oBAAoB,WAAW,aAAa;AACnD,6BAAmB,GAAG,KAAK,OAAO,QAAQ,cAAc;AAAA,QAC1D;AAEA,eAAO,iBAAiB,WAAW,aAAa;AAAA,MAClD,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,yBAAmB,KAAK,OAAO,QAAQ;AACvC,uBAAiB,KAAK,OAAO,QAAQ;AACrC,yBAAmB,GAAG,KAAK,OAAO,QAAQ,cAAc;AACxD,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,MAAM,eACJ,aACoB;AACpB,UAAM,MAAM,IAAI,IAAI,WAAW;AAC/B,UAAM,SAAS,IAAI;AAGnB,UAAM,QAAQ,OAAO,IAAI,OAAO;AAChC,QAAI,OAAO;AACT,YAAM,OAAO,OAAO,IAAI,mBAAmB,KAAK;AAChD,YAAM,IAAI,SAAS,wBAAwB,6BAAS,IAAI,EAAE;AAAA,IAC5D;AAEA,UAAM,OAAO,OAAO,IAAI,MAAM;AAC9B,UAAM,gBAAgB,OAAO,IAAI,OAAO;AAExC,QAAI,CAAC,MAAM;AACT,YAAM,IAAI,SAAS,wBAAwB,wDAA+B;AAAA,IAC5E;AAGA,UAAM,aAAa,cAAc,KAAK,OAAO,QAAQ;AACrD,QAAI,CAAC,cAAc,CAAC,sBAAsB,YAAY,iBAAiB,EAAE,GAAG;AAE1E,uBAAiB,KAAK,OAAO,QAAQ;AACrC,yBAAmB,KAAK,OAAO,QAAQ;AACvC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAGA,UAAM,WAAW,gBAAgB,KAAK,OAAO,QAAQ;AACrD,QAAI,CAAC,UAAU;AACb,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAGA,UAAM,gBAAgB,MAAM,KAAK,kBAAkB;AACnD,UAAM,OAAO,IAAI,gBAAgB;AACjC,SAAK,IAAI,cAAc,oBAAoB;AAC3C,SAAK,IAAI,QAAQ,IAAI;AACrB,SAAK,IAAI,iBAAiB,QAAQ;AAClC,SAAK,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC1C,SAAK,IAAI,gBAAgB,KAAK,OAAO,WAAW;AAChD,QAAI,KAAK,OAAO,cAAc;AAC5B,WAAK,IAAI,iBAAiB,KAAK,OAAO,YAAY;AAAA,IACpD;AAEA,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,MAAM,eAAe;AAAA,QAC/B,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,QAC/D,MAAM,KAAK,SAAS;AAAA,MACtB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,IAAI,SAAS,iBAAiB,wCAAU,GAAG;AAAA,IACnD;AAEA,QAAI,CAAC,IAAI,IAAI;AACX,UAAI,UAAmC,CAAC;AACxC,UAAI;AAAE,kBAAU,MAAM,IAAI,KAAK;AAAA,MAAG,QAAQ;AAAA,MAAe;AACzD,YAAM,cAAe,QAAQ,SAAoB;AACjD,YAAM,IAAI;AAAA,QACR,uBAAuB,WAAW;AAAA,QACjC,QAAQ,qBAAgC,wCAAoB,IAAI,MAAM;AAAA,MACzE;AAAA,IACF;AAIA,UAAM,OAAsB,MAAM,IAAI,KAAK;AAG3C,qBAAiB,KAAK,OAAO,QAAQ;AACrC,uBAAmB,KAAK,OAAO,QAAQ;AAGvC,QAAI,KAAK,UAAU;AACjB,UAAI;AACF,cAAM;AAAA,UACJ,KAAK;AAAA,UACL,KAAK;AAAA,UACL,KAAK,OAAO;AAAA,UACZ,KAAK,OAAO;AAAA,QACd;AAAA,MACF,SAAS,KAAK;AAEZ,wBAAgB,KAAK,OAAO,QAAQ;AACpC,cAAM;AAAA,MACR;AAAA,IACF;AAEA,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,YAAuB;AAAA,MAC3B,cAAc,KAAK;AAAA,MACnB,YAAY,KAAK;AAAA,MACjB,YAAY,KAAK;AAAA,MACjB,eAAe,KAAK;AAAA,MACpB,UAAU,KAAK;AAAA,MACf,WAAW;AAAA,MACX,YAAY,MAAM,KAAK,aAAa;AAAA,IACtC;AAEA,kBAAc,WAAW,KAAK,OAAO,QAAQ;AAC7C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAM,eAAmC;AAEvC,QAAI,KAAK,aAAc,QAAO,KAAK;AAEnC,SAAK,eAAe,KAAK,gBAAgB;AACzC,QAAI;AACF,aAAO,MAAM,KAAK;AAAA,IACpB,UAAE;AACA,WAAK,eAAe;AAAA,IACtB;AAAA,EACF;AAAA,EAEA,MAAc,kBAAsC;AAClD,UAAM,UAAU,aAAa,KAAK,OAAO,QAAQ;AACjD,QAAI,CAAC,SAAS,eAAe;AAC3B,YAAM,IAAI,SAAS,oBAAoB,8CAAqB;AAAA,IAC9D;AAEA,UAAM,gBAAgB,MAAM,KAAK,kBAAkB;AACnD,UAAM,OAAO,IAAI,gBAAgB;AACjC,SAAK,IAAI,cAAc,eAAe;AACtC,SAAK,IAAI,iBAAiB,QAAQ,aAAa;AAC/C,SAAK,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC1C,QAAI,KAAK,OAAO,cAAc;AAC5B,WAAK,IAAI,iBAAiB,KAAK,OAAO,YAAY;AAAA,IACpD;AAEA,QAAI,MAAuB;AAC3B,QAAI;AACJ,aAAS,UAAU,GAAG,UAAU,GAAG,WAAW;AAC5C,UAAI;AACF,cAAM,MAAM,MAAM,eAAe;AAAA,UAC/B,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,UAC/D,MAAM,KAAK,SAAS;AAAA,QACtB,CAAC;AACD,kBAAU;AACV;AAAA,MACF,SAAS,KAAK;AACZ,kBAAU;AACV,YAAI,UAAU,EAAG,OAAM,IAAI,QAAQ,CAAC,MAAM,WAAW,GAAG,GAAI,CAAC;AAAA,MAC/D;AAAA,IACF;AACA,QAAI,WAAW,CAAC,KAAK;AACnB,YAAM,IAAI,SAAS,iBAAiB,2DAAmB,OAAO;AAAA,IAChE;AAEA,QAAI,CAAC,IAAI,IAAI;AACX,UAAI,UAAmC,CAAC;AACxC,UAAI;AAAE,kBAAU,MAAM,IAAI,KAAK;AAAA,MAAG,QAAQ;AAAA,MAAe;AACzD,YAAM,YAAa,QAAQ,SAAoB;AAE/C,UAAI,cAAc,mBAAmB,IAAI,WAAW,KAAK;AACvD,wBAAgB,KAAK,OAAO,QAAQ;AAAA,MACtC;AACA,YAAM,IAAI;AAAA,QACR,uBAAuB,WAAW,SAAS;AAAA,QAC1C,QAAQ,qBAAgC,yCAAqB,IAAI,MAAM;AAAA,MAC1E;AAAA,IACF;AAEA,UAAM,OAAsB,MAAM,IAAI,KAAK;AAE3C,QAAI,KAAK,UAAU;AACjB,UAAI;AACF,cAAM;AAAA,UACJ,KAAK;AAAA,UACL,KAAK;AAAA,UACL,KAAK,OAAO;AAAA,UACZ,KAAK,OAAO;AAAA,QACd;AAAA,MACF,SAAS,KAAK;AACZ,wBAAgB,KAAK,OAAO,QAAQ;AACpC,cAAM;AAAA,MACR;AAAA,IACF;AAEA,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,YAAuB;AAAA,MAC3B,cAAc,KAAK;AAAA,MACnB,YAAY,KAAK;AAAA,MACjB,YAAY,KAAK;AAAA;AAAA,MAEjB,eAAe,KAAK,iBAAiB,QAAQ;AAAA,MAC7C,UAAU,KAAK;AAAA,MACf,WAAW;AAAA,MACX,YAAY,MAAM,KAAK,aAAa;AAAA,IACtC;AAEA,kBAAc,WAAW,KAAK,OAAO,QAAQ;AAC7C,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,cAAgC;AACpC,QAAI,YAAY,aAAa,KAAK,OAAO,QAAQ;AAEjD,QAAI,CAAC,WAAW;AACd,YAAM,IAAI,SAAS,qBAAqB,oBAAK;AAAA,IAC/C;AAGA,QAAI,KAAK,IAAI,KAAK,UAAU,YAAY;AACtC,kBAAY,MAAM,KAAK,aAAa;AAAA,IACtC;AAEA,UAAM,mBAAmB,MAAM,KAAK,qBAAqB;AAEzD,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,MAAM,kBAAkB;AAAA,QAClC,SAAS;AAAA,UACP,eAAe,UAAU,UAAU,YAAY;AAAA,QACjD;AAAA,MACF,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,IAAI,SAAS,iBAAiB,4EAAgB,GAAG;AAAA,IACzD;AAEA,QAAI,CAAC,IAAI,IAAI;AACX,UAAI,IAAI,WAAW,KAAK;AACtB,wBAAgB,KAAK,OAAO,QAAQ;AACpC,cAAM,IAAI,SAAS,qBAAqB,0BAAW;AAAA,MACrD;AACA,YAAM,IAAI;AAAA,QACR;AAAA,QACA,0DAAkB,IAAI,MAAM;AAAA,MAC9B;AAAA,IACF;AAEA,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,iBAAyC;AAC7C,QAAI,YAAY,aAAa,KAAK,OAAO,QAAQ;AACjD,QAAI,CAAC,UAAW,QAAO;AAEvB,QAAI,KAAK,IAAI,KAAK,UAAU,YAAY;AACtC,kBAAY,MAAM,KAAK,aAAa;AAAA,IACtC;AAEA,WAAO,UAAU;AAAA,EACnB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,kBAA2B;AACzB,UAAM,YAAY,aAAa,KAAK,OAAO,QAAQ;AACnD,QAAI,CAAC,UAAW,QAAO;AACvB,WAAO,KAAK,IAAI,IAAI,UAAU;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAO,gBAAyB,OAAsB;AAE1D,UAAM,YAAY,aAAa,KAAK,OAAO,QAAQ;AACnD,UAAM,eAAe,WAAW;AAChC,UAAM,cAAc,WAAW;AAE/B,oBAAgB,KAAK,OAAO,QAAQ;AAIpC,QAAI,gBAAgB,KAAK,OAAO,UAAU;AACxC,UAAI;AACF,cAAM,YAAY,MAAM,KAAK,cAAc;AAC3C,cAAM,YACJ,WAAW,uBACX,GAAG,KAAK,OAAO,UAAU;AAC3B,cAAM,aAAa,IAAI,gBAAgB;AAAA,UACrC,OAAO;AAAA,UACP,iBAAiB;AAAA,UACjB,WAAW,KAAK,OAAO;AAAA,QACzB,CAAC;AACD,YAAI,KAAK,OAAO,cAAc;AAC5B,qBAAW,IAAI,iBAAiB,KAAK,OAAO,YAAY;AAAA,QAC1D;AACA,cAAM,MAAM,WAAW;AAAA,UACrB,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,UAC/D,MAAM,WAAW,SAAS;AAAA,QAC5B,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,QAAI,eAAe;AAEjB,YAAM,YAAY,MAAM,KAAK,cAAc;AAC3C,YAAM,qBACJ,WAAW,wBAAwB,GAAG,KAAK,OAAO,UAAU;AAC9D,YAAM,YAAY,IAAI,IAAI,kBAAkB;AAC5C,gBAAU,aAAa,IAAI,aAAa,KAAK,OAAO,QAAQ;AAC5D,YAAM,gBAAgB,KAAK,OAAO,yBAAyB,KAAK,OAAO;AACvE,UAAI,eAAe;AACjB,kBAAU,aAAa;AAAA,UACrB;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,UAAI,aAAa;AACf,kBAAU,aAAa,IAAI,iBAAiB,WAAW;AAAA,MACzD;AACA,YAAM,QAAQ,cAAc;AAC5B,gBAAU,aAAa,IAAI,SAAS,KAAK;AACzC,aAAO,SAAS,OAAO,UAAU,SAAS;AAAA,IAC5C;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,eAA8C;AAClD,WAAO,KAAK,cAAc;AAAA,EAC5B;AACF;AAAA;AA5rBa,WAOa,mBAAmB,IAAI,KAAK;AAAA;AAPzC,WAUa,uBAAuB;AAV1C,IAAM,YAAN;;;AN/CP,IAAM,iBAAa,4BAAsC,IAAI;AA4B7D,IAAM,sBAAsB;AAC5B,IAAM,cAAc;AAGpB,IAAM,aAAa,oBAAI,IAAoB;AAE3C,SAAS,QAAQ,UAA0B;AACzC,SAAO,sBAAsB;AAC/B;AAUA,SAAS,mBAAmB,UAA2B;AACrD,MAAI,OAAO,iBAAiB,YAAa,QAAO;AAChD,QAAM,MAAM,QAAQ,QAAQ;AAC5B,QAAM,MAAM,KAAK,IAAI;AACrB,QAAM,MAAM,aAAa,QAAQ,GAAG;AACpC,MAAI,KAAK;AACP,UAAM,KAAK,SAAS,KAAK,EAAE;AAC3B,QAAI,CAAC,MAAM,EAAE,KAAK,MAAM,KAAK,aAAa;AACxC,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,QAAQ,GAAG,GAAG,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,CAAC,CAAC;AAC3D,eAAa,QAAQ,KAAK,KAAK;AAE/B,MAAI,aAAa,QAAQ,GAAG,MAAM,MAAO,QAAO;AAChD,aAAW,IAAI,UAAU,KAAK;AAC9B,SAAO;AACT;AAEA,SAAS,mBAAmB,UAAwB;AAClD,MAAI,OAAO,iBAAiB,YAAa;AACzC,QAAM,QAAQ,WAAW,IAAI,QAAQ;AACrC,aAAW,OAAO,QAAQ;AAE1B,MAAI,SAAS,aAAa,QAAQ,QAAQ,QAAQ,CAAC,MAAM,OAAO;AAC9D,iBAAa,WAAW,QAAQ,QAAQ,CAAC;AAAA,EAC3C;AACF;AAeA,eAAsB,gBAAgB,UAAkB,MAA6C;AACnG,MACE,OAAO,cAAc,eACrB,OAAO,UAAU,OAAO,YAAY,YACpC;AACA,QAAI;AACF,UAAI,MAAM;AACV,YAAM,UAAU,MAAM;AAAA,QACpB,uBAAuB,QAAQ;AAAA,QAC/B,EAAE,aAAa,KAAK;AAAA,QACpB,OAAO,SAAS;AACd,cAAI,CAAC,KAAM;AACX,gBAAM;AACN,gBAAM,KAAK;AAAA,QACb;AAAA,MACF;AACA,aAAO;AAAA,IACT,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,MAAI,CAAC,mBAAmB,QAAQ,EAAG,QAAO;AAC1C,MAAI;AACF,UAAM,KAAK;AACX,WAAO;AAAA,EACT,UAAE;AACA,uBAAmB,QAAQ;AAAA,EAC7B;AACF;AAMO,SAAS,YAAY;AAAA,EAC1B;AAAA,EACA;AAAA,EACA,mBAAmB;AAAA,EACnB;AACF,GAAqB;AACnB,QAAM,CAAC,MAAM,OAAO,QAAI,uBAAyB,IAAI;AACrD,QAAM,CAAC,WAAW,YAAY,QAAI,uBAAS,IAAI;AAC/C,QAAM,CAAC,iBAAiB,kBAAkB,QAAI,uBAAS,KAAK;AAE5D,QAAM,CAAC,MAAM,QAAI,uBAAS,MAAM,IAAI,UAAU,MAAM,CAAC;AACrD,QAAM,sBAAkB,qBAA6C,IAAI;AACzE,QAAM,gBAAY,qBAAO,KAAK;AAG9B,QAAM,eAAW,0BAAY,YAAY;AAIvC,UAAM,YAAY,aAAa,OAAO,OAAO,QAAQ;AACrD,QAAI,CAAC,WAAW;AACd,cAAQ,IAAI;AACZ,yBAAmB,KAAK;AACxB,mBAAa,KAAK;AAClB;AAAA,IACF;AAEA,QAAI;AACF,YAAM,IAAI,MAAM,OAAO,YAAY;AACnC,cAAQ,CAAC;AACT,yBAAmB,IAAI;AAAA,IACzB,QAAQ;AACN,cAAQ,IAAI;AACZ,yBAAmB,KAAK;AACxB,sBAAgB,OAAO,OAAO,QAAQ;AAAA,IACxC,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF,GAAG,CAAC,MAAM,CAAC;AAGX,8BAAU,MAAM;AACd,QAAI,UAAU,QAAS;AACvB,cAAU,UAAU;AAEpB,YAAQ,QAAQ,EAAE,KAAK,MAAM;AAE3B,UAAI,aAAa,OAAO,OAAO,QAAQ,GAAG;AACxC,iBAAS;AAAA,MACX,OAAO;AACL,qBAAa,KAAK;AAAA,MACpB;AAAA,IACF,CAAC;AAAA,EACH,GAAG,CAAC,QAAQ,QAAQ,CAAC;AAGrB,8BAAU,MAAM;AACd,QAAI,SAAS;AAIb,UAAM,iBAAiB,MACrB,gBAAgB,OAAO,OAAO,UAAU,YAAY;AAClD,UAAI;AACF,cAAM,KAAK,MAAM,OAAO,aAAa;AACrC,2BAAmB,GAAG,YAAY;AAClC,iBAAS;AAAA,MACX,QAAQ;AACN,mBAAW,MAAM,SAAS,GAAG,GAAG;AAAA,MAClC;AAAA,IACF,CAAC;AAEH,UAAM,sBAAsB,MAAM;AAChC,UAAI,CAAC,OAAQ;AAGb,UAAI,gBAAgB,SAAS;AAC3B,qBAAa,gBAAgB,OAAO;AACpC,wBAAgB,UAAU;AAAA,MAC5B;AAEA,YAAM,YAAY,aAAa,OAAO,OAAO,QAAQ;AACrD,UAAI,CAAC,UAAW;AAGhB,YAAM,gBAAgB,UAAU,aAAa,KAAK,IAAI,KAAK;AAE3D,UAAI,gBAAgB,GAAG;AAErB,aAAK,eAAe;AACpB;AAAA,MACF;AAEA,UAAI,gBAAgB,kBAAkB;AAEpC,aAAK,eAAe;AACpB;AAAA,MACF;AAGA,YAAM,WAAW,eAAe,oBAAoB;AAEpD,sBAAgB,UAAU,WAAW,MAAM;AACzC,YAAI,CAAC,OAAQ;AACb,cAAM,KAAK,aAAa,OAAO,OAAO,QAAQ;AAC9C,YAAI,CAAC,GAAI;AAET,cAAM,WAAW,GAAG,aAAa,KAAK,IAAI,KAAK;AAC/C,YAAI,WAAW,kBAAkB;AAC/B,eAAK,eAAe,EAAE,KAAK,CAAC,eAAe;AAEzC,gBAAI,WAAY,qBAAoB;AAAA,UACtC,CAAC;AAAA,QACH;AAAA,MACF,GAAG,KAAK,IAAI,SAAS,GAAI,CAAC;AAAA,IAC5B;AAEA,wBAAoB;AAEpB,WAAO,MAAM;AACX,eAAS;AACT,UAAI,gBAAgB,SAAS;AAC3B,qBAAa,gBAAgB,OAAO;AACpC,wBAAgB,UAAU;AAAA,MAC5B;AAAA,IACF;AAAA,EACF,GAAG,CAAC,QAAQ,UAAU,kBAAkB,gBAAgB,CAAC;AAGzD,8BAAU,MAAM;AACd,UAAM,sBAAsB,CAAC,MAAoB;AAC/C,UACE,EAAE,OACF,EAAE,IAAI,WAAW,cAAc,KAC/B,CAAC,EAAE,IAAI,WAAW,mBAAmB,GACrC;AACA,iBAAS;AAAA,MACX;AAAA,IACF;AAEA,WAAO,iBAAiB,WAAW,mBAAmB;AACtD,WAAO,MAAM,OAAO,oBAAoB,WAAW,mBAAmB;AAAA,EACxE,GAAG,CAAC,QAAQ,CAAC;AAGb,QAAM,YAAQ;AAAA,IACZ,OAAO,cAAuB;AAC5B,YAAM,OAAO,MAAM,SAAS;AAAA,IAC9B;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AAGA,QAAM,iBAAa;AAAA,IACjB,OAAO,YAAsE;AAC3E,YAAM,YAAY,MAAM,OAAO,WAAW,OAAO;AACjD,YAAM,SAAS;AACf,aAAO;AAAA,IACT;AAAA,IACA,CAAC,QAAQ,QAAQ;AAAA,EACnB;AAGA,QAAM,aAAS;AAAA,IACb,OAAO,gBAAyB,UAAU;AACxC,YAAM,OAAO,OAAO,aAAa;AACjC,cAAQ,IAAI;AACZ,yBAAmB,KAAK;AAAA,IAC1B;AAAA,IACA,CAAC,MAAM;AAAA,EACT;AAGA,QAAM,kBAAc,0BAAY,YAAY;AAC1C,UAAM,SAAS;AAAA,EACjB,GAAG,CAAC,QAAQ,CAAC;AAGb,QAAM,qBAAiB,0BAAY,YAAoC;AACrE,WAAO,OAAO,eAAe;AAAA,EAC/B,GAAG,CAAC,MAAM,CAAC;AAEX,QAAM,QAAyB;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,SAAO,aAAAA,QAAM,cAAc,WAAW,UAAU,EAAE,MAAM,GAAG,QAAQ;AACrE;AAoBO,SAAS,SAA0B;AACxC,QAAM,UAAM,yBAAW,UAAU;AACjC,MAAI,CAAC,KAAK;AACR,UAAM,IAAI,MAAM,oEAAiC;AAAA,EACnD;AACA,SAAO;AACT;;;AOxYA,IAAAC,gBAA6D;AAsCtD,SAAS,YAAY;AAAA,EAC1B;AAAA,EACA;AAAA,EACA,YAAY;AAAA,EACZ,WAAW;AACb,GAAqB;AACnB,QAAM,EAAE,iBAAiB,WAAW,OAAO,WAAW,IAAI,OAAO;AACjE,QAAM,wBAAoB,sBAAO,KAAK;AAEtC,+BAAU,MAAM;AACd,QAAI,CAAC,aAAa,CAAC,mBAAmB,aAAa,CAAC,kBAAkB,SAAS;AAC7E,wBAAkB,UAAU;AAC5B,YAAM,cAAc,OAAO,SAAS,WAAW,OAAO,SAAS;AAE/D,UAAI,UAAU;AACZ,mBAAW,EAAE,WAAW,YAAY,CAAC,EAAE,MAAM,CAAC,QAAQ;AAEpD,cAAK,IAA0B,SAAS,iBAAiB;AACvD,kBAAM,WAAW;AAAA,UACnB;AAAA,QACF,CAAC;AAAA,MACH,OAAO;AACL,cAAM,WAAW;AAAA,MACnB;AAAA,IACF;AAAA,EACF,GAAG,CAAC,WAAW,iBAAiB,WAAW,UAAU,OAAO,UAAU,CAAC;AAEvE,MAAI,WAAW;AACb,WACE,YAAY,cAAAC,QAAM,cAAc,OAAO,MAAM,qDAAa;AAAA,EAE9D;AAEA,MAAI,CAAC,iBAAiB;AACpB,QAAI,SAAU,QAAO,cAAAA,QAAM,cAAc,cAAAA,QAAM,UAAU,MAAM,QAAQ;AACvE,WAAO,cAAAA,QAAM,cAAc,OAAO,MAAM,0BAAM;AAAA,EAChD;AAEA,SAAO,cAAAA,QAAM,cAAc,cAAAA,QAAM,UAAU,MAAM,QAAQ;AAC3D;AAeO,SAAS,SACd,WACkB;AAClB,QAAM,cACJ,UAAU,eAAe,UAAU,QAAQ;AAE7C,WAAS,iBAAiB,OAAU;AAClC,WAAO,cAAAA,QAAM;AAAA,MACX;AAAA,MACA;AAAA,MACA,cAAAA,QAAM,cAAc,WAAW,KAAK;AAAA,IACtC;AAAA,EACF;AAEA,mBAAiB,cAAc,YAAY,WAAW;AACtD,SAAO;AACT;;;ACpGA,IAAAC,gBAA2C;AAMpC,SAAS,eAAe;AAC7B,QAAM,EAAE,QAAQ,YAAY,IAAI,OAAO;AACvC,QAAM,CAAC,OAAO,QAAQ,QAAI,wBAAwB,IAAI;AACtD,QAAM,CAAC,YAAY,aAAa,QAAI,wBAAS,IAAI;AAEjD,+BAAU,MAAM;AAEd,QAAI,OAAO,UAAU,CAAC,OAAO,OAAO,QAAQ;AAC1C,YAAM,QAAQ,IAAI,IAAI,OAAO,SAAS,IAAI,EAAE,aAAa,IAAI,aAAa;AAE1E,UAAI,eAAe,OAAO,SAAS;AACnC,UAAI;AACF,uBAAe,OAAO,OAAO,SAAS;AAAA,MACxC,QAAQ;AAAA,MAER;AACA,aAAO,OAAO;AAAA,QACZ,EAAE,MAAM,8BAA8B,aAAa,OAAO,SAAS,MAAM,OAAO,SAAS,OAAU;AAAA,QACnG;AAAA,MACF;AAEA,cAAQ,QAAQ,EAAE,KAAK,MAAM,cAAc,KAAK,CAAC;AACjD;AAAA,IACF;AAEA,QAAI,YAAY;AAEhB,mBAAe,iBAAiB;AAC9B,UAAI;AACF,cAAM,OAAO,eAAe,OAAO,SAAS,IAAI;AAEhD,YAAI,UAAW;AAGf,cAAM,YAAY;AAGlB,cAAM,YAAY,aAAa;AAC/B,wBAAgB;AAChB,eAAO,SAAS,OACd,aAAa,mBAAmB,WAAW,OAAO,SAAS,MAAM,IAC7D,YACA;AAAA,MACR,SAAS,KAAK;AACZ,YAAI,UAAW;AACf,YAAI,eAAe,UAAU;AAE3B,mBAAS,IAAI,eAAe,qBAAW,IAAI,IAAI,GAAG;AAAA,QACpD,WAAW,eAAe,aAAa,IAAI,QAAQ,SAAS,OAAO,GAAG;AAEpE,mBAAS,4FAAiB;AAAA,QAC5B,WAAW,eAAe,OAAO;AAC/B,mBAAS,qDAAa,IAAI,OAAO,EAAE;AAAA,QACrC,OAAO;AACL,mBAAS,0EAAc;AAAA,QACzB;AACA,sBAAc,KAAK;AAAA,MACrB;AAAA,IACF;AAEA,mBAAe;AAEf,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAM;AAAA,EACnC,GAAG,CAAC,QAAQ,WAAW,CAAC;AAExB,MAAI,OAAO;AACT,WAAO,cAAAC,QAAM;AAAA,MACX;AAAA,MACA;AAAA,QACE,OAAO;AAAA,UACL,SAAS;AAAA,UACT,eAAe;AAAA,UACf,YAAY;AAAA,UACZ,gBAAgB;AAAA,UAChB,WAAW;AAAA,UACX,YAAY;AAAA,QACd;AAAA,MACF;AAAA,MACA,cAAAA,QAAM;AAAA,QACJ;AAAA,QACA,EAAE,OAAO,EAAE,OAAO,WAAW,cAAc,OAAO,EAAE;AAAA,QACpD;AAAA,MACF;AAAA,MACA,cAAAA,QAAM;AAAA,QACJ;AAAA,QACA,EAAE,MAAM,KAAK,OAAO,EAAE,OAAO,WAAW,gBAAgB,YAAY,EAAE;AAAA,QACtE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,MAAI,YAAY;AACd,WAAO,cAAAA,QAAM;AAAA,MACX;AAAA,MACA;AAAA,QACE,OAAO;AAAA,UACL,SAAS;AAAA,UACT,YAAY;AAAA,UACZ,gBAAgB;AAAA,UAChB,WAAW;AAAA,UACX,YAAY;AAAA,QACd;AAAA,MACF;AAAA,MACA,cAAAA,QAAM,cAAc,KAAK,MAAM,qDAAa;AAAA,IAC9C;AAAA,EACF;AAEA,SAAO;AACT;","names":["React","import_react","React","import_react","React"]}