@oxyhq/services 29.0.0 → 30.0.0

package/lib/typescript/module/ui/navigation/surfaces.d.ts

@@ -1,110 +0,0 @@
-import { type PresentOptions } from '@oxyhq/bloom/surfaces';
-import type { RouteName } from './routes.js';
-import { type SurfaceProps, type SurfaceResult } from './surfaceRegistry.js';
-import { type SurfaceNavStack } from './surfaceNavStack.js';
-/**
- * A live handle to a presented SDK surface. Exposes DEPTH controls (`dismiss`,
- * `result`) and NAV-WITHIN controls (`navigate`/`replace`/`goBack`/`setStep`) that
- * drive this surface's own nav stack. Held by the `showBottomSheet` adapter (base
- * surface) and by `OxyContext` (the AccountDialog surface).
- */
-export interface SurfaceInstance<K extends RouteName = RouteName> {
-    readonly route: RouteName;
-    navigate: (route: RouteName, props?: Record<string, unknown>) => void;
-    replace: (route: RouteName, props?: Record<string, unknown>) => void;
-    goBack: () => boolean;
-    canGoBack: () => boolean;
-    setStep: (step: number) => void;
-    /** Open a result-bearing sub-flow WITHIN this surface (morph). See {@link openWithinOrPresent}. */
-    beginFlow: (route: RouteName, props?: Record<string, unknown>) => Promise<unknown>;
-    dismiss: (result?: SurfaceResult<K>) => void;
-    readonly result: Promise<SurfaceResult<K> | undefined>;
-}
-/**
- * The type-erased handle the `showBottomSheet` adapter needs from a tracked
- * surface: what it hosts, and how to drive/dismiss it. Kept result-type-free so
- * the (generic) `SurfaceInstance<K>` never has to be widened into a shared array.
- * Exported so `OxyContext` can hold the surface it MORPHS the account dialog into
- * (see {@link topRouteSurface}).
- */
-export interface TrackedSurface {
-    readonly route: RouteName;
-    navigate: (route: RouteName, props?: Record<string, unknown>) => void;
-    goBack: () => boolean;
-    /** Open a result-bearing sub-flow WITHIN this surface (morph). See {@link openWithinOrPresent}. */
-    beginFlow: (route: RouteName, props?: Record<string, unknown>) => Promise<unknown>;
-    dismiss: () => void;
-}
-/**
- * Present a NEW route surface on top of the stack (the DEPTH axis). Resolves with
- * the value the surface is dismissed with. Registered in the route-surface stack.
- */
-export declare function present<K extends RouteName>(route: K, props?: SurfaceProps<K>, opts?: PresentOptions): SurfaceInstance<K>;
-/**
- * Present a surface that is NOT part of the `showBottomSheet` base-navigation
- * lineage (the AccountDialog modal). Otherwise identical to {@link present}.
- */
-export declare function presentDetached<K extends RouteName>(route: K, props?: SurfaceProps<K>, opts?: PresentOptions): SurfaceInstance<K>;
-/**
- * Untyped present for the adapter, the nav helpers, and the `SurfaceScreen`
- * binding (where the route is a runtime value and its props are already erased).
- */
-export declare function presentRoute(route: RouteName, props?: Record<string, unknown>): SurfaceInstance;
-/** The top-most active route surface, or `undefined` when none are open. */
-export declare function topRouteSurface(): TrackedSurface | undefined;
-/**
- * The frontmost surface a result-bearing flow should morph INTO: the detached
- * AccountDialog if open (it sits on top of everything), else the top tracked
- * route surface. Used by {@link openWithinOrPresent} so the account-menu hero
- * avatar morphs the dialog into `ChangeAvatar` instead of stacking a new surface.
- */
-export declare function topMorphableSurface(): TrackedSurface | undefined;
-/**
- * Dismiss every active route surface (the whole `showBottomSheet` session). The
- * AccountDialog is untracked, so it is untouched. Iterates a snapshot because
- * `dismiss` mutates `activeRouteSurfaces` asynchronously as surfaces settle.
- */
-export declare function closeAllRouteSurfaces(): void;
-/**
- * Drill in from a screen. From inside a surface the DEFAULT is to navigate WITHIN
- * it — the panel MORPHS from the current frame's size to the next's. EVERY screen
- * morphs; a NEW surface is stacked on top ONLY when the target route declares
- * `stacks` (reserved for genuine overlays — none today, since action sheets /
- * confirms / prompts are Bloom-raw `surfaces.present` calls outside this
- * registry). A stacked surface gets its own backdrop + entry animation; dismissing
- * it unwinds back to the surface that opened it.
- */
-export declare function navigateWithinOrPresent(navStack: SurfaceNavStack, route: RouteName, props?: Record<string, unknown>): void;
-/** Replace variant of {@link navigateWithinOrPresent} (swaps the top frame). */
-export declare function replaceWithinOrPresent(navStack: SurfaceNavStack, route: RouteName, props?: Record<string, unknown>): void;
-/**
- * Open a result-bearing route the SAME way a drill-in navigates (the morph-by-
- * default rule), but returning the route's dismissal RESULT to the caller.
- *
- * When a surface is already open and the target morphs into it (the default —
- * anything not marked `stacks`), it runs as a SUB-FLOW inside that surface: the
- * panel morphs from the current screen into the target, and the promise resolves
- * with the target's `dismiss(result)` (or `undefined` when cancelled), popping
- * back to the caller's frame WITHOUT closing the host. Otherwise (no surface, or a
- * route that stacks) it presents a fresh surface and resolves with its dismissal —
- * identical to the historical `present(route).result`.
- *
- * The entry seam for the avatar picker AND its nested "My Oxy files" media
- * selector: each awaits its result whether it morphed into the caller's surface
- * or opened cold, with no morph-vs-present branch of its own.
- */
-export declare function openWithinOrPresent<K extends RouteName>(route: K, props?: SurfaceProps<K>): Promise<SurfaceResult<K> | undefined>;
-/**
- * The SDK's imperative surface API (a module singleton). `present` is the typed
- * route presenter; `dismissAll` unwinds the whole session. Not yet exported from
- * the package root — the public `surfaces`/`useSurfaces` API lands in a later
- * phase; for P1 the internal adapters (`showBottomSheet`, `openAccountDialog`)
- * are the only public entry points.
- */
-export declare const surfaces: {
-    readonly present: <K extends RouteName>(route: K, props?: SurfaceProps<K>, opts?: PresentOptions) => Promise<SurfaceResult<K> | undefined>;
-    readonly dismissAll: typeof closeAllRouteSurfaces;
-};
-/** Hook form of {@link surfaces} (stable singleton). */
-export declare function useSurfaces(): typeof surfaces;
-//# sourceMappingURL=surfaces.d.ts.map

package/lib/typescript/module/ui/navigation/surfaces.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"surfaces.d.ts","sourceRoot":"","sources":["../../../../../src/ui/navigation/surfaces.ts"],"names":[],"mappings":"AAEA,OAAO,EAEL,KAAK,cAAc,EAEpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAU,CAAC;AAC1C,OAAO,EAEL,KAAK,YAAY,EACjB,KAAK,aAAa,EAEnB,MAAM,sBAAmB,CAAC;AAC3B,OAAO,EAAyB,KAAK,eAAe,EAAE,MAAM,sBAAmB,CAAC;AA8EhF;;;;;GAKG;AACH,MAAM,WAAW,eAAe,CAAC,CAAC,SAAS,SAAS,GAAG,SAAS;IAC9D,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACtE,OAAO,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACrE,MAAM,EAAE,MAAM,OAAO,CAAC;IACtB,SAAS,EAAE,MAAM,OAAO,CAAC;IACzB,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC,mGAAmG;IACnG,SAAS,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnF,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC;IAC7C,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;CACxD;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;IACtE,MAAM,EAAE,MAAM,OAAO,CAAC;IACtB,mGAAmG;IACnG,SAAS,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACnF,OAAO,EAAE,MAAM,IAAI,CAAC;CACrB;AA2FD;;;GAGG;AACH,wBAAgB,OAAO,CAAC,CAAC,SAAS,SAAS,EACzC,KAAK,EAAE,CAAC,EACR,KAAK,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,EACvB,IAAI,CAAC,EAAE,cAAc,GACpB,eAAe,CAAC,CAAC,CAAC,CAEpB;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,SAAS,SAAS,EACjD,KAAK,EAAE,CAAC,EACR,KAAK,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,EACvB,IAAI,CAAC,EAAE,cAAc,GACpB,eAAe,CAAC,CAAC,CAAC,CAEpB;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,eAAe,CAE/F;AAED,4EAA4E;AAC5E,wBAAgB,eAAe,IAAI,cAAc,GAAG,SAAS,CAE5D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,IAAI,cAAc,GAAG,SAAS,CAEhE;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE,SAAS,EAChB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,IAAI,CAON;AAED,gFAAgF;AAChF,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,eAAe,EACzB,KAAK,EAAE,SAAS,EAChB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,IAAI,CAON;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,mBAAmB,CAAC,CAAC,SAAS,SAAS,EACrD,KAAK,EAAE,CAAC,EACR,KAAK,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,GACtB,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,CAUvC;AAED;;;;;;GAMG;AACH,eAAO,MAAM,QAAQ;uBACT,CAAC,SAAS,SAAS,SAAS,CAAC,UAAU,YAAY,CAAC,CAAC,CAAC,SAAS,cAAc;;CAG/E,CAAC;AAEX,wDAAwD;AACxD,wBAAgB,WAAW,IAAI,OAAO,QAAQ,CAE7C"}

package/lib/typescript/module/ui/oauth/browserAuthTransport.d.ts

@@ -1,56 +0,0 @@
-/**
- * The single web entry point for third-party "Sign in with Oxy".
- *
- * Picks the transport (`popup` or `redirect`), drives it, and returns ONE typed
- * result — so callers (`OxySignInButton`, and any RP with its own button) never
- * touch `window.open`, `postMessage`, or the token exchange themselves.
- *
- * Popup mode keeps the relying party mounted: its route, scroll position, and
- * unsaved state survive because the tab never navigates. Redirect mode is the
- * compatibility fallback, and is also where popup mode lands when the browser
- * blocks the window — a blocked popup must still sign the user in, not dead-end.
- *
- * Native is NOT handled here: `openAuthorizeUrlNative` (an in-app auth session)
- * remains the native lane and is untouched by this module.
- */
-import type { OxyServices } from '@oxyhq/core';
-import type { OAuthPopupHandle, OAuthSessionCommitInput, WebAuthMode, WebOAuthSignInResult } from './types.js';
-/** Provider-owned wiring for a web sign-in — everything that is not per-press. */
-export interface WebOAuthTransportContext {
-    /** The provider's `webAuthMode`. */
-    mode: WebAuthMode;
-    oxyServices: OxyServices;
-    /** The app's registered client id; `null` disables third-party sign-in. */
-    clientId: string | null;
-    /** Authorize endpoint override (local/staging deployments). */
-    authorizeBaseUrl?: string;
-    /** `sessionMode: 'identity'` — no third-party OAuth lane exists by design. */
-    identityBound: boolean;
-    /** The provider's session commit funnel. */
-    commitSession: (input: OAuthSessionCommitInput) => Promise<void>;
-}
-/** Per-press inputs for {@link startWebOAuthSignIn}. */
-export interface StartWebOAuthSignInOptions {
-    /** EXACT registered redirect URI for this application. */
-    redirectUri: string;
-    /**
-     * The popup to drive, when the caller already opened one.
-     *
-     * - omitted — this call opens the window itself, which is only valid when it
-     *   was invoked SYNCHRONOUSLY from the user's click (gesture attribution);
-     * - `null` — the caller tried and the browser blocked it: fall back to a
-     *   full-page redirect;
-     * - a handle — use exactly this window.
-     *
-     * Callers that must `await` before signing in (resolving the application, for
-     * instance) have to open the window in their press handler and pass it here;
-     * a window opened after an `await` is silently blocked by every browser.
-     */
-    popup?: OAuthPopupHandle | null;
-    /** Requested scope; defaults to the SDK's standard sign-in scope. */
-    scope?: string;
-    /** Popup timeout override (ms). */
-    timeoutMs?: number;
-}
-export declare function startWebOAuthSignIn(context: WebOAuthTransportContext, options: StartWebOAuthSignInOptions): Promise<WebOAuthSignInResult>;
-//# sourceMappingURL=browserAuthTransport.d.ts.map

package/lib/typescript/module/ui/oauth/browserAuthTransport.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"browserAuthTransport.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/browserAuthTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAM/C,OAAO,KAAK,EACV,gBAAgB,EAChB,uBAAuB,EACvB,WAAW,EAEX,oBAAoB,EACrB,MAAM,YAAS,CAAC;AAEjB,kFAAkF;AAClF,MAAM,WAAW,wBAAwB;IACvC,oCAAoC;IACpC,IAAI,EAAE,WAAW,CAAC;IAClB,WAAW,EAAE,WAAW,CAAC;IACzB,2EAA2E;IAC3E,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,+DAA+D;IAC/D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,8EAA8E;IAC9E,aAAa,EAAE,OAAO,CAAC;IACvB,4CAA4C;IAC5C,aAAa,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAClE;AAED,wDAAwD;AACxD,MAAM,WAAW,0BAA0B;IACzC,0DAA0D;IAC1D,WAAW,EAAE,MAAM,CAAC;IACpB;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAChC,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,mCAAmC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,wBAAwB,EACjC,OAAO,EAAE,0BAA0B,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAsF/B"}

package/lib/typescript/module/ui/oauth/completeOAuthCode.d.ts

@@ -1,49 +0,0 @@
-/**
- * The ONE path from an OAuth authorization code to a committed session.
- *
- * Both web transports end here — the popup with an in-memory handshake, the
- * redirect lane with one read back from `sessionStorage` — so state validation,
- * the PKCE exchange, the session commit, and handshake cleanup exist exactly
- * once. Duplicating any of those per transport is how the two lanes would drift
- * apart on the security-critical steps.
- *
- * Ordering is deliberate and load-bearing:
- *   1. validate `state` BEFORE anything is sent to the token endpoint,
- *   2. exchange the code for a session,
- *   3. run `cleanup` (drop the persisted handshake / strip `?code=` from the
- *      URL) BEFORE the commit, so a stale code can never re-enter the exchange,
- *   4. commit the session.
- *
- * `cleanup` runs exactly once on EVERY exit path, including a state mismatch
- * and a failed exchange.
- */
-import type { OxyServices } from '@oxyhq/core';
-import type { OAuthCompletionResult, OAuthHandshake, OAuthSessionCommitInput } from './types.js';
-/** Inputs for {@link completeOAuthCode}. */
-export interface CompleteOAuthCodeInput {
-    oxyServices: OxyServices;
-    /** The registered `ApplicationCredential` public key (`oxy_dk_…`). */
-    clientId: string;
-    /** The single-use authorization code the IdP issued. */
-    code: string;
-    /** The `state` the IdP returned, or `null` when it sent none. */
-    returnedState: string | null;
-    /**
-     * The handshake this RP started the authorize request with, or `null` when it
-     * is gone (never stored, expired, or a different tab's). A missing handshake
-     * is treated exactly like a mismatched `state`: no exchange is attempted.
-     */
-    handshake: OAuthHandshake | null;
-    /** EXACT redirect URI sent on the authorize request — OAuth requires a match. */
-    redirectUri: string;
-    /** The provider's session commit funnel. */
-    commitSession: (input: OAuthSessionCommitInput) => Promise<void>;
-    /**
-     * Transport-specific teardown, invoked once after the exchange settles and
-     * before the commit. The redirect lane strips `?code=` and clears the
-     * persisted handshake; the popup lane has nothing persisted and omits it.
-     */
-    cleanup?: () => void;
-}
-export declare function completeOAuthCode(input: CompleteOAuthCodeInput): Promise<OAuthCompletionResult>;
-//# sourceMappingURL=completeOAuthCode.d.ts.map

package/lib/typescript/module/ui/oauth/completeOAuthCode.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"completeOAuthCode.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/completeOAuthCode.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE/C,OAAO,KAAK,EAAE,qBAAqB,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,YAAS,CAAC;AAE9F,4CAA4C;AAC5C,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,WAAW,CAAC;IACzB,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,iEAAiE;IACjE,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B;;;;OAIG;IACH,SAAS,EAAE,cAAc,GAAG,IAAI,CAAC;IACjC,iFAAiF;IACjF,WAAW,EAAE,MAAM,CAAC;IACpB,4CAA4C;IAC5C,aAAa,EAAE,CAAC,KAAK,EAAE,uBAAuB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE;;;;OAIG;IACH,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC;CACtB;AAED,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,sBAAsB,GAC5B,OAAO,CAAC,qBAAqB,CAAC,CAuChC"}

package/lib/typescript/module/ui/oauth/oauthHandshake.d.ts

@@ -1,50 +0,0 @@
-/**
- * The RP half of an OAuth authorize request: a fresh CSRF `state` + PKCE pair,
- * and the authorize URL built from them.
- *
- * Both web transports start here, and the ONLY difference between them is one
- * parameter: `popup` asks the IdP for `response_mode=web_message` so the result
- * comes back to `window.opener` instead of navigating the RP's tab. Everything
- * else — `S256` PKCE, exact registered `redirect_uri`, random `state` — is
- * identical, which is what lets both lanes converge on one completion path.
- */
-import type { OAuthHandshake } from './types.js';
-/** Inputs for {@link prepareAuthorizeRequest}. */
-export interface PrepareAuthorizeRequestParams {
-    /** The registered `ApplicationCredential` public key (`oxy_dk_…`). */
-    clientId: string;
-    /** EXACT registered redirect URI. The token exchange must replay this value. */
-    redirectUri: string;
-    /** Authorize endpoint override; defaults to the production Oxy IdP. */
-    authorizeBaseUrl?: string;
-    /** Requested scope; defaults to the SDK's standard sign-in scope. */
-    scope?: string;
-    /**
-     * Ask the IdP to deliver the result to `window.opener` via `postMessage`
-     * instead of redirecting. Set ONLY by the popup transport. It is a request,
-     * not a guarantee — an IdP with no opener still redirects.
-     */
-    responseMode?: 'web_message';
-}
-/** A ready-to-use authorize request plus the secrets that finish it. */
-export interface PreparedAuthorizeRequest {
-    /** Fully-built `auth.oxy.so/authorize` URL. */
-    authorizeUrl: string;
-    /**
-     * Exact origin of {@link authorizeUrl}. The popup transport accepts
-     * `postMessage` from this origin and no other.
-     */
-    authorizeOrigin: string;
-    /** The `state` + PKCE verifier this request is bound to. */
-    handshake: OAuthHandshake;
-}
-/**
- * Generate a fresh handshake and build the authorize URL around it.
- *
- * The verifier is returned to the caller and never stored here: the popup
- * transport keeps it in memory for the lifetime of the attempt, and the
- * redirect transport persists it through `persistOAuthHandshake` because a
- * full-page navigation destroys the running document.
- */
-export declare function prepareAuthorizeRequest(params: PrepareAuthorizeRequestParams): Promise<PreparedAuthorizeRequest>;
-//# sourceMappingURL=oauthHandshake.d.ts.map

package/lib/typescript/module/ui/oauth/oauthHandshake.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauthHandshake.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/oauthHandshake.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAS,CAAC;AAE9C,kDAAkD;AAClD,MAAM,WAAW,6BAA6B;IAC5C,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC;IACjB,gFAAgF;IAChF,WAAW,EAAE,MAAM,CAAC;IACpB,uEAAuE;IACvE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,qEAAqE;IACrE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,YAAY,CAAC,EAAE,aAAa,CAAC;CAC9B;AAED,wEAAwE;AACxE,MAAM,WAAW,wBAAwB;IACvC,+CAA+C;IAC/C,YAAY,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,4DAA4D;IAC5D,SAAS,EAAE,cAAc,CAAC;CAC3B;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,6BAA6B,GACpC,OAAO,CAAC,wBAAwB,CAAC,CAkBnC"}

package/lib/typescript/module/ui/oauth/oauthPopup.d.ts

@@ -1,83 +0,0 @@
-/**
- * Popup lifecycle for the web OAuth transport.
- *
- * Owns the window itself — opening it, navigating it, watching it, and tearing
- * every listener and timer down — and nothing else: message validation lives in
- * `oauthPopupMessages.ts`, and the code exchange in `completeOAuthCode.ts`.
- *
- * Three browser realities shape this module:
- *
- * - **Gesture attribution.** `window.open` only succeeds while the user's click
- *   is still being handled. Anything awaited first (resolving the application,
- *   generating PKCE) loses it and the popup is silently blocked. So the window
- *   is opened EMPTY up front and navigated once the authorize URL exists —
- *   the same shape as `passkeyHubPopup.ts`.
- * - **No close event.** A cross-origin popup fires nothing when the user
- *   dismisses it; polling `closed` is the only mechanism (as in core's
- *   `AccountDialogController.watchPopup`).
- * - **No cross-origin reads.** The popup's URL, title, and document are all
- *   opaque. The authorization result arrives ONLY as a `postMessage`.
- */
-import type { OAuthPopupHandle, OAuthPopupOutcome } from './types.js';
-/**
- * Window name for the sign-in popup. Naming the target means a second press
- * REUSES the same window instead of stacking a new one behind the first.
- */
-export declare const OXY_OAUTH_POPUP_WINDOW_NAME = "oxy-oauth";
-/**
- * How long a popup sign-in may stay unanswered (ms).
- *
- * Generous on purpose: the IdP surface can involve scanning a QR and approving
- * on a phone, so this tracks the authorize handle's own ~5-minute lifetime
- * rather than a UI-scale timeout. It is a backstop against a wedged popup, not
- * a pace-setter — a user who gives up closes the window and gets the faster
- * `closed` outcome.
- */
-export declare const DEFAULT_OAUTH_POPUP_TIMEOUT_MS = 300000;
-/**
- * Open a new, EMPTY sign-in popup.
- *
- * MUST be called SYNCHRONOUSLY from a user-gesture handler, before any `await`.
- * Returns `null` when the browser blocked it, when `window.open` threw, and on
- * hosts with no DOM (native / SSR) — never throws, because "no popup" is an
- * ordinary outcome the caller answers by falling back to a redirect.
- */
-export declare function openOAuthPopup(): OAuthPopupHandle | null;
-/**
- * Point an already-open popup at the authorize URL. Returns `false` when the
- * assignment threw (a window closed between opening and navigating), so the
- * caller can fall back to a redirect instead of waiting on a dead window.
- */
-export declare function navigateOAuthPopup(popup: OAuthPopupHandle, url: string): boolean;
-/** Close the popup if it is still open. Idempotent, null-safe, never throws. */
-export declare function closeOAuthPopup(popup: OAuthPopupHandle | null): void;
-/** Inputs for {@link awaitOAuthPopupResult}. */
-export interface AwaitOAuthPopupOptions {
-    /** The exact window reference returned by {@link openOAuthPopup}. */
-    popup: OAuthPopupHandle;
-    /** Exact origin the IdP will post from (`new URL(authorizeUrl).origin`). */
-    expectedOrigin: string;
-    /** The CSRF `state` sent on the authorize request. */
-    expectedState: string;
-    /**
-     * EXACT registered redirect URI for this attempt. When the IdP cannot
-     * `postMessage` (no usable opener) it falls back to redirecting the popup;
-     * if that lands on the same origin, the result is read from the popup URL.
-     */
-    redirectUri: string;
-    /** @default DEFAULT_OAUTH_POPUP_TIMEOUT_MS */
-    timeoutMs?: number;
-}
-/**
- * Wait for the popup to deliver an authorization result.
- *
- * Settles EXACTLY once, with a typed outcome for every path — code, IdP error,
- * state mismatch, user-closed, timeout — and removes its listener, its close
- * poll, and both timers before resolving, whatever the outcome. Messages that
- * arrive after settling reach nothing, so a duplicate delivery is inert.
- *
- * Never rejects: closing the window and running out of time are expected
- * outcomes, not exceptions.
- */
-export declare function awaitOAuthPopupResult(options: AwaitOAuthPopupOptions): Promise<OAuthPopupOutcome>;
-//# sourceMappingURL=oauthPopup.d.ts.map

package/lib/typescript/module/ui/oauth/oauthPopup.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauthPopup.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/oauthPopup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAIH,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,YAAS,CAAC;AAEnE;;;GAGG;AACH,eAAO,MAAM,2BAA2B,cAAc,CAAC;AAKvD;;;;;;;;GAQG;AACH,eAAO,MAAM,8BAA8B,SAAU,CAAC;AAkCtD;;;;;;;GAOG;AACH,wBAAgB,cAAc,IAAI,gBAAgB,GAAG,IAAI,CASxD;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAQhF;AAED,gFAAgF;AAChF,wBAAgB,eAAe,CAAC,KAAK,EAAE,gBAAgB,GAAG,IAAI,GAAG,IAAI,CAOpE;AA2CD,gDAAgD;AAChD,MAAM,WAAW,sBAAsB;IACrC,qEAAqE;IACrE,KAAK,EAAE,gBAAgB,CAAC;IACxB,4EAA4E;IAC5E,cAAc,EAAE,MAAM,CAAC;IACvB,sDAAsD;IACtD,aAAa,EAAE,MAAM,CAAC;IACtB;;;;OAIG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,sBAAsB,GAC9B,OAAO,CAAC,iBAAiB,CAAC,CAmF5B"}

package/lib/typescript/module/ui/oauth/oauthPopupMessages.d.ts

@@ -1,67 +0,0 @@
-/**
- * Runtime validation for the popup OAuth `postMessage` channel.
- *
- * Everything arriving on `window`'s `message` event is untrusted: any frame on
- * the page, any other popup, and any browser extension can post to us. This
- * module is the ONLY place that decides whether an incoming event is a genuine
- * authorization response, and it answers with a value — never a thrown error.
- *
- * A message is accepted only when ALL of these hold:
- *   1. `event.origin` is EXACTLY the authorize endpoint's origin,
- *   2. `event.source` is the exact `Window` reference we opened,
- *   3. `event.data` matches one of the two frozen message shapes,
- *   4. the `state` it carries matches the one this RP sent.
- *
- * Failing (1)–(3) is indistinguishable from unrelated page traffic, so the
- * message is IGNORED and the flow keeps waiting. Failing (4) means our own
- * popup answered a different request than the one in flight, which is terminal:
- * it is reported as a mismatch rather than left to hang until the timeout.
- */
-import type { OAuthPopupHandle, OxyOAuthMessage } from './types.js';
-/** `postMessage` discriminator for a successful authorization. */
-export declare const OXY_OAUTH_CODE_MESSAGE_TYPE = "oxy:oauth:code";
-/** `postMessage` discriminator for a typed OAuth failure. */
-export declare const OXY_OAUTH_ERROR_MESSAGE_TYPE = "oxy:oauth:error";
-/** Verdict for one incoming `message` event. */
-export type OAuthPopupMessageVerdict = 
-/** Not ours (wrong origin/source) or not a valid message — keep waiting. */
-{
-    kind: 'ignore';
-} | {
-    kind: 'code';
-    code: string;
-    state: string;
-} | {
-    kind: 'oauth-error';
-    error: string;
-    errorDescription?: string;
-}
-/** Well-formed, from our popup, but bound to a different authorize request. */
- | {
-    kind: 'state-mismatch';
-};
-/** What {@link readOAuthPopupMessage} validates an event against. */
-export interface OAuthPopupMessageContext {
-    /** Exact origin of the authorize endpoint (`new URL(authorizeUrl).origin`). */
-    expectedOrigin: string;
-    /** The CSRF `state` this RP sent on the authorize request. */
-    expectedState: string;
-    /** The exact popup reference `window.open()` returned. */
-    popup: OAuthPopupHandle;
-}
-/**
- * Parse untrusted `event.data` into one of the two frozen message shapes, or
- * `null` when it is anything else (including `null`, primitives, arrays, and
- * objects with missing/wrong-typed fields).
- *
- * Unknown extra properties are tolerated but never read: only the fields below
- * are ever surfaced, so a hostile sender cannot smuggle values past this point.
- */
-export declare function parseOAuthPopupMessage(data: unknown): OxyOAuthMessage | null;
-/**
- * Classify one `message` event against the in-flight authorize request.
- *
- * Never throws. See the module header for the acceptance rules.
- */
-export declare function readOAuthPopupMessage(event: MessageEvent, context: OAuthPopupMessageContext): OAuthPopupMessageVerdict;
-//# sourceMappingURL=oauthPopupMessages.d.ts.map

package/lib/typescript/module/ui/oauth/oauthPopupMessages.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"oauthPopupMessages.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/oauthPopupMessages.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,YAAS,CAAC;AAEjE,kEAAkE;AAClE,eAAO,MAAM,2BAA2B,mBAAmB,CAAC;AAE5D,6DAA6D;AAC7D,eAAO,MAAM,4BAA4B,oBAAoB,CAAC;AAE9D,gDAAgD;AAChD,MAAM,MAAM,wBAAwB;AAClC,4EAA4E;AAC1E;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE;AACnE,+EAA+E;GAC7E;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAE/B,qEAAqE;AACrE,MAAM,WAAW,wBAAwB;IACvC,+EAA+E;IAC/E,cAAc,EAAE,MAAM,CAAC;IACvB,8DAA8D;IAC9D,aAAa,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,KAAK,EAAE,gBAAgB,CAAC;CACzB;AAkBD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,eAAe,GAAG,IAAI,CAsB5E;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,YAAY,EACnB,OAAO,EAAE,wBAAwB,GAChC,wBAAwB,CA+B1B"}

package/lib/typescript/module/ui/oauth/types.d.ts

@@ -1,176 +0,0 @@
-/**
- * Typed contracts shared by the browser "Sign in with Oxy" OAuth transports.
- *
- * Two transports deliver the same authorization code to the same completion
- * path (see `completeOAuthCode.ts`):
- *
- * - `redirect` — the historical full-page hand-off to `auth.oxy.so/authorize`.
- *   The RP tab navigates away and comes back to its registered `redirect_uri`
- *   with `?code=…&state=…`; cold boot finishes the exchange.
- * - `popup` — a small `auth.oxy.so` window opened from the user's click. The RP
- *   stays mounted with its route and unsaved state intact; the IdP delivers the
- *   result to `window.opener` via `postMessage` and closes itself.
- *
- * Only the authorization code, the CSRF `state`, and a typed OAuth error ever
- * cross the `postMessage` channel. Access tokens, device secrets, and the PKCE
- * `code_verifier` NEVER do — the opener keeps the verifier and performs the code
- * exchange itself.
- */
-/** How a web relying party hands the user to the IdP for third-party sign-in. */
-export type WebAuthMode = 'popup' | 'redirect';
-/**
- * Minimal structural handle over a popup `Window` — exactly what the popup
- * transport needs: navigate it once the authorize URL is built, detect the user
- * closing it (`closed`, polled — there is no cross-origin close event), and
- * close it programmatically on completion. Satisfied directly by the value
- * `window.open()` returns.
- *
- * Deliberately NOT `Window`: the transport must never read cross-origin
- * properties off the popup, and a narrow handle makes that impossible to do by
- * accident (and trivial to fake in tests).
- */
-export interface OAuthPopupHandle {
-    readonly closed: boolean;
-    close(): void;
-    location: {
-        href: string;
-    };
-}
-/**
- * The RP-side OAuth handshake for one authorize request: the CSRF `state` sent
- * to the IdP and the PKCE `code_verifier` replayed on the token exchange.
- *
- * In `redirect` mode it is persisted to `sessionStorage` across the full-page
- * navigation; in `popup` mode it never leaves memory.
- */
-export interface OAuthHandshake {
-    /** Opaque CSRF token echoed back by the IdP and validated before any exchange. */
-    state: string;
-    /** The PKCE secret. Never crosses `postMessage`, a URL, or storage in popup mode. */
-    codeVerifier: string;
-}
-/** Successful authorization delivered by the IdP over `postMessage`. */
-export interface OxyOAuthCodeMessage {
-    type: 'oxy:oauth:code';
-    code: string;
-    state: string;
-}
-/** Typed OAuth failure delivered by the IdP over `postMessage`. */
-export interface OxyOAuthErrorMessage {
-    type: 'oxy:oauth:error';
-    error: string;
-    errorDescription?: string;
-    state?: string;
-}
-/** The ONLY two message shapes that may cross the popup channel. */
-export type OxyOAuthMessage = OxyOAuthCodeMessage | OxyOAuthErrorMessage;
-/** Session material handed to the provider's commit funnel after an exchange. */
-export interface OAuthSessionCommitInput {
-    sessionId: string;
-    accessToken?: string;
-    deviceId?: string;
-    deviceSecret?: string;
-    userId: string;
-    expiresAt?: string;
-    user?: {
-        id: string;
-        username?: string;
-        avatar?: string;
-    };
-}
-/**
- * Terminal outcome of one popup sign-in attempt. Every expected path — the user
- * closing the window, a timeout, an IdP error — is a value, never a thrown
- * exception.
- */
-export type OAuthPopupOutcome = 
-/** The IdP delivered an authorization code whose `state` matched. */
-{
-    kind: 'code';
-    code: string;
-    state: string;
-}
-/** The IdP delivered a typed OAuth error (`access_denied`, `login_required`, …). */
- | {
-    kind: 'oauth-error';
-    error: string;
-    errorDescription?: string;
-}
-/** A well-formed message from our popup carried the wrong `state`. */
- | {
-    kind: 'state-mismatch';
-}
-/** The user dismissed the popup without completing sign-in. */
- | {
-    kind: 'closed';
-}
-/** No result arrived within the allotted window. */
- | {
-    kind: 'timed-out';
-}
-/** No DOM message host (SSR / native) — the popup transport does not apply. */
- | {
-    kind: 'unsupported';
-};
-/** Why the shared completion path could not produce a session. */
-export type OAuthCompletionFailure = 'state-mismatch' | 'exchange-failed';
-/** Result of the ONE completion path both transports run. */
-export type OAuthCompletionResult = {
-    ok: true;
-} | {
-    ok: false;
-    reason: OAuthCompletionFailure;
-};
-/** Why the transport fell back to a full-page redirect. */
-export type WebOAuthRedirectReason = 
-/** `webAuthMode: 'redirect'` — the configured transport. */
-'redirect-mode'
-/** The browser refused `window.open` (blocker, or no gesture attribution). */
- | 'popup-blocked'
-/** The popup opened but could not be navigated to the authorize URL. */
- | 'popup-navigation-failed';
-/** Why a web sign-in attempt failed outright. */
-export type WebOAuthFailureReason = 
-/** The handshake could not be persisted for the redirect return (no/blocked storage). */
-'handshake-storage'
-/** The `state` returned by the IdP did not match the one we sent. */
- | 'state-mismatch'
-/** `POST /auth/oauth/token` or the session commit failed. */
- | 'exchange-failed'
-/** The IdP reported a typed OAuth error. */
- | 'idp-error';
-/** Why a web sign-in attempt was not applicable at all. */
-export type WebOAuthUnsupportedReason = 
-/** Not a browser (native / SSR) — native uses `openAuthorizeUrlNative`. */
-'no-browser'
-/** `sessionMode: 'identity'` has no third-party OAuth lane by construction. */
- | 'identity-bound'
-/** No `clientId` is configured on the provider. */
- | 'missing-client-id';
-/** Terminal, typed outcome of a web third-party sign-in attempt. */
-export type WebOAuthSignInResult = 
-/** A session was committed; the RP is authenticated without a reload. */
-{
-    status: 'signed-in';
-}
-/** The tab is navigating to the IdP; nothing else will resolve in this document. */
- | {
-    status: 'redirecting';
-    via: WebOAuthRedirectReason;
-}
-/** The user dismissed the popup. */
- | {
-    status: 'cancelled';
-}
-/** No result arrived within the allotted window. */
- | {
-    status: 'timed-out';
-} | {
-    status: 'failed';
-    reason: WebOAuthFailureReason;
-    description?: string;
-} | {
-    status: 'unsupported';
-    reason: WebOAuthUnsupportedReason;
-};
-//# sourceMappingURL=types.d.ts.map

package/lib/typescript/module/ui/oauth/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/ui/oauth/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,iFAAiF;AACjF,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,UAAU,CAAC;AAE/C;;;;;;;;;;GAUG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,KAAK,IAAI,IAAI,CAAC;IACd,QAAQ,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CAC5B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,kFAAkF;IAClF,KAAK,EAAE,MAAM,CAAC;IACd,qFAAqF;IACrF,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,wEAAwE;AACxE,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,gBAAgB,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED,mEAAmE;AACnE,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,oEAAoE;AACpE,MAAM,MAAM,eAAe,GAAG,mBAAmB,GAAG,oBAAoB,CAAC;AAEzE,iFAAiF;AACjF,MAAM,WAAW,uBAAuB;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3D;AAED;;;;GAIG;AACH,MAAM,MAAM,iBAAiB;AAC3B,qEAAqE;AACnE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE;AAC/C,oFAAoF;GAClF;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAAE;AACnE,sEAAsE;GACpE;IAAE,IAAI,EAAE,gBAAgB,CAAA;CAAE;AAC5B,+DAA+D;GAC7D;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE;AACpB,oDAAoD;GAClD;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE;AACvB,+EAA+E;GAC7E;IAAE,IAAI,EAAE,aAAa,CAAA;CAAE,CAAC;AAE5B,kEAAkE;AAClE,MAAM,MAAM,sBAAsB,GAAG,gBAAgB,GAAG,iBAAiB,CAAC;AAE1E,6DAA6D;AAC7D,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GACZ;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,CAAC;AAElD,2DAA2D;AAC3D,MAAM,MAAM,sBAAsB;AAChC,4DAA4D;AAC1D,eAAe;AACjB,8EAA8E;GAC5E,eAAe;AACjB,wEAAwE;GACtE,yBAAyB,CAAC;AAE9B,iDAAiD;AACjD,MAAM,MAAM,qBAAqB;AAC/B,yFAAyF;AACvF,mBAAmB;AACrB,qEAAqE;GACnE,gBAAgB;AAClB,6DAA6D;GAC3D,iBAAiB;AACnB,4CAA4C;GAC1C,WAAW,CAAC;AAEhB,2DAA2D;AAC3D,MAAM,MAAM,yBAAyB;AACnC,2EAA2E;AACzE,YAAY;AACd,+EAA+E;GAC7E,gBAAgB;AAClB,mDAAmD;GACjD,mBAAmB,CAAC;AAExB,oEAAoE;AACpE,MAAM,MAAM,oBAAoB;AAC9B,yEAAyE;AACvE;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE;AACzB,oFAAoF;GAClF;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,GAAG,EAAE,sBAAsB,CAAA;CAAE;AACxD,oCAAoC;GAClC;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE;AACzB,oDAAoD;GAClD;IAAE,MAAM,EAAE,WAAW,CAAA;CAAE,GACvB;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,qBAAqB,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACzE;IAAE,MAAM,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,yBAAyB,CAAA;CAAE,CAAC"}