@owlmeans/server-oidc-rp 0.1.1 → 0.1.3

package/LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2024 OwlMeans Common — Fullstack typescript framework
+Copyright (c) 2026 OwlMeans Common — Fullstack typescript framework
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/README.md

@@ -1,520 +1,105 @@
 # @owlmeans/server-oidc-rp
 
-The **@owlmeans/server-oidc-rp** package provides server-side OpenID Connect Relying Party (RP) functionality for OwlMeans Common Libraries, enabling secure authentication and authorization through OIDC protocols in fullstack applications.
+Server-side OIDC relying party — registers the OIDC guard, wrapping service, gate, and IdP-side client wiring.
 
-## Purpose
+## Overview
 
-This package serves as a comprehensive OIDC client implementation for server-side applications, specifically designed for:
-
-- **OIDC Client Management**: Create and manage OpenID Connect clients with automatic discovery
-- **Token Operations**: Handle authorization code grants, client credentials, token refresh, and introspection
-- **Provider Integration**: Connect to multiple OIDC providers with flexible configuration
-- **Account Linking**: Link external OIDC accounts with internal user profiles
-- **Security Integration**: Integrate with OwlMeans authentication and authorization system
-- **Module-based Authentication**: Provide OIDC guards and gates for route protection
-
-## Key Concepts
-
-### OpenID Connect Relying Party
-A Relying Party (RP) is an OAuth 2.0 client application that uses OpenID Connect to verify the identity of end-users. This package implements server-side RP functionality.
-
-### Provider Configuration
-The package supports multiple OIDC providers with configuration including discovery URLs, client credentials, and service mappings.
-
-### Account Linking
-Enables linking external OIDC provider accounts with internal user accounts, supporting both automatic linking and manual credential mapping.
-
-### Token Management
-Comprehensive token lifecycle management including acquisition, refresh, introspection, and validation.
+- `appendOidcGuard(context)` — registers the OIDC guard service
+- `makeOidcWrappingService()` / `makeOidcGate()` — token wrapping service and gate factory
+- `setupOidcGuard(modules, coguards?, extras?)` — attaches the OIDC guard to module declarations
+- `setupAuthServiceModules(...)` — wires external auth modules
+- `makeOidcClientService()` / `OidcClientService` — IdP-side client (e.g., Keycloak admin)
+- Subpath `./auth` — admin-client constants like `OIDC_ADMIN_CLIENT`
 
 ## Installation
 
 ```bash
-npm install @owlmeans/server-oidc-rp
+bun add @owlmeans/server-oidc-rp
 ```
 
-## API Reference
-
-### Types
+## Usage
 
-#### `OidcClientService`
-Main service interface for OIDC client operations.
+Register services in `context.ts`:
 
 ```typescript
-interface OidcClientService extends InitializedService {
-  getConfiguration(clientId: string | Partial<OidcProviderConfig>): Promise<OidcClientDescriptor>
-  getClient(clientId: string | OidcClientDescriptor | Partial<OidcProviderConfig>): Promise<OidcClientAdapter>
-  getConfig(clientId: string | Partial<OidcProviderConfig>): Promise<OidcProviderConfig | undefined>
-  getDefault(): string | undefined
-  
-  registerTemporaryProvider(config: OidcProviderConfig): OidcProviderConfig
-  unregisterTemporaryProvider(params: Partial<OidcProviderConfig>): void
-  hasProvider(params: Partial<OidcProviderConfig>): boolean
-  entityToClientId(params: Partial<OidcProviderConfig>): string
-  
-  providerApi(): ProviderApiService | null
-  accountLinking(): AccountLinkingService | null
-}
-```
-
-#### `OidcClientAdapter`
-Interface for individual OIDC client instances.
+import {
+  appendOidcGuard, makeOidcWrappingService, makeOidcGate, makeOidcClientService
+} from '@owlmeans/server-oidc-rp'
 
-```typescript
-interface OidcClientAdapter {
-  getMetadata(): ServerMetadata
-  getClientId(): string
-  getConfig(): OidcProviderConfig
-  makeAuthUrl(params: Record<string, string>): string
-  grantWithCredentials(): Promise<TokenSet>
-  grantWithCode(currentUrl: string, checks: AuthorizationCodeGrantChecks, params: Record<string, string>): Promise<TokenSet>
-  refresh(tokenSet: TokenSetParameters | string): Promise<TokenSetParameters>
-  introspect(tokenSet: TokenSetParameters, type?: string): Promise<IntrospectionResponse>
-}
+context.registerService(makeOidcWrappingService())
+context.registerService(makeOidcGate())
+context.registerService(makeOidcClientService())
+appendOidcGuard<C, T>(context)
 ```
 
-#### `AccountLinkingService`
-Service interface for linking OIDC accounts with internal profiles.
+Wire onto modules in `modules.ts`:
 
 ```typescript
-interface AccountLinkingService extends InitializedService {
-  getLinkedProfile(details: ProviderProfileDetails): Promise<AuthPayload | null>
-  linkProfile(details: ProviderProfileDetails, meta: AccountMeta): Promise<AuthPayload>
-  linkCredentials(details: ProviderProfileDetails): Promise<AuthPayload>
-  getOwnerProfiles(entityId: string): Promise<Profile[]>
-  getOwnerCredentials(userId: string, entityId?: string, type?: string): Promise<AuthCredentials | undefined>
-}
-```
+import { setupOidcGuard, setupAuthServiceModules } from '@owlmeans/server-oidc-rp'
 
-#### `ProviderApiService`
-Service interface for interacting with OIDC provider APIs.
-
-```typescript
-interface ProviderApiService extends InitializedService {
-  getUserDetails(token: string, userId: string): Promise<OidcUserDetails>
-  getSettings(token: string, realm: string): Promise<OidcProviderSettings>
-}
+setupOidcGuard(appModules)
+setupAuthServiceModules(appModules)
 ```
 
-#### `Config`
-Configuration interface extending ServerConfig.
-
-```typescript
-interface Config extends ServerConfig, WithSharedConfig {
-  oidc: OidcRpConfig
-}
-
-interface OidcRpConfig extends OidcSharedConfig {
-  accountLinkingService?: string
-  providerApiService?: string
-}
-```
-
-### Factory Functions
-
-#### `makeOidcClientService(alias?: string): OidcClientService`
-
-Creates an OIDC client service instance.
-
-**Parameters:**
-- `alias`: Service alias (defaults to 'oidc-client')
-
-**Returns:** OidcClientService instance
-
-```typescript
-import { makeOidcClientService } from '@owlmeans/server-oidc-rp'
-
-const oidcService = makeOidcClientService('my-oidc-client')
-```
-
-### Guard Functions
-
-#### `appendOidcGuard<C extends Config, T extends Context<C>>(context: T, opts?: OidcGuardOptions): T`
-
-Appends OIDC guard functionality to a context.
-
-**Parameters:**
-- `context`: Server context instance
-- `opts`: Optional OIDC guard configuration
-
-**Returns:** Enhanced context with OIDC guard capabilities
+Configure providers in `config.ts`:
 
 ```typescript
-import { appendOidcGuard } from '@owlmeans/server-oidc-rp'
+import { OIDC_ADMIN_CLIENT } from '@owlmeans/server-oidc-rp/auth'
 
-const enhancedContext = appendOidcGuard(context, {
-  defaultProvider: 'keycloak'
+cfg.oidc ??= {}
+cfg.oidc.providers ??= []
+cfg.oidc.providers.push({
+  clientId: OIDC_ADMIN_CLIENT,
+  basePath: 'realms/master',
+  service: OIDC_PRODUCT,
+  secret: '/etc/master-secret/oidc-admin-secret',
+  internal: true
 })
 ```
 
-#### `setupOidcGuard(modules: CommonModule[], coguards?: string | string[]): void`
-
-Sets up OIDC guard functionality for modules.
-
-**Parameters:**
-- `modules`: Array of modules to enhance
-- `coguards`: Optional co-guard configurations
+Use the IdP-side client in a service:
 
 ```typescript
-import { setupOidcGuard } from '@owlmeans/server-oidc-rp'
+import { DEFAULT_ALIAS as OIDC_SERVICE } from '@owlmeans/server-oidc-rp'
+import type { OidcClientService } from '@owlmeans/server-oidc-rp'
 
-setupOidcGuard(modules, ['authenticated', 'oidc-verified'])
+const oidc = context.service<OidcClientService>(OIDC_SERVICE)
 ```
 
-### Module Setup
-
-#### `setupAuthServiceModules(modules: CommonModule[], serviceAlias: string, prefix?: string): void`
+## API
 
-Sets up authentication service modules with OIDC routes.
+### Service factories
 
-**Parameters:**
-- `modules`: Array of modules to add OIDC routes to
-- `serviceAlias`: Service alias for the routes
-- `prefix`: URL prefix for OIDC routes (defaults to 'oidc-api')
+- `appendOidcGuard<C, T>(context): T` — register the OIDC guard
+- `makeOidcWrappingService(alias?)` — token-wrapping service
+- `makeOidcGate(alias?)` — gate factory
+- `makeOidcClientService(alias?)` — IdP-side client (used to call OIDC admin API)
 
-```typescript
-import { setupAuthServiceModules } from '@owlmeans/server-oidc-rp'
+### Module wiring
 
-setupAuthServiceModules(modules, 'auth-service', 'oidc-api')
-```
+- `setupOidcGuard(modules, coguards?, extras?)` — attach guard to module declarations
+- `setupAuthServiceModules(modules, ...)` — register external auth modules
 
 ### Constants
 
-#### Service Aliases
-```typescript
-const DEFAULT_ALIAS = 'oidc-client'
-const DEF_OIDC_ACCOUNT_LINKING = 'oidc-consumer-account-linking'
-const DEF_OIDC_PROVIDER_API = 'oidc-consumer-provider-api'
-```
-
-#### Route Definitions
-```typescript
-const authService = {
-  provider: {
-    list: 'external-auth:provider:list'
-  },
-  auth: {
-    update: 'external-auth:auth:update'
-  }
-}
-```
-
-#### Cache and Timing Constants
-```typescript
-const OIDC_TOKEN_STORE = 'oidc-token-store'
-const PROVIDER_CACHE_TTL = (5 * 60 - 1) * 1000    // ~5 minutes
-const OIDC_AUTH_LIFTETIME = 24 * 3600 * 1000      // 24 hours
-const OIDC_WRAP_FRESHNESS = (5 * 60 - 1) * 1000   // ~5 minutes
-```
-
-## Usage Examples
-
-### Basic OIDC Client Setup
+- `DEFAULT_ALIAS` — `'oidc-client'`
+- `OIDC_TOKEN_STORE`, `PROVIDER_CACHE_TTL`, `OIDC_AUTH_LIFTETIME`, `OIDC_WRAP_FRESHNESS`
+- `./auth` subpath: `OIDC_ADMIN_CLIENT` and related admin-client constants
 
-```typescript
-import { makeOidcClientService, setupOidcGuard } from '@owlmeans/server-oidc-rp'
-import { makeServerContext, makeServerConfig } from '@owlmeans/server-context'
-
-// Create server context with OIDC configuration
-const config = makeServerConfig('auth-server', {
-  oidc: {
-    providers: [{
-      clientId: 'my-app',
-      secret: 'client-secret',
-      service: 'keycloak',
-      basePath: '/realms/my-realm',
-      def: true
-    }]
-  }
-})
-
-const context = makeServerContext(config)
-
-// Create and register OIDC client service
-const oidcService = makeOidcClientService()
-context.registerService(oidcService)
-
-// Initialize context
-await context.configure().init()
-```
-
-### Using OIDC Client
-
-```typescript
-// Get the OIDC service
-const oidcService = context.service<OidcClientService>('oidc-client')
-
-// Get OIDC client for default provider
-const defaultClientId = oidcService.getDefault()
-const client = await oidcService.getClient(defaultClientId!)
-
-// Create authorization URL
-const authUrl = client.makeAuthUrl({
-  redirect_uri: 'https://myapp.com/callback',
-  scope: 'openid profile email',
-  state: 'random-state'
-})
-
-console.log('Redirect user to:', authUrl)
-```
-
-### Authorization Code Flow
-
-```typescript
-// Handle callback from OIDC provider
-app.get('/callback', async (req, res) => {
-  const client = await oidcService.getClient('my-app')
-  
-  try {
-    const tokenSet = await client.grantWithCode(
-      req.url,
-      { 
-        state: req.query.state,
-        code_verifier: 'stored-code-verifier' // if using PKCE
-      },
-      { flow: 'authorization_code' }
-    )
-    
-    console.log('Access token:', tokenSet.access_token)
-    console.log('ID token:', tokenSet.id_token)
-    
-    // Store tokens securely
-    res.redirect('/dashboard')
-  } catch (error) {
-    console.error('OIDC authentication failed:', error)
-    res.redirect('/login?error=auth_failed')
-  }
-})
-```
-
-### Client Credentials Flow
-
-```typescript
-// Get access token using client credentials
-const client = await oidcService.getClient('service-account')
-const tokenSet = await client.grantWithCredentials()
-
-console.log('Service access token:', tokenSet.access_token)
-
-// Use token for API calls
-const response = await fetch('https://api.service.com/data', {
-  headers: {
-    'Authorization': `Bearer ${tokenSet.access_token}`
-  }
-})
-```
-
-### Token Refresh
-
-```typescript
-// Refresh an expired token
-try {
-  const newTokenSet = await client.refresh(oldTokenSet)
-  console.log('New access token:', newTokenSet.access_token)
-} catch (error) {
-  console.error('Token refresh failed:', error)
-  // Redirect to login
-}
-```
-
-### Token Introspection
-
-```typescript
-// Validate and introspect a token
-const introspection = await client.introspect(tokenSet, 'access_token')
-
-if (introspection.active) {
-  console.log('Token is valid')
-  console.log('Token expires at:', new Date(introspection.exp! * 1000))
-  console.log('Token subject:', introspection.sub)
-} else {
-  console.log('Token is invalid or expired')
-}
-```
-
-### Multiple Provider Configuration
-
-```typescript
-const config = makeServerConfig('multi-provider-app', {
-  oidc: {
-    providers: [
-      {
-        clientId: 'keycloak-client',
-        secret: 'secret1',
-        service: 'keycloak',
-        basePath: '/realms/main',
-        def: true
-      },
-      {
-        clientId: 'google-client',
-        secret: 'secret2',
-        discoveryUrl: 'https://accounts.google.com/.well-known/openid_configuration'
-      }
-    ]
-  }
-})
-
-// Get specific provider clients
-const keycloakClient = await oidcService.getClient('keycloak-client')
-const googleClient = await oidcService.getClient('google-client')
-```
-
-### Account Linking
-
-```typescript
-// Setup account linking service
-const accountLinkingService: AccountLinkingService = createService('account-linking', {
-  getLinkedProfile: async (details) => {
-    // Check if external profile is already linked
-    const existing = await database.findLinkedAccount(details.sub, details.iss)
-    return existing ? existing.authPayload : null
-  },
-  
-  linkProfile: async (details, meta) => {
-    // Link external account to existing user
-    const user = await database.findUserByUsername(meta.username)
-    await database.linkExternalAccount(user.id, details)
-    return createAuthPayload(user)
-  },
-  
-  linkCredentials: async (details) => {
-    // Auto-link based on email or other criteria
-    const user = await database.findUserByEmail(details.email)
-    if (user) {
-      await database.linkExternalAccount(user.id, details)
-      return createAuthPayload(user)
-    }
-    throw new Error('No matching user found')
-  }
-})
-
-context.registerService(accountLinkingService)
-```
-
-### Module Protection with OIDC Guards
-
-```typescript
-import { module, guard } from '@owlmeans/module'
-import { route } from '@owlmeans/route'
-
-// Create protected modules
-const protectedModules = [
-  module(route('profile', '/profile'), guard('oidc-authenticated')),
-  module(route('admin', '/admin'), guard(['oidc-authenticated', 'admin-role']))
-]
-
-// Setup OIDC guards
-setupOidcGuard(protectedModules, 'oidc-authenticated')
-```
-
-## Error Handling
-
-The package throws `AuthManagerError` for various OIDC-related issues:
-
-```typescript
-import { AuthManagerError } from '@owlmeans/auth'
-
-try {
-  const client = await oidcService.getClient('invalid-client')
-} catch (error) {
-  if (error instanceof AuthManagerError) {
-    switch (error.message) {
-      case 'oidc.client.basepath':
-        console.error('OIDC provider base path not configured')
-        break
-      case 'oidc.client.service':
-        console.error('OIDC provider service not specified')
-        break
-      case 'oidc.client.client-id':
-        console.error('OIDC client ID missing')
-        break
-      case 'oidc.client.secert':
-        console.error('OIDC client secret missing')
-        break
-      default:
-        console.error('OIDC error:', error.message)
-    }
-  }
-}
-```
-
-## Integration Patterns
-
-### Express.js Integration
-
-```typescript
-import express from 'express'
-import { makeOidcClientService } from '@owlmeans/server-oidc-rp'
-
-const app = express()
-
-// OIDC login route
-app.get('/login/:provider?', async (req, res) => {
-  const providerId = req.params.provider || oidcService.getDefault()
-  const client = await oidcService.getClient(providerId!)
-  
-  const authUrl = client.makeAuthUrl({
-    redirect_uri: `${req.protocol}://${req.get('host')}/callback`,
-    scope: 'openid profile email',
-    state: generateState()
-  })
-  
-  res.redirect(authUrl)
-})
-
-// OIDC callback route
-app.get('/callback', async (req, res) => {
-  // Handle authorization code flow as shown above
-})
-```
-
-### API Gateway Integration
-
-```typescript
-// Create API gateway with OIDC token validation
-const validateToken = async (req: Request) => {
-  const authHeader = req.headers.authorization
-  if (!authHeader?.startsWith('Bearer ')) {
-    throw new Error('Missing or invalid authorization header')
-  }
-  
-  const token = authHeader.substring(7)
-  const client = await oidcService.getClient(oidcService.getDefault()!)
-  
-  const introspection = await client.introspect({ access_token: token })
-  if (!introspection.active) {
-    throw new Error('Invalid or expired token')
-  }
-  
-  return introspection
-}
-```
-
-## Best Practices
+### Types
 
-1. **Secure Configuration**: Store client secrets securely and never expose them in client-side code
-2. **Token Storage**: Store tokens securely with appropriate encryption and expiration handling
-3. **Error Handling**: Implement comprehensive error handling for all OIDC operations
-4. **Provider Discovery**: Use OIDC discovery when possible for automatic configuration
-5. **Token Validation**: Always validate tokens before using them for authorization decisions
-6. **Account Linking**: Implement secure account linking with proper user consent flows
-7. **Monitoring**: Monitor OIDC operations for security and performance issues
+`OidcClientService`, RP config types — exported from the root entry.
 
-## Dependencies
+## Product-Viable Integration Notes
 
-This package depends on:
-- `@owlmeans/auth` - Authentication framework
-- `@owlmeans/auth-common` - Common authentication utilities
-- `@owlmeans/context` - Context management
-- `@owlmeans/oidc` - Core OIDC functionality
-- `@owlmeans/server-context` - Server context management
-- `@owlmeans/server-module` - Server module system
-- `openid-client` - OpenID Connect client library
-- `jose` - JSON Web Token utilities
+- `makeOidcClientService()` reads provider descriptors from `cfg.oidc.providers`, including Google and internal admin providers.
+- Use `findProvider(predicate)`, `hasProvider(params)`, and `entityToClientId(params)` for provider lookup rather than ad hoc config scans.
+- `setupAuthServiceModules(managerModules, AUTH_API)` wires provider-list and token-update endpoints protected by `GUARD_ED25519`.
+- If OIDC/Google is only the login provider and local identity records hold authorization, do not re-add `appendOidcGuard()`, `makeOidcGate()`, or `setupOidcGuard()` as product authorization. Use a product-specific `GateService` over local profile scopes.
 
 ## Related Packages
 
-- [`@owlmeans/web-oidc-rp`](../web-oidc-rp) - Web client OIDC Relying Party
-- [`@owlmeans/oidc`](../oidc) - Core OIDC functionality
-- [`@owlmeans/server-auth`](../server-auth) - Server authentication framework
-- [`@owlmeans/auth`](../auth) - Authentication foundation
+- [`@owlmeans/oidc`](../oidc) — shared `OIDC_GATE`, `OIDC_GUARD`, types
+- [`@owlmeans/server-auth`](../server-auth) — works alongside the OIDC guard for token verification
+- [`@owlmeans/server-context`](../server-context) — base context where services are registered
+- [`@owlmeans/auth-common`](../auth-common) — `DEFAULT_GUARD` co-attached via `setupOidcGuard`

package/build/actions/init.d.ts

@@ -1,3 +1,3 @@
-import type { RefedModuleHandler } from '@owlmeans/server-module';
-export declare const init: RefedModuleHandler;
+import type { RefedEntrypointHandler } from '@owlmeans/server-entrypoint';
+export declare const init: RefedEntrypointHandler;
 //# sourceMappingURL=init.d.ts.map

package/build/actions/init.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/actions/init.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAiBjE,eAAO,MAAM,IAAI,EAAE,kBAmFjB,CAAA"}
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../../src/actions/init.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAiBzE,eAAO,MAAM,IAAI,EAAE,sBAmFjB,CAAA"}

package/build/actions/init.js

@@ -27,7 +27,7 @@ export const init = handleBody(async (body, ctx) => {
          * @TODO We need to move it to some remote resource.
          * And make oidc service itself use such a resource to get required client.
          */
-        const [providers] = await context.module(authService.provider.list).call({
+        const [providers] = await context.entrypoint(authService.provider.list).call({
             params: { service: context.cfg.alias ?? context.cfg.service },
             query: { entityId }
         });
@@ -64,7 +64,7 @@ export const init = handleBody(async (body, ctx) => {
         client: client.getClientId(),
         entityId,
     }, { ttl: AUTHEN_TIMEFRAME / 1000 });
-    const [dispatcherUrl] = await context.module(DISPATCHER).call();
+    const [dispatcherUrl] = await context.entrypoint(DISPATCHER).call();
     const cfg = client.getConfig();
     const url = client.makeAuthUrl({
         scope: `openid profile email ${cfg?.extraScopes ?? ''}`,

package/build/actions/init.js.map

@@ -1 +1 @@
-{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/actions/init.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEjD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAGjD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACzD,qDAAqD;AACrD,8CAA8C;AAE9C,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAExD,MAAM,CAAC,MAAM,IAAI,GAAuB,UAAU,CAAC,KAAK,EAAE,IAAwB,EAAE,GAAG,EAAE,EAAE;IACzF,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IACxC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAA;IAE5B,MAAM,OAAO,GAAG,aAAa,CAAkB,GAAG,CAAC,CAAA;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;IAE9D,IAAI,MAAM,GAA6B,IAAI,CAAA;IAE3C,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;IACzC,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;IAChD,CAAC;IACD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,yCAAyC;QACzC;;;WAGG;QACH,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CACtC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAC1B,CAAC,IAAI,CAAC;YACL,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE;YAC7D,KAAK,EAAE,EAAE,QAAQ,EAAE;SACpB,CAAC,CAAA;QAEF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,WAAW,EAAE,CAAA;QACzB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,qDAAqD,EAAE,SAAS,CAAC,CAAA;QAE7E,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,CAAA;QACzE,iFAAiF;QACjF,IAAI,QAAQ,IAAI,IAAI,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC1C,OAAO,QAAQ,CAAC,GAAG,CAAA;QACrB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAA;QAChD,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;QAEjC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,EAAE,CAAA;QACzB,CAAC;QACD,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,oEAAoE;IACpE,+FAA+F;IAC/F,WAAW;IACX,oCAAoC;IACpC,8DAA8D;IAC9D,OAAO;IACP,IAAI;IAEJ,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;IAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEjD,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAA;IAE3H,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAC1B,EAAE,EAAE,UAAU,CAAC,SAAS,CAAC;QACzB,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE;QAC5B,QAAQ;KACT,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;IAEpC,MAAM,CAAC,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAuB,UAAU,CAAC,CAAC,IAAI,EAAE,CAAA;IAErF,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;IAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC;QAC7B,KAAK,EAAE,wBAAwB,GAAG,EAAE,WAAW,IAAI,EAAE,EAAE;QACvD,cAAc,EAAE,SAAS;QACzB,qBAAqB,EAAE,MAAM;QAC7B,YAAY,EAAE,aAAa;KAC5B,CAAC,CAAA;IAEF,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAA;IAE9B,OAAO,GAAG,CAAA;AACZ,CAAC,CAAC,CAAA"}
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../../src/actions/init.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEjD,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAA;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAGjD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AACzD,qDAAqD;AACrD,8CAA8C;AAE9C,OAAO,EAAE,cAAc,IAAI,MAAM,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AACjD,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAA;AAC3C,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAExD,MAAM,CAAC,MAAM,IAAI,GAA2B,UAAU,CAAC,KAAK,EAAE,IAAwB,EAAE,GAAG,EAAE,EAAE;IAC7F,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,kBAAkB,CAAC,QAAQ,CAAC,CAAA;IACxC,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAA;IAE5B,MAAM,OAAO,GAAG,aAAa,CAAkB,GAAG,CAAC,CAAA;IACnD,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAoB,aAAa,CAAC,CAAA;IAE9D,IAAI,MAAM,GAA6B,IAAI,CAAA;IAE3C,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,EAAE,CAAA;IACzC,IAAI,eAAe,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,CAAA;IAChD,CAAC;IACD,IAAI,MAAM,IAAI,IAAI,EAAE,CAAC;QACnB,yCAAyC;QACzC;;;WAGG;QACH,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAC1C,WAAW,CAAC,QAAQ,CAAC,IAAI,CAC1B,CAAC,IAAI,CAAC;YACL,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE;YAC7D,KAAK,EAAE,EAAE,QAAQ,EAAE;SACpB,CAAC,CAAA;QAEF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,WAAW,EAAE,CAAA;QACzB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,qDAAqD,EAAE,SAAS,CAAC,CAAA;QAE7E,MAAM,QAAQ,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,IAAI,SAAS,CAAC,KAAK,EAAE,CAAA;QACzE,iFAAiF;QACjF,IAAI,QAAQ,IAAI,IAAI,IAAI,KAAK,IAAI,QAAQ,EAAE,CAAC;YAC1C,OAAO,QAAQ,CAAC,GAAG,CAAA;QACrB,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,QAAQ,CAAC,CAAA;QAChD,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;QAEjC,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,IAAI,WAAW,EAAE,CAAA;QACzB,CAAC;QACD,IAAI,CAAC,yBAAyB,CAAC,QAAQ,CAAC,CAAA;QACxC,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAA;IAC1E,CAAC;IACD,oEAAoE;IACpE,+FAA+F;IAC/F,WAAW;IACX,oCAAoC;IACpC,8DAA8D;IAC9D,OAAO;IACP,IAAI;IAEJ,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAA;IAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAA;IAEjD,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,MAAM,CAAC,CAAA;IAE3H,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC;QAC1B,EAAE,EAAE,UAAU,CAAC,SAAS,CAAC;QACzB,QAAQ;QACR,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE;QAC5B,QAAQ;KACT,EAAE,EAAE,GAAG,EAAE,gBAAgB,GAAG,IAAI,EAAE,CAAC,CAAA;IAEpC,MAAM,CAAC,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,UAAU,CAA2B,UAAU,CAAC,CAAC,IAAI,EAAE,CAAA;IAE7F,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;IAC9B,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAAC;QAC7B,KAAK,EAAE,wBAAwB,GAAG,EAAE,WAAW,IAAI,EAAE,EAAE;QACvD,cAAc,EAAE,SAAS;QACzB,qBAAqB,EAAE,MAAM;QAC7B,YAAY,EAAE,aAAa;KAC5B,CAAC,CAAA;IAEF,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAA;IAE9B,OAAO,GAAG,CAAA;AACZ,CAAC,CAAC,CAAA"}

package/build/actions/process.d.ts

@@ -1,4 +1,4 @@
-import type { RefedModuleHandler } from '@owlmeans/server-module';
+import type { RefedEntrypointHandler } from '@owlmeans/server-entrypoint';
 /**
  * Authentication method links together OIDC and OwlMeans auth.
  * 1. We authenticate OIDC redirect back params with the classic OIDC client.
@@ -13,5 +13,5 @@ import type { RefedModuleHandler } from '@owlmeans/server-module';
  *
  * ! There is also token renewal mechanism that should be implemented nearby.
  */
-export declare const authenticate: RefedModuleHandler;
+export declare const authenticate: RefedEntrypointHandler;
 //# sourceMappingURL=process.d.ts.map

package/build/actions/process.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"process.d.ts","sourceRoot":"","sources":["../../src/actions/process.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAA;AAkBjE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,YAAY,EAAE,kBAgFzB,CAAA"}
+{"version":3,"file":"process.d.ts","sourceRoot":"","sources":["../../src/actions/process.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAA;AAkBzE;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,YAAY,EAAE,sBAgFzB,CAAA"}

package/build/actions/process.js.map

@@ -1 +1 @@
-{"version":3,"file":"process.js","sourceRoot":"","sources":["../../src/actions/process.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,GAAG,MAAM,KAAK,CAAA;AACrB,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEzD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAChC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAE7C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,YAAY,GAAuB,UAAU,CAAC,KAAK,EAC9D,EAAE,OAAO,EAAE,GAAG,MAAM,EAAyB,EAC7C,GAAG,EACH,EAAE;IACF,MAAM,OAAO,GAAG,aAAa,CAAkB,GAAG,CAAC,CAAA;IAEnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAChC,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IAExD,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACnE,SAAS,EAAE,WAAW,GAAG,GAAG,GAAG,OAAO;QACtC,UAAU,EAAE,IAAI,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;KACpC,CAAC,CAAA;IAGrB,OAAO,CAAC,GAAG,CAAC,6DAA6D,EAAE,GAAG,CAAC,CAAA;IAE/E,IAAI,QAAQ,CAAC,QAAQ,IAAI,IAAI,IAAI,QAAQ,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;QAC/D,MAAM,IAAI,YAAY,EAAE,CAAA;IAC1B,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAA;IACvC,CAAC;IAED,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IAE9C,OAAO,CAAC,GAAG,CACT,iCAAiC,EACjC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,CACjC,CAAA;IAED,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACvC,OAAO,CAAC,GAAG,CACT,WAAW,EACX,QAAQ,EACR,QAAQ,CAAC,MAAM,EAAE,EACjB,EAAE,CACH,CAAA;IAED,IAAI,IAAI,GAAS;QACf,IAAI,EAAE,kBAAkB;QACxB,KAAK;QACL,2EAA2E;QAC3E,kCAAkC;QAClC,MAAM,EAAE,EAAE,CAAC,GAAa;QACxB,mEAAmE;QACnE,sBAAsB;QACtB,IAAI,EAAE,QAAQ,CAAC,KAAK;QACpB,kEAAkE;QAClE,MAAM,EAAE;YACN,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,OAAO;YACnB,GAAG,CAAC,OAAO;SACZ;QACD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1E,2EAA2E;QAC3E,gCAAgC;QAChC,2BAA2B;QAC3B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAA;IAED,OAAO,CAAC,GAAG,CAAC,oCAAoC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;IACnE,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CACzB,EAAE,EAAE,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,EACjE,EAAE,GAAG,EAAE,mBAAmB,GAAG,IAAI,EAAE,CACpC,CAAA;IAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACxG,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAO,kBAAkB,CAAC;SACpE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;IAEzD,IAAI,IAAI,GAAG,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,WAAW,EAAE,IAAI,aAAa,EAAE,EAAE,CAAA;IAE5E,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAA;IAExD,OAAO,IAAI,CAAA;AACb,CAAC,CAAC,CAAA"}
+{"version":3,"file":"process.js","sourceRoot":"","sources":["../../src/actions/process.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAEjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAEjD,OAAO,GAAG,MAAM,KAAK,CAAA;AACrB,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAEzD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAA;AAChC,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAChE,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAE7C;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,YAAY,GAA2B,UAAU,CAAC,KAAK,EAClE,EAAE,OAAO,EAAE,GAAG,MAAM,EAAyB,EAC7C,GAAG,EACH,EAAE;IACF,MAAM,OAAO,GAAG,aAAa,CAAkB,GAAG,CAAC,CAAA;IAEnD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAChC,MAAM,WAAW,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;IAExD,MAAM,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC;QACnE,SAAS,EAAE,WAAW,GAAG,GAAG,GAAG,OAAO;QACtC,UAAU,EAAE,IAAI,GAAG,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;KACpC,CAAC,CAAA;IAGrB,OAAO,CAAC,GAAG,CAAC,6DAA6D,EAAE,GAAG,CAAC,CAAA;IAE/E,IAAI,QAAQ,CAAC,QAAQ,IAAI,IAAI,IAAI,QAAQ,CAAC,YAAY,IAAI,IAAI,EAAE,CAAC;QAC/D,MAAM,IAAI,YAAY,EAAE,CAAA;IAC1B,CAAC;IAED,IAAI,GAAG,CAAC,OAAO,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,CAAA;IACvC,CAAC;IAED,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAA;IAE9C,OAAO,CAAC,GAAG,CACT,iCAAiC,EACjC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,CACjC,CAAA;IAED,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACvC,OAAO,CAAC,GAAG,CACT,WAAW,EACX,QAAQ,EACR,QAAQ,CAAC,MAAM,EAAE,EACjB,EAAE,CACH,CAAA;IAED,IAAI,IAAI,GAAS;QACf,IAAI,EAAE,kBAAkB;QACxB,KAAK;QACL,2EAA2E;QAC3E,kCAAkC;QAClC,MAAM,EAAE,EAAE,CAAC,GAAa;QACxB,mEAAmE;QACnE,sBAAsB;QACtB,IAAI,EAAE,QAAQ,CAAC,KAAK;QACpB,kEAAkE;QAClE,MAAM,EAAE;YACN,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACnE,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,OAAO;YACnB,GAAG,CAAC,OAAO;SACZ;QACD,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC,QAAQ,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;QAC1E,2EAA2E;QAC3E,gCAAgC;QAChC,2BAA2B;QAC3B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAA;IAED,OAAO,CAAC,GAAG,CAAC,oCAAoC,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,CAAA;IACnE,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CACzB,EAAE,EAAE,EAAE,SAAS,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,EACjE,EAAE,GAAG,EAAE,mBAAmB,GAAG,IAAI,EAAE,CACpC,CAAA;IAED,MAAM,OAAO,GAAG,MAAM,KAAK,CAAkB,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IACxG,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAO,kBAAkB,CAAC;SACpE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC,CAAA;IAEzD,IAAI,IAAI,GAAG,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,WAAW,EAAE,IAAI,aAAa,EAAE,EAAE,CAAA;IAE5E,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,CAAA;IAExD,OAAO,IAAI,CAAA;AACb,CAAC,CAAC,CAAA"}