@oxyhq/services 13.3.0 → 14.0.0

package/src/utils/deviceFlowSignIn.ts

@@ -2,25 +2,51 @@
  * Shared, pure orchestration for completing the cross-app device-flow sign-in
  * (the QR-code / "Open Oxy Auth" path used on native and web).
  *
- * THE BUG THIS FIXES (native): once another authenticated device approves the
- * pending AuthSession, the originating client is notified (socket / poll /
- * deep-link) with the authorized `sessionId`. Before any session-management
- * code can use it, the client MUST exchange the secret 128-bit `sessionToken`
- * (held only by this client, generated for THIS flow) for the first access
- * token via `claimSessionByToken` — the device-flow equivalent of OAuth's
- * code-for-token exchange (RFC 8628 §3.4).
+ * THE FIRST BUG THIS FIXES (native): once another authenticated device
+ * approves the pending AuthSession, the originating client is notified
+ * (socket / poll / deep-link) with the authorized `sessionId`. Before any
+ * session-management code can use it, the client MUST exchange the secret
+ * 128-bit `sessionToken` (held only by this client, generated for THIS flow)
+ * for the first access token via `claimSessionByToken` — the device-flow
+ * equivalent of OAuth's code-for-token exchange (RFC 8628 §3.4).
+ *
+ * THE SECOND BUG THIS FIXES (session-sync cutover regression): the
+ * freshly-claimed session is NOT yet registered in the device's
+ * server-authoritative session set — nothing has run
+ * `sessionClient.addCurrentAccount()` for it — so it must NOT be committed
+ * through `switchSession`. That path is now an account-SWITCH between
+ * accounts already registered on this device (`OxyContext`'s
+ * `switchSessionForContext`), and throws `No device account found for
+ * session "..."` for anything else, surfacing as "Authorization successful
+ * but failed to complete sign in." Instead the claimed session must be
+ * committed through the SAME path a fresh password sign-in uses —
+ * `useOxy().handleWebSession` (`OxyContext`'s `handleWebSSOSession`) — which
+ * registers the account into the device set, persists it durably, and
+ * hydrates the full user profile.
  *
  * Skipping the claim leaves the SDK with NO bearer token: the session is
  * authorized server-side but the app never becomes authenticated and the UI
- * sits "Waiting for authorization..." forever. Consolidating the claim→switch
- * sequence here keeps native and web identical and unit-testable.
+ * sits "Waiting for authorization..." forever. Consolidating the
+ * claim->commit sequence here keeps native and web identical and
+ * unit-testable.
  */
 
-import { KeyManager, type User } from '@oxyhq/core';
+import {
+  KeyManager,
+  establishIdpSessionAfterClaim,
+  type EstablishAfterClaimDeps,
+  type MinimalUserData,
+  type SessionLoginResponse,
+  type SsoEstablishClient,
+  type User,
+} from '@oxyhq/core';
 
 interface DeviceFlowClaimResult {
   accessToken?: string;
   sessionId?: string;
+  deviceId?: string;
+  expiresAt?: string;
+  user?: User;
 }
 
 /**
@@ -28,8 +54,11 @@ interface DeviceFlowClaimResult {
  * structural type (rather than importing the full client) so the helper is
  * trivially unit-testable with a stub and never pulls the RN/Expo runtime into
  * a test bundle.
+ *
+ * Extends {@link SsoEstablishClient} (`requestSsoEstablishUrl`) so the WEB
+ * post-claim durable-session hop can be driven off the same client.
  */
-export interface DeviceFlowClient {
+export interface DeviceFlowClient extends SsoEstablishClient {
   /**
    * Exchange the device-flow `sessionToken` for the first access + refresh
    * token, planting them on the client. Single-use; replay is rejected by the
@@ -49,25 +78,37 @@ export interface CompleteDeviceFlowSignInOptions {
    */
   sessionToken: string;
   /**
-   * The session-management `switchSession` from `useOxy()`. Hydrates the
-   * activated session (validates, fetches the user, persists, updates state).
-   * Runs AFTER the bearer is planted so its bearer-protected calls succeed.
+   * `useOxy().handleWebSession` — commits the freshly-claimed session into
+   * context state through the SAME path a password sign-in uses:
+   * registers the account into the device's server-authoritative session set,
+   * persists it durably, and hydrates the full user profile. Runs AFTER the
+   * bearer is planted so its bearer-protected calls succeed.
    */
-  switchSession: (sessionId: string) => Promise<User>;
+  commitSession: (session: SessionLoginResponse) => Promise<void>;
+  /**
+   * Injectable web seams for the post-claim durable-session establish hop
+   * ({@link establishIdpSessionAfterClaim}). Omit in production — the defaults
+   * resolve to `window.*` (and no-op off-web / on native). Tests inject fakes to
+   * drive the web path deterministically.
+   */
+  establishDeps?: EstablishAfterClaimDeps;
 }
 
 /**
  * Complete a device-flow sign-in: claim the first access token with the secret
- * `sessionToken` (planting the bearer), then hydrate the session via
- * `switchSession`. Returns the authenticated user.
+ * `sessionToken` (planting the bearer), then commit the resulting session via
+ * `commitSession` (registers it into the device's server-authoritative session
+ * set and hydrates the full user). Returns the authenticated user.
  *
- * Throws if either the claim or the switch fails; callers surface a retry UI.
+ * Throws if the claim did not return a usable session, or if either the claim
+ * or the commit fails; callers surface a retry UI.
  */
 export async function completeDeviceFlowSignIn({
   oxyServices,
   sessionId,
   sessionToken,
-  switchSession,
+  commitSession,
+  establishDeps,
 }: CompleteDeviceFlowSignInOptions): Promise<User> {
   // 1) Plant the bearer + refresh tokens. The claim response is also persisted
   //    to native shared secure storage so a later cold boot has a bearer before
@@ -77,6 +118,42 @@ export async function completeDeviceFlowSignIn({
     await KeyManager.storeSharedSession(claimed.sessionId || sessionId, claimed.accessToken);
   }
 
-  // 2) Bearer is now planted — hydrate the session through the normal path.
-  return switchSession(sessionId);
+  if (!claimed?.accessToken || !claimed.user) {
+    throw new Error('Device-flow claim did not return a usable session');
+  }
+
+  // `SessionLoginResponse.user` is the minimal session-carried shape (avatar
+  // is `string | undefined`); the claim response returns the full `User`
+  // (avatar is `string | null | undefined`). Normalize rather than widening
+  // `SessionLoginResponse.user` to accept `null`.
+  const minimalUser: MinimalUserData = {
+    id: claimed.user.id,
+    username: claimed.user.username,
+    name: claimed.user.name,
+    avatar: claimed.user.avatar ?? undefined,
+  };
+
+  // 2) Bearer is now planted — commit the session through the same path a
+  //    fresh sign-in uses so it is registered into the device's
+  //    server-authoritative session set instead of an account switch.
+  await commitSession({
+    sessionId: claimed.sessionId || sessionId,
+    deviceId: claimed.deviceId ?? '',
+    expiresAt: claimed.expiresAt ?? '',
+    user: minimalUser,
+    accessToken: claimed.accessToken,
+  });
+
+  // 3) WEB durable-session hop (no-op on native). A device-flow claim plants
+  //    ONLY in-memory tokens — no IdP `fedcm_session` cookie is ever planted, so
+  //    a reload cannot re-mint a token and the session is lost. Now that the
+  //    session is committed AND durably persisted (step 2), plant the per-apex
+  //    IdP cookie via ONE top-level establish hop. Single attempt; total (never
+  //    throws) — an establish failure leaves the committed session as-is. On web
+  //    success it navigates away, so it is the LAST step: the browser tears the
+  //    page down on the next tick, after `claimed.user` is returned to the
+  //    caller's `onSignedIn`.
+  await establishIdpSessionAfterClaim(oxyServices, establishDeps ?? {});
+
+  return claimed.user;
 }

package/lib/commonjs/ui/components/accountMenuRows.js

@@ -1,33 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.buildAccountRows = buildAccountRows;
-/**
- * Pure builder for `AccountMenu` rows. Extracted so the multi-account display
- * logic can be unit-tested without rendering React Native.
- *
- * Maps each {@link DeviceAccount} (sourced from `useDeviceAccounts()`, which
- * hydrates EVERY account with real name/email/avatar/color from the shared
- * apex `refresh-all` path or the local fallback) into an `AccountRow`.
- *
- * `secondary` is the account's real email when present; otherwise it falls
- * back to the `@handle` line. A missing email is NEVER synthesized into a fake
- * `username@oxy.so` — the device-account layer already resolved `email` to the
- * real value or the `@handle` fallback.
- */
-function buildAccountRows({
-  accounts
-}) {
-  return accounts.map(account => ({
-    sessionId: account.sessionId,
-    authuser: account.authuser,
-    isActive: account.isCurrent,
-    displayName: account.displayName,
-    secondary: account.email,
-    avatarUri: account.avatarUrl,
-    user: account.user
-  }));
-}
-//# sourceMappingURL=accountMenuRows.js.map

package/lib/commonjs/ui/components/accountMenuRows.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["buildAccountRows","accounts","map","account","sessionId","authuser","isActive","isCurrent","displayName","secondary","email","avatarUri","avatarUrl","user"],"sourceRoot":"../../../../src","sources":["ui/components/accountMenuRows.ts"],"mappings":";;;;;;AAsBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASA,gBAAgBA,CAAC;EAC7BC;AACmB,CAAC,EAAgB;EACpC,OAAOA,QAAQ,CAACC,GAAG,CAAEC,OAAsB,KAAkB;IACzDC,SAAS,EAAED,OAAO,CAACC,SAAS;IAC5BC,QAAQ,EAAEF,OAAO,CAACE,QAAQ;IAC1BC,QAAQ,EAAEH,OAAO,CAACI,SAAS;IAC3BC,WAAW,EAAEL,OAAO,CAACK,WAAW;IAChCC,SAAS,EAAEN,OAAO,CAACO,KAAK;IACxBC,SAAS,EAAER,OAAO,CAACS,SAAS;IAC5BC,IAAI,EAAEV,OAAO,CAACU;EAClB,CAAC,CAAC,CAAC;AACP","ignoreList":[]}

package/lib/commonjs/ui/hooks/useDeviceAccounts.js

@@ -1,280 +0,0 @@
-"use strict";
-
-Object.defineProperty(exports, "__esModule", {
-  value: true
-});
-exports.markCurrentAccount = markCurrentAccount;
-exports.useDeviceAccounts = useDeviceAccounts;
-var _react = require("react");
-var _reactQuery = require("@tanstack/react-query");
-var _core = require("@oxyhq/core");
-var _OxyContext = require("../context/OxyContext.js");
-var _useI18n = require("./useI18n.js");
-var _queryKeys = require("./queries/queryKeys.js");
-/**
- * The per-account user shape carried by a {@link DeviceAccount}. Either:
- *  - the minimal projection returned by `POST /auth/refresh-all`
- *    ({@link RefreshAllAccountUser}, the shared apex path), or
- *  - the SDK's canonical {@link User} document (the active row on the local
- *    fallback path, which already has the full user loaded in `useOxy()`).
- *
- * Both satisfy `getAccountDisplayName`'s `DisplayNameUserShape`, so display
- * resolution is uniform across paths.
- */
-
-/**
- * One signed-in account on this device, fully hydrated for the account
- * chooser. Unlike the old `AccountMenu` behaviour (which only carried the
- * ACTIVE session's user), EVERY entry here carries real per-account
- * `displayName` / `email` / `avatarUrl` / `color`.
- */
-
-/**
- * Resolve which entries are the current account, robustly.
- *
- * Primary signal: `entry.sessionId === activeSessionId`. On the web shared-apex
- * path, `refreshAllSessions()` returns SERVER-side session ids that may not
- * equal the locally-stored `activeSessionId` (a different storage namespace /
- * server perspective), so a pure `sessionId` match can flag NO row as current —
- * the bug that surfaced as "Not signed in" even while authenticated.
- *
- * Fallbacks, applied only when the `sessionId` match found nothing AND the user
- * is authenticated:
- *  1. Match the live `user.id` against each entry's per-account user id.
- *  2. If still nothing and there is exactly one account, mark that one current.
- *
- * At most ONE entry is ever marked current.
- *
- * Pure & side-effect free so it is unit-testable without rendering React.
- */
-function markCurrentAccount(accounts, activeSessionId, liveUserId, isAuthenticated) {
-  const bySession = accounts.map(account => ({
-    ...account,
-    isCurrent: Boolean(activeSessionId) && account.sessionId === activeSessionId
-  }));
-  if (bySession.some(account => account.isCurrent) || !isAuthenticated) {
-    return bySession;
-  }
-
-  // No row matched by session id: fall back to the live user's id, marking at
-  // most the FIRST matching entry current (never more than one).
-  if (liveUserId) {
-    let matched = false;
-    const byUser = bySession.map(account => {
-      if (!matched && account.user.id === liveUserId) {
-        matched = true;
-        return {
-          ...account,
-          isCurrent: true
-        };
-      }
-      return account;
-    });
-    if (matched) {
-      return byUser;
-    }
-  }
-
-  // Authenticated, nothing matched, but there is exactly one account → it must
-  // be the current one (single-account shared-apex / cross-domain case).
-  if (bySession.length === 1) {
-    return [{
-      ...bySession[0],
-      isCurrent: true
-    }];
-  }
-  return bySession;
-}
-
-/**
- * Resolve every account signed in on this device for the unified account
- * switcher, with real per-account name / email / avatar / color.
- *
- * ## Data sources (web vs native)
- *
- * - **Web on a `*.oxy.so` host** → `oxyServices.refreshAllSessions()` returns
- *   the full apex device-account list (identical to what `auth.oxy.so` sees,
- *   because the `Domain=oxy.so` refresh cookies reach `api.oxy.so`). Used
- *   directly — this is the `fromSharedApex: true` path.
- * - **Cross-domain web (non-`oxy.so` apex)** OR **native (no browser cookies)**
- *   → `refreshAllSessions()` yields `{ accounts: [] }` (the apex cookies never
- *   reach the request: cross-domain by `Domain`, native by having no cookie
- *   jar at all; a 401 is also normalised to `{ accounts: [] }` inside the
- *   core mixin). In that case we FALL BACK to the SDK's local multi-account
- *   list from `useOxy()` (`sessions` + `activeSessionId` + the active `user`).
- *   This is the `fromSharedApex: false` path.
- *
- * The fallback decision is purely data-driven: **if `refreshAllSessions()`
- * returns >0 accounts, use the shared path; otherwise fall back to local
- * `useOxy()` sessions.** No host sniffing is needed — the cookie scoping does
- * the discrimination for us, and the same code path works on native (where the
- * fetch returns `{ accounts: [] }`).
- *
- * ## Why React Query (not a `useRef`/`useState` start-once like the auth app)
- *
- * The auth app's `use-device-accounts.ts` hand-rolls a `startedRef` because it
- * has no React Query. The SDK does. `refreshAllSessions()` ROTATES single-use
- * refresh cookies on every call, so it must run AT MOST ONCE per page load:
- * we model that with `staleTime: Infinity` + `gcTime: Infinity` +
- * `refetchOnWindowFocus/Reconnect/Mount: false` + `retry: false`. React Query
- * dedupes concurrent mounts and caches the single result for the page's
- * lifetime — the exact "run once" guarantee the auth app documents, but
- * without the manual ref/state machinery.
- *
- * ## Validation note (intentionally NO zod re-parse)
- *
- * The auth app's hook calls `fetch` directly, so IT must `safeParse` the wire
- * response with `@oxyhq/contracts`. This hook calls
- * `oxyServices.refreshAllSessions()`, whose core mixin ALREADY validates and
- * normalises the wire response (skips entries missing required fields,
- * normalises `authuser` null→0, builds the `RefreshAllAccountUser` shape) — the
- * mixin is the single source of truth. Re-validating the SDK's own already-typed
- * output here would be redundant double-validation, so we do not re-parse.
- *
- * ## Error handling
- *
- * `refreshAllSessions()` already maps 401/404/abort to `{ accounts: [] }`
- * internally. Any OTHER failure (network, 5xx) propagates as a thrown error and
- * is surfaced by React Query (`query.isError`) — never swallowed. Callers that
- * don't care can ignore it; the hook still returns the local fallback list so
- * the chooser stays usable.
- */
-function useDeviceAccounts() {
-  const {
-    oxyServices,
-    sessions,
-    activeSessionId,
-    user,
-    isAuthenticated
-  } = (0, _OxyContext.useOxy)();
-  const {
-    locale
-  } = (0, _useI18n.useI18n)();
-
-  // Stable, per-API-origin query key. `refreshAllSessions` resolves against
-  // the session base url derived from `getBaseURL()`, so keying on it scopes
-  // the cached result to the API the provider is pointed at.
-  const baseURL = oxyServices.getBaseURL();
-  const query = (0, _reactQuery.useQuery)({
-    queryKey: [..._queryKeys.queryKeys.accounts.all, 'deviceAccounts', baseURL],
-    queryFn: () => oxyServices.refreshAllSessions(),
-    // Only attempt the shared apex path while signed in. When logged out
-    // there is nothing to enumerate and the fallback (also empty) is used.
-    enabled: isAuthenticated,
-    // Single-use cookie rotation → run at most once per page load.
-    staleTime: Number.POSITIVE_INFINITY,
-    gcTime: Number.POSITIVE_INFINITY,
-    refetchOnWindowFocus: false,
-    refetchOnReconnect: false,
-    refetchOnMount: false,
-    retry: false
-  });
-  const sharedAccounts = query.data?.accounts ?? [];
-  const fromSharedApex = sharedAccounts.length > 0;
-  const accounts = (0, _react.useMemo)(() => {
-    const resolveAvatarUrl = avatar => avatar ? oxyServices.getFileDownloadUrl(avatar, 'thumb') : undefined;
-
-    // Build a single current-account row from the live `useOxy().user`. Used
-    // as a last-resort fallback when neither the shared-apex probe nor the
-    // local session store yielded a row but the user IS authenticated (e.g.
-    // a cross-domain host where the apex probe returned empty before the
-    // local session store hydrated). The signed-in user must ALWAYS be
-    // represented. Email is the REAL email or the `@handle` line — never a
-    // synthesized `username@oxy.so`.
-    const liveUserRow = () => {
-      if (!isAuthenticated || !user || !activeSessionId) {
-        return [];
-      }
-      const displayName = (0, _core.getAccountDisplayName)(user, locale);
-      const handle = (0, _core.getAccountFallbackHandle)(user);
-      const secondaryHandle = handle ? `@${handle}` : null;
-      return [{
-        sessionId: activeSessionId,
-        authuser: undefined,
-        isCurrent: true,
-        displayName,
-        email: user.email ?? secondaryHandle,
-        avatarUrl: resolveAvatarUrl(user.avatar),
-        color: user.color ?? null,
-        user
-      }];
-    };
-    let built;
-    if (fromSharedApex) {
-      // Shared apex path: every entry carries a real per-account user.
-      built = sharedAccounts.flatMap(entry => {
-        if (!entry.user) {
-          return [];
-        }
-        const accountUser = entry.user;
-        const displayName = (0, _core.getAccountDisplayName)(accountUser, locale);
-        const handle = (0, _core.getAccountFallbackHandle)(accountUser);
-        const email = entry.user.email ?? null;
-        const secondaryHandle = handle ? `@${handle}` : null;
-        return [{
-          sessionId: entry.sessionId,
-          authuser: entry.authuser,
-          // Provisional; finalised by `markCurrentAccount` below so the
-          // shared-apex path is robust to server/local session-id skew.
-          isCurrent: false,
-          displayName,
-          // Real email, or null (NEVER synthesized). The UI uses the
-          // `@handle` line only when email is genuinely absent.
-          email: email ?? secondaryHandle,
-          avatarUrl: resolveAvatarUrl(entry.user.avatar),
-          color: entry.user.color ?? null,
-          user: accountUser
-        }];
-      });
-    } else {
-      // Local fallback path: build from the SDK's multi-session store. The
-      // active session row gets the full loaded `user`; inactive fallback
-      // rows carry only what the `ClientSession` exposes (no synthesized
-      // identity — they show the active user's data only when active).
-      built = (sessions ?? []).flatMap(session => {
-        const isCurrent = session.sessionId === activeSessionId;
-        if (!isCurrent || !user) {
-          return [];
-        }
-        const accountUser = user;
-        const displayName = (0, _core.getAccountDisplayName)(accountUser, locale);
-        const handle = (0, _core.getAccountFallbackHandle)(accountUser);
-        const email = user.email ?? null;
-        const secondaryHandle = handle ? `@${handle}` : null;
-        return [{
-          sessionId: session.sessionId,
-          authuser: session.authuser,
-          isCurrent,
-          displayName,
-          email: email ?? secondaryHandle,
-          avatarUrl: resolveAvatarUrl(user.avatar),
-          color: user.color ?? null,
-          user: accountUser
-        }];
-      });
-    }
-
-    // Robust current-account detection: tolerate server/local session-id
-    // skew on the shared-apex path by falling back to the live user's id and
-    // the single-account heuristic.
-    const flagged = markCurrentAccount(built, activeSessionId, user?.id ?? null, isAuthenticated);
-
-    // The signed-in user must ALWAYS be represented. If detection produced
-    // an empty list yet the user is authenticated, synthesize a single
-    // current row from the live `useOxy().user`.
-    if (flagged.length === 0) {
-      return liveUserRow();
-    }
-    return flagged;
-  }, [fromSharedApex, sharedAccounts, sessions, activeSessionId, user, isAuthenticated, locale, oxyServices]);
-  return {
-    accounts,
-    // `isLoading` only reflects the shared probe while it's the relevant
-    // source. Once we know we're on the fallback (probe settled with 0
-    // accounts) the local list is synchronously available.
-    isLoading: isAuthenticated && query.isLoading,
-    currentSessionId: activeSessionId ?? null,
-    fromSharedApex
-  };
-}
-//# sourceMappingURL=useDeviceAccounts.js.map

package/lib/commonjs/ui/hooks/useDeviceAccounts.js.map

@@ -1 +0,0 @@
-{"version":3,"names":["_react","require","_reactQuery","_core","_OxyContext","_useI18n","_queryKeys","markCurrentAccount","accounts","activeSessionId","liveUserId","isAuthenticated","bySession","map","account","isCurrent","Boolean","sessionId","some","matched","byUser","user","id","length","useDeviceAccounts","oxyServices","sessions","useOxy","locale","useI18n","baseURL","getBaseURL","query","useQuery","queryKey","queryKeys","all","queryFn","refreshAllSessions","enabled","staleTime","Number","POSITIVE_INFINITY","gcTime","refetchOnWindowFocus","refetchOnReconnect","refetchOnMount","retry","sharedAccounts","data","fromSharedApex","useMemo","resolveAvatarUrl","avatar","getFileDownloadUrl","undefined","liveUserRow","displayName","getAccountDisplayName","handle","getAccountFallbackHandle","secondaryHandle","authuser","email","avatarUrl","color","built","flatMap","entry","accountUser","session","flagged","isLoading","currentSessionId"],"sourceRoot":"../../../../src","sources":["ui/hooks/useDeviceAccounts.ts"],"mappings":";;;;;;;AAAA,IAAAA,MAAA,GAAAC,OAAA;AACA,IAAAC,WAAA,GAAAD,OAAA;AACA,IAAAE,KAAA,GAAAF,OAAA;AASA,IAAAG,WAAA,GAAAH,OAAA;AACA,IAAAI,QAAA,GAAAJ,OAAA;AACA,IAAAK,UAAA,GAAAL,OAAA;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;;AAGA;AACA;AACA;AACA;AACA;AACA;;AA4CA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASM,kBAAkBA,CAC9BC,QAAyB,EACzBC,eAA0C,EAC1CC,UAAqC,EACrCC,eAAwB,EACT;EACf,MAAMC,SAAS,GAAGJ,QAAQ,CAACK,GAAG,CAAEC,OAAO,KAAqB;IACxD,GAAGA,OAAO;IACVC,SAAS,EAAEC,OAAO,CAACP,eAAe,CAAC,IAAIK,OAAO,CAACG,SAAS,KAAKR;EACjE,CAAC,CAAC,CAAC;EAEH,IAAIG,SAAS,CAACM,IAAI,CAAEJ,OAAO,IAAKA,OAAO,CAACC,SAAS,CAAC,IAAI,CAACJ,eAAe,EAAE;IACpE,OAAOC,SAAS;EACpB;;EAEA;EACA;EACA,IAAIF,UAAU,EAAE;IACZ,IAAIS,OAAO,GAAG,KAAK;IACnB,MAAMC,MAAM,GAAGR,SAAS,CAACC,GAAG,CAAEC,OAAO,IAAoB;MACrD,IAAI,CAACK,OAAO,IAAIL,OAAO,CAACO,IAAI,CAACC,EAAE,KAAKZ,UAAU,EAAE;QAC5CS,OAAO,GAAG,IAAI;QACd,OAAO;UAAE,GAAGL,OAAO;UAAEC,SAAS,EAAE;QAAK,CAAC;MAC1C;MACA,OAAOD,OAAO;IAClB,CAAC,CAAC;IACF,IAAIK,OAAO,EAAE;MACT,OAAOC,MAAM;IACjB;EACJ;;EAEA;EACA;EACA,IAAIR,SAAS,CAACW,MAAM,KAAK,CAAC,EAAE;IACxB,OAAO,CAAC;MAAE,GAAGX,SAAS,CAAC,CAAC,CAAC;MAAEG,SAAS,EAAE;IAAK,CAAC,CAAC;EACjD;EAEA,OAAOH,SAAS;AACpB;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAASY,iBAAiBA,CAAA,EAA4B;EACzD,MAAM;IACFC,WAAW;IACXC,QAAQ;IACRjB,eAAe;IACfY,IAAI;IACJV;EACJ,CAAC,GAAG,IAAAgB,kBAAM,EAAC,CAAC;EACZ,MAAM;IAAEC;EAAO,CAAC,GAAG,IAAAC,gBAAO,EAAC,CAAC;;EAE5B;EACA;EACA;EACA,MAAMC,OAAO,GAAGL,WAAW,CAACM,UAAU,CAAC,CAAC;EAExC,MAAMC,KAAK,GAAG,IAAAC,oBAAQ,EAAC;IACnBC,QAAQ,EAAE,CAAC,GAAGC,oBAAS,CAAC3B,QAAQ,CAAC4B,GAAG,EAAE,gBAAgB,EAAEN,OAAO,CAAU;IACzEO,OAAO,EAAEA,CAAA,KAAMZ,WAAW,CAACa,kBAAkB,CAAC,CAAC;IAC/C;IACA;IACAC,OAAO,EAAE5B,eAAe;IACxB;IACA6B,SAAS,EAAEC,MAAM,CAACC,iBAAiB;IACnCC,MAAM,EAAEF,MAAM,CAACC,iBAAiB;IAChCE,oBAAoB,EAAE,KAAK;IAC3BC,kBAAkB,EAAE,KAAK;IACzBC,cAAc,EAAE,KAAK;IACrBC,KAAK,EAAE;EACX,CAAC,CAAC;EAEF,MAAMC,cAAc,GAAGhB,KAAK,CAACiB,IAAI,EAAEzC,QAAQ,IAAI,EAAE;EACjD,MAAM0C,cAAc,GAAGF,cAAc,CAACzB,MAAM,GAAG,CAAC;EAEhD,MAAMf,QAAQ,GAAG,IAAA2C,cAAO,EAAkB,MAAM;IAC5C,MAAMC,gBAAgB,GAAIC,MAAiC,IACvDA,MAAM,GAAG5B,WAAW,CAAC6B,kBAAkB,CAACD,MAAM,EAAE,OAAO,CAAC,GAAGE,SAAS;;IAExE;IACA;IACA;IACA;IACA;IACA;IACA;IACA,MAAMC,WAAW,GAAGA,CAAA,KAAuB;MACvC,IAAI,CAAC7C,eAAe,IAAI,CAACU,IAAI,IAAI,CAACZ,eAAe,EAAE;QAC/C,OAAO,EAAE;MACb;MACA,MAAMgD,WAAW,GAAG,IAAAC,2BAAqB,EAACrC,IAAI,EAAEO,MAAM,CAAC;MACvD,MAAM+B,MAAM,GAAG,IAAAC,8BAAwB,EAACvC,IAAI,CAAC;MAC7C,MAAMwC,eAAe,GAAGF,MAAM,GAAG,IAAIA,MAAM,EAAE,GAAG,IAAI;MACpD,OAAO,CAAC;QACJ1C,SAAS,EAAER,eAAe;QAC1BqD,QAAQ,EAAEP,SAAS;QACnBxC,SAAS,EAAE,IAAI;QACf0C,WAAW;QACXM,KAAK,EAAE1C,IAAI,CAAC0C,KAAK,IAAIF,eAAe;QACpCG,SAAS,EAAEZ,gBAAgB,CAAC/B,IAAI,CAACgC,MAAM,CAAC;QACxCY,KAAK,EAAE5C,IAAI,CAAC4C,KAAK,IAAI,IAAI;QACzB5C;MACJ,CAAC,CAAC;IACN,CAAC;IAED,IAAI6C,KAAsB;IAE1B,IAAIhB,cAAc,EAAE;MAChB;MACAgB,KAAK,GAAGlB,cAAc,CAACmB,OAAO,CAAEC,KAAK,IAAsB;QACvD,IAAI,CAACA,KAAK,CAAC/C,IAAI,EAAE;UACb,OAAO,EAAE;QACb;QACA,MAAMgD,WAA8B,GAAGD,KAAK,CAAC/C,IAAI;QACjD,MAAMoC,WAAW,GAAG,IAAAC,2BAAqB,EAACW,WAAW,EAAEzC,MAAM,CAAC;QAC9D,MAAM+B,MAAM,GAAG,IAAAC,8BAAwB,EAACS,WAAW,CAAC;QACpD,MAAMN,KAAK,GAAGK,KAAK,CAAC/C,IAAI,CAAC0C,KAAK,IAAI,IAAI;QACtC,MAAMF,eAAe,GAAGF,MAAM,GAAG,IAAIA,MAAM,EAAE,GAAG,IAAI;QACpD,OAAO,CAAC;UACJ1C,SAAS,EAAEmD,KAAK,CAACnD,SAAS;UAC1B6C,QAAQ,EAAEM,KAAK,CAACN,QAAQ;UACxB;UACA;UACA/C,SAAS,EAAE,KAAK;UAChB0C,WAAW;UACX;UACA;UACAM,KAAK,EAAEA,KAAK,IAAIF,eAAe;UAC/BG,SAAS,EAAEZ,gBAAgB,CAACgB,KAAK,CAAC/C,IAAI,CAACgC,MAAM,CAAC;UAC9CY,KAAK,EAAEG,KAAK,CAAC/C,IAAI,CAAC4C,KAAK,IAAI,IAAI;UAC/B5C,IAAI,EAAEgD;QACV,CAAC,CAAC;MACN,CAAC,CAAC;IACN,CAAC,MAAM;MACH;MACA;MACA;MACA;MACAH,KAAK,GAAG,CAACxC,QAAQ,IAAI,EAAE,EAAEyC,OAAO,CAAEG,OAAsB,IAAsB;QAC1E,MAAMvD,SAAS,GAAGuD,OAAO,CAACrD,SAAS,KAAKR,eAAe;QACvD,IAAI,CAACM,SAAS,IAAI,CAACM,IAAI,EAAE;UACrB,OAAO,EAAE;QACb;QACA,MAAMgD,WAA8B,GAAGhD,IAAI;QAC3C,MAAMoC,WAAW,GAAG,IAAAC,2BAAqB,EAACW,WAAW,EAAEzC,MAAM,CAAC;QAC9D,MAAM+B,MAAM,GAAG,IAAAC,8BAAwB,EAACS,WAAW,CAAC;QACpD,MAAMN,KAAK,GAAG1C,IAAI,CAAC0C,KAAK,IAAI,IAAI;QAChC,MAAMF,eAAe,GAAGF,MAAM,GAAG,IAAIA,MAAM,EAAE,GAAG,IAAI;QACpD,OAAO,CAAC;UACJ1C,SAAS,EAAEqD,OAAO,CAACrD,SAAS;UAC5B6C,QAAQ,EAAEQ,OAAO,CAACR,QAAQ;UAC1B/C,SAAS;UACT0C,WAAW;UACXM,KAAK,EAAEA,KAAK,IAAIF,eAAe;UAC/BG,SAAS,EAAEZ,gBAAgB,CAAC/B,IAAI,CAACgC,MAAM,CAAC;UACxCY,KAAK,EAAE5C,IAAI,CAAC4C,KAAK,IAAI,IAAI;UACzB5C,IAAI,EAAEgD;QACV,CAAC,CAAC;MACN,CAAC,CAAC;IACN;;IAEA;IACA;IACA;IACA,MAAME,OAAO,GAAGhE,kBAAkB,CAC9B2D,KAAK,EACLzD,eAAe,EACfY,IAAI,EAAEC,EAAE,IAAI,IAAI,EAChBX,eACJ,CAAC;;IAED;IACA;IACA;IACA,IAAI4D,OAAO,CAAChD,MAAM,KAAK,CAAC,EAAE;MACtB,OAAOiC,WAAW,CAAC,CAAC;IACxB;IACA,OAAOe,OAAO;EAClB,CAAC,EAAE,CACCrB,cAAc,EACdF,cAAc,EACdtB,QAAQ,EACRjB,eAAe,EACfY,IAAI,EACJV,eAAe,EACfiB,MAAM,EACNH,WAAW,CACd,CAAC;EAEF,OAAO;IACHjB,QAAQ;IACR;IACA;IACA;IACAgE,SAAS,EAAE7D,eAAe,IAAIqB,KAAK,CAACwC,SAAS;IAC7CC,gBAAgB,EAAEhE,eAAe,IAAI,IAAI;IACzCyC;EACJ,CAAC;AACL","ignoreList":[]}