@owlmeans/client-auth 0.1.18-rc.6 → 0.1.18-rc.60

package/build/login/i18n/fr.json

@@ -0,0 +1,41 @@
+{
+    "login": {
+        "title": "Connexion",
+        "subtitle": "Choisissez comment continuer.",
+        "busy": "Ouverture de la connexion…",
+        "empty": "Aucune méthode de connexion n’est configurée pour cette application.",
+        "method": {
+            "google": "Continuer avec Google",
+            "oidc": "Continuer avec {{provider}}",
+            "oidc-default": "Connexion / Inscription",
+            "oidc-client": "Continuer avec {{provider}}",
+            "basic-ed25519": "Se connecter avec une clé",
+            "pk-supervisor": "Clé secrète (opérateur)",
+            "wallet-consumer": "Portefeuille d’identité OwlMeans",
+            "one-time-token": "Se connecter avec un code e-mail",
+            "fallback": "Continuer avec {{method}}"
+        },
+        "terms": {
+            "accept": "J’ai lu et j’accepte {{documents}}.",
+            "terms": "conditions générales",
+            "privacy": "politique de confidentialité",
+            "cookies": "Politique relative aux cookies",
+            "billing": "Conditions de facturation",
+            "product": "Conditions du produit {{product}}",
+            "notice": "Comment nous traitons vos données personnelles : {{notices}}.",
+            "revised": "Dernière mise à jour : {{date}}",
+            "required": "Confirmez {{documents}} pour continuer."
+        },
+        "consent": {
+            "required": "La connexion enregistre un cookie de session. Acceptez les cookies essentiels pour continuer."
+        },
+        "credit": {
+            "powered": "Propulsé par OwlMeans"
+        },
+        "error": {
+            "failed": "La connexion n’a pas abouti. Réessayez.",
+            "blocked": "La fenêtre de connexion a été bloquée. Cliquez sur l’icône de fenêtre contextuelle bloquée dans la barre d’adresse pour l’ouvrir."
+        },
+        "orphaned": "Vous êtes connecté. Vous pouvez fermer cette fenêtre et continuer dans l’application."
+    }
+}

package/build/login/i18n/pl.json

@@ -0,0 +1,41 @@
+{
+    "login": {
+        "title": "Zaloguj się",
+        "subtitle": "Wybierz sposób, w jaki chcesz kontynuować.",
+        "busy": "Otwieranie logowania…",
+        "empty": "Dla tej aplikacji nie skonfigurowano żadnej metody logowania.",
+        "method": {
+            "google": "Kontynuuj z Google",
+            "oidc": "Kontynuuj z {{provider}}",
+            "oidc-default": "Zaloguj się / Zarejestruj się",
+            "oidc-client": "Kontynuuj z {{provider}}",
+            "basic-ed25519": "Zaloguj się kluczem",
+            "pk-supervisor": "Klucz tajny (operator)",
+            "wallet-consumer": "Portfel OwlMeans ID",
+            "one-time-token": "Zaloguj się kodem e-mail",
+            "fallback": "Kontynuuj z {{method}}"
+        },
+        "terms": {
+            "accept": "Przeczytałem(-am) i akceptuję {{documents}}.",
+            "terms": "Regulamin",
+            "privacy": "Politykę prywatności",
+            "cookies": "Politykę plików cookie",
+            "billing": "Warunki rozliczeń",
+            "product": "Warunki produktu {{product}}",
+            "notice": "Jak przetwarzamy Twoje dane osobowe: {{notices}}.",
+            "revised": "Ostatnia aktualizacja: {{date}}",
+            "required": "Aby kontynuować, potwierdź {{documents}}."
+        },
+        "consent": {
+            "required": "Logowanie zapisuje plik cookie sesji. Zaakceptuj niezbędne pliki cookie, aby kontynuować."
+        },
+        "credit": {
+            "powered": "Napędzane przez OwlMeans"
+        },
+        "error": {
+            "failed": "Logowanie nie zostało ukończone. Spróbuj ponownie.",
+            "blocked": "Okno logowania zostało zablokowane. Kliknij ikonę zablokowanego okienka w pasku adresu przeglądarki, aby je otworzyć."
+        },
+        "orphaned": "Zalogowano. Możesz zamknąć to okno i kontynuować w aplikacji."
+    }
+}

package/build/login/i18n/ru.json

@@ -0,0 +1,41 @@
+{
+    "login": {
+        "title": "Вход",
+        "subtitle": "Выберите способ входа.",
+        "busy": "Открываем окно входа…",
+        "empty": "Для этого приложения не настроен ни один способ входа.",
+        "method": {
+            "google": "Продолжить с Google",
+            "oidc": "Продолжить с {{provider}}",
+            "oidc-default": "Войти / Зарегистрироваться",
+            "oidc-client": "Продолжить с {{provider}}",
+            "basic-ed25519": "Войти с ключом",
+            "pk-supervisor": "Секретный ключ (оператор)",
+            "wallet-consumer": "Кошелёк OwlMeans ID",
+            "one-time-token": "Войти по коду из письма",
+            "fallback": "Продолжить с {{method}}"
+        },
+        "terms": {
+            "accept": "Я прочитал(а) и принимаю {{documents}}.",
+            "terms": "Условия использования",
+            "privacy": "Политику конфиденциальности",
+            "cookies": "Политику файлов cookie",
+            "billing": "Условия оплаты",
+            "product": "Условия использования продукта {{product}}",
+            "notice": "Как мы обрабатываем ваши персональные данные: {{notices}}.",
+            "revised": "Последнее обновление: {{date}}",
+            "required": "Чтобы продолжить, подтвердите {{documents}}."
+        },
+        "consent": {
+            "required": "Вход сохраняет сессионный файл cookie. Примите необходимые файлы cookie, чтобы продолжить."
+        },
+        "credit": {
+            "powered": "Работает на OwlMeans"
+        },
+        "error": {
+            "failed": "Вход не завершён. Попробуйте ещё раз.",
+            "blocked": "Окно входа заблокировано. Нажмите на значок заблокированного всплывающего окна в адресной строке браузера, чтобы открыть его."
+        },
+        "orphaned": "Вход выполнен. Можете закрыть это окно и вернуться в приложение."
+    }
+}

package/build/login/i18n/uk.json

@@ -0,0 +1,41 @@
+{
+    "login": {
+        "title": "Вхід",
+        "subtitle": "Оберіть спосіб входу.",
+        "busy": "Відкриваємо вікно входу…",
+        "empty": "Для цього застосунку не налаштовано жодного способу входу.",
+        "method": {
+            "google": "Продовжити з Google",
+            "oidc": "Продовжити з {{provider}}",
+            "oidc-default": "Увійти / Зареєструватися",
+            "oidc-client": "Продовжити з {{provider}}",
+            "basic-ed25519": "Увійти з ключем",
+            "pk-supervisor": "Секретний ключ (оператор)",
+            "wallet-consumer": "Гаманець OwlMeans ID",
+            "one-time-token": "Увійти за кодом з листа",
+            "fallback": "Продовжити з {{method}}"
+        },
+        "terms": {
+            "accept": "Я прочитав(-ла) і приймаю {{documents}}.",
+            "terms": "Умови користування",
+            "privacy": "Політику конфіденційності",
+            "cookies": "Політику файлів cookie",
+            "billing": "Умови оплати",
+            "product": "Умови продукту {{product}}",
+            "notice": "Як ми обробляємо ваші персональні дані: {{notices}}.",
+            "revised": "Востаннє оновлено: {{date}}",
+            "required": "Щоб продовжити, підтвердьте {{documents}}."
+        },
+        "consent": {
+            "required": "Вхід зберігає сеансовий файл cookie. Прийміть необхідні файли cookie, щоб продовжити."
+        },
+        "credit": {
+            "powered": "Працює на OwlMeans"
+        },
+        "error": {
+            "failed": "Вхід не завершено. Спробуйте ще раз.",
+            "blocked": "Вікно входу заблоковано. Натисніть значок заблокованого спливаючого вікна в адресному рядку браузера, щоб відкрити його."
+        },
+        "orphaned": "Вхід виконано. Можете закрити це вікно й повернутися до застосунку."
+    }
+}

package/build/login/i18n.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=i18n.d.ts.map

package/build/login/i18n.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"i18n.d.ts","sourceRoot":"","sources":["../../src/login/i18n.ts"],"names":[],"mappings":""}

package/build/login/i18n.js

@@ -0,0 +1,27 @@
+import en from './i18n/en.json' with { type: 'json' };
+import pl from './i18n/pl.json' with { type: 'json' };
+import ru from './i18n/ru.json' with { type: 'json' };
+import be from './i18n/be.json' with { type: 'json' };
+import uk from './i18n/uk.json' with { type: 'json' };
+import es from './i18n/es.json' with { type: 'json' };
+import de from './i18n/de.json' with { type: 'json' };
+import fr from './i18n/fr.json' with { type: 'json' };
+import { i18nHelper } from '@owlmeans/i18n';
+/**
+ * The sign-in screen's copy, registered into the `auth` library resource.
+ *
+ * `_addI18n` PUSHES rather than replaces, so this coexists with `@owlmeans/web-client`'s own
+ * `auth` registration (which owns `dispatcher.*` and `surrogate.*`) and the two merge by tier and
+ * priority. Registering here rather than in a UI package is what lets the plain fallback screen
+ * and every styled one read the same keys — so the seven-language rule holds on every path a user
+ * can actually reach, not only the pretty one.
+ */
+i18nHelper.addI18nLib('en', 'auth', en);
+i18nHelper.addI18nLib('pl', 'auth', pl);
+i18nHelper.addI18nLib('ru', 'auth', ru);
+i18nHelper.addI18nLib('be', 'auth', be);
+i18nHelper.addI18nLib('uk', 'auth', uk);
+i18nHelper.addI18nLib('es', 'auth', es);
+i18nHelper.addI18nLib('de', 'auth', de);
+i18nHelper.addI18nLib('fr', 'auth', fr);
+//# sourceMappingURL=i18n.js.map

package/build/login/i18n.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"i18n.js","sourceRoot":"","sources":["../../src/login/i18n.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,MAAM,gBAAgB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAA;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAE3C;;;;;;;;GAQG;AACH,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;AACvC,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;AACvC,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;AACvC,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;AACvC,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;AACvC,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;AACvC,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA;AACvC,UAAU,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,CAAA"}

package/build/login/index.d.ts

@@ -0,0 +1,27 @@
+import './i18n.js';
+export * from './consts.js';
+export * from './types.js';
+export type * from './env/types.js';
+export type * from './adopt/types.js';
+export type * from './methods/types.js';
+export type * from './resume/types.js';
+export type * from './terms/types.js';
+export type * from './credit/types.js';
+export type * from './surrogate/types.js';
+export type * from './land/types.js';
+export type * from './start/types.js';
+export * from './env.js';
+export * from './adopt.js';
+export * from './methods.js';
+export * from './flow.js';
+export * from './resume.js';
+export * from './terms-config.js';
+export * from './terms.js';
+export * from './credit.js';
+export * from './surrogate.js';
+export * from './screen.js';
+export * from './service.js';
+export * from './start.js';
+export * from './hook.js';
+export * from './land.js';
+//# sourceMappingURL=index.d.ts.map

package/build/login/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/login/index.ts"],"names":[],"mappings":"AAAA,OAAO,WAAW,CAAA;AAElB,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAC1B,mBAAmB,gBAAgB,CAAA;AACnC,mBAAmB,kBAAkB,CAAA;AACrC,mBAAmB,oBAAoB,CAAA;AACvC,mBAAmB,mBAAmB,CAAA;AACtC,mBAAmB,kBAAkB,CAAA;AACrC,mBAAmB,mBAAmB,CAAA;AACtC,mBAAmB,sBAAsB,CAAA;AACzC,mBAAmB,iBAAiB,CAAA;AACpC,mBAAmB,kBAAkB,CAAA;AACrC,cAAc,UAAU,CAAA;AACxB,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,mBAAmB,CAAA;AACjC,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,WAAW,CAAA"}

package/build/login/index.js

@@ -0,0 +1,18 @@
+import './i18n.js';
+export * from './consts.js';
+export * from './types.js';
+export * from './env.js';
+export * from './adopt.js';
+export * from './methods.js';
+export * from './flow.js';
+export * from './resume.js';
+export * from './terms-config.js';
+export * from './terms.js';
+export * from './credit.js';
+export * from './surrogate.js';
+export * from './screen.js';
+export * from './service.js';
+export * from './start.js';
+export * from './hook.js';
+export * from './land.js';
+//# sourceMappingURL=index.js.map

package/build/login/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/login/index.ts"],"names":[],"mappings":"AAAA,OAAO,WAAW,CAAA;AAElB,cAAc,aAAa,CAAA;AAC3B,cAAc,YAAY,CAAA;AAU1B,cAAc,UAAU,CAAA;AACxB,cAAc,YAAY,CAAA;AAC1B,cAAc,cAAc,CAAA;AAC5B,cAAc,WAAW,CAAA;AACzB,cAAc,aAAa,CAAA;AAC3B,cAAc,mBAAmB,CAAA;AACjC,cAAc,YAAY,CAAA;AAC1B,cAAc,aAAa,CAAA;AAC3B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,WAAW,CAAA;AACzB,cAAc,WAAW,CAAA"}

package/build/login/land/types.d.ts

@@ -0,0 +1,52 @@
+import type { LoginLandingParams } from '../types.js';
+/** Where a finished sign-in (or a pending step) lands. */
+export interface LoginLanding {
+    alias: string;
+    params?: LoginLandingParams;
+    query?: LoginLandingParams;
+    /** The step alias this landing came from, when it came from one. */
+    step?: string;
+}
+/** Options for {@link LoginService.landAfterLogin}-shaped helpers (./land.js). */
+export interface LandOptions {
+    /** Where to land when nothing else claims the flow. Defaults to `{ alias: HOME }`. */
+    fallback?: LoginLanding;
+    /** `false` skips `resumeSuspendedFlow` — the caller already has its own concrete destination. */
+    resume?: boolean;
+    /** Skip every step up to and including this alias — the resume point for a step's re-entry. */
+    after?: string;
+    /**
+     * Overrides the step/hook timeout for this call. Mainly for tests; production callers leave it
+     * at the default (`LOGIN_STEP_TIMEOUT`).
+     */
+    stepTimeout?: number;
+}
+/** Where one context's finished sign-in goes: its pending steps, a suspended flow, or the fallback. */
+export interface LoginLandingHelper {
+    /**
+     * Where a finished sign-in should go: the first pending step, else a suspended flow, else the
+     * fallback (ordinarily `HOME`).
+     *
+     * Re-checks `env().surrogate` even though {@link landAfterLogin} already did — this function is
+     * also called directly (e.g. from `useContinueLogin`, after the surrogate window has already
+     * closed), and the check is cheap insurance either way: **no step and no landing hook ever runs
+     * inside the surrogate popup.** It has nothing of its own to collect and nowhere to navigate —
+     * the popup's own `DispatcherHOC` has no `navigate() → HOME` at all.
+     */
+    continueLogin: (opts?: LandOptions) => Promise<LoginLanding>;
+    /**
+     * The whole post-sign-in landing decision: run any due landing hooks for a freshly seen token,
+     * then delegate to {@link continueLogin} for where the flow actually goes.
+     *
+     * This is what a plugin that just adopted a token calls in place of the old inline
+     * "`resumeSuspendedFlow` else `HOME`" — `DispatcherHOC`, the supervisor plugin and both Google
+     * plugins all replace their own copy of that logic with this one.
+     */
+    landAfterLogin: (opts?: LandOptions) => Promise<LoginLanding>;
+    /**
+     * The absolute URL a landing resolves to — the same shape the supervisor and Google plugins
+     * already build their own `window.location.href` from.
+     */
+    landingUrl: (landing: LoginLanding) => Promise<string>;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/login/land/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/login/land/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AAErD,0DAA0D;AAC1D,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,kBAAkB,CAAA;IAC3B,KAAK,CAAC,EAAE,kBAAkB,CAAA;IAC1B,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,kFAAkF;AAClF,MAAM,WAAW,WAAW;IAC1B,sFAAsF;IACtF,QAAQ,CAAC,EAAE,YAAY,CAAA;IACvB,iGAAiG;IACjG,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,+FAA+F;IAC/F,KAAK,CAAC,EAAE,MAAM,CAAA;IACd;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,uGAAuG;AACvG,MAAM,WAAW,kBAAkB;IACjC;;;;;;;;;OASG;IACH,aAAa,EAAE,CAAC,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC5D;;;;;;;OAOG;IACH,cAAc,EAAE,CAAC,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,YAAY,CAAC,CAAA;IAC7D;;;OAGG;IACH,UAAU,EAAE,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CACvD"}

package/build/login/land/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/login/land/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/login/land/types.ts"],"names":[],"mappings":""}

package/build/login/land.d.ts

@@ -0,0 +1,6 @@
+import type { LoginContext } from './types.js';
+import type { LoginLandingHelper } from './land/types.js';
+export declare const makeLoginLandingHelper: (ctx: LoginContext) => LoginLandingHelper;
+/** The landing helper of a context — one per context. */
+export declare const loginLandingOf: (target: LoginContext) => LoginLandingHelper;
+//# sourceMappingURL=land.d.ts.map

package/build/login/land.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"land.d.ts","sourceRoot":"","sources":["../../src/login/land.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,YAAY,EAAgB,MAAM,YAAY,CAAA;AAC5D,OAAO,KAAK,EAA6B,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AA6BpF,eAAO,MAAM,sBAAsB,QAAS,YAAY,KAAG,kBA4G1D,CAAA;AAED,yDAAyD;AACzD,eAAO,MAAM,cAAc,8CAA6C,CAAA"}

package/build/login/land.js

@@ -0,0 +1,122 @@
+import { DISPATCHER } from '@owlmeans/auth';
+import { HOME, memoHelper } from '@owlmeans/context';
+import { DEFAULT_ALIAS as AUTH_ALIAS } from '../consts.js';
+import { ensureLoginService } from './service.js';
+import { LOGIN_LANDED_STORAGE, LOGIN_STEP_TIMEOUT } from './consts.js';
+import { flowLandingOf } from '@owlmeans/client-flow';
+/**
+ * Race a promise against a bound, resolving to `onTimeout` (never rejecting) if the bound wins.
+ *
+ * A synchronous throw from the wrapped call is turned into a rejection by the caller before this
+ * ever sees it, so the only two outcomes here are "settled in time" and "timed out". `onTimeout`
+ * defaults to `undefined` — every existing caller that omits it keeps its old fail-open meaning;
+ * `continueLogin` passes a step's own `required` flag through it so a step that hangs is read the
+ * same way as one that throws.
+ */
+const withTimeout = async (promise, ms, onTimeout) => {
+    let timer;
+    try {
+        return await Promise.race([
+            promise,
+            new Promise(resolve => { timer = setTimeout(() => resolve(onTimeout), ms); }),
+        ]);
+    }
+    finally {
+        if (timer != null) {
+            clearTimeout(timer);
+        }
+    }
+};
+export const makeLoginLandingHelper = (ctx) => {
+    /**
+     * Run every registered landing hook, once per distinct token.
+     *
+     * The stored token is overwritten BEFORE the hooks run, not after: a hook that throws or hangs
+     * must never make the same token re-run the whole set on the next call, since surviving exactly
+     * that is what the bound-and-swallow contract is for. The raw token string is the marker rather
+     * than a digest of it — it never leaves the browser, and this package already keeps the terms
+     * acceptance marker the same way (`LOGIN_TERMS_STORAGE`).
+     */
+    const runLandingHooks = async (login, timeout) => {
+        const auth = ctx.service(AUTH_ALIAS);
+        const token = await auth.authenticated();
+        if (token == null) {
+            return;
+        }
+        let last = null;
+        try {
+            last = window.localStorage.getItem(LOGIN_LANDED_STORAGE);
+        }
+        catch {
+            // Storage can be unavailable (private modes, blocked cookies). Treated as "never landed",
+            // which just re-runs the hooks — the safe direction, same as the terms-acceptance marker.
+        }
+        if (last === token) {
+            return;
+        }
+        try {
+            window.localStorage.setItem(LOGIN_LANDED_STORAGE, token);
+        }
+        catch { /* nothing to remember if storage was never available */ }
+        for (const hook of login.landingHooks()) {
+            await withTimeout(Promise.resolve().then(() => hook.landed(ctx)), timeout).catch(() => undefined);
+        }
+    };
+    const continueLogin = async (opts) => {
+        const login = ensureLoginService(ctx);
+        if (login.env().surrogate) {
+            return { alias: DISPATCHER };
+        }
+        const timeout = opts?.stepTimeout ?? LOGIN_STEP_TIMEOUT;
+        const auth = ctx.service(AUTH_ALIAS);
+        const token = await auth.authenticated();
+        if (token != null) {
+            const steps = login.steps();
+            let start = 0;
+            if (opts?.after != null) {
+                const index = steps.findIndex(step => step.alias === opts.after);
+                if (index >= 0) {
+                    start = index + 1;
+                }
+            }
+            for (let i = start; i < steps.length; i++) {
+                const step = steps[i];
+                // Registration proves only that some module reached the bundle — the step's own screen may
+                // not be bound in this tree (an older target, a partial import). Skipped, never thrown.
+                if (!ctx.hasEntrypoint(step.entrypoint)) {
+                    continue;
+                }
+                // A step that throws or hangs fails OPEN ("not pending") by default — UNLESS it declared
+                // itself `required`, in which case a broken read must show the step rather than let the
+                // person through it unconfirmed (a Terms box moved here from the sign-in screen).
+                const onBroken = step.required === true;
+                const pending = await withTimeout(Promise.resolve().then(() => step.pending(ctx)), timeout, onBroken).catch(() => onBroken);
+                if (pending === true) {
+                    return { alias: step.entrypoint, query: await step.query?.(ctx), step: step.alias };
+                }
+            }
+        }
+        if (opts?.resume !== false) {
+            const landing = await flowLandingOf(ctx).resumeSuspendedFlow();
+            if (landing != null) {
+                return { alias: landing.entrypoint, query: landing.query };
+            }
+        }
+        return opts?.fallback ?? { alias: HOME };
+    };
+    const landAfterLogin = async (opts) => {
+        const login = ensureLoginService(ctx);
+        // Never run a step or a landing hook while THIS document is the surrogate popup — see the note
+        // on `continueLogin`.
+        if (login.env().surrogate) {
+            return { alias: DISPATCHER };
+        }
+        await runLandingHooks(login, opts?.stepTimeout ?? LOGIN_STEP_TIMEOUT);
+        return continueLogin(opts);
+    };
+    const landingUrl = async (landing) => await ctx.entrypoint(landing.alias).url({ params: landing.params, query: landing.query }, { absolute: true });
+    return { continueLogin, landAfterLogin, landingUrl };
+};
+/** The landing helper of a context — one per context. */
+export const loginLandingOf = memoHelper.oncePer(makeLoginLandingHelper);
+//# sourceMappingURL=land.js.map

package/build/login/land.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"land.js","sourceRoot":"","sources":["../../src/login/land.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC3C,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAGpD,OAAO,EAAE,aAAa,IAAI,UAAU,EAAE,MAAM,cAAc,CAAA;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAGjD,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAA;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAA;AAErD;;;;;;;;GAQG;AACH,MAAM,WAAW,GAAG,KAAK,EACvB,OAAmB,EAAE,EAAU,EAAE,SAAa,EACtB,EAAE;IAC1B,IAAI,KAAgD,CAAA;IACpD,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAgB;YACvC,OAAO;YACP,IAAI,OAAO,CAAgB,OAAO,CAAC,EAAE,GAAG,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAA,CAAC,CAAC,CAAC;SAC5F,CAAC,CAAA;IACJ,CAAC;YAAS,CAAC;QACT,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,YAAY,CAAC,KAAK,CAAC,CAAA;QACrB,CAAC;IACH,CAAC;AACH,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAiB,EAAsB,EAAE;IAC9E;;;;;;;;OAQG;IACH,MAAM,eAAe,GAAG,KAAK,EAAE,KAAmB,EAAE,OAAe,EAAiB,EAAE;QACpF,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAc,UAAU,CAAC,CAAA;QACjD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAA;QACxC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,OAAM;QACR,CAAC;QAED,IAAI,IAAI,GAAkB,IAAI,CAAA;QAC9B,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAA;QAC1D,CAAC;QAAC,MAAM,CAAC;YACP,0FAA0F;YAC1F,0FAA0F;QAC5F,CAAC;QACD,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,OAAM;QACR,CAAC;QAED,IAAI,CAAC;YACH,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAA;QAC1D,CAAC;QAAC,MAAM,CAAC,CAAC,wDAAwD,CAAC,CAAC;QAEpE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,YAAY,EAAE,EAAE,CAAC;YACxC,MAAM,WAAW,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QACnG,CAAC;IACH,CAAC,CAAA;IAED,MAAM,aAAa,GAAG,KAAK,EAAE,IAAkB,EAAyB,EAAE;QACxE,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;QACrC,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;YAC1B,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAA;QAC9B,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,EAAE,WAAW,IAAI,kBAAkB,CAAA;QACvD,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAc,UAAU,CAAC,CAAA;QACjD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAA;QAExC,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;YAClB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,EAAE,CAAA;YAC3B,IAAI,KAAK,GAAG,CAAC,CAAA;YACb,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC;gBACxB,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK,CAAC,CAAA;gBAChE,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;oBACf,KAAK,GAAG,KAAK,GAAG,CAAC,CAAA;gBACnB,CAAC;YACH,CAAC;YAED,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;gBACrB,2FAA2F;gBAC3F,wFAAwF;gBACxF,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;oBACxC,SAAQ;gBACV,CAAC;gBAED,yFAAyF;gBACzF,wFAAwF;gBACxF,kFAAkF;gBAClF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAA;gBACvC,MAAM,OAAO,GAAG,MAAM,WAAW,CAC/B,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CACnE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,CAAA;gBAEvB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACrB,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,KAAK,EAAE,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,CAAA;gBACrF,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,IAAI,EAAE,MAAM,KAAK,KAAK,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,GAA+B,CAAC,CAAC,mBAAmB,EAAE,CAAA;YAC1F,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gBACpB,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,UAAU,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAA;YAC5D,CAAC;QACH,CAAC;QAED,OAAO,IAAI,EAAE,QAAQ,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAA;IAC1C,CAAC,CAAA;IAED,MAAM,cAAc,GAAG,KAAK,EAAE,IAAkB,EAAyB,EAAE;QACzE,MAAM,KAAK,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;QACrC,+FAA+F;QAC/F,sBAAsB;QACtB,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;YAC1B,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAA;QAC9B,CAAC;QAED,MAAM,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,IAAI,kBAAkB,CAAC,CAAA;QAErE,OAAO,aAAa,CAAC,IAAI,CAAC,CAAA;IAC5B,CAAC,CAAA;IAED,MAAM,UAAU,GAAG,KAAK,EAAE,OAAqB,EAAmB,EAAE,CAClE,MAAM,GAAG,CAAC,UAAU,CAA2B,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAC/D,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CACrE,CAAA;IAEH,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,CAAA;AACtD,CAAC,CAAA;AAED,yDAAyD;AACzD,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAA"}

package/build/login/methods/types.d.ts

@@ -0,0 +1,30 @@
+import type { LoginScreenConfig } from '@owlmeans/config';
+import type { LoginMethod, LoginMethodContext, LoginMethodSource } from '../types.js';
+/** The sign-in methods on offer: the global source registry and the resolution of a screen's list. */
+export interface LoginMethodsHelper {
+    /** Register a source globally — replacing an earlier one of the same alias. */
+    registerMethodSource: (source: LoginMethodSource) => void;
+    /** The globally registered sources, in registration order. */
+    listMethodSources: () => LoginMethodSource[];
+    /**
+     * Everything the current environment may be offered, in the order it should be offered in.
+     *
+     * Resolution order matters and is not arbitrary:
+     *
+     * 1. Sources produce candidates. A source that throws is skipped rather than taking the screen
+     *    down — a misconfigured provider list must not remove the sign-in method that does work.
+     * 2. `restricted` candidates are dropped unless the configuration named them, which is what makes
+     *    an operator login opt-in rather than merely unadvertised.
+     * 3. An explicit `methods` list is both a filter AND the order, because an app that bothered to
+     *    list them means that list.
+     */
+    resolveLoginMethods: (ctx: LoginMethodContext, cfg?: LoginScreenConfig, extra?: LoginMethodSource[]) => LoginMethod[];
+    /**
+     * The method a screen highlights and focuses.
+     *
+     * The first `primary` one, else the first offered. It is highlighted, never started: requirement
+     * one of this whole feature is that nothing leaves the document without a click.
+     */
+    primaryLoginMethod: (methods: LoginMethod[]) => LoginMethod | null;
+}
+//# sourceMappingURL=types.d.ts.map

package/build/login/methods/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/login/methods/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAA;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAErF,sGAAsG;AACtG,MAAM,WAAW,kBAAkB;IACjC,+EAA+E;IAC/E,oBAAoB,EAAE,CAAC,MAAM,EAAE,iBAAiB,KAAK,IAAI,CAAA;IACzD,8DAA8D;IAC9D,iBAAiB,EAAE,MAAM,iBAAiB,EAAE,CAAA;IAC5C;;;;;;;;;;;OAWG;IACH,mBAAmB,EAAE,CACnB,GAAG,EAAE,kBAAkB,EAAE,GAAG,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,EAAE,iBAAiB,EAAE,KAC1E,WAAW,EAAE,CAAA;IAClB;;;;;OAKG;IACH,kBAAkB,EAAE,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,WAAW,GAAG,IAAI,CAAA;CACnE"}

package/build/login/methods/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/build/login/methods/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/login/methods/types.ts"],"names":[],"mappings":""}

package/build/login/methods.d.ts

@@ -0,0 +1,7 @@
+import type { LoginMethod } from './types.js';
+import type { LoginMethodsHelper } from './methods/types.js';
+export declare const createLoginMethodsHelper: () => LoginMethodsHelper;
+export declare const loginMethodsHelper: LoginMethodsHelper;
+/** @deprecated compat:factory-refactor — use `loginMethodsHelper.primaryLoginMethod(…)` */
+export declare const primaryLoginMethod: (methods: LoginMethod[]) => LoginMethod | null;
+//# sourceMappingURL=methods.d.ts.map

package/build/login/methods.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"methods.d.ts","sourceRoot":"","sources":["../../src/login/methods.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAyC,MAAM,YAAY,CAAA;AACpF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAmB5D,eAAO,MAAM,wBAAwB,QAAO,kBAgF3C,CAAA;AAED,eAAO,MAAM,kBAAkB,oBAA6B,CAAA;AAE5D,2FAA2F;AAC3F,eAAO,MAAM,kBAAkB,YAAa,WAAW,EAAE,KAAG,WAAW,GAAG,IAC1B,CAAA"}

package/build/login/methods.js

@@ -0,0 +1,87 @@
+import { DEFAULT_METHOD_ORDER } from './consts.js';
+import { logger } from '@owlmeans/log';
+const log = logger('client-auth:login');
+/**
+ * The module-global registry of method SOURCES.
+ *
+ * A source, rather than a method, because the two things that offer sign-in methods answer
+ * different questions at different times: the plugin registry knows what code is loaded, and the
+ * OIDC configuration knows what an entity is federated with. Both are answered per render — a
+ * provider list can arrive from the api-config middleware after the first paint.
+ *
+ * Global, like the `AuthenticationPlugin` map it mirrors, because a package registers its source
+ * from a side-effect import that has no context to hang it on. A context-scoped registry exists
+ * alongside it on the login service, and both are merged by `resolveLoginMethods`.
+ */
+const sources = [];
+export const createLoginMethodsHelper = () => {
+    const registerMethodSource = (source) => {
+        const existing = sources.findIndex(candidate => candidate.alias === source.alias);
+        if (existing >= 0) {
+            sources.splice(existing, 1);
+        }
+        sources.push(source);
+    };
+    const listMethodSources = () => [...sources];
+    /** Normalize a config entry, which may be a bare id or a full override object. */
+    const asConfig = (entry) => typeof entry === 'string' ? { id: entry } : entry;
+    const merge = (method, override) => override == null ? method : {
+        ...method,
+        ...(override.label != null ? { label: override.label } : {}),
+        ...(override.i18nKey != null ? { i18nKey: override.i18nKey } : {}),
+        ...(override.icon != null ? { icon: override.icon } : {}),
+        ...(override.order != null ? { order: override.order } : {}),
+        ...(override.emphasis != null ? { emphasis: override.emphasis } : {}),
+        ...(override.params != null ? { params: { ...method.params, ...override.params } } : {}),
+    };
+    const resolveLoginMethods = (ctx, cfg, extra = []) => {
+        const candidates = [];
+        for (const source of [...sources, ...extra]) {
+            try {
+                candidates.push(...source.list(ctx));
+            }
+            catch (e) {
+                log.warn('Login method source failed', { source: source.alias, error: e });
+            }
+        }
+        const overrides = cfg?.overrides ?? {};
+        const listed = cfg?.methods?.map(asConfig);
+        const listedIds = listed?.map(entry => entry.id).filter((id) => id != null);
+        const offered = candidates
+            .filter(method => {
+            const override = overrides[method.id] ?? listed?.find(entry => entry.id === method.id);
+            if (override?.enabled === false || override?.hidden === true) {
+                return false;
+            }
+            // A restricted method is offered only where the configuration asked for it — by naming it in
+            // `methods`, or by enabling it in `overrides`. Registering the plugin is deliberately not
+            // enough: an operator login that appears wherever its code happens to be bundled is an
+            // operator login in production.
+            if (method.restricted === true
+                && listedIds?.includes(method.id) !== true
+                && override?.enabled !== true) {
+                return false;
+            }
+            return true;
+        })
+            .map(method => merge(method, overrides[method.id]));
+        if (listedIds != null) {
+            return listedIds
+                .map(id => {
+                const method = offered.find(candidate => candidate.id === id);
+                return method != null ? merge(method, listed?.find(entry => entry.id === id)) : null;
+            })
+                .filter((method) => method != null);
+        }
+        return offered.sort((a, b) => {
+            const order = (a.order ?? DEFAULT_METHOD_ORDER) - (b.order ?? DEFAULT_METHOD_ORDER);
+            return order !== 0 ? order : a.id.localeCompare(b.id);
+        });
+    };
+    const primaryLoginMethod = (methods) => methods.find(method => method.emphasis === 'primary') ?? methods[0] ?? null;
+    return { registerMethodSource, listMethodSources, resolveLoginMethods, primaryLoginMethod };
+};
+export const loginMethodsHelper = createLoginMethodsHelper();
+/** @deprecated compat:factory-refactor — use `loginMethodsHelper.primaryLoginMethod(…)` */
+export const primaryLoginMethod = (methods) => loginMethodsHelper.primaryLoginMethod(methods);
+//# sourceMappingURL=methods.js.map

package/build/login/methods.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"methods.js","sourceRoot":"","sources":["../../src/login/methods.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAGlD,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAA;AAEtC,MAAM,GAAG,GAAG,MAAM,CAAC,mBAAmB,CAAC,CAAA;AAEvC;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,GAAwB,EAAE,CAAA;AAEvC,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAuB,EAAE;IAC/D,MAAM,oBAAoB,GAAG,CAAC,MAAyB,EAAQ,EAAE;QAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,CAAA;QACjF,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;YAClB,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;QAC7B,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IACtB,CAAC,CAAA;IAED,MAAM,iBAAiB,GAAG,GAAwB,EAAE,CAAC,CAAC,GAAG,OAAO,CAAC,CAAA;IAEjE,kFAAkF;IAClF,MAAM,QAAQ,GAAG,CAAC,KAAiC,EAAqB,EAAE,CACxE,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAA;IAEnD,MAAM,KAAK,GAAG,CAAC,MAAmB,EAAE,QAAuC,EAAe,EAAE,CAC1F,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1B,GAAG,MAAM;QACT,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,QAAQ,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,GAAG,CAAC,QAAQ,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,QAAQ,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,QAAQ,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzF,CAAA;IAEH,MAAM,mBAAmB,GAAG,CAC1B,GAAuB,EAAE,GAAuB,EAAE,KAAK,GAAwB,EAAE,EAClE,EAAE;QACjB,MAAM,UAAU,GAAkB,EAAE,CAAA;QACpC,KAAK,MAAM,MAAM,IAAI,CAAC,GAAG,OAAO,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC;YAC5C,IAAI,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAA;YACtC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAA;YAC5E,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,GAAG,EAAE,SAAS,IAAI,EAAE,CAAA;QACtC,MAAM,MAAM,GAAG,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC1C,MAAM,SAAS,GAAG,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAgB,EAAE,CAAC,EAAE,IAAI,IAAI,CAAC,CAAA;QAEzF,MAAM,OAAO,GAAG,UAAU;aACvB,MAAM,CAAC,MAAM,CAAC,EAAE;YACf,MAAM,QAAQ,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAC,CAAA;YACtF,IAAI,QAAQ,EAAE,OAAO,KAAK,KAAK,IAAI,QAAQ,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC;gBAC7D,OAAO,KAAK,CAAA;YACd,CAAC;YACD,6FAA6F;YAC7F,0FAA0F;YAC1F,uFAAuF;YACvF,gCAAgC;YAChC,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI;mBACzB,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,IAAI;mBACvC,QAAQ,EAAE,OAAO,KAAK,IAAI,EAAE,CAAC;gBAChC,OAAO,KAAK,CAAA;YACd,CAAC;YACD,OAAO,IAAI,CAAA;QACb,CAAC,CAAC;aACD,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;QAErD,IAAI,SAAS,IAAI,IAAI,EAAE,CAAC;YACtB,OAAO,SAAS;iBACb,GAAG,CAAC,EAAE,CAAC,EAAE;gBACR,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAA;gBAC7D,OAAO,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YACtF,CAAC,CAAC;iBACD,MAAM,CAAC,CAAC,MAAM,EAAyB,EAAE,CAAC,MAAM,IAAI,IAAI,CAAC,CAAA;QAC9D,CAAC;QAED,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YAC3B,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,oBAAoB,CAAC,CAAA;YACnF,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;QACvD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,MAAM,kBAAkB,GAAG,CAAC,OAAsB,EAAsB,EAAE,CACxE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,CAAA;IAE7E,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,CAAA;AAC7F,CAAC,CAAA;AAED,MAAM,CAAC,MAAM,kBAAkB,GAAG,wBAAwB,EAAE,CAAA;AAE5D,2FAA2F;AAC3F,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,OAAsB,EAAsB,EAAE,CAC/E,kBAAkB,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAA"}