@stapel/auth-react 1.0.0

package/CHANGELOG.md

@@ -0,0 +1,56 @@
+# @stapel/auth-react
+
+## 1.0.0
+
+### Minor Changes
+
+- 809b706: New package: headless React auth flow pair for stapel-auth (frontend-standard
+  §2), built on `@stapel/core`. First instance of the framework's
+  `createFlowMachine` pattern (typed steps, human-wait vs async `run`,
+  auto-instrumented `flow.<id>.<step>` analytics).
+
+  Full journeys: Email/Phone OTP, password login (with TOTP challenge branch),
+  password change/reset, the step-up **verification factor flow** wired into
+  core's verification-403 interception (the flagship cross-module seam), TOTP
+  setup, OAuth token exchange, sessions, token refresh with rotation + teardown,
+  QR login polling, magic-link request, anonymous, instant authenticator change,
+  and SSO discovery. Passkeys + the passkey verification factor are flow-complete
+  with a thin injectable WebAuthn binding (see MODULE.md).
+
+  Ships typed API client (CSRF on mutations), open-redirect guards (§19.2),
+  namespaced TanStack Query hooks/mutations, `createAuthRuntime` (session token
+  seam + verification controller wired into the client), render-prop headless
+  components, and an i18n key bundle.
+
+  Not released — Opus-authored first instance, awaits independent adversarial
+  review.
+
+### Patch Changes
+
+- Updated dependencies [5dfa61e]
+  - @stapel/core@0.2.0
+
+## 0.1.0 (unreleased)
+
+Initial headless auth flow pair for stapel-auth (frontend-standard §2), built on
+`@stapel/core`. First instance of the framework's `createFlowMachine` pattern.
+
+- **flows/** — `createFlowMachine` primitive (typed steps, human-wait vs async
+  `run`, auto-instrumented `flow.<id>.<step>` analytics) + machines for OTP,
+  password login (with TOTP branch), password change/reset, step-up
+  verification, TOTP setup, OAuth, QR login, magic link, anonymous,
+  authenticator change, SSO, and passkeys.
+- **api/** — typed client over `StapelClient` for the auth-sa.md endpoints
+  (CSRF header on mutations), browser-redirect URL builders, and the §19.2
+  open-redirect guards.
+- **model/** — `createAuthRuntime` (wires the session token seam and the
+  verification-403 controller into the client), `AuthSession` (refresh rotation
+  - teardown + persistence), namespaced TanStack Query hooks and mutations.
+- **headless/** — render-prop components incl. the flagship
+  `<VerificationChallenge>` factor UI, plus `<AuthProvider>`.
+- **i18n/** — auth-react key bundle registered into core's engine.
+
+Passkeys and the passkey verification factor are flow-complete; the WebAuthn
+browser binding is a thin injectable seam (see MODULE.md).
+
+**NOT released** — awaits independent adversarial review.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Stapel contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/MODULE.md

@@ -0,0 +1,147 @@
+# @stapel/auth-react — MODULE.md
+
+Headless auth flow pair for stapel-auth (frontend-standard §2/§5). First
+instance of the framework's **flow-machine** pattern; later `-react` pairs copy
+it. Layers: `api/` (typed client over `@stapel/core`) → `model/` (runtime,
+session, query hooks) → `flows/` (state machines) → `headless/` (render props)
+→ `i18n/` (key bundle).
+
+## The `createFlowMachine` pattern (reusable primitive)
+
+A flow is a tiny state container whose state is a discriminated union keyed by
+`step`. `createFlowMachine({ id, initial, analytics })` gives every flow three
+things for free:
+
+- **Typed transitions** — `to(next)` swaps state (immutable snapshots) and
+  notifies React via `useFlow` (`useSyncExternalStore`).
+- **Human-wait vs async steps** — a resting step waits for user input (`to`);
+  an async step goes through `run(pending, task, { resolve, reject })`, which
+  parks in `pending`, awaits, then transitions on the result. `run` **never
+  throws** — rejections fold into an error state, so hosts render errors
+  instead of catching them. `run` is **staleness-guarded** (an epoch counter
+  bumped on every `to`): if a newer transition happens while the task is in
+  flight — double-submit, cancel, navigate, challenge expiry — the late result
+  is dropped, never clobbering the newer state nor running its resolve/reject
+  side effects (analytics still fires). This guard lives in the primitive so
+  every future pair inherits it.
+- **Auto-instrumentation** — each transition emits `flow.<id>.<step>` started;
+  each `run` emits `completed`/`failed` for its pending step
+  (analytics-standard §1.2). Funnels exist without hand-written tracking.
+
+Each flow is a factory `createXxxFlow(deps) → { machine, ...actions }`. Deps are
+`{ api, analytics?, onAuthenticated? }`. Copy this shape for new pairs.
+
+## Flows & headless components
+
+| Journey (auth-sa.md) | Flow factory | Headless | Status |
+|---|---|---|---|
+| Email/Phone OTP §1–2 | `createOtpFlow` | `<PasswordlessLogin>` | **full** |
+| Password login + TOTP branch §3/§11 | `createPasswordLoginFlow` | `<PasswordLogin>` | **full** |
+| Password change §4 | `createPasswordChangeFlow` | `<PasswordChange>` | **full** |
+| Password reset §5 | `createPasswordResetFlow` | `<PasswordReset>` | **full** |
+| Step-up verification §11 | `createVerificationController` | `<VerificationChallenge>` | **full** (passkey factor thin) |
+| TOTP setup §11 | `createTotpSetupFlow` | `<TotpSetup>` | **full** |
+| OAuth token exchange §7 | `createOAuthFlow` | — (+ `authUrls().oauthAuthorize`) | **full** |
+| Sessions §12 | model hooks/mutations | — | **full** |
+| Token refresh §13 | `AuthSession.onAuthRefresh` | — | **full** |
+| QR login/session-share §8 | `createQrLoginFlow` | `<QrLogin>` | **full** (polling) |
+| Magic link §15 | `createMagicLinkFlow` | `<MagicLink>` | **full** (request side) |
+| Anonymous §6 | `createAnonymousFlow` | `<AnonymousSession>` | **full** |
+| Authenticator change (instant) §9 | `createAuthenticatorChangeFlow` | `<AuthenticatorChange>` | **full** (delayed = CRUD hooks) |
+| SSO discovery §18 | `createSsoFlow` | `<SsoDiscovery>` | **full** (redirect handoff) |
+| Passkeys §17 | `createPasskeyRegistrationFlow` / `createPasskeyLoginFlow` | `<PasskeyRegistration>` / `<PasskeyLogin>` | **flow complete, WebAuthn binding THIN** |
+
+### Thin-WebAuthn TODO (honest scope)
+
+Passkeys and the `passkey` verification factor model the full
+begin→ceremony→complete journey and surface the server `options` /
+`session_key`. The **single browser step** — `navigator.credentials.create()` /
+`.get()` — is **not** implemented here. Provide it one of two ways:
+
+1. **Inject a binding** — pass `webauthnCreate` / `webauthnGet` (to the flow,
+   the `<Passkey*>` components, or `createAuthRuntime({ webauthnGet })`); the
+   flow auto-drives the ceremony.
+2. **Drive it manually** — read the `awaitingCredential` / `awaitingAssertion`
+   state's `options`, run the ceremony yourself, call `submitCredential` /
+   `submitAssertion` / `submitPasskey`.
+
+No "no credentials" heuristics — per auth-sa.md §19.6 that leak works against
+the privacy property; show the single copy key `auth.passkey.no_credentials`.
+
+## Verification challenge lifecycle
+
+Exactly one challenge is live at a time. The controller holds the core
+request's awaited resolver, so it must always release it:
+
+- **Success** → `settle({ retry: true, token })`; core replays with
+  `X-Verification-Token`.
+- **Cancel** → `settle({ retry: false })`; the original 403 propagates.
+- **Expiry** → the envelope's `expires_at` schedules an auto-release: an
+  abandoned modal (user walks away, never cancels) resolves `{ retry: false }`
+  instead of hanging the core `fetch` forever — and because the resolver is
+  cleared, subsequent challenges are handled rather than declined (no wedge).
+- **Factor initiate failure** → a 404 (challenge gone) ends the whole challenge
+  (`unavailable` + settle `retry:false`); any other failure (a 423-locked or
+  invalid factor, network) returns to the **picker** carrying the error, so a
+  different, still-valid factor remains choosable.
+
+## Model hooks
+
+Queries: `useCapabilities`, `useMe`, `useSecurityStatus`, `usePasswordMethods`,
+`useSessions`, `usePasskeys`, `useAuditLog`, `useDelayedChangeStatus`,
+`useSsoLookup`. Mutations (with invalidation): `useLogout`, `useRevokeSession`,
+`useRevokeOtherSessions`, `useConfirmSession`, `useRemovePasskey`,
+`useDisableTotp`, `useCancelDelayedChange`. Keys are namespaced under `["auth"]`
+(`authQueryKeys`).
+
+## Session & persist policy
+
+`AuthSession` (via `createAuthRuntime`) holds `{ user, tokens, status }`,
+exposes `getAccessToken` / `onAuthRefresh` wired into the client, and rotates
+the refresh token on 401. `error.401.refresh_revoked` → `onTeardown("revoked")`
+(hard logout); any other refresh failure → `"expired"`; explicit
+`logout()` → `"logout"`. A recursion guard ensures the refresh request's own
+401 does not re-enter refresh. Session persists `{ user, tokens }` to core's
+`PersistStorage` (IndexedDB→localStorage) under `stapel-auth:session`; query
+cache persistence is per-user via core's `setPersistUser` — call
+`purgePersistedCache()` from `onTeardown` for GDPR-grade logout.
+
+## Extension points (fork-free, frontend-standard §7)
+
+- **Client injection** — every flow/hook uses the client from
+  `createAuthRuntime` (host-built); a divergent backend injects its own
+  generated client into the same machines.
+- **Steps/guards** — flows are plain factories; wrap or replace actions.
+- **Headless layer** — render props are replaceable by definition; shadcn-copy
+  them into the app.
+- **i18n** — override any key via core's `loadLocale`.
+
+## Ambiguities / conflicts surfaced from auth-sa.md
+
+1. **Legacy step-up vs verification envelope.** §11 keeps `POST /totp/step-up/`
+   + `X-Step-Up-Token`, while §19.4 says the interceptor currently handles
+   `403 error.403.step_up_required` (the legacy path). auth-sa.md itself says
+   "new integrations should implement the envelope flow." We implement **only**
+   the envelope flow (`error.403.verification_required` → `verification`
+   object), matching `@stapel/core`'s interception seam. The legacy
+   `X-Step-Up-Token` path is intentionally **not** implemented — flag for review
+   if any endpoint still emits it.
+2. **QR error codes diverge.** The §8 status polling uses a `{status}` body
+   (`rejected`/`expired`) while the Error reference lists `error.409.qr_*` /
+   `error.403.qr_*` HTTP errors. The flow treats the status body as
+   authoritative for polling and surfaces HTTP errors as `error` state.
+3. **OAuth redirect (option A) shapes.** §7 option A + §19.1 imply a
+   `/app/oauth/callback` frontend route and a `/totp-challenge` alias; those are
+   **host routing** concerns (the backend sets cookies), so auth-react provides
+   only `authUrls().oauthAuthorize` and the token-exchange flow (option B), not
+   the callback route.
+4. **Magic-link / SSO landings** (`/login?...` params, §15/§18.2) are backend
+   redirects to host routes; auth-react provides the `safeNextPath` /
+   `safeScanRedirect` guards (§19.2) but the route components are app-layer.
+5. **Capabilities `password` under registration** is documented but no
+   password-registration endpoint exists in §1–18; treated as display-only.
+
+## Status
+
+**NOT released** — Opus-authored first instance; awaits independent adversarial
+review before any npm publish (no-Fable protocol).

package/README.md

@@ -0,0 +1,116 @@
+# @stapel/auth-react
+
+The **headless** React flow pair for [stapel-auth](../../../docs/auth-sa.md)
+(frontend-standard §2). Business + state only — **zero visual opinion**. Every
+flow is a typed state machine; every headless component is a render prop. You
+bring the markup and design; auth-react brings the auth journeys, the token
+seam, and the flagship step-up verification flow.
+
+Built entirely on [`@stapel/core`](../core): typed client + error envelope,
+verification-403 interception, token refresh seam, TanStack Query layer, i18n
+engine, and the analytics facade.
+
+## Install
+
+```
+pnpm add @stapel/auth-react @stapel/core @tanstack/react-query react
+```
+
+## Wire the app once
+
+`createAuthRuntime` is the single place the flagship seams are connected: it
+builds a `StapelClient` whose token refresh comes from the session and whose
+`onVerificationChallenge` is the verification controller. Hand that client to
+core's provider.
+
+```tsx
+import {
+  createStapelQueryClient,
+  StapelConfigProvider,
+  I18nProvider,
+  createI18n,
+} from "@stapel/core";
+import { QueryClientProvider } from "@tanstack/react-query";
+import {
+  createAuthRuntime,
+  AuthProvider,
+  VerificationChallenge,
+  registerAuthI18n,
+} from "@stapel/auth-react";
+
+const runtime = createAuthRuntime({
+  baseUrl: "/auth/api",
+  // cookieMode: true,          // httponly JWT cookies instead of bearer
+  onTeardown: (reason) => {     // auth-sa.md §19.3
+    void query.purgePersistedCache();
+    location.assign(reason === "revoked" ? "/sign-in?session_revoked=1" : "/sign-in");
+  },
+});
+
+const query = createStapelQueryClient({ cacheVersion: "0.1.0" });
+const i18n = createI18n({ locale: "en" });
+registerAuthI18n(i18n); // auth-react's key bundle → core's engine
+
+export function Root({ children }: { children: React.ReactNode }) {
+  return (
+    <StapelConfigProvider config={{ client: runtime.client }} analytics={analytics}>
+      <QueryClientProvider client={query.queryClient}>
+        <I18nProvider i18n={i18n}>
+          <AuthProvider runtime={runtime}>
+            {children}
+            {/* Mount ONCE — renders your step-up modal on demand */}
+            <VerificationChallenge>
+              {({ state, chooseFactor, submitCode, cancel }) => (
+                <YourModal open={state.step !== "idle"} onClose={cancel}>
+                  {/* render state.challenge.factors → chooseFactor(f) → submitCode({code}) */}
+                </YourModal>
+              )}
+            </VerificationChallenge>
+          </AuthProvider>
+        </I18nProvider>
+      </QueryClientProvider>
+    </StapelConfigProvider>
+  );
+}
+```
+
+## Use a headless component
+
+```tsx
+import { PasswordlessLogin } from "@stapel/auth-react";
+import { useT } from "@stapel/core";
+
+function SignIn() {
+  const t = useT();
+  return (
+    <PasswordlessLogin>
+      {({ state, requestCode, submitCode, resend }) => {
+        if (state.step === "codeSent" || state.step === "codeError")
+          return (
+            <CodeForm
+              hint={t("auth.otp.sent_to", { target: state.target })}
+              error={state.step === "codeError" ? t(state.error.code, state.error.params) : null}
+              onSubmit={submitCode}
+              onResend={() => resend()}
+            />
+          );
+        if (state.step === "authenticated") return <Redirect to="/app" />;
+        return <EmailForm onSubmit={(email) => requestCode("email", email)} />;
+      }}
+    </PasswordlessLogin>
+  );
+}
+```
+
+Error codes on every flow error state are backend `localizable_error` keys —
+resolve them with core's `useT()`. auth-react ships an English fallback bundle
+(`registerAuthI18n`) covering both its UI keys and the auth-sa.md error codes.
+
+## Shadcn mode (frontend-standard §7)
+
+Every headless component is app-layer by definition — copy it into your repo
+and own it while keeping `api/`/`model/`/`flows/` as a dependency. Visual
+divergence never forks the package.
+
+See **[MODULE.md](./MODULE.md)** for the full flow/hook catalogue, extension
+points, and which journeys are full vs thin-WebAuthn.

package/dist/api/authApi.d.ts

@@ -0,0 +1,68 @@
+import type { StapelClient } from "@stapel/core";
+import type { AuthResponse, AuditPage, AuthSession, Capabilities, ChangeOldVerifiedResponse, DelayedChangeInitiatedResponse, DelayedChangeStatus, LoginResponse, OtpChannel, OtpRequestResponse, Passkey, PasskeyAuthenticateBeginResponse, PasskeyRegisterBeginResponse, PasswordMethods, QrGenerateResponse, QrStatusResponse, QrType, RefreshResponse, SecurityStatus, SsoLookupResponse, StapelUser, StatusResponse, TotpDisableRequest, TotpSetupConfirmResponse, TotpSetupResponse, VerificationCompleteResponse, VerificationEnvelope, VerificationFactorId, VerificationInitiateResponse } from "./types.js";
+/**
+ * The typed auth surface. One method per auth-sa.md endpoint that a JS client
+ * may call. Browser-redirect endpoints (OAuth authorize, SSO login, QR scan,
+ * magic-link verify) are intentionally absent — see `authUrls`.
+ */
+export interface AuthApi {
+    readonly client: StapelClient;
+    capabilities(): Promise<Capabilities>;
+    me(): Promise<StapelUser>;
+    logout(): Promise<StatusResponse>;
+    otpRequest(channel: OtpChannel, value: string, captchaToken?: string): Promise<OtpRequestResponse>;
+    otpVerify(channel: OtpChannel, value: string, code: string): Promise<AuthResponse>;
+    passwordLogin(login: string, password: string): Promise<LoginResponse>;
+    passwordMethods(): Promise<PasswordMethods>;
+    passwordChange(oldPassword: string, newPassword: string): Promise<StatusResponse>;
+    passwordChangeOtpRequest(method: OtpChannel): Promise<OtpRequestResponse>;
+    passwordChangeOtpVerify(method: OtpChannel, code: string, newPassword: string): Promise<StatusResponse>;
+    passwordResetRequest(channel: OtpChannel, value: string): Promise<OtpRequestResponse>;
+    passwordResetVerify(channel: OtpChannel, value: string, code: string, newPassword: string): Promise<AuthResponse>;
+    anonymous(deviceId?: string): Promise<AuthResponse>;
+    oauthLogin(provider: string, accessToken: string): Promise<LoginResponse>;
+    totpChallengeVerify(challengeToken: string, proof: {
+        code?: string;
+        backup_code?: string;
+    }): Promise<AuthResponse>;
+    totpSetup(): Promise<TotpSetupResponse>;
+    totpSetupConfirm(code: string): Promise<TotpSetupConfirmResponse>;
+    totpDisable(request: TotpDisableRequest): Promise<StatusResponse>;
+    totpDisableOtpRequest(): Promise<OtpRequestResponse>;
+    verificationGet(challengeId: string): Promise<VerificationEnvelope>;
+    verificationInitiate(challengeId: string, factor: VerificationFactorId): Promise<VerificationInitiateResponse>;
+    verificationComplete(challengeId: string, body: Record<string, unknown>): Promise<VerificationCompleteResponse>;
+    securityStatus(): Promise<SecurityStatus>;
+    sessions(): Promise<readonly AuthSession[]>;
+    confirmSession(id: string): Promise<StatusResponse>;
+    revokeSession(id: string): Promise<StatusResponse>;
+    revokeOtherSessions(): Promise<StatusResponse>;
+    tokenRefresh(refresh?: string): Promise<RefreshResponse>;
+    qrGenerate(type: QrType, redirectUrl: string, allowUnauthenticatedScanner?: boolean): Promise<QrGenerateResponse>;
+    qrStatus(key: string): Promise<QrStatusResponse>;
+    qrConfirm(key: string): Promise<StatusResponse>;
+    qrReject(key: string): Promise<StatusResponse>;
+    magicRequest(email: string, redirectUrl?: string): Promise<StatusResponse>;
+    passkeys(): Promise<readonly Passkey[]>;
+    passkeyRegisterBegin(): Promise<PasskeyRegisterBeginResponse>;
+    passkeyRegisterComplete(credential: unknown, deviceName?: string): Promise<Passkey>;
+    passkeyAuthenticateBegin(email?: string): Promise<PasskeyAuthenticateBeginResponse>;
+    passkeyAuthenticateComplete(sessionKey: string, credential: unknown): Promise<AuthResponse>;
+    passkeyRemove(id: string): Promise<void>;
+    changeInstantRequestOld(channel: OtpChannel): Promise<OtpRequestResponse>;
+    changeInstantVerifyOld(channel: OtpChannel, code: string): Promise<ChangeOldVerifiedResponse>;
+    changeInstantRequestNew(channel: OtpChannel, value: string, changeToken: string): Promise<OtpRequestResponse>;
+    changeInstantVerifyNew(channel: OtpChannel, value: string, code: string, changeToken: string): Promise<AuthResponse>;
+    changeDelayedInitiate(channel: OtpChannel, value: string): Promise<DelayedChangeInitiatedResponse>;
+    changeDelayedStatus(channel: OtpChannel): Promise<DelayedChangeStatus>;
+    changeDelayedCancel(channel: OtpChannel, changeRequestId: string): Promise<StatusResponse>;
+    ssoLookup(domain: string): Promise<SsoLookupResponse>;
+    auditLog(page?: number): Promise<AuditPage>;
+}
+/**
+ * Build the auth API bound to an injected {@link StapelClient} (per-module
+ * override from `StapelProvider`, the fork-resolution seam of §7.2). All
+ * mutations carry the CSRF header.
+ */
+export declare function createAuthApi(client: StapelClient): AuthApi;
+//# sourceMappingURL=authApi.d.ts.map

package/dist/api/authApi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authApi.d.ts","sourceRoot":"","sources":["../../src/api/authApi.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAwB,MAAM,cAAc,CAAC;AACvE,OAAO,KAAK,EACV,YAAY,EACZ,SAAS,EACT,WAAW,EACX,YAAY,EACZ,yBAAyB,EACzB,8BAA8B,EAC9B,mBAAmB,EACnB,aAAa,EACb,UAAU,EACV,kBAAkB,EAClB,OAAO,EACP,gCAAgC,EAChC,4BAA4B,EAC5B,eAAe,EACf,kBAAkB,EAClB,gBAAgB,EAChB,MAAM,EACN,eAAe,EACf,cAAc,EACd,iBAAiB,EACjB,UAAU,EACV,cAAc,EACd,kBAAkB,EAClB,wBAAwB,EACxB,iBAAiB,EACjB,4BAA4B,EAC5B,oBAAoB,EACpB,oBAAoB,EACpB,4BAA4B,EAC7B,MAAM,YAAY,CAAC;AAqBpB;;;;GAIG;AACH,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAG9B,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IACtC,EAAE,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IAC1B,MAAM,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;IAGlC,UAAU,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACnG,SAAS,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAGnF,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACvE,eAAe,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IAC5C,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAClF,wBAAwB,CAAC,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC1E,uBAAuB,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACxG,oBAAoB,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACtF,mBAAmB,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAGlH,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAGpD,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAG1E,mBAAmB,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACnH,SAAS,IAAI,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACxC,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAClE,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAClE,qBAAqB,IAAI,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAGrD,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACpE,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC/G,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAGhH,cAAc,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;IAG1C,QAAQ,IAAI,OAAO,CAAC,SAAS,WAAW,EAAE,CAAC,CAAC;IAC5C,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACpD,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IACnD,mBAAmB,IAAI,OAAO,CAAC,cAAc,CAAC,CAAC;IAG/C,YAAY,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAGzD,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,2BAA2B,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClH,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACjD,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAChD,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAG/C,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAG3E,QAAQ,IAAI,OAAO,CAAC,SAAS,OAAO,EAAE,CAAC,CAAC;IACxC,oBAAoB,IAAI,OAAO,CAAC,4BAA4B,CAAC,CAAC;IAC9D,uBAAuB,CAAC,UAAU,EAAE,OAAO,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpF,wBAAwB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gCAAgC,CAAC,CAAC;IACpF,2BAA2B,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC5F,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAGzC,uBAAuB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC1E,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC;IAC9F,uBAAuB,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC9G,sBAAsB,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACrH,qBAAqB,CAAC,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,8BAA8B,CAAC,CAAC;IACnG,mBAAmB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACvE,mBAAmB,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAG3F,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAGtD,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;CAC7C;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAyL3D"}

package/dist/api/authApi.js

@@ -0,0 +1,90 @@
+/**
+ * CSRF rule for cookie-authenticated browser clients (auth-sa.md §"CSRF"):
+ * the simplest SPA rule is to always send `X-Requested-With: XMLHttpRequest`
+ * on mutating requests. Header-token clients are exempt but it is harmless
+ * for them, so we send it on every mutation.
+ */
+const CSRF_HEADERS = {
+    "X-Requested-With": "XMLHttpRequest",
+};
+function mutating(options) {
+    return {
+        ...options,
+        headers: { ...CSRF_HEADERS, ...options?.headers },
+    };
+}
+/**
+ * Build the auth API bound to an injected {@link StapelClient} (per-module
+ * override from `StapelProvider`, the fork-resolution seam of §7.2). All
+ * mutations carry the CSRF header.
+ */
+export function createAuthApi(client) {
+    return {
+        client,
+        capabilities: () => client.get("/capabilities/"),
+        me: () => client.get("/me/"),
+        logout: () => client.post("/logout/", undefined, mutating()),
+        otpRequest: (channel, value, captchaToken) => client.post(`/${channel}/request/`, captchaToken === undefined
+            ? { [channel]: value }
+            : { [channel]: value, captcha_token: captchaToken }, mutating()),
+        otpVerify: (channel, value, code) => client.post(`/${channel}/verify/`, { [channel]: value, code }, mutating()),
+        passwordLogin: (login, password) => client.post("/password/login/", { login, password }, mutating()),
+        passwordMethods: () => client.get("/password/methods/"),
+        passwordChange: (oldPassword, newPassword) => client.post("/password/change/", { old_password: oldPassword, new_password: newPassword }, mutating()),
+        passwordChangeOtpRequest: (method) => client.post("/password/change/otp/request/", { method }, mutating()),
+        passwordChangeOtpVerify: (method, code, newPassword) => client.post("/password/change/otp/verify/", { method, code, new_password: newPassword }, mutating()),
+        passwordResetRequest: (channel, value) => client.post(`/password/reset/${channel}/request/`, { [channel]: value }, mutating()),
+        passwordResetVerify: (channel, value, code, newPassword) => client.post(`/password/reset/${channel}/verify/`, { [channel]: value, code, new_password: newPassword }, mutating()),
+        anonymous: (deviceId) => client.post("/anonymous/", deviceId === undefined ? {} : { device_id: deviceId }, mutating()),
+        oauthLogin: (provider, accessToken) => client.post("/oauth/login/", { provider, access_token: accessToken }, mutating()),
+        totpChallengeVerify: (challengeToken, proof) => client.post("/totp/challenge/verify/", { challenge_token: challengeToken, ...proof }, mutating()),
+        totpSetup: () => client.post("/totp/setup/", undefined, mutating()),
+        totpSetupConfirm: (code) => client.post("/totp/setup/confirm/", { code }, mutating()),
+        totpDisable: (request) => client.post("/totp/disable/", request, mutating()),
+        totpDisableOtpRequest: () => client.post("/totp/disable-otp/request/", undefined, mutating()),
+        verificationGet: (challengeId) => client.get(`/verification/${challengeId}/`),
+        verificationInitiate: (challengeId, factor) => client.post(`/verification/${challengeId}/initiate/`, { factor }, mutating()),
+        verificationComplete: (challengeId, body) => client.post(`/verification/${challengeId}/complete/`, body, mutating()),
+        securityStatus: () => client.get("/security/status/"),
+        sessions: () => client.get("/sessions/"),
+        confirmSession: (id) => client.post(`/sessions/${id}/confirm/`, undefined, mutating()),
+        revokeSession: (id) => client.delete(`/sessions/${id}/`, mutating()),
+        revokeOtherSessions: () => client.delete("/sessions/", mutating()),
+        tokenRefresh: (refresh) => refresh === undefined
+            ? client.get("/token/refresh/")
+            : client.post("/token/refresh/", { refresh }, mutating()),
+        qrGenerate: (type, redirectUrl, allowUnauthenticatedScanner) => client.post("/qr/generate/", allowUnauthenticatedScanner === undefined
+            ? { type, redirect_url: redirectUrl }
+            : {
+                type,
+                redirect_url: redirectUrl,
+                allow_unauthenticated_scanner: allowUnauthenticatedScanner,
+            }, mutating()),
+        qrStatus: (key) => client.get(`/qr/${key}/status/`),
+        qrConfirm: (key) => client.post(`/qr/${key}/confirm/`, undefined, mutating()),
+        qrReject: (key) => client.post(`/qr/${key}/reject/`, undefined, mutating()),
+        magicRequest: (email, redirectUrl) => client.post("/magic/request/", redirectUrl === undefined ? { email } : { email, redirect_url: redirectUrl }, mutating()),
+        passkeys: () => client
+            .get("/passkey/")
+            .then((r) => r.passkeys),
+        passkeyRegisterBegin: () => client.post("/passkey/register/begin/", undefined, mutating()),
+        passkeyRegisterComplete: (credential, deviceName) => client.post("/passkey/register/complete/", deviceName === undefined
+            ? { credential }
+            : { credential, device_name: deviceName }, mutating()),
+        passkeyAuthenticateBegin: (email) => client.post("/passkey/authenticate/begin/", email === undefined ? {} : { email }, mutating()),
+        passkeyAuthenticateComplete: (sessionKey, credential) => client.post("/passkey/authenticate/complete/", { session_key: sessionKey, credential }, mutating()),
+        passkeyRemove: (id) => client.delete(`/passkey/${id}/`, mutating()),
+        changeInstantRequestOld: (channel) => client.post(`/${channel}/change/instant/request-old/`, undefined, mutating()),
+        changeInstantVerifyOld: (channel, code) => client.post(`/${channel}/change/instant/verify-old/`, { code }, mutating()),
+        changeInstantRequestNew: (channel, value, changeToken) => client.post(`/${channel}/change/instant/request-new/`, { [channel]: value, change_token: changeToken }, mutating()),
+        changeInstantVerifyNew: (channel, value, code, changeToken) => client.post(`/${channel}/change/instant/verify-new/`, { [channel]: value, code, change_token: changeToken }, mutating()),
+        changeDelayedInitiate: (channel, value) => client.post(`/${channel}/change/delayed/initiate/`, { [channel]: value }, mutating()),
+        changeDelayedStatus: (channel) => client.get(`/${channel}/change/delayed/status/`),
+        changeDelayedCancel: (channel, changeRequestId) => client.post(`/${channel}/change/delayed/cancel/`, { change_request_id: changeRequestId }, mutating()),
+        ssoLookup: (domain) => client.get("/sso/lookup/", { query: { domain } }),
+        auditLog: (page) => client.get("/security/audit/", {
+            query: page === undefined ? {} : { page },
+        }),
+    };
+}
+//# sourceMappingURL=authApi.js.map

package/dist/api/authApi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authApi.js","sourceRoot":"","sources":["../../src/api/authApi.ts"],"names":[],"mappings":"AAiCA;;;;;GAKG;AACH,MAAM,YAAY,GAA2B;IAC3C,kBAAkB,EAAE,gBAAgB;CACrC,CAAC;AAEF,SAAS,QAAQ,CACf,OAAuD;IAEvD,OAAO;QACL,GAAG,OAAO;QACV,OAAO,EAAE,EAAE,GAAG,YAAY,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE;KAClD,CAAC;AACJ,CAAC;AA2FD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,MAAoB;IAChD,OAAO;QACL,MAAM;QAEN,YAAY,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,gBAAgB,CAAC;QAChD,EAAE,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;QAC5B,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAE5D,UAAU,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,CAC3C,MAAM,CAAC,IAAI,CACT,IAAI,OAAO,WAAW,EACtB,YAAY,KAAK,SAAS;YACxB,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE;YACtB,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,YAAY,EAAE,EACrD,QAAQ,EAAE,CACX;QACH,SAAS,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,CAClC,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,UAAU,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC;QAE5E,aAAa,EAAE,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,CACjC,MAAM,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,CAAC;QAClE,eAAe,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACvD,cAAc,EAAE,CAAC,WAAW,EAAE,WAAW,EAAE,EAAE,CAC3C,MAAM,CAAC,IAAI,CACT,mBAAmB,EACnB,EAAE,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,EACxD,QAAQ,EAAE,CACX;QACH,wBAAwB,EAAE,CAAC,MAAM,EAAE,EAAE,CACnC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC;QACtE,uBAAuB,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CACrD,MAAM,CAAC,IAAI,CACT,8BAA8B,EAC9B,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,EAC3C,QAAQ,EAAE,CACX;QACH,oBAAoB,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CACvC,MAAM,CAAC,IAAI,CACT,mBAAmB,OAAO,WAAW,EACrC,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EACpB,QAAQ,EAAE,CACX;QACH,mBAAmB,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CACzD,MAAM,CAAC,IAAI,CACT,mBAAmB,OAAO,UAAU,EACpC,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,EACrD,QAAQ,EAAE,CACX;QAEH,SAAS,EAAE,CAAC,QAAQ,EAAE,EAAE,CACtB,MAAM,CAAC,IAAI,CACT,aAAa,EACb,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,EACrD,QAAQ,EAAE,CACX;QAEH,UAAU,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,EAAE,CACpC,MAAM,CAAC,IAAI,CACT,eAAe,EACf,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,EACvC,QAAQ,EAAE,CACX;QAEH,mBAAmB,EAAE,CAAC,cAAc,EAAE,KAAK,EAAE,EAAE,CAC7C,MAAM,CAAC,IAAI,CACT,yBAAyB,EACzB,EAAE,eAAe,EAAE,cAAc,EAAE,GAAG,KAAK,EAAE,EAC7C,QAAQ,EAAE,CACX;QACH,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QACnE,gBAAgB,EAAE,CAAC,IAAI,EAAE,EAAE,CACzB,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC;QAC3D,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,gBAAgB,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;QAC5E,qBAAqB,EAAE,GAAG,EAAE,CAC1B,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAElE,eAAe,EAAE,CAAC,WAAW,EAAE,EAAE,CAC/B,MAAM,CAAC,GAAG,CAAC,iBAAiB,WAAW,GAAG,CAAC;QAC7C,oBAAoB,EAAE,CAAC,WAAW,EAAE,MAAM,EAAE,EAAE,CAC5C,MAAM,CAAC,IAAI,CAAC,iBAAiB,WAAW,YAAY,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,CAAC;QAC/E,oBAAoB,EAAE,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAC1C,MAAM,CAAC,IAAI,CAAC,iBAAiB,WAAW,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAEzE,cAAc,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,mBAAmB,CAAC;QAErD,QAAQ,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;QACxC,cAAc,EAAE,CAAC,EAAE,EAAE,EAAE,CACrB,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAChE,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;QACpE,mBAAmB,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,QAAQ,EAAE,CAAC;QAElE,YAAY,EAAE,CAAC,OAAO,EAAE,EAAE,CACxB,OAAO,KAAK,SAAS;YACnB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC;YAC/B,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC;QAE7D,UAAU,EAAE,CAAC,IAAI,EAAE,WAAW,EAAE,2BAA2B,EAAE,EAAE,CAC7D,MAAM,CAAC,IAAI,CACT,eAAe,EACf,2BAA2B,KAAK,SAAS;YACvC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE;YACrC,CAAC,CAAC;gBACE,IAAI;gBACJ,YAAY,EAAE,WAAW;gBACzB,6BAA6B,EAAE,2BAA2B;aAC3D,EACL,QAAQ,EAAE,CACX;QACH,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,OAAO,GAAG,UAAU,CAAC;QACnD,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,GAAG,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC7E,QAAQ,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,GAAG,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAE3E,YAAY,EAAE,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,CACnC,MAAM,CAAC,IAAI,CACT,iBAAiB,EACjB,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,EAC5E,QAAQ,EAAE,CACX;QAEH,QAAQ,EAAE,GAAG,EAAE,CACb,MAAM;aACH,GAAG,CAAmC,WAAW,CAAC;aAClD,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC5B,oBAAoB,EAAE,GAAG,EAAE,CACzB,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAChE,uBAAuB,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,CAClD,MAAM,CAAC,IAAI,CACT,6BAA6B,EAC7B,UAAU,KAAK,SAAS;YACtB,CAAC,CAAC,EAAE,UAAU,EAAE;YAChB,CAAC,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,EAC3C,QAAQ,EAAE,CACX;QACH,wBAAwB,EAAE,CAAC,KAAK,EAAE,EAAE,CAClC,MAAM,CAAC,IAAI,CACT,8BAA8B,EAC9B,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EACpC,QAAQ,EAAE,CACX;QACH,2BAA2B,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,EAAE,CACtD,MAAM,CAAC,IAAI,CACT,iCAAiC,EACjC,EAAE,WAAW,EAAE,UAAU,EAAE,UAAU,EAAE,EACvC,QAAQ,EAAE,CACX;QACH,aAAa,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;QAEnE,uBAAuB,EAAE,CAAC,OAAO,EAAE,EAAE,CACnC,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,8BAA8B,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;QAC/E,sBAAsB,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,CACxC,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,6BAA6B,EAAE,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC;QAC7E,uBAAuB,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,CACvD,MAAM,CAAC,IAAI,CACT,IAAI,OAAO,8BAA8B,EACzC,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,EAC/C,QAAQ,EAAE,CACX;QACH,sBAAsB,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAC5D,MAAM,CAAC,IAAI,CACT,IAAI,OAAO,6BAA6B,EACxC,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,EACrD,QAAQ,EAAE,CACX;QACH,qBAAqB,EAAE,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,CACxC,MAAM,CAAC,IAAI,CACT,IAAI,OAAO,2BAA2B,EACtC,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EACpB,QAAQ,EAAE,CACX;QACH,mBAAmB,EAAE,CAAC,OAAO,EAAE,EAAE,CAC/B,MAAM,CAAC,GAAG,CAAC,IAAI,OAAO,yBAAyB,CAAC;QAClD,mBAAmB,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,EAAE,CAChD,MAAM,CAAC,IAAI,CACT,IAAI,OAAO,yBAAyB,EACpC,EAAE,iBAAiB,EAAE,eAAe,EAAE,EACtC,QAAQ,EAAE,CACX;QAEH,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC;QAExE,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,CACjB,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE;YAC7B,KAAK,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE;SAC1C,CAAC;KACL,CAAC;AACJ,CAAC"}