@ofidj/entry 3.10.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2024 fidj
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,66 @@
+# @ofidj/entry
+
+The Fidj entry, as a package: the sign-in and account screens, the service
+agreement, the provider window and the design system. One implementation, shared
+by Fidj's own console, every generated app and mleweb.
+
+Read the [workspace README](../README.md) for the product target and
+[AGENTS.md](../AGENTS.md) for the working rules. The flow these screens
+implement is [Entry: one flow, the same everywhere](../README.md#entry-one-flow-the-same-everywhere).
+
+## Why it exists
+
+These files used to live only in `generator-fidj`'s template, which meant the
+only way to ship them was to generate an app. Fidj's own console was therefore
+generated too — `fidj-app` built as a module, wrapped by the generator, published
+from `.gen/fidj/www` — and you could not tell from `fidj-app/src` what
+`fidj.ovh` actually draws. The alternative, keeping a second Angular copy in
+step by hand, is what produced four unguarded copies of the service agreement.
+
+A package is the third answer: the console imports the same code a generated app
+renders, so there is one implementation and no hand-porting.
+
+## Use it
+
+```sh
+npm install @ofidj/entry
+```
+
+```ts
+import { providerEntry, bindAgreement, acceptedAgreement } from "@ofidj/entry";
+import "@ofidj/entry/tokens.css";
+import "@ofidj/entry/style.css";
+```
+
+`tokens.css` defines every colour, family and radius the product paints with;
+nothing else may introduce a literal. `fonts.css` is shipped separately because
+each consumer serves its own font files and the `url()`s differ by one path
+prefix.
+
+## What is here, and what is not
+
+Moved, and covered by characterization tests in `test/`:
+
+| Module                                 | What it holds                                                                                                      |
+| -------------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
+| `service-agreement.ts`                 | the agreement block and its loading, `providerEntry`'s three shapes, the remembered address, sign-in error wording |
+| `provider-window.ts`                   | the Fidj window and the answer it relays back                                                                      |
+| `version.ts`                           | the `fidj@<version>` badge                                                                                         |
+| `tokens.css`, `fonts.css`, `style.css` | the design system                                                                                                  |
+
+Still in `generator-fidj`'s template, and next to move: the screens inside
+`content.ts` — the sign-in entry, `#/forgot`, `#/reset`, `#/verify`, `#/account`
+and the Fidj-hosted OIDC interaction page. They import `app.config.json`
+directly, so they move behind a config argument rather than verbatim.
+
+**The generator has not switched over yet.** Its template still carries its own
+copies and builds from them, so a change made here reaches nobody until that
+lands. `test/no-drift-from-the-generator.test.mjs` fails while the two disagree,
+and is deleted in the same change that deletes the generator's copies.
+
+## Release
+
+This package joins [the one release series](../README.md#one-release-series-for-every-ofidj-package)
+and publishes from `./dist` when its `package` branch is pushed. It sits after
+`@ofidj/contracts` and `@ofidj/node` and before `@ofidj/generator-fidj` in the
+dependency chain, because the generator and the console both consume it.

package/fonts.css

@@ -0,0 +1,92 @@
+/* The design system's typefaces, self-hosted.
+ *
+ * A generated site has to stay statically hostable, and an app that sells
+ * privacy should not hand a third party a request log on every sign-in. Latin
+ * and latin-ext only; other scripts fall back to the stack in tokens.css.
+ *
+ * The url()s are runtime paths relative to the built main.css, not bundle
+ * inputs — the files ride along in public/ and esbuild leaves them external.
+ * A consumer that serves the same tokens from somewhere else (fidj-app mounts
+ * its console under /module/) writes its own @font-face block instead.
+ */
+
+@font-face {
+  font-family: "IBM Plex Sans";
+  font-style: normal;
+  font-weight: 400 600;
+  font-display: swap;
+  src: url("fonts/IBMPlexSans-400_600-latin.woff2") format("woff2");
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA,
+    U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193,
+    U+2212, U+2215, U+FEFF, U+FFFD;
+}
+@font-face {
+  font-family: "IBM Plex Sans";
+  font-style: normal;
+  font-weight: 400 600;
+  font-display: swap;
+  src: url("fonts/IBMPlexSans-400_600-latin-ext.woff2") format("woff2");
+  unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7,
+    U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF,
+    U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+@font-face {
+  font-family: "IBM Plex Mono";
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url("fonts/IBMPlexMono-400-latin.woff2") format("woff2");
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA,
+    U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193,
+    U+2212, U+2215, U+FEFF, U+FFFD;
+}
+@font-face {
+  font-family: "IBM Plex Mono";
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url("fonts/IBMPlexMono-400-latin-ext.woff2") format("woff2");
+  unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7,
+    U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF,
+    U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+@font-face {
+  font-family: "IBM Plex Mono";
+  font-style: normal;
+  font-weight: 500;
+  font-display: swap;
+  src: url("fonts/IBMPlexMono-500-latin.woff2") format("woff2");
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA,
+    U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193,
+    U+2212, U+2215, U+FEFF, U+FFFD;
+}
+@font-face {
+  font-family: "IBM Plex Mono";
+  font-style: normal;
+  font-weight: 500;
+  font-display: swap;
+  src: url("fonts/IBMPlexMono-500-latin-ext.woff2") format("woff2");
+  unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7,
+    U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF,
+    U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}
+@font-face {
+  font-family: "Instrument Serif";
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url("fonts/InstrumentSerif-400-latin.woff2") format("woff2");
+  unicode-range: U+0000-00FF, U+0131, U+0152-0153, U+02BB-02BC, U+02C6, U+02DA,
+    U+02DC, U+0304, U+0308, U+0329, U+2000-206F, U+20AC, U+2122, U+2191, U+2193,
+    U+2212, U+2215, U+FEFF, U+FFFD;
+}
+@font-face {
+  font-family: "Instrument Serif";
+  font-style: normal;
+  font-weight: 400;
+  font-display: swap;
+  src: url("fonts/InstrumentSerif-400-latin-ext.woff2") format("woff2");
+  unicode-range: U+0100-02BA, U+02BD-02C5, U+02C7-02CC, U+02CE-02D7,
+    U+02DD-02FF, U+0304, U+0308, U+0329, U+1D00-1DBF, U+1E00-1E9F, U+1EF2-1EFF,
+    U+2020, U+20A0-20AB, U+20AD-20C0, U+2113, U+2C60-2C7F, U+A720-A7FF;
+}

package/index.d.ts

@@ -0,0 +1,3 @@
+export { agreementMarkup, acceptedAgreement, signInErrorMessage, bindAgreement, providerEntry, signInHint, rememberSignIn, forgetSignIn, showEmailEntry, type SigninShape, } from "./service-agreement.js";
+export { openProviderWindow, relayProviderAnswer, type ProviderWindow, } from "./provider-window.js";
+export { showVersionBadge } from "./version.js";

package/index.js

@@ -0,0 +1,11 @@
+// The Fidj entry, in one place.
+//
+// Everything here was lifted verbatim out of generator-fidj's template, where
+// it could only ship by being generated. It is a package now so that the
+// console can import the same screens a generated app renders, instead of the
+// two being kept in step by hand — which is how the service agreement ended up
+// existing in four copies that no test could diff.
+export { agreementMarkup, acceptedAgreement, signInErrorMessage, bindAgreement, providerEntry, signInHint, rememberSignIn, forgetSignIn, showEmailEntry, } from "./service-agreement.js";
+export { openProviderWindow, relayProviderAnswer, } from "./provider-window.js";
+export { showVersionBadge } from "./version.js";
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsZ0NBQWdDO0FBQ2hDLEVBQUU7QUFDRiw4RUFBOEU7QUFDOUUseUVBQXlFO0FBQ3pFLDhFQUE4RTtBQUM5RSwrRUFBK0U7QUFDL0UsbURBQW1EO0FBQ25ELE9BQU8sRUFDTCxlQUFlLEVBQ2YsaUJBQWlCLEVBQ2pCLGtCQUFrQixFQUNsQixhQUFhLEVBQ2IsYUFBYSxFQUNiLFVBQVUsRUFDVixjQUFjLEVBQ2QsWUFBWSxFQUNaLGNBQWMsR0FFZixNQUFNLHdCQUF3QixDQUFDO0FBQ2hDLE9BQU8sRUFDTCxrQkFBa0IsRUFDbEIsbUJBQW1CLEdBRXBCLE1BQU0sc0JBQXNCLENBQUM7QUFDOUIsT0FBTyxFQUFFLGdCQUFnQixFQUFFLE1BQU0sY0FBYyxDQUFDIn0=

package/package.json

@@ -0,0 +1,35 @@
+{
+  "name": "@ofidj/entry",
+  "version": "3.10.0",
+  "description": "The Fidj entry: sign-in, account recovery, the service agreement and the design system, shared verbatim by Fidj, the generated apps and the console.",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "type": "module",
+  "main": "./index.js",
+  "types": "./index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./index.d.ts",
+      "default": "./index.js"
+    },
+    "./tokens.css": "./tokens.css",
+    "./fonts.css": "./fonts.css",
+    "./style.css": "./style.css"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc --project tsconfig.json && cp src/*.css dist/ && cp *.md LICENSE dist/ && cp package.json dist/",
+    "test": "npm run build && node --test test/*.test.mjs",
+    "bp:style:fix": "prettier --write \"src/**/*.ts\" \"test/**/*.mjs\" --no-error-on-unmatched-pattern"
+  },
+  "devDependencies": {
+    "jsdom": "^25.0.1",
+    "prettier": "^3.3.3",
+    "typescript": "^5.6.3"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ofidj/fidj-entry.git"
+  }
+}

package/provider-window.d.ts

@@ -0,0 +1,9 @@
+export type ProviderWindow = {
+    show(url: string): void;
+    isOpen(): boolean;
+    focus(): void;
+    giveUp(): void;
+    answer(): Promise<URL | null>;
+};
+export declare function openProviderWindow(): ProviderWindow | null;
+export declare function relayProviderAnswer(): boolean;

package/provider-window.js

@@ -0,0 +1,165 @@
+// Signing in happens in a window of its own.
+//
+// Fidj's screens are served from another origin — Fidj's front end, or the API
+// itself, depending on the deployment — and that origin refuses to be framed,
+// so no dialog drawn inside this page can hold them. A window can, and it keeps
+// the page the person was already on: they come back to what they were reading,
+// not to a shell that reloaded underneath them and forgot where they were.
+//
+// The window is opened empty and synchronously, before anything is awaited. A
+// window opened after an await is a window the browser no longer connects to
+// the click that asked for it, and every popup blocker refuses it — so the
+// authorization URL, which takes a discovery round-trip to build, is fetched
+// afterwards and navigated into a window that already exists.
+// One window per page, not one per browser.
+//
+// Naming it is what lets a second press reuse the window instead of stacking
+// another one on top, and that much is wanted. Sharing the name across tabs is
+// not: the answer comes back to whichever page opened the window, so a second
+// tab reusing the first tab's window would hand that tab's sign-in to a page
+// that never asked, and leave the one that did waiting forever. Stable for this
+// document, unique to it.
+const WINDOW_NAME = "fidj-signin-" + Math.random().toString(36).slice(2, 10);
+const CALLBACK = "fidj:oidc-callback";
+// Comfortable rather than minimal: the provider asks for a password, states who
+// is asking and where the person is going back to, and a cramped window turns
+// that into scrolling. Clamped to the screen so a small display still gets a
+// window it can show whole, and centred on the display the opener is on.
+function features() {
+    const width = Math.min(560, Math.max(320, window.screen.availWidth - 80));
+    const height = Math.min(760, Math.max(480, window.screen.availHeight - 80));
+    const left = Math.round((window.screenX || 0) + Math.max(0, (window.outerWidth - width) / 2));
+    const top = Math.round((window.screenY || 0) + Math.max(0, (window.outerHeight - height) / 3));
+    return `popup=yes,width=${width},height=${height},left=${left},top=${top},resizable=yes,scrollbars=yes`;
+}
+export function openProviderWindow() {
+    let opened = null;
+    try {
+        opened = window.open("", WINDOW_NAME, features());
+    }
+    catch {
+        opened = null;
+    }
+    // Blocked, or a browser that refuses named windows. The caller falls back to
+    // leaving this page, which is the flow this one replaced.
+    if (!opened)
+        return null;
+    try {
+        opened.document.write('<!doctype html><meta charset="utf-8"><title>Signing in with Fidj</title><body style="margin:0;font:15px/1.5 system-ui;color:#4a4540;display:grid;place-items:center;height:100vh">Opening Fidj…</body>');
+        opened.document.close();
+    }
+    catch { }
+    return {
+        show(url) {
+            // `replace`, so the blank placeholder is not a history entry the person
+            // can press Back into.
+            try {
+                opened.location.replace(url);
+            }
+            catch {
+                opened.location.href = url;
+            }
+        },
+        isOpen() {
+            try {
+                return !opened.closed;
+            }
+            catch {
+                return false;
+            }
+        },
+        focus() {
+            try {
+                opened.focus();
+            }
+            catch { }
+        },
+        giveUp() {
+            try {
+                opened.close();
+            }
+            catch { }
+        },
+        answer() {
+            return new Promise((resolve) => {
+                let done = false;
+                const finish = (result) => {
+                    if (done)
+                        return;
+                    done = true;
+                    window.removeEventListener("message", onMessage);
+                    window.clearInterval(watch);
+                    try {
+                        opened.close();
+                    }
+                    catch { }
+                    resolve(result);
+                };
+                const onMessage = (event) => {
+                    // Only this origin, and only the window this entry opened: the
+                    // callback carries a single-use authorization code, and anything else
+                    // posting into this page is not part of this conversation.
+                    if (event.origin !== window.location.origin)
+                        return;
+                    if (event.source !== opened)
+                        return;
+                    const data = event.data;
+                    if (!data || data.fidj !== CALLBACK || typeof data.href !== "string")
+                        return;
+                    let callback;
+                    try {
+                        callback = new URL(data.href);
+                    }
+                    catch {
+                        return;
+                    }
+                    if (callback.origin !== window.location.origin)
+                        return;
+                    finish(callback);
+                };
+                window.addEventListener("message", onMessage);
+                // A window closed by hand answers nothing, and nothing is what this
+                // page would wait for forever otherwise. `closed` is the only signal a
+                // cross-origin window gives, so it is polled.
+                const watch = window.setInterval(() => {
+                    if (opened.closed)
+                        finish(null);
+                }, 400);
+            });
+        },
+    };
+}
+// The other half, running in that window: the provider has just answered into
+// it, and its only remaining job is to hand the answer back and get out of the
+// way. It never completes the sign-in itself — the transaction that has to
+// match the answer was written by the page that opened it, and session storage
+// is copied into a new window, not shared with it.
+//
+// Answering `true` means the hand-off was made and this window asked to close;
+// the caller shows one line and, if the browser refuses to close a window it
+// did not see scripted open, finishes the sign-in here after all.
+export function relayProviderAnswer() {
+    let opener = null;
+    try {
+        opener = window.opener;
+    }
+    catch {
+        return false;
+    }
+    if (!opener || opener === window || opener.closed)
+        return false;
+    if (!new URL(window.location.href).searchParams.has("state"))
+        return false;
+    try {
+        opener.postMessage({ fidj: CALLBACK, href: window.location.href }, window.location.origin);
+    }
+    catch {
+        return false;
+    }
+    try {
+        window.close();
+    }
+    catch { }
+    return true;
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicHJvdmlkZXItd2luZG93LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL3Byb3ZpZGVyLXdpbmRvdy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSw2Q0FBNkM7QUFDN0MsRUFBRTtBQUNGLCtFQUErRTtBQUMvRSw4RUFBOEU7QUFDOUUsZ0ZBQWdGO0FBQ2hGLGdGQUFnRjtBQUNoRiwyRUFBMkU7QUFDM0UsRUFBRTtBQUNGLDhFQUE4RTtBQUM5RSw2RUFBNkU7QUFDN0UsMkVBQTJFO0FBQzNFLDZFQUE2RTtBQUM3RSw4REFBOEQ7QUFFOUQsNENBQTRDO0FBQzVDLEVBQUU7QUFDRiw2RUFBNkU7QUFDN0UsK0VBQStFO0FBQy9FLDhFQUE4RTtBQUM5RSw2RUFBNkU7QUFDN0UsZ0ZBQWdGO0FBQ2hGLDBCQUEwQjtBQUMxQixNQUFNLFdBQVcsR0FBRyxjQUFjLEdBQUcsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDO0FBQzdFLE1BQU0sUUFBUSxHQUFHLG9CQUFvQixDQUFDO0FBRXRDLGdGQUFnRjtBQUNoRiw4RUFBOEU7QUFDOUUsNkVBQTZFO0FBQzdFLHlFQUF5RTtBQUN6RSxTQUFTLFFBQVE7SUFDZixNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRSxJQUFJLENBQUMsR0FBRyxDQUFDLEdBQUcsRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsR0FBRyxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQzFFLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxFQUFFLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUMsV0FBVyxHQUFHLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDNUUsTUFBTSxJQUFJLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FDckIsQ0FBQyxNQUFNLENBQUMsT0FBTyxJQUFJLENBQUMsQ0FBQyxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxFQUFFLENBQUMsTUFBTSxDQUFDLFVBQVUsR0FBRyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FDckUsQ0FBQztJQUNGLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQ3BCLENBQUMsTUFBTSxDQUFDLE9BQU8sSUFBSSxDQUFDLENBQUMsR0FBRyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxDQUFDLE1BQU0sQ0FBQyxXQUFXLEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQ3ZFLENBQUM7SUFDRixPQUFPLG1CQUFtQixLQUFLLFdBQVcsTUFBTSxTQUFTLElBQUksUUFBUSxHQUFHLCtCQUErQixDQUFDO0FBQzFHLENBQUM7QUFxQkQsTUFBTSxVQUFVLGtCQUFrQjtJQUNoQyxJQUFJLE1BQU0sR0FBa0IsSUFBSSxDQUFDO0lBQ2pDLElBQUksQ0FBQztRQUNILE1BQU0sR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLEVBQUUsRUFBRSxXQUFXLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUNwRCxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsTUFBTSxHQUFHLElBQUksQ0FBQztJQUNoQixDQUFDO0lBQ0QsNkVBQTZFO0lBQzdFLDBEQUEwRDtJQUMxRCxJQUFJLENBQUMsTUFBTTtRQUFFLE9BQU8sSUFBSSxDQUFDO0lBQ3pCLElBQUksQ0FBQztRQUNILE1BQU0sQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUNuQix3TUFBd00sQ0FDek0sQ0FBQztRQUNGLE1BQU0sQ0FBQyxRQUFRLENBQUMsS0FBSyxFQUFFLENBQUM7SUFDMUIsQ0FBQztJQUFDLE1BQU0sQ0FBQyxDQUFBLENBQUM7SUFDVixPQUFPO1FBQ0wsSUFBSSxDQUFDLEdBQVc7WUFDZCx3RUFBd0U7WUFDeEUsdUJBQXVCO1lBQ3ZCLElBQUksQ0FBQztnQkFDSCxNQUFPLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUNoQyxDQUFDO1lBQUMsTUFBTSxDQUFDO2dCQUNQLE1BQU8sQ0FBQyxRQUFRLENBQUMsSUFBSSxHQUFHLEdBQUcsQ0FBQztZQUM5QixDQUFDO1FBQ0gsQ0FBQztRQUNELE1BQU07WUFDSixJQUFJLENBQUM7Z0JBQ0gsT0FBTyxDQUFDLE1BQU8sQ0FBQyxNQUFNLENBQUM7WUFDekIsQ0FBQztZQUFDLE1BQU0sQ0FBQztnQkFDUCxPQUFPLEtBQUssQ0FBQztZQUNmLENBQUM7UUFDSCxDQUFDO1FBQ0QsS0FBSztZQUNILElBQUksQ0FBQztnQkFDSCxNQUFPLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDbEIsQ0FBQztZQUFDLE1BQU0sQ0FBQyxDQUFBLENBQUM7UUFDWixDQUFDO1FBQ0QsTUFBTTtZQUNKLElBQUksQ0FBQztnQkFDSCxNQUFPLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDbEIsQ0FBQztZQUFDLE1BQU0sQ0FBQyxDQUFBLENBQUM7UUFDWixDQUFDO1FBQ0QsTUFBTTtZQUNKLE9BQU8sSUFBSSxPQUFPLENBQWEsQ0FBQyxPQUFPLEVBQUUsRUFBRTtnQkFDekMsSUFBSSxJQUFJLEdBQUcsS0FBSyxDQUFDO2dCQUNqQixNQUFNLE1BQU0sR0FBRyxDQUFDLE1BQWtCLEVBQUUsRUFBRTtvQkFDcEMsSUFBSSxJQUFJO3dCQUFFLE9BQU87b0JBQ2pCLElBQUksR0FBRyxJQUFJLENBQUM7b0JBQ1osTUFBTSxDQUFDLG1CQUFtQixDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQztvQkFDakQsTUFBTSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsQ0FBQztvQkFDNUIsSUFBSSxDQUFDO3dCQUNILE1BQU8sQ0FBQyxLQUFLLEVBQUUsQ0FBQztvQkFDbEIsQ0FBQztvQkFBQyxNQUFNLENBQUMsQ0FBQSxDQUFDO29CQUNWLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQztnQkFDbEIsQ0FBQyxDQUFDO2dCQUNGLE1BQU0sU0FBUyxHQUFHLENBQUMsS0FBbUIsRUFBRSxFQUFFO29CQUN4QywrREFBK0Q7b0JBQy9ELHNFQUFzRTtvQkFDdEUsMkRBQTJEO29CQUMzRCxJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssTUFBTSxDQUFDLFFBQVEsQ0FBQyxNQUFNO3dCQUFFLE9BQU87b0JBQ3BELElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxNQUFNO3dCQUFFLE9BQU87b0JBQ3BDLE1BQU0sSUFBSSxHQUFHLEtBQUssQ0FBQyxJQUErQyxDQUFDO29CQUNuRSxJQUFJLENBQUMsSUFBSSxJQUFJLElBQUksQ0FBQyxJQUFJLEtBQUssUUFBUSxJQUFJLE9BQU8sSUFBSSxDQUFDLElBQUksS0FBSyxRQUFRO3dCQUNsRSxPQUFPO29CQUNULElBQUksUUFBYSxDQUFDO29CQUNsQixJQUFJLENBQUM7d0JBQ0gsUUFBUSxHQUFHLElBQUksR0FBRyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztvQkFDaEMsQ0FBQztvQkFBQyxNQUFNLENBQUM7d0JBQ1AsT0FBTztvQkFDVCxDQUFDO29CQUNELElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxNQUFNLENBQUMsUUFBUSxDQUFDLE1BQU07d0JBQUUsT0FBTztvQkFDdkQsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDO2dCQUNuQixDQUFDLENBQUM7Z0JBQ0YsTUFBTSxDQUFDLGdCQUFnQixDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQztnQkFDOUMsb0VBQW9FO2dCQUNwRSx1RUFBdUU7Z0JBQ3ZFLDhDQUE4QztnQkFDOUMsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLFdBQVcsQ0FBQyxHQUFHLEVBQUU7b0JBQ3BDLElBQUksTUFBTyxDQUFDLE1BQU07d0JBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDO2dCQUNuQyxDQUFDLEVBQUUsR0FBRyxDQUFDLENBQUM7WUFDVixDQUFDLENBQUMsQ0FBQztRQUNMLENBQUM7S0FDRixDQUFDO0FBQ0osQ0FBQztBQUVELDhFQUE4RTtBQUM5RSwrRUFBK0U7QUFDL0UsMkVBQTJFO0FBQzNFLCtFQUErRTtBQUMvRSxtREFBbUQ7QUFDbkQsRUFBRTtBQUNGLCtFQUErRTtBQUMvRSw2RUFBNkU7QUFDN0Usa0VBQWtFO0FBQ2xFLE1BQU0sVUFBVSxtQkFBbUI7SUFDakMsSUFBSSxNQUFNLEdBQWtCLElBQUksQ0FBQztJQUNqQyxJQUFJLENBQUM7UUFDSCxNQUFNLEdBQUcsTUFBTSxDQUFDLE1BQXVCLENBQUM7SUFDMUMsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELElBQUksQ0FBQyxNQUFNLElBQUksTUFBTSxLQUFLLE1BQU0sSUFBSSxNQUFNLENBQUMsTUFBTTtRQUFFLE9BQU8sS0FBSyxDQUFDO0lBQ2hFLElBQUksQ0FBQyxJQUFJLEdBQUcsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDLFlBQVksQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDM0UsSUFBSSxDQUFDO1FBQ0gsTUFBTSxDQUFDLFdBQVcsQ0FDaEIsRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLElBQUksRUFBRSxNQUFNLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxFQUM5QyxNQUFNLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FDdkIsQ0FBQztJQUNKLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxJQUFJLENBQUM7UUFDSCxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7SUFDakIsQ0FBQztJQUFDLE1BQU0sQ0FBQyxDQUFBLENBQUM7SUFDVixPQUFPLElBQUksQ0FBQztBQUNkLENBQUMifQ==

package/service-agreement.d.ts

@@ -0,0 +1,13 @@
+export declare function agreementMarkup(): string;
+export declare function acceptedAgreement(form: HTMLFormElement): {
+    termsAccepted: boolean;
+    termsVersion: string;
+} | null;
+export declare function signInErrorMessage(error: unknown): "Too many attempts. Please wait before trying again." | "We could not sign in to this account. Check the email and password." | "An account already uses this email. Check the password or sign in instead." | "We cannot reach Fidj right now. Please try again." | "We could not sign in to this account. Please try again.";
+export declare function bindAgreement(form: HTMLFormElement | null, title: string, endpoint: string, appId: string, checked?: boolean): Promise<void>;
+export declare function signInHint(appId: string): string;
+export declare function rememberSignIn(appId: string, label: string): void;
+export declare function forgetSignIn(appId: string): void;
+export type SigninShape = "button" | "inline" | "both";
+export declare function providerEntry(title: string, appId: string, credentials: string, isFidjItself?: boolean, shape?: SigninShape): string;
+export declare function showEmailEntry(open: boolean, focus?: boolean): void;

package/service-agreement.js

@@ -0,0 +1,184 @@
+export function agreementMarkup() {
+    return `<div class="signin-agreement"><label class="agreement-choice"><input id="service-agreement" type="checkbox" aria-required="true" disabled><span id="agreement-label">I accept the service agreement for this app.</span></label><button type="button" id="read-agreement" disabled>Read service agreement</button><p id="agreement-status" class="fineprint" role="status">Loading service agreement…</p><button type="button" id="retry-agreement" hidden>Retry</button></div><dialog id="agreement-dialog" aria-labelledby="agreement-heading"><h2 id="agreement-heading">Service agreement</h2><p id="agreement-version"></p><p id="agreement-text"></p><button type="button" id="close-agreement">Close agreement</button></dialog>`;
+}
+export function acceptedAgreement(form) {
+    const checkbox = form.querySelector("#service-agreement");
+    if (!checkbox?.checked || checkbox.disabled || !checkbox.dataset.version)
+        return null;
+    return { termsAccepted: true, termsVersion: checkbox.dataset.version };
+}
+export function signInErrorMessage(error) {
+    const detail = error;
+    const reason = typeof detail?.reason === "string" ? detail.reason : typeof detail?.message === "string" ? detail.message : "";
+    if (detail?.code === 429)
+        return "Too many attempts. Please wait before trying again.";
+    if (reason === "unknown-user")
+        return "We could not sign in to this account. Check the email and password.";
+    if (reason === "already exists - inconsistent request")
+        return "An account already uses this email. Check the password or sign in instead.";
+    if (/ECONNREFUSED|ENOTFOUND|ETIMEDOUT|ECONNRESET|EHOSTUNREACH|network/i.test(reason))
+        return "We cannot reach Fidj right now. Please try again.";
+    return "We could not sign in to this account. Please try again.";
+}
+export async function bindAgreement(form, title, endpoint, appId, checked = false) {
+    if (!form)
+        return;
+    // An app whose only door is Fidj carries no agreement block: Fidj asks for
+    // this app's agreement on the screen that names it, and records the version.
+    const checkbox = form.querySelector("#service-agreement");
+    if (!checkbox)
+        return;
+    const read = form.querySelector("#read-agreement");
+    const dialog = form.querySelector("#agreement-dialog");
+    const status = form.querySelector("#agreement-status");
+    const retry = form.querySelector("#retry-agreement");
+    // What this agreement gates is the app's own door, and only that one. The
+    // Fidj door is about to be asked the same question on the screen that names
+    // the app, where the answer is recorded with its version — so an agreement
+    // that is still loading, or that could not be loaded at all, must not be what
+    // stands between a person and the door that does not need it.
+    const gated = form.querySelector("#email-entry") || form;
+    const submitButtons = gated.querySelectorAll('button[type="submit"]');
+    const update = () => submitButtons.forEach(button => { button.disabled = checkbox.disabled; });
+    form.querySelector("#agreement-label").textContent = `I accept the service agreement for ${title}.`;
+    update();
+    checkbox.addEventListener("change", update);
+    read.addEventListener("click", () => dialog.showModal());
+    form.querySelector("#close-agreement").addEventListener("click", () => dialog.close());
+    const load = async () => {
+        retry.hidden = true;
+        status.textContent = "Loading service agreement…";
+        try {
+            const response = await fetch(`${endpoint}/apps/${encodeURIComponent(appId)}`, { signal: AbortSignal.timeout(10000) });
+            if (!response.ok)
+                throw new Error(response.status === 404 ? "missing" : "unreachable");
+            const agreement = (await response.json()).app?.agreement;
+            if (!agreement || typeof agreement.version !== "string" || !agreement.version || typeof agreement.text !== "string" || !agreement.text)
+                throw new Error("missing");
+            if (!form.isConnected)
+                return;
+            checkbox.dataset.version = agreement.version;
+            checkbox.disabled = false;
+            checkbox.checked = checked;
+            read.disabled = false;
+            dialog.querySelector("#agreement-version").textContent = `Version ${agreement.version}`;
+            dialog.querySelector("#agreement-text").textContent = agreement.text;
+            status.textContent = "Required to sign in. Optional data choices stay separate.";
+            update();
+        }
+        catch (error) {
+            if (!form.isConnected)
+                return;
+            status.textContent = error instanceof Error && error.message === "missing"
+                ? "This app has no service agreement available."
+                : "We cannot reach Fidj right now. Try again.";
+            retry.hidden = false;
+        }
+    };
+    retry.addEventListener("click", load);
+    await load();
+}
+// The entry every app that delegates to the provider renders, in one place
+// because both app shapes render it and they had drifted apart.
+//
+// "Continue with Fidj" alone borrows the grammar of an optional social login —
+// that button always sits next to an email and a password — so on an app whose
+// accounts *are* Fidj accounts, the missing form reads as something broken. The
+// explanation therefore comes before the button, not as reassurance after it,
+// and nothing presupposes an account the person may not have yet.
+const hintKey = (appId) => "fidj.entry." + appId;
+export function signInHint(appId) {
+    try {
+        return localStorage.getItem(hintKey(appId)) || "";
+    }
+    catch {
+        return "";
+    }
+}
+// Remembered on this app's own origin, about this app's own member: no
+// cross-site question is asked, and none is answered. Signing out forgets, so a
+// shared browser does not show the next person an address.
+export function rememberSignIn(appId, label) {
+    try {
+        if (label)
+            localStorage.setItem(hintKey(appId), label);
+    }
+    catch { }
+}
+export function forgetSignIn(appId) {
+    try {
+        localStorage.removeItem(hintKey(appId));
+    }
+    catch { }
+}
+export function providerEntry(title, appId, credentials, isFidjItself = false, shape = "button") {
+    const escapeText = (value) => String(value ?? "").replace(/[&<>"']/g, (char) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[char]);
+    const hint = signInHint(appId);
+    const both = shape === "both" && Boolean(credentials);
+    // The app's own form and nothing else. Nothing is folded away because there is
+    // no second way in to fold it under, and the trade-off is stated plainly:
+    // on this path it is this site that holds the password.
+    if (shape === "inline")
+        return (`<p class="signin-lead">${isFidjItself
+            ? "One account across every app that uses Fidj, and a separate set of choices for each one."
+            : `${escapeText(title)} accounts are Fidj accounts. Sign in below — ${escapeText(title)} handles your password itself on this page.`}</p>` +
+            agreementMarkup() +
+            credentials);
+    const lead = hint
+        ? `<p class="signin-lead">You signed in here with Fidj before. ${escapeText(title)} accounts are Fidj accounts — continue as yourself, or use another.</p>`
+        : both
+            ? `<p class="signin-lead">${escapeText(title)} accounts are Fidj accounts. Fidj asks in a window of its own, so this site never sees your password.</p>`
+            : isFidjItself
+                ? `<p class="signin-lead">One account across every app that uses Fidj, and a separate set of choices for each one. Fidj asks in a window of its own; this page stays where it is.</p>`
+                : `<p class="signin-lead">${escapeText(title)} accounts are Fidj accounts. You will sign in — or create yours — in a Fidj window, so this site never sees your password.</p>`;
+    // The accent is the Fidj mark, and this is the one control on the screen that
+    // is Fidj's rather than the app's. It is also the door the app would rather
+    // people took, and those two happen to want the same thing.
+    const fidj = hint
+        ? `<button class="primary fidj-entry" type="submit" name="entry" value="fidj">Continue as ${escapeText(hint)}</button><button type="button" id="forget-hint" class="quiet">Use a different account</button>`
+        : `<button class="primary fidj-entry" type="submit" name="entry" value="fidj">${isFidjItself ? "Sign in" : "Sign in with Fidj"}</button>`;
+    // Fidj is the only door: it collects the agreement itself, a moment later, on
+    // the screen that names the app — and records it with its version. Collecting
+    // it here first recorded nothing and asked the same question twice.
+    if (shape !== "both" || !both)
+        return lead + fidj;
+    // Both doors. The app's own one is a second thought for the person who wants
+    // it, which is what a disclosure is for: it costs one click and takes nothing
+    // away, where a second button of equal weight cost everybody a decision.
+    return (lead +
+        fidj +
+        `<div class="signin-alternate"><button type="button" id="use-email" class="signin-toggle" aria-expanded="false" aria-controls="email-entry"><span class="signin-toggle-label">Inline form<span class="caret" aria-hidden="true"></span></span></button>
+  <div id="email-entry" hidden>${agreementMarkup()}${credentials}</div></div>`);
+}
+// Opening the app's own form takes the space the Fidj door was using.
+//
+// The two are alternatives, not a list, and watching one fold away as the other
+// arrives is what says so — where a form appearing underneath a button that is
+// still there reads as "and also". The toggle stays put through both states, so
+// it ends up labelling whichever one is on screen: a caret pointing down at a
+// form that is not here yet, and up at the one it would put away.
+//
+// Shared, because both app shapes render the same entry.
+export function showEmailEntry(open, focus = false) {
+    const fields = document.getElementById("email-entry");
+    const toggle = document.getElementById("use-email");
+    if (!fields || !toggle)
+        return;
+    toggle.setAttribute("aria-expanded", String(open));
+    fields.hidden = !open;
+    const door = document.querySelector(".fidj-entry");
+    if (door) {
+        door.classList.toggle("is-folded", open);
+        // Out of the tab order and out of the accessibility tree the moment it
+        // starts leaving: something mid-fold is not something to press, and an
+        // animation is not what decides that.
+        if (open)
+            door.setAttribute("aria-hidden", "true");
+        else
+            door.removeAttribute("aria-hidden");
+        door.tabIndex = open ? -1 : 0;
+    }
+    if (open && focus)
+        document.getElementById("email")?.focus();
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2VydmljZS1hZ3JlZW1lbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvc2VydmljZS1hZ3JlZW1lbnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsTUFBTSxVQUFVLGVBQWU7SUFDN0IsT0FBTyx5c0JBQXlzQixDQUFDO0FBQ250QixDQUFDO0FBRUQsTUFBTSxVQUFVLGlCQUFpQixDQUFDLElBQXFCO0lBQ3JELE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxhQUFhLENBQW1CLG9CQUFvQixDQUFDLENBQUM7SUFDNUUsSUFBSSxDQUFDLFFBQVEsRUFBRSxPQUFPLElBQUksUUFBUSxDQUFDLFFBQVEsSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsT0FBTztRQUFFLE9BQU8sSUFBSSxDQUFDO0lBQ3RGLE9BQU8sRUFBRSxhQUFhLEVBQUUsSUFBSSxFQUFFLFlBQVksRUFBRSxRQUFRLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxDQUFDO0FBQ3pFLENBQUM7QUFFRCxNQUFNLFVBQVUsa0JBQWtCLENBQUMsS0FBYztJQUMvQyxNQUFNLE1BQU0sR0FBRyxLQUE2RCxDQUFDO0lBQzdFLE1BQU0sTUFBTSxHQUFHLE9BQU8sTUFBTSxFQUFFLE1BQU0sS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLE9BQU8sTUFBTSxFQUFFLE9BQU8sS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUM5SCxJQUFJLE1BQU0sRUFBRSxJQUFJLEtBQUssR0FBRztRQUFFLE9BQU8scURBQXFELENBQUM7SUFDdkYsSUFBSSxNQUFNLEtBQUssY0FBYztRQUFFLE9BQU8scUVBQXFFLENBQUM7SUFDNUcsSUFBSSxNQUFNLEtBQUssdUNBQXVDO1FBQUUsT0FBTyw0RUFBNEUsQ0FBQztJQUM1SSxJQUFJLG1FQUFtRSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUM7UUFBRSxPQUFPLG1EQUFtRCxDQUFDO0lBQ2pKLE9BQU8seURBQXlELENBQUM7QUFDbkUsQ0FBQztBQUVELE1BQU0sQ0FBQyxLQUFLLFVBQVUsYUFBYSxDQUFDLElBQTRCLEVBQUUsS0FBYSxFQUFFLFFBQWdCLEVBQUUsS0FBYSxFQUFFLE9BQU8sR0FBRyxLQUFLO0lBQy9ILElBQUksQ0FBQyxJQUFJO1FBQUUsT0FBTztJQUNsQiwyRUFBMkU7SUFDM0UsNkVBQTZFO0lBQzdFLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxhQUFhLENBQW1CLG9CQUFvQixDQUFDLENBQUM7SUFDNUUsSUFBSSxDQUFDLFFBQVE7UUFBRSxPQUFPO0lBQ3RCLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxhQUFhLENBQW9CLGlCQUFpQixDQUFFLENBQUM7SUFDdkUsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLGFBQWEsQ0FBb0IsbUJBQW1CLENBQUUsQ0FBQztJQUMzRSxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsYUFBYSxDQUFjLG1CQUFtQixDQUFFLENBQUM7SUFDckUsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLGFBQWEsQ0FBb0Isa0JBQWtCLENBQUUsQ0FBQztJQUN6RSwwRUFBMEU7SUFDMUUsNEVBQTRFO0lBQzVFLDJFQUEyRTtJQUMzRSw4RUFBOEU7SUFDOUUsOERBQThEO0lBQzlELE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxhQUFhLENBQUMsY0FBYyxDQUFDLElBQUksSUFBSSxDQUFDO0lBQ3pELE1BQU0sYUFBYSxHQUFHLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBb0IsdUJBQXVCLENBQUMsQ0FBQztJQUN6RixNQUFNLE1BQU0sR0FBRyxHQUFHLEVBQUUsQ0FBQyxhQUFhLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxFQUFFLEdBQUcsTUFBTSxDQUFDLFFBQVEsR0FBRyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDL0YsSUFBSSxDQUFDLGFBQWEsQ0FBQyxrQkFBa0IsQ0FBRSxDQUFDLFdBQVcsR0FBRyxzQ0FBc0MsS0FBSyxHQUFHLENBQUM7SUFDckcsTUFBTSxFQUFFLENBQUM7SUFDVCxRQUFRLENBQUMsZ0JBQWdCLENBQUMsUUFBUSxFQUFFLE1BQU0sQ0FBQyxDQUFDO0lBQzVDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxPQUFPLEVBQUUsR0FBRyxFQUFFLENBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxDQUFDLENBQUM7SUFDekQsSUFBSSxDQUFDLGFBQWEsQ0FBQyxrQkFBa0IsQ0FBRSxDQUFDLGdCQUFnQixDQUFDLE9BQU8sRUFBRSxHQUFHLEVBQUUsQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQztJQUN4RixNQUFNLElBQUksR0FBRyxLQUFLLElBQUksRUFBRTtRQUN0QixLQUFLLENBQUMsTUFBTSxHQUFHLElBQUksQ0FBQztRQUNwQixNQUFNLENBQUMsV0FBVyxHQUFHLDRCQUE0QixDQUFDO1FBQ2xELElBQUksQ0FBQztZQUNILE1BQU0sUUFBUSxHQUFHLE1BQU0sS0FBSyxDQUFDLEdBQUcsUUFBUSxTQUFTLGtCQUFrQixDQUFDLEtBQUssQ0FBQyxFQUFFLEVBQUUsRUFBQyxNQUFNLEVBQUUsV0FBVyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsRUFBQyxDQUFDLENBQUM7WUFDcEgsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFO2dCQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsUUFBUSxDQUFDLE1BQU0sS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsYUFBYSxDQUFDLENBQUM7WUFDdkYsTUFBTSxTQUFTLEdBQUcsQ0FBQyxNQUFNLFFBQVEsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDLEdBQUcsRUFBRSxTQUFTLENBQUM7WUFDekQsSUFBSSxDQUFDLFNBQVMsSUFBSSxPQUFPLFNBQVMsQ0FBQyxPQUFPLEtBQUssUUFBUSxJQUFJLENBQUMsU0FBUyxDQUFDLE9BQU8sSUFBSSxPQUFPLFNBQVMsQ0FBQyxJQUFJLEtBQUssUUFBUSxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUk7Z0JBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUNuSyxJQUFJLENBQUMsSUFBSSxDQUFDLFdBQVc7Z0JBQUUsT0FBTztZQUM5QixRQUFRLENBQUMsT0FBTyxDQUFDLE9BQU8sR0FBRyxTQUFTLENBQUMsT0FBTyxDQUFDO1lBQzdDLFFBQVEsQ0FBQyxRQUFRLEdBQUcsS0FBSyxDQUFDO1lBQzFCLFFBQVEsQ0FBQyxPQUFPLEdBQUcsT0FBTyxDQUFDO1lBQzNCLElBQUksQ0FBQyxRQUFRLEdBQUcsS0FBSyxDQUFDO1lBQ3RCLE1BQU0sQ0FBQyxhQUFhLENBQUMsb0JBQW9CLENBQUUsQ0FBQyxXQUFXLEdBQUcsV0FBVyxTQUFTLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDekYsTUFBTSxDQUFDLGFBQWEsQ0FBQyxpQkFBaUIsQ0FBRSxDQUFDLFdBQVcsR0FBRyxTQUFTLENBQUMsSUFBSSxDQUFDO1lBQ3RFLE1BQU0sQ0FBQyxXQUFXLEdBQUcsMkRBQTJELENBQUM7WUFDakYsTUFBTSxFQUFFLENBQUM7UUFDWCxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLElBQUksQ0FBQyxJQUFJLENBQUMsV0FBVztnQkFBRSxPQUFPO1lBQzlCLE1BQU0sQ0FBQyxXQUFXLEdBQUcsS0FBSyxZQUFZLEtBQUssSUFBSSxLQUFLLENBQUMsT0FBTyxLQUFLLFNBQVM7Z0JBQ3hFLENBQUMsQ0FBQyw4Q0FBOEM7Z0JBQ2hELENBQUMsQ0FBQyw0Q0FBNEMsQ0FBQztZQUNqRCxLQUFLLENBQUMsTUFBTSxHQUFHLEtBQUssQ0FBQztRQUN2QixDQUFDO0lBQ0gsQ0FBQyxDQUFDO0lBQ0YsS0FBSyxDQUFDLGdCQUFnQixDQUFDLE9BQU8sRUFBRSxJQUFJLENBQUMsQ0FBQztJQUN0QyxNQUFNLElBQUksRUFBRSxDQUFDO0FBQ2YsQ0FBQztBQUVELDJFQUEyRTtBQUMzRSxnRUFBZ0U7QUFDaEUsRUFBRTtBQUNGLCtFQUErRTtBQUMvRSwrRUFBK0U7QUFDL0UsZ0ZBQWdGO0FBQ2hGLDhFQUE4RTtBQUM5RSxrRUFBa0U7QUFDbEUsTUFBTSxPQUFPLEdBQUcsQ0FBQyxLQUFhLEVBQUUsRUFBRSxDQUFDLGFBQWEsR0FBRyxLQUFLLENBQUM7QUFFekQsTUFBTSxVQUFVLFVBQVUsQ0FBQyxLQUFhO0lBQ3RDLElBQUksQ0FBQztRQUNILE9BQU8sWUFBWSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDcEQsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sRUFBRSxDQUFDO0lBQ1osQ0FBQztBQUNILENBQUM7QUFFRCx1RUFBdUU7QUFDdkUsZ0ZBQWdGO0FBQ2hGLDJEQUEyRDtBQUMzRCxNQUFNLFVBQVUsY0FBYyxDQUFDLEtBQWEsRUFBRSxLQUFhO0lBQ3pELElBQUksQ0FBQztRQUNILElBQUksS0FBSztZQUFFLFlBQVksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxFQUFFLEtBQUssQ0FBQyxDQUFDO0lBQ3pELENBQUM7SUFBQyxNQUFNLENBQUMsQ0FBQSxDQUFDO0FBQ1osQ0FBQztBQUVELE1BQU0sVUFBVSxZQUFZLENBQUMsS0FBYTtJQUN4QyxJQUFJLENBQUM7UUFDSCxZQUFZLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO0lBQzFDLENBQUM7SUFBQyxNQUFNLENBQUMsQ0FBQSxDQUFDO0FBQ1osQ0FBQztBQWVELE1BQU0sVUFBVSxhQUFhLENBQzNCLEtBQWEsRUFDYixLQUFhLEVBQ2IsV0FBbUIsRUFDbkIsWUFBWSxHQUFHLEtBQUssRUFDcEIsUUFBcUIsUUFBUTtJQUU3QixNQUFNLFVBQVUsR0FBRyxDQUFDLEtBQWMsRUFBRSxFQUFFLENBQ3BDLE1BQU0sQ0FBQyxLQUFLLElBQUksRUFBRSxDQUFDLENBQUMsT0FBTyxDQUN6QixVQUFVLEVBQ1YsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUNQLENBQUMsRUFBRSxHQUFHLEVBQUUsT0FBTyxFQUFFLEdBQUcsRUFBRSxNQUFNLEVBQUUsR0FBRyxFQUFFLE1BQU0sRUFBRSxHQUFHLEVBQUUsUUFBUSxFQUFFLEdBQUcsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUN2RSxJQUFJLENBQ0osQ0FDTCxDQUFDO0lBQ0osTUFBTSxJQUFJLEdBQUcsVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQy9CLE1BQU0sSUFBSSxHQUFHLEtBQUssS0FBSyxNQUFNLElBQUksT0FBTyxDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQ3RELCtFQUErRTtJQUMvRSwwRUFBMEU7SUFDMUUsd0RBQXdEO0lBQ3hELElBQUksS0FBSyxLQUFLLFFBQVE7UUFDcEIsT0FBTyxDQUNMLDBCQUNFLFlBQVk7WUFDVixDQUFDLENBQUMsMEZBQTBGO1lBQzVGLENBQUMsQ0FBQyxHQUFHLFVBQVUsQ0FBQyxLQUFLLENBQUMsZ0RBQWdELFVBQVUsQ0FBQyxLQUFLLENBQUMsNkNBQzNGLE1BQU07WUFDTixlQUFlLEVBQUU7WUFDakIsV0FBVyxDQUNaLENBQUM7SUFDSixNQUFNLElBQUksR0FBRyxJQUFJO1FBQ2YsQ0FBQyxDQUFDLCtEQUErRCxVQUFVLENBQUMsS0FBSyxDQUFDLHlFQUF5RTtRQUMzSixDQUFDLENBQUMsSUFBSTtZQUNKLENBQUMsQ0FBQywwQkFBMEIsVUFBVSxDQUFDLEtBQUssQ0FBQywyR0FBMkc7WUFDeEosQ0FBQyxDQUFDLFlBQVk7Z0JBQ1osQ0FBQyxDQUFDLG9MQUFvTDtnQkFDdEwsQ0FBQyxDQUFDLDBCQUEwQixVQUFVLENBQUMsS0FBSyxDQUFDLGdJQUFnSSxDQUFDO0lBQ3BMLDhFQUE4RTtJQUM5RSw0RUFBNEU7SUFDNUUsNERBQTREO0lBQzVELE1BQU0sSUFBSSxHQUFHLElBQUk7UUFDZixDQUFDLENBQUMsMEZBQTBGLFVBQVUsQ0FBQyxJQUFJLENBQUMsZ0dBQWdHO1FBQzVNLENBQUMsQ0FBQyw4RUFBOEUsWUFBWSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLG1CQUFtQixXQUFXLENBQUM7SUFDNUksOEVBQThFO0lBQzlFLDhFQUE4RTtJQUM5RSxvRUFBb0U7SUFDcEUsSUFBSSxLQUFLLEtBQUssTUFBTSxJQUFJLENBQUMsSUFBSTtRQUFFLE9BQU8sSUFBSSxHQUFHLElBQUksQ0FBQztJQUNsRCw2RUFBNkU7SUFDN0UsOEVBQThFO0lBQzlFLHlFQUF5RTtJQUN6RSxPQUFPLENBQ0wsSUFBSTtRQUNKLElBQUk7UUFDSjtpQ0FDNkIsZUFBZSxFQUFFLEdBQUcsV0FBVyxjQUFjLENBQzNFLENBQUM7QUFDSixDQUFDO0FBRUQsc0VBQXNFO0FBQ3RFLEVBQUU7QUFDRixnRkFBZ0Y7QUFDaEYsK0VBQStFO0FBQy9FLGdGQUFnRjtBQUNoRiw4RUFBOEU7QUFDOUUsa0VBQWtFO0FBQ2xFLEVBQUU7QUFDRix5REFBeUQ7QUFDekQsTUFBTSxVQUFVLGNBQWMsQ0FBQyxJQUFhLEVBQUUsS0FBSyxHQUFHLEtBQUs7SUFDekQsTUFBTSxNQUFNLEdBQUcsUUFBUSxDQUFDLGNBQWMsQ0FBQyxhQUFhLENBQUMsQ0FBQztJQUN0RCxNQUFNLE1BQU0sR0FBRyxRQUFRLENBQUMsY0FBYyxDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQ3BELElBQUksQ0FBQyxNQUFNLElBQUksQ0FBQyxNQUFNO1FBQUUsT0FBTztJQUMvQixNQUFNLENBQUMsWUFBWSxDQUFDLGVBQWUsRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztJQUNuRCxNQUFNLENBQUMsTUFBTSxHQUFHLENBQUMsSUFBSSxDQUFDO0lBQ3RCLE1BQU0sSUFBSSxHQUFHLFFBQVEsQ0FBQyxhQUFhLENBQW9CLGFBQWEsQ0FBQyxDQUFDO0lBQ3RFLElBQUksSUFBSSxFQUFFLENBQUM7UUFDVCxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxXQUFXLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDekMsdUVBQXVFO1FBQ3ZFLHVFQUF1RTtRQUN2RSxzQ0FBc0M7UUFDdEMsSUFBSSxJQUFJO1lBQUUsSUFBSSxDQUFDLFlBQVksQ0FBQyxhQUFhLEVBQUUsTUFBTSxDQUFDLENBQUM7O1lBQzlDLElBQUksQ0FBQyxlQUFlLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDekMsSUFBSSxDQUFDLFFBQVEsR0FBRyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDaEMsQ0FBQztJQUNELElBQUksSUFBSSxJQUFJLEtBQUs7UUFBRSxRQUFRLENBQUMsY0FBYyxDQUFDLE9BQU8sQ0FBQyxFQUFFLEtBQUssRUFBRSxDQUFDO0FBQy9ELENBQUMifQ==