@portaidentity/cli 1.7.3 → 1.8.0

package/dist/admin/client-service.js

@@ -0,0 +1,484 @@
+/** Validated SDK boundary for selected-organization OIDC client administration. */
+import { PortaAuthenticationError, PortaConflictError, PortaForbiddenError, PortaValidationError, } from '@portaidentity/sdk';
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** Returns true when text contains a terminal control character. */
+function containsTerminalControl(value) {
+    for (const character of value) {
+        const codePoint = character.codePointAt(0) ?? 0;
+        if (codePoint <= 0x1f || (codePoint >= 0x7f && codePoint <= 0x9f))
+            return true;
+    }
+    return false;
+}
+/** Validates bounded text retained by the terminal. */
+function isText(value, maximum, minimum = 0) {
+    return (typeof value === 'string' &&
+        value.length >= minimum &&
+        value.length <= maximum &&
+        !containsTerminalControl(value));
+}
+/** Validates a display timestamp. */
+function isTimestamp(value) {
+    if (!isText(value, 40, 20) ||
+        !/^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d{1,9})?Z$/.test(value)) {
+        return false;
+    }
+    const parsed = new Date(value);
+    return Number.isFinite(parsed.getTime()) && parsed.toISOString().slice(0, 19) === value.slice(0, 19);
+}
+/** Validates an optional display timestamp. */
+function isNullableTimestamp(value) {
+    return value === null || isTimestamp(value);
+}
+/** Validates an optional bounded, control-free HTTP entity tag. */
+function isEtag(value) {
+    return value === null || (typeof value === 'string' && /^W\/"[0-9a-f]{16}"$/.test(value));
+}
+/** Returns true for a non-array object that can be inspected by field name. */
+function isObjectValue(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+/** Returns an object-shaped untrusted value. */
+function objectValue(value) {
+    return isObjectValue(value) ? value : undefined;
+}
+/** Validates one bounded string collection. */
+function stringCollection(value, maximumItems, maximumLength, minimumItems = 0) {
+    if (!Array.isArray(value) || value.length < minimumItems || value.length > maximumItems) {
+        return undefined;
+    }
+    const result = [];
+    for (const entry of value) {
+        if (!isText(entry, maximumLength, 1))
+            return undefined;
+        result.push(entry);
+    }
+    return Object.freeze(result);
+}
+/** Validates one closed login-method collection. */
+function loginMethods(value, nullable) {
+    if (nullable && value === null)
+        return null;
+    if (!Array.isArray(value) || value.length < 1 || value.length > 2)
+        return undefined;
+    const methods = [];
+    for (const method of value) {
+        if (method !== 'password' && method !== 'magic_link')
+            return undefined;
+        methods.push(method);
+    }
+    return Object.freeze(methods);
+}
+/** Validates the closed OAuth grant-type collection. */
+function grantTypes(value) {
+    if (!Array.isArray(value) || value.length < 1 || value.length > 3)
+        return undefined;
+    const grants = [];
+    for (const grant of value) {
+        if (grant !== 'authorization_code' &&
+            grant !== 'client_credentials' &&
+            grant !== 'refresh_token') {
+            return undefined;
+        }
+        grants.push(grant);
+    }
+    return Object.freeze(grants);
+}
+/** Validates the closed OIDC response-type collection. */
+function responseTypes(value) {
+    if (!Array.isArray(value) || value.length !== 1 || value[0] !== 'code')
+        return undefined;
+    return Object.freeze(['code']);
+}
+/** Validates a safe absolute redirect URI without fragments or wildcards. */
+function isRedirectUri(value) {
+    if (!isText(value, 2_048, 1) || value.includes('*'))
+        return false;
+    try {
+        const parsed = new URL(value);
+        return parsed.protocol.length > 1 && parsed.hash === '';
+    }
+    catch {
+        return false;
+    }
+}
+/** Validates an exact HTTP or HTTPS browser origin. */
+function isAllowedOrigin(value) {
+    if (!isText(value, 2_048, 1) || value.includes('*'))
+        return false;
+    try {
+        const parsed = new URL(value);
+        return ((parsed.protocol === 'https:' || parsed.protocol === 'http:') &&
+            parsed.username === '' &&
+            parsed.password === '' &&
+            parsed.pathname === '/' &&
+            parsed.search === '' &&
+            parsed.hash === '' &&
+            parsed.origin === value);
+    }
+    catch {
+        return false;
+    }
+}
+/** Validates the public/confidential protocol relationships used by Porta. */
+function hasCompatibleProtocol(clientType, grants, authenticationMethod, requirePkce) {
+    if (clientType === 'public') {
+        return (authenticationMethod === 'none' &&
+            requirePkce &&
+            !grants.includes('client_credentials'));
+    }
+    return authenticationMethod !== 'none';
+}
+/** Projects one complete organization-owned client or rejects it. */
+function clientValue(value, organizationId) {
+    const candidate = objectValue(value);
+    const redirects = candidate ? stringCollection(candidate.redirectUris, 10, 2_048, 1) : undefined;
+    const logoutRedirects = candidate
+        ? stringCollection(candidate.postLogoutRedirectUris, 10, 2_048)
+        : undefined;
+    const grants = candidate ? grantTypes(candidate.grantTypes) : undefined;
+    const responses = candidate ? responseTypes(candidate.responseTypes) : undefined;
+    const origins = candidate ? stringCollection(candidate.allowedOrigins, 10, 2_048) : undefined;
+    const override = candidate ? loginMethods(candidate.loginMethods, true) : undefined;
+    const effective = candidate ? loginMethods(candidate.effectiveLoginMethods, false) : undefined;
+    if (!candidate ||
+        typeof candidate.id !== 'string' ||
+        !UUID.test(candidate.id) ||
+        candidate.organizationId !== organizationId ||
+        typeof candidate.applicationId !== 'string' ||
+        !UUID.test(candidate.applicationId) ||
+        !isText(candidate.clientId, 255, 1) ||
+        !isText(candidate.clientName, 255, 1) ||
+        !(candidate.clientType === 'public' || candidate.clientType === 'confidential') ||
+        !(candidate.applicationType === 'web' ||
+            candidate.applicationType === 'native' ||
+            candidate.applicationType === 'spa') ||
+        !redirects ||
+        !redirects.every(isRedirectUri) ||
+        !logoutRedirects ||
+        !logoutRedirects.every(isRedirectUri) ||
+        !grants ||
+        !responses ||
+        !isText(candidate.scope, 2_048, 1) ||
+        !(candidate.tokenEndpointAuthMethod === 'client_secret_basic' ||
+            candidate.tokenEndpointAuthMethod === 'client_secret_post' ||
+            candidate.tokenEndpointAuthMethod === 'none') ||
+        !origins ||
+        !origins.every(isAllowedOrigin) ||
+        typeof candidate.requirePkce !== 'boolean' ||
+        !hasCompatibleProtocol(candidate.clientType, grants, candidate.tokenEndpointAuthMethod, candidate.requirePkce) ||
+        override === undefined ||
+        !effective ||
+        !(candidate.status === 'active' || candidate.status === 'inactive') ||
+        !isTimestamp(candidate.createdAt) ||
+        !isTimestamp(candidate.updatedAt)) {
+        return undefined;
+    }
+    return Object.freeze({
+        id: candidate.id,
+        organizationId,
+        applicationId: candidate.applicationId,
+        clientId: candidate.clientId,
+        clientName: candidate.clientName,
+        clientType: candidate.clientType,
+        applicationType: candidate.applicationType,
+        redirectUris: redirects,
+        postLogoutRedirectUris: logoutRedirects,
+        grantTypes: grants,
+        responseTypes: responses,
+        scope: candidate.scope,
+        tokenEndpointAuthMethod: candidate.tokenEndpointAuthMethod,
+        allowedOrigins: origins,
+        requirePkce: candidate.requirePkce,
+        loginMethods: override,
+        effectiveLoginMethods: effective,
+        status: candidate.status,
+        createdAt: candidate.createdAt,
+        updatedAt: candidate.updatedAt,
+    });
+}
+/** Projects secret metadata and rejects plaintext-bearing values. */
+function secretValue(value, clientId) {
+    const candidate = objectValue(value);
+    if (!candidate ||
+        'plaintext' in candidate ||
+        typeof candidate.id !== 'string' ||
+        !UUID.test(candidate.id) ||
+        candidate.clientId !== clientId ||
+        !(candidate.label === null || isText(candidate.label, 255)) ||
+        !(candidate.status === 'active' || candidate.status === 'revoked') ||
+        !isNullableTimestamp(candidate.lastUsedAt) ||
+        !isNullableTimestamp(candidate.expiresAt) ||
+        !isTimestamp(candidate.createdAt)) {
+        return undefined;
+    }
+    return Object.freeze({
+        id: candidate.id,
+        clientId,
+        label: candidate.label,
+        status: candidate.status,
+        lastUsedAt: candidate.lastUsedAt,
+        expiresAt: candidate.expiresAt,
+        createdAt: candidate.createdAt,
+    });
+}
+/** Projects one one-time generated secret for a synchronous continuation. */
+function generatedSecretValue(value, clientId) {
+    const candidate = objectValue(value);
+    if (!candidate ||
+        typeof candidate.id !== 'string' ||
+        !UUID.test(candidate.id) ||
+        candidate.clientId !== clientId ||
+        !(candidate.label === null || isText(candidate.label, 255)) ||
+        !isText(candidate.plaintext, 4_096, 1) ||
+        !isNullableTimestamp(candidate.expiresAt) ||
+        !isTimestamp(candidate.createdAt)) {
+        return undefined;
+    }
+    return Object.freeze({
+        id: candidate.id,
+        clientId,
+        label: candidate.label,
+        plaintext: candidate.plaintext,
+        expiresAt: candidate.expiresAt,
+        createdAt: candidate.createdAt,
+    });
+}
+/** Projects a complete collection without returning partial values. */
+function collection(value, project) {
+    if (!Array.isArray(value))
+        return undefined;
+    const ids = new Set();
+    const projected = [];
+    for (const entry of value) {
+        const item = project(entry);
+        const candidate = objectValue(item);
+        if (!item || !candidate || typeof candidate.id !== 'string' || ids.has(candidate.id)) {
+            return undefined;
+        }
+        ids.add(candidate.id);
+        projected.push(item);
+    }
+    return Object.freeze(projected);
+}
+/** Maps a read error to a fixed safe result. */
+function readError(error) {
+    if (error instanceof PortaAuthenticationError)
+        return { kind: 'session-invalid' };
+    if (error instanceof PortaValidationError)
+        return { kind: 'failure', failure: 'validation' };
+    if (error instanceof PortaForbiddenError)
+        return { kind: 'failure', failure: 'unauthorized' };
+    if (error instanceof PortaConflictError)
+        return { kind: 'failure', failure: 'conflict' };
+    return { kind: 'failure', failure: 'unavailable' };
+}
+/** Maps a mutation error to a fixed safe result. */
+function mutationError(error) {
+    if (error instanceof DOMException && error.name === 'AbortError')
+        return { kind: 'cancelled' };
+    if (error instanceof PortaAuthenticationError)
+        return { kind: 'session-invalid' };
+    if (error instanceof PortaValidationError)
+        return { kind: 'failure', failure: 'validation' };
+    if (error instanceof PortaForbiddenError)
+        return { kind: 'failure', failure: 'unauthorized' };
+    if (error instanceof PortaConflictError)
+        return { kind: 'failure', failure: 'conflict' };
+    return { kind: 'outcome-unknown' };
+}
+/** Verifies that an existing client belongs to the active organization before further work. */
+async function readOwnedClient(remote, organizationId, clientId) {
+    try {
+        const response = await remote.get(clientId);
+        const value = clientValue(response.data, organizationId);
+        if (value?.id !== clientId)
+            return { kind: 'failure', failure: 'invalid-response' };
+        return value
+            ? { kind: 'success', value }
+            : { kind: 'failure', failure: 'invalid-response' };
+    }
+    catch (error) {
+        return readError(error);
+    }
+}
+/** Converts a pre-dispatch ownership result to a mutation result. */
+function ownershipMutationFailure(result) {
+    return result.kind === 'session-invalid'
+        ? result
+        : { kind: 'failure', failure: result.failure };
+}
+/** Invokes one void mutation exactly once. */
+async function voidMutation(invoke) {
+    try {
+        await invoke();
+        return { kind: 'success' };
+    }
+    catch (error) {
+        return mutationError(error);
+    }
+}
+/** Creates the feature-local client SDK adapter. */
+export function createAdminClientOperations(domain) {
+    return {
+        async listAll(organizationId) {
+            if (!UUID.test(organizationId))
+                return { kind: 'failure', failure: 'validation' };
+            try {
+                const value = collection(await domain().listAll({ organizationId }), (entry) => clientValue(entry, organizationId));
+                return value
+                    ? { kind: 'success', value }
+                    : { kind: 'failure', failure: 'invalid-response' };
+            }
+            catch (error) {
+                return readError(error);
+            }
+        },
+        async get(organizationId, clientId) {
+            if (!UUID.test(organizationId) || !UUID.test(clientId)) {
+                return { kind: 'failure', failure: 'validation' };
+            }
+            try {
+                const response = await domain().get(clientId);
+                const value = clientValue(response.data, organizationId);
+                if (!value || value.id !== clientId || !isEtag(response.etag)) {
+                    return { kind: 'failure', failure: 'invalid-response' };
+                }
+                return { kind: 'success', value: { client: value, etag: response.etag } };
+            }
+            catch (error) {
+                return readError(error);
+            }
+        },
+        async create(organizationId, input) {
+            if (!UUID.test(organizationId))
+                return { kind: 'failure', failure: 'validation' };
+            try {
+                const response = await domain().create({ ...input, organizationId });
+                const created = clientValue(response.client, organizationId);
+                const generated = response.secret
+                    ? generatedSecretValue(response.secret, response.client.id)
+                    : undefined;
+                if (!created ||
+                    (created.clientType === 'confidential' && !generated) ||
+                    (created.clientType === 'public' && generated)) {
+                    return { kind: 'outcome-unknown' };
+                }
+                return {
+                    kind: 'success',
+                    value: generated ? { client: created, secret: generated } : { client: created },
+                };
+            }
+            catch (error) {
+                return mutationError(error);
+            }
+        },
+        async update(organizationId, clientId, input, etag, signal) {
+            if (!UUID.test(organizationId) || !UUID.test(clientId)) {
+                return { kind: 'failure', failure: 'validation' };
+            }
+            try {
+                const remote = domain();
+                const ownership = await readOwnedClient(remote, organizationId, clientId);
+                if (ownership.kind !== 'success')
+                    return ownershipMutationFailure(ownership);
+                if (signal?.aborted)
+                    return { kind: 'cancelled' };
+                const value = clientValue(await remote.update(clientId, input, etag), organizationId);
+                return value
+                    ? { kind: 'success', value }
+                    : { kind: 'outcome-unknown' };
+            }
+            catch (error) {
+                return mutationError(error);
+            }
+        },
+        async activate(organizationId, clientId, signal) {
+            if (!UUID.test(organizationId) || !UUID.test(clientId)) {
+                return { kind: 'failure', failure: 'validation' };
+            }
+            const remote = domain();
+            const ownership = await readOwnedClient(remote, organizationId, clientId);
+            if (ownership.kind === 'success' && signal?.aborted)
+                return { kind: 'cancelled' };
+            return ownership.kind === 'success'
+                ? voidMutation(() => remote.activate(clientId))
+                : ownershipMutationFailure(ownership);
+        },
+        async deactivate(organizationId, clientId, signal) {
+            if (!UUID.test(organizationId) || !UUID.test(clientId)) {
+                return { kind: 'failure', failure: 'validation' };
+            }
+            const remote = domain();
+            const ownership = await readOwnedClient(remote, organizationId, clientId);
+            if (ownership.kind === 'success' && signal?.aborted)
+                return { kind: 'cancelled' };
+            return ownership.kind === 'success'
+                ? voidMutation(() => remote.deactivate(clientId))
+                : ownershipMutationFailure(ownership);
+        },
+        async delete(organizationId, clientId, signal) {
+            if (!UUID.test(organizationId) || !UUID.test(clientId)) {
+                return { kind: 'failure', failure: 'validation' };
+            }
+            const remote = domain();
+            const ownership = await readOwnedClient(remote, organizationId, clientId);
+            if (ownership.kind === 'success' && signal?.aborted)
+                return { kind: 'cancelled' };
+            return ownership.kind === 'success'
+                ? voidMutation(() => remote.delete(clientId))
+                : ownershipMutationFailure(ownership);
+        },
+        async listSecrets(organizationId, clientId) {
+            if (!UUID.test(organizationId) || !UUID.test(clientId)) {
+                return { kind: 'failure', failure: 'validation' };
+            }
+            try {
+                const remote = domain();
+                const ownership = await readOwnedClient(remote, organizationId, clientId);
+                if (ownership.kind !== 'success')
+                    return ownership;
+                const value = collection(await remote.listSecrets(clientId), (entry) => secretValue(entry, clientId));
+                return value
+                    ? { kind: 'success', value }
+                    : { kind: 'failure', failure: 'invalid-response' };
+            }
+            catch (error) {
+                return readError(error);
+            }
+        },
+        async generateSecret(organizationId, clientId, input, signal) {
+            if (!UUID.test(organizationId) || !UUID.test(clientId)) {
+                return { kind: 'failure', failure: 'validation' };
+            }
+            try {
+                const remote = domain();
+                const ownership = await readOwnedClient(remote, organizationId, clientId);
+                if (ownership.kind !== 'success')
+                    return ownershipMutationFailure(ownership);
+                if (signal?.aborted)
+                    return { kind: 'cancelled' };
+                const value = generatedSecretValue(await remote.generateSecret(clientId, input), clientId);
+                return value
+                    ? { kind: 'success', value }
+                    : { kind: 'outcome-unknown' };
+            }
+            catch (error) {
+                return mutationError(error);
+            }
+        },
+        async revokeSecret(organizationId, clientId, secretId, signal) {
+            if (!UUID.test(organizationId) || !UUID.test(clientId) || !UUID.test(secretId)) {
+                return { kind: 'failure', failure: 'validation' };
+            }
+            const remote = domain();
+            const ownership = await readOwnedClient(remote, organizationId, clientId);
+            if (ownership.kind === 'success' && signal?.aborted)
+                return { kind: 'cancelled' };
+            return ownership.kind === 'success'
+                ? voidMutation(() => remote.revokeSecret(clientId, secretId))
+                : ownershipMutationFailure(ownership);
+        },
+    };
+}
+//# sourceMappingURL=client-service.js.map

package/dist/admin/client-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client-service.js","sourceRoot":"","sources":["../../src/admin/client-service.ts"],"names":[],"mappings":"AAAA,mFAAmF;AAEnF,OAAO,EACL,wBAAwB,EACxB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,GACrB,MAAM,oBAAoB,CAAC;AAiB5B,MAAM,IAAI,GAAG,iEAAiE,CAAC;AAE/E,oEAAoE;AACpE,SAAS,uBAAuB,CAAC,KAAa;IAC5C,KAAK,MAAM,SAAS,IAAI,KAAK,EAAE,CAAC;QAC9B,MAAM,SAAS,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,IAAI,SAAS,IAAI,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IACjF,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uDAAuD;AACvD,SAAS,MAAM,CAAC,KAAc,EAAE,OAAe,EAAE,OAAO,GAAG,CAAC;IAC1D,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,CAAC,MAAM,IAAI,OAAO;QACvB,KAAK,CAAC,MAAM,IAAI,OAAO;QACvB,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAChC,CAAC;AACJ,CAAC;AAED,qCAAqC;AACrC,SAAS,WAAW,CAAC,KAAc;IACjC,IACE,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC;QACtB,CAAC,sDAAsD,CAAC,IAAI,CAAC,KAAK,CAAC,EACnE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACvG,CAAC;AAED,+CAA+C;AAC/C,SAAS,mBAAmB,CAAC,KAAc;IACzC,OAAO,KAAK,KAAK,IAAI,IAAI,WAAW,CAAC,KAAK,CAAC,CAAC;AAC9C,CAAC;AAED,mEAAmE;AACnE,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,KAAK,KAAK,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED,+EAA+E;AAC/E,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,gDAAgD;AAChD,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,+CAA+C;AAC/C,SAAS,gBAAgB,CACvB,KAAc,EACd,YAAoB,EACpB,aAAqB,EACrB,YAAY,GAAG,CAAC;IAEhB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,YAAY,IAAI,KAAK,CAAC,MAAM,GAAG,YAAY,EAAE,CAAC;QACxF,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,oDAAoD;AACpD,SAAS,YAAY,CACnB,KAAc,EACd,QAAiB;IAEjB,IAAI,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACpF,MAAM,OAAO,GAAkC,EAAE,CAAC;IAClD,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;QAC3B,IAAI,MAAM,KAAK,UAAU,IAAI,MAAM,KAAK,YAAY;YAAE,OAAO,SAAS,CAAC;QACvE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAChC,CAAC;AAED,wDAAwD;AACxD,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACpF,MAAM,MAAM,GAA6C,EAAE,CAAC;IAC5D,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,IACE,KAAK,KAAK,oBAAoB;YAC9B,KAAK,KAAK,oBAAoB;YAC9B,KAAK,KAAK,eAAe,EACzB,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,0DAA0D;AAC1D,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,SAAS,CAAC;IACzF,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;AACjC,CAAC;AAED,6EAA6E;AAC7E,SAAS,aAAa,CAAC,KAAa;IAClC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,uDAAuD;AACvD,SAAS,eAAe,CAAC,KAAa;IACpC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,OAAO,CACL,CAAC,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC;YAC7D,MAAM,CAAC,QAAQ,KAAK,EAAE;YACtB,MAAM,CAAC,QAAQ,KAAK,EAAE;YACtB,MAAM,CAAC,QAAQ,KAAK,GAAG;YACvB,MAAM,CAAC,MAAM,KAAK,EAAE;YACpB,MAAM,CAAC,IAAI,KAAK,EAAE;YAClB,MAAM,CAAC,MAAM,KAAK,KAAK,CACxB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,qBAAqB,CAC5B,UAAqC,EACrC,MAAiC,EACjC,oBAA4D,EAC5D,WAAoB;IAEpB,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,CACL,oBAAoB,KAAK,MAAM;YAC/B,WAAW;YACX,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CACvC,CAAC;IACJ,CAAC;IACD,OAAO,oBAAoB,KAAK,MAAM,CAAC;AACzC,CAAC;AAED,qEAAqE;AACrE,SAAS,WAAW,CAAC,KAAc,EAAE,cAAsB;IACzD,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,SAAS,CAAC,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjG,MAAM,eAAe,GAAG,SAAS;QAC/B,CAAC,CAAC,gBAAgB,CAAC,SAAS,CAAC,sBAAsB,EAAE,EAAE,EAAE,KAAK,CAAC;QAC/D,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACjF,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,SAAS,CAAC,cAAc,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9F,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpF,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,qBAAqB,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/F,IACE,CAAC,SAAS;QACV,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ;QAChC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACxB,SAAS,CAAC,cAAc,KAAK,cAAc;QAC3C,OAAO,SAAS,CAAC,aAAa,KAAK,QAAQ;QAC3C,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;QACnC,CAAC,MAAM,CAAC,SAAS,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QACnC,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;QACrC,CAAC,CAAC,SAAS,CAAC,UAAU,KAAK,QAAQ,IAAI,SAAS,CAAC,UAAU,KAAK,cAAc,CAAC;QAC/E,CAAC,CACC,SAAS,CAAC,eAAe,KAAK,KAAK;YACnC,SAAS,CAAC,eAAe,KAAK,QAAQ;YACtC,SAAS,CAAC,eAAe,KAAK,KAAK,CACpC;QACD,CAAC,SAAS;QACV,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC;QAC/B,CAAC,eAAe;QAChB,CAAC,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC;QACrC,CAAC,MAAM;QACP,CAAC,SAAS;QACV,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QAClC,CAAC,CACC,SAAS,CAAC,uBAAuB,KAAK,qBAAqB;YAC3D,SAAS,CAAC,uBAAuB,KAAK,oBAAoB;YAC1D,SAAS,CAAC,uBAAuB,KAAK,MAAM,CAC7C;QACD,CAAC,OAAO;QACR,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC;QAC/B,OAAO,SAAS,CAAC,WAAW,KAAK,SAAS;QAC1C,CAAC,qBAAqB,CACpB,SAAS,CAAC,UAAU,EACpB,MAAM,EACN,SAAS,CAAC,uBAAuB,EACjC,SAAS,CAAC,WAAW,CACtB;QACD,QAAQ,KAAK,SAAS;QACtB,CAAC,SAAS;QACV,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC;QACnE,CAAC,WAAW,CAAC,SAAS,CAAC,SAAS,CAAC;QACjC,CAAC,WAAW,CAAC,SAAS,CAAC,SAAS,CAAC,EACjC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,SAAS,CAAC,EAAE;QAChB,cAAc;QACd,aAAa,EAAE,SAAS,CAAC,aAAa;QACtC,QAAQ,EAAE,SAAS,CAAC,QAAQ;QAC5B,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,eAAe,EAAE,SAAS,CAAC,eAAe;QAC1C,YAAY,EAAE,SAAS;QACvB,sBAAsB,EAAE,eAAe;QACvC,UAAU,EAAE,MAAM;QAClB,aAAa,EAAE,SAAS;QACxB,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,uBAAuB,EAAE,SAAS,CAAC,uBAAuB;QAC1D,cAAc,EAAE,OAAO;QACvB,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,YAAY,EAAE,QAAQ;QACtB,qBAAqB,EAAE,SAAS;QAChC,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,SAAS,EAAE,SAAS,CAAC,SAAS;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,qEAAqE;AACrE,SAAS,WAAW,CAAC,KAAc,EAAE,QAAgB;IACnD,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACrC,IACE,CAAC,SAAS;QACV,WAAW,IAAI,SAAS;QACxB,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ;QAChC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACxB,SAAS,CAAC,QAAQ,KAAK,QAAQ;QAC/B,CAAC,CAAC,SAAS,CAAC,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC3D,CAAC,CAAC,SAAS,CAAC,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,SAAS,CAAC;QAClE,CAAC,mBAAmB,CAAC,SAAS,CAAC,UAAU,CAAC;QAC1C,CAAC,mBAAmB,CAAC,SAAS,CAAC,SAAS,CAAC;QACzC,CAAC,WAAW,CAAC,SAAS,CAAC,SAAS,CAAC,EACjC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,SAAS,CAAC,EAAE;QAChB,QAAQ;QACR,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,MAAM,EAAE,SAAS,CAAC,MAAM;QACxB,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,SAAS,EAAE,SAAS,CAAC,SAAS;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,SAAS,oBAAoB,CAC3B,KAAc,EACd,QAAgB;IAEhB,MAAM,SAAS,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IACrC,IACE,CAAC,SAAS;QACV,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ;QAChC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;QACxB,SAAS,CAAC,QAAQ,KAAK,QAAQ;QAC/B,CAAC,CAAC,SAAS,CAAC,KAAK,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC3D,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;QACtC,CAAC,mBAAmB,CAAC,SAAS,CAAC,SAAS,CAAC;QACzC,CAAC,WAAW,CAAC,SAAS,CAAC,SAAS,CAAC,EACjC,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,EAAE,EAAE,SAAS,CAAC,EAAE;QAChB,QAAQ;QACR,KAAK,EAAE,SAAS,CAAC,KAAK;QACtB,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,SAAS,EAAE,SAAS,CAAC,SAAS;QAC9B,SAAS,EAAE,SAAS,CAAC,SAAS;KAC/B,CAAC,CAAC;AACL,CAAC;AAED,uEAAuE;AACvE,SAAS,UAAU,CACjB,KAAc,EACd,OAA0C;IAE1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,MAAM,SAAS,GAAQ,EAAE,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,CAAC,IAAI,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,CAAC,EAAE,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,EAAE,CAAC;YACrF,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACtB,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,gDAAgD;AAChD,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,YAAY,wBAAwB;QAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;IAClF,IAAI,KAAK,YAAY,oBAAoB;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAC7F,IAAI,KAAK,YAAY,mBAAmB;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IAC9F,IAAI,KAAK,YAAY,kBAAkB;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IACzF,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;AACrD,CAAC;AAED,oDAAoD;AACpD,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,KAAK,YAAY,YAAY,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC/F,IAAI,KAAK,YAAY,wBAAwB;QAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;IAClF,IAAI,KAAK,YAAY,oBAAoB;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAC7F,IAAI,KAAK,YAAY,mBAAmB;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IAC9F,IAAI,KAAK,YAAY,kBAAkB;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;IACzF,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;AACrC,CAAC;AAuFD,+FAA+F;AAC/F,KAAK,UAAU,eAAe,CAC5B,MAAyB,EACzB,cAAsB,EACtB,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACzD,IAAI,KAAK,EAAE,EAAE,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;QACpF,OAAO,KAAK;YACV,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE;YAC5B,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,SAAS,wBAAwB,CAC/B,MAAwE;IAExE,OAAO,MAAM,CAAC,IAAI,KAAK,iBAAiB;QACtC,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;AACnD,CAAC;AAED,8CAA8C;AAC9C,KAAK,UAAU,YAAY,CAAC,MAA8B;IACxD,IAAI,CAAC;QACH,MAAM,MAAM,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;AACH,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,2BAA2B,CACzC,MAA+B;IAE/B,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,cAAc;YAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YAClF,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAC7E,WAAW,CAAC,KAAK,EAAE,cAAc,CAAC,CACnC,CAAC;gBACF,OAAO,KAAK;oBACV,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE;oBAC5B,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ;YAChC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YACpD,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC9C,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;gBACzD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC9D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;gBAC1D,CAAC;gBACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;YAC5E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,KAAK;YAChC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC;gBAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YAClF,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,GAAG,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;gBACrE,MAAM,OAAO,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;gBAC7D,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM;oBAC/B,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC3D,CAAC,CAAC,SAAS,CAAC;gBACd,IACE,CAAC,OAAO;oBACR,CAAC,OAAO,CAAC,UAAU,KAAK,cAAc,IAAI,CAAC,SAAS,CAAC;oBACrD,CAAC,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,SAAS,CAAC,EAC9C,CAAC;oBACD,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;gBACrC,CAAC;gBACD,OAAO;oBACL,IAAI,EAAE,SAAS;oBACf,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE;iBAChF,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM;YACxD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YACpD,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;gBACxB,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;gBAC1E,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS;oBAAE,OAAO,wBAAwB,CAAC,SAAS,CAAC,CAAC;gBAC7E,IAAI,MAAM,EAAE,OAAO;oBAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;gBAClD,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,cAAc,CAAC,CAAC;gBACtF,OAAO,KAAK;oBACV,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE;oBAC5B,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;YAClC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM;YAC7C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YACpD,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;YAC1E,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,EAAE,OAAO;gBAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YAClF,OAAO,SAAS,CAAC,IAAI,KAAK,SAAS;gBACjC,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBAC/C,CAAC,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM;YAC/C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YACpD,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;YAC1E,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,EAAE,OAAO;gBAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YAClF,OAAO,SAAS,CAAC,IAAI,KAAK,SAAS;gBACjC,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;gBACjD,CAAC,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,QAAQ,EAAE,MAAM;YAC3C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YACpD,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;YAC1E,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,EAAE,OAAO;gBAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YAClF,OAAO,SAAS,CAAC,IAAI,KAAK,SAAS;gBACjC,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;gBAC7C,CAAC,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,cAAc,EAAE,QAAQ;YACxC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YACpD,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;gBACxB,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;gBAC1E,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS;oBAAE,OAAO,SAAS,CAAC;gBACnD,MAAM,KAAK,GAAG,UAAU,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CACrE,WAAW,CAAC,KAAK,EAAE,QAAQ,CAAC,CAC7B,CAAC;gBACF,OAAO,KAAK;oBACV,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE;oBAC5B,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,cAAc,CAAC,cAAc,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM;YAC1D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YACpD,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;gBACxB,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;gBAC1E,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS;oBAAE,OAAO,wBAAwB,CAAC,SAAS,CAAC,CAAC;gBAC7E,IAAI,MAAM,EAAE,OAAO;oBAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;gBAClD,MAAM,KAAK,GAAG,oBAAoB,CAChC,MAAM,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,KAAK,CAAC,EAC5C,QAAQ,CACT,CAAC;gBACF,OAAO,KAAK;oBACV,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE;oBAC5B,CAAC,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC;YAClC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM;YAC3D,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC/E,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;YACpD,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,cAAc,EAAE,QAAQ,CAAC,CAAC;YAC1E,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,EAAE,OAAO;gBAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;YAClF,OAAO,SAAS,CAAC,IAAI,KAAK,SAAS;gBACjC,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;gBAC7D,CAAC,CAAC,wBAAwB,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/admin/client-state.d.ts

@@ -0,0 +1,157 @@
+/** Immutable selected-organization OIDC client values retained by the terminal application. */
+/** Supported OIDC client lifecycle values. */
+export type AdminClientStatus = 'active' | 'inactive';
+/** Allowlisted OIDC client projection safe for terminal presentation. */
+export interface AdminClient {
+    /** Stable internal client UUID used by Admin routes. */
+    readonly id: string;
+    /** Internal UUID of the owning organization. */
+    readonly organizationId: string;
+    /** Internal UUID of the global application definition. */
+    readonly applicationId: string;
+    /** Generated OIDC client identifier. */
+    readonly clientId: string;
+    /** Administrative display name. */
+    readonly clientName: string;
+    /** Whether the client holds secrets. */
+    readonly clientType: 'public' | 'confidential';
+    /** Deployment model used for protocol defaults. */
+    readonly applicationType: 'web' | 'native' | 'spa';
+    /** Registered authorization redirect URIs. */
+    readonly redirectUris: readonly string[];
+    /** Registered post-logout redirect URIs. */
+    readonly postLogoutRedirectUris: readonly string[];
+    /** Enabled OAuth grant types. */
+    readonly grantTypes: readonly ('authorization_code' | 'client_credentials' | 'refresh_token')[];
+    /** Enabled OIDC response types. */
+    readonly responseTypes: readonly 'code'[];
+    /** Space-delimited scope allowlist. */
+    readonly scope: string;
+    /** Token endpoint authentication method. */
+    readonly tokenEndpointAuthMethod: 'client_secret_basic' | 'client_secret_post' | 'none';
+    /** Exact browser origins permitted by the server. */
+    readonly allowedOrigins: readonly string[];
+    /** Whether authorization-code requests require PKCE. */
+    readonly requirePkce: boolean;
+    /** Per-client login-method override, or null to inherit. */
+    readonly loginMethods: readonly ('password' | 'magic_link')[] | null;
+    /** Effective login methods after organization inheritance. */
+    readonly effectiveLoginMethods: readonly ('password' | 'magic_link')[];
+    /** Current lifecycle state. */
+    readonly status: AdminClientStatus;
+    /** Creation timestamp. */
+    readonly createdAt: string;
+    /** Most recent update timestamp. */
+    readonly updatedAt: string;
+}
+/** Allowlisted client-secret metadata that never contains plaintext. */
+export interface AdminClientSecret {
+    /** Stable internal secret UUID. */
+    readonly id: string;
+    /** Internal UUID of the owning client. */
+    readonly clientId: string;
+    /** Optional administrative label. */
+    readonly label: string | null;
+    /** Stored lifecycle state. */
+    readonly status: 'active' | 'revoked';
+    /** Most recent successful-use timestamp. */
+    readonly lastUsedAt: string | null;
+    /** Optional expiry timestamp. */
+    readonly expiresAt: string | null;
+    /** Creation timestamp. */
+    readonly createdAt: string;
+}
+/** One-time secret returned only through a synchronous controller continuation. */
+export interface AdminGeneratedClientSecret {
+    /** Stable internal secret UUID. */
+    readonly id: string;
+    /** Internal UUID of the owning client. */
+    readonly clientId: string;
+    /** Optional administrative label. */
+    readonly label: string | null;
+    /** One-time plaintext that must never enter application state. */
+    readonly plaintext: string;
+    /** Optional expiry timestamp. */
+    readonly expiresAt: string | null;
+    /** Creation timestamp. */
+    readonly createdAt: string;
+}
+/** Transient secret presentation value enriched with safe client display identity. */
+export interface AdminClientSecretPresentation extends AdminGeneratedClientSecret {
+    /** Administrative client name returned by the same authoritative workflow. */
+    readonly clientName: string;
+    /** Generated OIDC client identifier shown to the operator. */
+    readonly oidcClientId: string;
+}
+/** Fixed client failure categories safe to display. */
+export type AdminClientFailureKind = 'validation' | 'unauthorized' | 'conflict' | 'unavailable' | 'invalid-response';
+/** Sanitized client read result. */
+export type AdminClientReadResult<T> = {
+    readonly kind: 'success';
+    readonly value: T;
+} | {
+    readonly kind: 'session-invalid';
+} | {
+    readonly kind: 'failure';
+    readonly failure: AdminClientFailureKind;
+};
+/** Sanitized client mutation result. */
+export type AdminClientMutationResult<T = void> = ({
+    readonly kind: 'success';
+} & (T extends void ? object : {
+    readonly value: T;
+})) | {
+    readonly kind: 'session-invalid';
+} | {
+    readonly kind: 'cancelled';
+} | {
+    readonly kind: 'outcome-unknown';
+} | {
+    readonly kind: 'failure';
+    readonly failure: AdminClientFailureKind;
+};
+/** Validated complete catalog for one selected organization. */
+export interface AdminClientListProjection {
+    /** Internal UUID of the selected organization. */
+    readonly organizationId: string;
+    /** Complete validated organization-owned client catalog. */
+    readonly clients: readonly AdminClient[];
+}
+/** Validated selected-client detail retained with its catalog. */
+export interface AdminClientDetailProjection extends AdminClientListProjection {
+    /** Selected organization-owned client. */
+    readonly client: AdminClient;
+    /** Resolved global application name when application read is available. */
+    readonly applicationName?: string;
+    /** Update precondition returned with the selected client. */
+    readonly etag?: string | null;
+    /** Metadata-only secrets already loaded for the selected client. */
+    readonly secrets: readonly AdminClientSecret[];
+}
+/** Safe client projection that may remain visible while an operation is pending or fails. */
+export type AdminClientProjection = ({
+    readonly kind: 'list';
+} & AdminClientListProjection) | ({
+    readonly kind: 'detail';
+} & AdminClientDetailProjection) | ({
+    readonly kind: 'secrets';
+    readonly legacyOnly?: boolean;
+} & AdminClientDetailProjection);
+/** Complete selected-organization client controller state. */
+export type AdminClientViewState = {
+    readonly kind: 'closed';
+} | {
+    readonly kind: 'loading';
+    readonly organizationId: string;
+    readonly previous?: AdminClientProjection | readonly AdminClient[];
+} | AdminClientProjection | {
+    readonly kind: 'indeterminate';
+    readonly organizationId: string;
+    readonly previous?: AdminClientProjection | readonly AdminClient[];
+} | {
+    readonly kind: 'failure';
+    readonly organizationId: string;
+    readonly failure: AdminClientFailureKind;
+    readonly previous?: AdminClientProjection | readonly AdminClient[];
+};
+//# sourceMappingURL=client-state.d.ts.map