@tempoxyz/id 0.0.0-stage → 0.0.1

package/dist/app/server/assets/authorize-BXzTo2Pb.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize-BXzTo2Pb.js","names":["createFileRoute","parseResponse","Client","Loader","Upgrade","style","CeremonyError","Error","name","Route","component","lazyRouteComponent","$$splitComponentImporter","loader","match","Promise","Page","Props","searchStr","location","query","URLSearchParams","get","preview","request","client","create","result","i","authorize","$get","oauth_query","toString","error","reason","redirect","href","document","loaderDeps","search","options","Options","Preview","v1","catch","undefined","read","key","refusal","upgrade","forKey","account","chain","styles","page","ReturnType","Client.create","Client.reason","Upgrade.forKey","createFileRoute","reason","create","parseResponse","redirect","forKey","Route","lazyRouteComponent","match","query","searchStr","client","result","error","preview","options","read","key","styles"],"sources":["../../../routes/authorize.tsx"],"sourcesContent":["/**\n * The approval page, where the signed-in user approves or denies an app's request. For a\n * wallet.tempo passkey's wallet that waits for its upgrade, Approve shows the upgrade step, and\n * both Continue and Not now finish the approval and return to the app. @module\n */\nimport { type UseMutationResult, useMutation } from '@tanstack/react-query'\nimport { Await, createFileRoute } from '@tanstack/react-router'\nimport { parseResponse } from 'hono/client'\nimport { type ReactNode, useState } from 'react'\nimport { Authentication } from 'webauthx/client'\nimport * as Client from '../lib/Client.js'\nimport * as Loader from '../lib/Loader.js'\nimport * as Upgrade from '../lib/Upgrade.js'\nimport { Approval, InvalidRequest } from '../screens/Approval.js'\nimport { WalletUpgrade } from '../screens/WalletUpgrade.js'\nimport { style } from '../zyzz.config.js'\n\n/** Wraps a failure of the browser's passkey ceremony. */\nclass CeremonyError extends Error {\n  override name = 'Page.CeremonyError'\n}\n\nexport const Route = createFileRoute('/authorize')({\n  component: () => <Page {...Route.useLoaderData()} />,\n  /**\n   * Returns no request for a query that Better Auth did not sign, and redirects a visitor without a\n   * session to sign-in. Otherwise returns the request, or redirects a refused key to the app. The\n   * account that approval signs for follows as `preview`, which the page streams in after it renders.\n   */\n  loader: async (match): Promise<Page.Props> => {\n    const { searchStr } = match.location\n    // Better Auth reads the query with `URLSearchParams`, so the page reads it the same way, and a\n    // malformed escape cannot show one request and approve another.\n    const query = new URLSearchParams(searchStr)\n    // Apps start at `/oauth2/authorize`, which signs the query, so an unsigned one is no request.\n    if (!query.get('sig')) return { preview: null, request: null }\n\n    const client = Client.create()\n    const result = await (async () => {\n      try {\n        return await parseResponse(\n          client.i.authorize.request.$get({\n            query: { oauth_query: query.toString() },\n          }),\n        )\n      } catch (error) {\n        if (Client.reason(error) === 'session_required')\n          Loader.redirect({ href: `/login${searchStr}` })\n        throw error\n      }\n    })()\n    if ('redirect' in result)\n      Loader.redirect({ document: true, href: result.redirect })\n    if (!result.request) return { preview: null, request: null }\n\n    // The owners' lookup can call every realm's Privy app, so the page renders without waiting for it.\n    return {\n      preview: preview(client, { query, request: result.request }),\n      request: result.request,\n    }\n  },\n  // The loader reads the whole query, so a change to any parameter loads the page again.\n  loaderDeps: (match) => ({ search: match.search }),\n})\n\n/** Renders the page. */\nfunction Page(props: Page.Props) {\n  const client = Client.use()\n  const consent = useMutation({\n    async mutationFn(variables: Page.Decision) {\n      const json = {\n        accept: variables.accept,\n        // Approval signs for the account that the page shows.\n        ...(variables.account ? { account: variables.account } : {}),\n        oauth_query: window.location.search.slice(1),\n        session_id: props.request?.session ?? '',\n        ...(variables.skipUpgrade ? { skip_upgrade: true } : {}),\n      }\n      const decided = await parseResponse(\n        client.v1.authorize.consent.$post({ json }),\n      )\n      if (!('step' in decided)) return decided\n\n      // The passkey signs the key authorization's digest, which the step's options carry.\n      const assertion = await Authentication.sign({\n        options: { publicKey: decided.step.options.publicKey },\n      }).catch((error: unknown) => {\n        throw new CeremonyError('Passkey ceremony failed.', { cause: error })\n      })\n      const signed = await parseResponse(\n        client.v1.authorize.consent.$post({\n          json: { ...json, passkey: { assertion } },\n        }),\n      )\n      if ('step' in signed)\n        throw new Error('The approval requested a second passkey step.')\n      return signed\n    },\n    // Without a session, the page's loader sends the browser to sign-in, which continues the request.\n    onError: (error) => {\n      if (Client.reason(error) === 'session_required') window.location.reload()\n    },\n    onSuccess: (data) => window.location.assign(data.redirect),\n  })\n  // The decision holds both buttons until the browser leaves, after the request succeeds too.\n  const decided = consent.isPending || consent.isSuccess\n\n  if (!props.request || !props.preview)\n    return (\n      <main {...styles.page()}>\n        <InvalidRequest />\n      </main>\n    )\n\n  // A denial needs no account, so Deny works while the account loads. Approve waits for it.\n  const approval = (request: Page.Request, options: Page.approval.Options) => (\n    <Approval\n      account={request.account}\n      app={request.app}\n      approving={decided && consent.variables.accept}\n      checking={options.checking}\n      denying={decided && !consent.variables.accept}\n      destination={request.destination}\n      email={request.email}\n      verified={request.verified}\n      error={\n        consent.error && Client.reason(consent.error) !== 'webauthn_required'\n          ? message(consent.error)\n          : undefined\n      }\n      keyAuthorization={request.key}\n      logo={request.logo}\n      onApprove={\n        options.onApprove ??\n        (() => consent.mutate({ accept: true, account: request.key?.account }))\n      }\n      onDeny={() => consent.mutate({ accept: false })}\n      // The API's refusal names the other flows, and the screen states the step here instead.\n      refusal={\n        Client.reason(consent.error) === 'webauthn_required'\n          ? 'passkey'\n          : undefined\n      }\n    />\n  )\n\n  return (\n    <main {...styles.page()}>\n      <Await\n        fallback={approval(props.request, { checking: true })}\n        promise={props.preview}\n      >\n        {(preview) => (\n          <Previewed approval={approval} consent={consent} preview={preview} />\n        )}\n      </Await>\n    </main>\n  )\n}\n\ndeclare namespace Page {\n  namespace approval {\n    type Options = {\n      /** Whether the account that approval signs for loads, which holds Approve. */\n      checking: boolean\n      /** Runs on Approve in place of the decision, such as to show the upgrade step first. */\n      onApprove?: (() => void) | undefined\n    }\n  }\n\n  /** The user's decision on the request, which `POST /v1/authorize/consent` records. */\n  type Decision = {\n    /** Whether the user approves the request. */\n    accept: boolean\n    /** The account that the page shows for the key, if any. */\n    account?: `0x${string}` | undefined\n    /** Whether the user skipped the wallet's upgrade, so the passkey signs for the wallet as it is. */\n    skipUpgrade?: boolean | undefined\n  }\n\n  type Props = {\n    /** The request with the account that approval signs for, which follows `request`. */\n    preview: Promise<Preview> | null\n    /** `null` for a forged or expired query or an unknown app. It holds no account. */\n    request: Request | null\n  }\n\n  /** The request with the account that approval signs for. */\n  type Preview = {\n    /** The request, with its account and the key's refusal. */\n    request: Request\n    /** The wallet upgrade that approval waits for, or `null`. */\n    upgrade: Upgrade.Pending | null\n  }\n\n  /** The request that the page shows. */\n  type Request = {\n    /** Absent unless the user holds several accounts in the app's realms. */\n    account?: Approval.Account | undefined\n    /** The app's display name. */\n    app: string\n    /** The host of the app's redirect URI, or the scheme of a native app. */\n    destination: string\n    /** The signed-in user's address. */\n    email: string\n    /** Absent without a key authorization. */\n    key?: Approval.Key | undefined\n    /** The app's logo as a `data:` URL, if any. */\n    logo?: string | undefined\n    /** The signed-in session's ID, which the decision names. */\n    session: string\n    /** Whether the app is registered, which marks its name as verified. */\n    verified: boolean\n  }\n}\n\n/**\n * Renders the approval with the account that approval signs for. For a wallet.tempo passkey's\n * wallet that waits for its upgrade, Approve shows the upgrade step, since approval cannot sign the\n * key before it. Continue upgrades the wallet, and Not now signs the key for the wallet as it is.\n * Both then approve the request, so the browser returns to the app.\n */\nfunction Previewed(props: Previewed.Props) {\n  const { consent, preview } = props\n  const client = Client.use()\n  const pending = preview.upgrade ?? undefined\n  const account = preview.request.key?.account\n  const upgrade = Upgrade.use({\n    // The approval starts before the upgrade settles, so Continue holds until the browser leaves.\n    onSuccess: () => consent.mutate({ accept: true, account }),\n    pending,\n  })\n  // A session older than 10 minutes cannot upgrade. Without a session, the page's loader sends the\n  // browser to sign-in, and back to the request.\n  const signOut = useMutation({\n    mutationFn: () => parseResponse(client.v1.auth.logout.$post()),\n    onSuccess: () => window.location.reload(),\n  })\n  // Whether Approve opened the upgrade step.\n  const [opened, setOpened] = useState(false)\n  const decided = consent.isPending || consent.isSuccess\n  const skipping = decided && consent.variables.skipUpgrade === true\n\n  // A failed approval shows the request again, with its error.\n  if (pending && opened && !consent.isError)\n    return (\n      <WalletUpgrade\n        error={(() => {\n          const error = signOut.error ?? upgrade.error\n          if (!error || (upgrade.stale && !signOut.error)) return undefined\n          return Upgrade.message(error)\n        })()}\n        onContinue={() => upgrade.mutate()}\n        onSignIn={upgrade.stale ? () => signOut.mutate() : undefined}\n        onSkip={() =>\n          consent.mutate({ accept: true, account, skipUpgrade: true })\n        }\n        preparing={upgrade.preparing}\n        skipping={skipping}\n        upgrading={\n          upgrade.isPending ||\n          (decided && !skipping) ||\n          signOut.isPending ||\n          signOut.isSuccess\n        }\n      />\n    )\n\n  const { key } = preview.request\n  if (!pending || !key)\n    return props.approval(preview.request, { checking: false })\n\n  // The upgrade step resolves the key's `upgrade` refusal, so Approve stays enabled. After the\n  // upgrade, Approve repeats the approval alone, and the page shows the request while it runs.\n  return props.approval(\n    { ...preview.request, key: { ...key, refusal: undefined } },\n    {\n      checking: false,\n      onApprove: () => {\n        if (upgrade.isSuccess) {\n          setOpened(false)\n          consent.mutate({ accept: true, account })\n          return\n        }\n        consent.reset()\n        setOpened(true)\n      },\n    },\n  )\n}\n\ndeclare namespace Previewed {\n  type Props = {\n    /** Renders the approval of `request`. */\n    approval: (\n      request: Page.Request,\n      options: Page.approval.Options,\n    ) => ReactNode\n    /** The decision on the request, which the page's approval shares. */\n    consent: UseMutationResult<{ redirect: string }, Error, Page.Decision>\n    /** The request with the account that approval signs for. */\n    preview: Page.Preview\n  }\n}\n\n/**\n * Returns `request` with the account that approval signs for, the key's refusal, and the upgrade\n * that an `upgrade` refusal waits for. A failed read holds the approval of a key with `unavailable`,\n * as a failed read of the owners does.\n */\nasync function preview(\n  client: Client.Client,\n  options: preview.Options,\n): Promise<Page.Preview> {\n  const result = await parseResponse(\n    client.v1.authorize.request.$get({\n      query: { oauth_query: options.query.toString() },\n    }),\n  ).catch(() => undefined)\n  const read = result && 'request' in result ? result.request : undefined\n  if (!read) {\n    const { key } = options.request\n    return {\n      request: {\n        ...options.request,\n        ...(key ? { key: { ...key, refusal: 'unavailable' } } : {}),\n      },\n      upgrade: null,\n    }\n  }\n\n  // An `upgrade` refusal names the account to upgrade on the key's chain, or none for a passkey of\n  // the email that has not linked.\n  const key = read.key\n  const upgrade =\n    key?.refusal === 'upgrade'\n      ? await Upgrade.forKey(client, {\n          account: key.account,\n          chain: key.chain.name,\n        })\n      : undefined\n  return { request: read, upgrade: upgrade ?? null }\n}\n\ndeclare namespace preview {\n  type Options = {\n    /** The approval page's signed query. */\n    query: URLSearchParams\n    /** The request that the page renders first. */\n    request: Page.Request\n  }\n}\n\n/** Returns the message for `error`, such as for a canceled ceremony. */\nfunction message(error: unknown) {\n  if (Client.reason(error) === 'webauthn_rejected')\n    return 'Your passkey did not sign the approval. Approve again, or deny the request.'\n  if (!(error instanceof CeremonyError)) return Client.message(error)\n  if (names(error).includes('NotAllowedError'))\n    return 'The passkey request was canceled. Approve again, or deny the request.'\n  return 'Your passkey did not sign the approval. Approve again, or deny the request.'\n}\n\n/** Returns the names of `error` and its causes. */\nfunction names(error: unknown): readonly string[] {\n  if (!(error instanceof Error)) return []\n  return [error.name, ...names(error.cause)]\n}\n\nnamespace styles {\n  export const page = style({\n    alignItems: 'center',\n    display: 'flex',\n    justifyContent: 'center',\n    minHeight: '100dvh !custom',\n    paddingBlock: '64',\n    paddingInline: '16',\n  })\n}\n"],"mappings":"A,sQAsBA,IAAaS,EAAQT,EAAgB,YAAY,CAAC,CAAC,CACjDU,UAASC,M,kCAAA,WAAA,EAMTE,OAAQ,KAAOC,IAA+B,CAC5C,GAAM,CAAEI,aAAcJ,EAAMK,SAGtBC,EAAQ,IAAIC,gBAAgBH,CAAS,EAE3C,GAAI,CAACE,EAAME,IAAI,KAAK,EAAG,MAAO,CAAEC,QAAS,KAAMC,QAAS,IAAK,EAE7D,IAAMC,EAASvB,EAAc,EACvByB,EAAS,MAAO,SAAY,CAChC,GAAI,CACF,OAAO,MAAM1B,EACXwB,EAAOG,EAAEC,UAAUL,QAAQM,KAAK,CAC9BV,MAAO,CAAEW,YAAaX,EAAMY,SAAS,CAAE,CACzC,CAAC,CACH,CACF,OAASC,EAAO,CAGd,MAFI/B,EAAc+B,CAAK,IAAM,oBAC3B9B,EAAgB,CAAEiC,KAAM,SAASlB,GAAY,CAAC,EAC1Ce,CACR,CACF,EAAA,CAAG,EAMH,MALI,aAAcN,GAChBxB,EAAgB,CAAEkC,SAAU,GAAMD,KAAMT,EAAOQ,QAAS,CAAC,EACtDR,EAAOH,QAGL,CACLD,QAASA,EAAQE,EAAQ,CAAEL,QAAOI,QAASG,EAAOH,OAAQ,CAAC,EAC3DA,QAASG,EAAOH,OAClB,EAN4B,CAAED,QAAS,KAAMC,QAAS,IAAK,CAO7D,EAEAc,WAAaxB,IAAW,CAAEyB,OAAQzB,EAAMyB,MAAO,EACjD,CAAC,EAuPD,eAAehB,EACbE,EACAe,EACuB,CACvB,IAAMb,EAAS,MAAM1B,EACnBwB,EAAOkB,GAAGd,UAAUL,QAAQM,KAAK,CAC/BV,MAAO,CAAEW,YAAaS,EAAQpB,MAAMY,SAAS,CAAE,CACjD,CAAC,CACH,CAAC,CAACY,UAAYC,IAAAA,EAAS,EACjBC,EAAOnB,GAAU,YAAaA,EAASA,EAAOH,QAAUqB,IAAAA,GAC9D,GAAI,CAACC,EAAM,CACT,GAAM,CAAEC,OAAQP,EAAQhB,QACxB,MAAO,CACLA,QAAS,CACP,GAAGgB,EAAQhB,QACX,GAAIuB,EAAM,CAAEA,IAAK,CAAE,GAAGA,EAAKC,QAAS,aAAc,CAAE,EAAI,CAAC,CAC3D,EACAC,QAAS,IACX,CACF,CAIA,IAAMF,EAAMD,EAAKC,IAQjB,MAAO,CAAEvB,QAASsB,EAAMG,SANtBF,GAAKC,UAAY,UACb,MAAM5C,EAAeqB,EAAQ,CAC3B0B,QAASJ,EAAII,QACbC,MAAOL,EAAIK,MAAM5C,IACnB,CAAC,EACDqC,IAAAA,KACsC,IAAK,CACnD,CA2BA,IAAUQ,GAAV,SAAA,EAAA,CACeC,EAAAA,KAAO,CAQtB,EAAA,CAAA,AAAAuB,IAAA,CAAA,CAAA,E"}

package/dist/app/server/assets/authorize-BzoUqOdA.js

@@ -0,0 +1,2 @@
+import{a as e}from"./rolldown-runtime-BWaJ3C7D.js";/* empty css                     */import{E as t,s as n}from"./react-dom-DYzj0HXX.js";import{a as r}from"./load-server-Dr0IlySo.js";import{t as i}from"./utils-D57zfcg-.js";import{a,i as o,o as s,r as c}from"./Client-Dx3KrpJZ.js";import"./zyzz.config-CJRpjn0E.js";import{n as l,t as u}from"./Authentication-C3oNZAVX.js";import{n as d,o as f}from"./Upgrade-Dbfm2nm0.js";import{t as p}from"./authorize-BXzTo2Pb.js";import{n as m,t as h}from"./Approval-DvkB9tWA.js";import{t as g}from"./WalletUpgrade-CWKc5fYt.js";var _=Symbol.for(`TSR_DEFERRED_PROMISE`);function v(e,t){let n=e;return n[_]||(n[_]={status:`pending`},n.then(e=>{n[_].status=`success`,n[_].data=e}).catch(e=>{n[_].status=`error`,n[_].error={data:(t?.serializeError??r)(e),__isServerError:!0}})),n}var y=e(t(),1),b=n();function x({promise:e}){if(i)return i(e);let t=v(e);if(t[_].status===`pending`)throw t;if(t[_].status===`error`)throw t[_].error;return t[_].data}function S(e){let t=(0,b.jsx)(C,{...e});return e.fallback?(0,b.jsx)(y.Suspense,{fallback:e.fallback,children:t}):t}function C(e){let t=x(e);return e.children(t)}var w=class extends Error{name=`Page.CeremonyError`};function T(e){let t=a(),n=l({async mutationFn(n){let r={accept:n.accept,...n.account?{account:n.account}:{},oauth_query:window.location.search.slice(1),session_id:e.request?.session??``,...n.skipUpgrade?{skip_upgrade:!0}:{}},i=await s(t.v1.authorize.consent.$post({json:r}));if(!(`step`in i))return i;let a=await u({options:{publicKey:i.step.options.publicKey}}).catch(e=>{throw new w(`Passkey ceremony failed.`,{cause:e})}),o=await s(t.v1.authorize.consent.$post({json:{...r,passkey:{assertion:a}}}));if(`step`in o)throw Error(`The approval requested a second passkey step.`);return o},onError:e=>{o(e)===`session_required`&&window.location.reload()},onSuccess:e=>window.location.assign(e.redirect)}),r=n.isPending||n.isSuccess;if(!e.request||!e.preview)return(0,b.jsx)(`main`,{className:k.page?`z_tempo_2d_id-V2chls0 z_tempo_2d_id-V2chls1 z_tempo_2d_id-V2chls2 z_tempo_2d_id-V2chls3 z_tempo_2d_id-V2chls4`:k.page().className,children:(0,b.jsx)(m,{})});let i=(e,t)=>(0,b.jsx)(h,{account:e.account,app:e.app,approving:r&&n.variables.accept,checking:t.checking,denying:r&&!n.variables.accept,destination:e.destination,email:e.email,verified:e.verified,error:n.error&&o(n.error)!==`webauthn_required`?D(n.error):void 0,keyAuthorization:e.key,logo:e.logo,onApprove:t.onApprove??(()=>n.mutate({accept:!0,account:e.key?.account})),onDeny:()=>n.mutate({accept:!1}),refusal:o(n.error)===`webauthn_required`?`passkey`:void 0});return(0,b.jsx)(`main`,{className:k.page?`z_tempo_2d_id-V2chls0 z_tempo_2d_id-V2chls1 z_tempo_2d_id-V2chls2 z_tempo_2d_id-V2chls3 z_tempo_2d_id-V2chls4`:k.page().className,children:(0,b.jsx)(S,{fallback:i(e.request,{checking:!0}),promise:e.preview,children:e=>(0,b.jsx)(E,{approval:i,consent:n,preview:e})})})}function E(e){let{consent:t,preview:n}=e,r=a(),i=n.upgrade??void 0,o=n.request.key?.account,c=f({onSuccess:()=>t.mutate({accept:!0,account:o}),pending:i}),u=l({mutationFn:()=>s(r.v1.auth.logout.$post()),onSuccess:()=>window.location.reload()}),[p,m]=(0,y.useState)(!1),h=t.isPending||t.isSuccess,_=h&&t.variables.skipUpgrade===!0;if(i&&p&&!t.isError)return(0,b.jsx)(g,{error:(()=>{let e=u.error??c.error;if(!(!e||c.stale&&!u.error))return d(e)})(),onContinue:()=>c.mutate(),onSignIn:c.stale?()=>u.mutate():void 0,onSkip:()=>t.mutate({accept:!0,account:o,skipUpgrade:!0}),preparing:c.preparing,skipping:_,upgrading:c.isPending||h&&!_||u.isPending||u.isSuccess});let{key:v}=n.request;return!i||!v?e.approval(n.request,{checking:!1}):e.approval({...n.request,key:{...v,refusal:void 0}},{checking:!1,onApprove:()=>{c.isSuccess?(m(!1),t.mutate({accept:!0,account:o})):(t.reset(),m(!0))}})}function D(e){return o(e)===`webauthn_rejected`?`Your passkey did not sign the approval. Approve again, or deny the request.`:e instanceof w?O(e).includes(`NotAllowedError`)?`The passkey request was canceled. Approve again, or deny the request.`:`Your passkey did not sign the approval. Approve again, or deny the request.`:c(e)}function O(e){return e instanceof Error?[e.name,...O(e.cause)]:[]}var k;(function(e){e.page=1})(k||={});var A=()=>(0,b.jsx)(T,{...p.useLoaderData()});export{A as component};
+//# sourceMappingURL=authorize-BzoUqOdA.js.map

package/dist/app/server/assets/authorize-BzoUqOdA.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize-BzoUqOdA.js","names":["useMutation","Await","parseResponse","useState","Authentication","Client","Upgrade","Approval","InvalidRequest","WalletUpgrade","style","CeremonyError","Error","name","Route","Page","props","client","use","consent","mutationFn","variables","json","accept","account","oauth_query","window","location","search","slice","session_id","request","session","skipUpgrade","skip_upgrade","decided","v1","authorize","$post","assertion","sign","options","publicKey","step","catch","error","cause","signed","passkey","onError","reason","reload","onSuccess","data","assign","redirect","isPending","isSuccess","preview","styles","page","className","approval","app","checking","destination","email","verified","message","undefined","key","logo","onApprove","mutate","Previewed","pending","upgrade","signOut","auth","logout","opened","setOpened","skipping","isError","stale","preparing","refusal","reset","names","includes","_styles","SplitComponent","useLoaderData","component","Client.use","Authentication.sign","Client.reason","Upgrade.use","useState","Upgrade.message","Client.message","__toESM","require_react","require_jsx_runtime","defaultSerializeError","reactUse","reason","parseResponse","message$1","useMutation","sign","message$2","use$1","Route","InvalidRequest","Approval","WalletUpgrade","TSR_DEFERRED_PROMISE","defer","promise","_promise","data","options","error","import_react","import_jsx_runtime","useAwaited","Await","inner","AwaitInner","props","CeremonyError","Page","client","use","consent","json","variables","decided","assertion","signed","styles","approval","request","message","Previewed","pending","preview","account","upgrade","signOut","opened","setOpened","skipping","key","names","SplitComponent"],"sources":["../../../../../node_modules/.pnpm/@tanstack+router-core@1.171.34/node_modules/@tanstack/router-core/dist/esm/defer.js","../../../../../node_modules/.pnpm/@tanstack+react-router@1.170.41_react-dom@19.3.0_react@19.3.0__react@19.3.0/node_modules/@tanstack/react-router/dist/esm/awaited.js","../../../routes/authorize.tsx?tsr-split=component"],"sourcesContent":["import { defaultSerializeError } from \"./router.js\";\n//#region src/defer.ts\n/**\n* Well-known symbol used by {@link defer} to tag a promise with\n* its deferred state. Consumers can read `promise[TSR_DEFERRED_PROMISE]`\n* to access `status`, `data`, or `error`.\n*/\nconst TSR_DEFERRED_PROMISE = Symbol.for(\"TSR_DEFERRED_PROMISE\");\n/**\n* Wrap a promise with a deferred state for use with `<Await>` and `useAwaited`.\n*\n* The returned promise is augmented with internal state (status/data/error)\n* so UI can read progress or suspend until it settles.\n*\n* @param _promise The promise to wrap.\n* @param options Optional config. Provide `serializeError` to customize how\n* errors are serialized for transfer.\n* @returns The same promise with attached deferred metadata.\n* @link https://tanstack.com/router/latest/docs/framework/react/api/router/deferFunction\n*/\nfunction defer(_promise, options) {\n\tconst promise = _promise;\n\tif (promise[TSR_DEFERRED_PROMISE]) return promise;\n\tpromise[TSR_DEFERRED_PROMISE] = { status: \"pending\" };\n\tpromise.then((data) => {\n\t\tpromise[TSR_DEFERRED_PROMISE].status = \"success\";\n\t\tpromise[TSR_DEFERRED_PROMISE].data = data;\n\t}).catch((error) => {\n\t\tpromise[TSR_DEFERRED_PROMISE].status = \"error\";\n\t\tpromise[TSR_DEFERRED_PROMISE].error = {\n\t\t\tdata: (options?.serializeError ?? defaultSerializeError)(error),\n\t\t\t__isServerError: true\n\t\t};\n\t});\n\treturn promise;\n}\n//#endregion\nexport { TSR_DEFERRED_PROMISE, defer };\n\n//# sourceMappingURL=defer.js.map","import { reactUse } from \"./utils.js\";\nimport { TSR_DEFERRED_PROMISE, defer } from \"@tanstack/router-core\";\nimport * as React$1 from \"react\";\nimport { jsx } from \"react/jsx-runtime\";\n//#region src/awaited.tsx\n/** Suspend until a deferred promise resolves or rejects and return its data. */\nfunction useAwaited({ promise: _promise }) {\n\tif (reactUse) return reactUse(_promise);\n\tconst promise = defer(_promise);\n\tif (promise[TSR_DEFERRED_PROMISE].status === \"pending\") throw promise;\n\tif (promise[TSR_DEFERRED_PROMISE].status === \"error\") throw promise[TSR_DEFERRED_PROMISE].error;\n\treturn promise[TSR_DEFERRED_PROMISE].data;\n}\n/**\n* Component that suspends on a deferred promise and renders its child with\n* the resolved value. Optionally provides a Suspense fallback.\n*/\nfunction Await(props) {\n\tconst inner = /* @__PURE__ */ jsx(AwaitInner, { ...props });\n\tif (props.fallback) return /* @__PURE__ */ jsx(React$1.Suspense, {\n\t\tfallback: props.fallback,\n\t\tchildren: inner\n\t});\n\treturn inner;\n}\nfunction AwaitInner(props) {\n\tconst data = useAwaited(props);\n\treturn props.children(data);\n}\n//#endregion\nexport { Await, useAwaited };\n\n//# sourceMappingURL=awaited.js.map","/**\n * The approval page, where the signed-in user approves or denies an app's request. For a\n * wallet.tempo passkey's wallet that waits for its upgrade, Approve shows the upgrade step, and\n * both Continue and Not now finish the approval and return to the app. @module\n */\nimport { type UseMutationResult, useMutation } from '@tanstack/react-query'\nimport { Await, createFileRoute } from '@tanstack/react-router'\nimport { parseResponse } from 'hono/client'\nimport { type ReactNode, useState } from 'react'\nimport { Authentication } from 'webauthx/client'\nimport * as Client from '../lib/Client.js'\nimport * as Loader from '../lib/Loader.js'\nimport * as Upgrade from '../lib/Upgrade.js'\nimport { Approval, InvalidRequest } from '../screens/Approval.js'\nimport { WalletUpgrade } from '../screens/WalletUpgrade.js'\nimport { style } from '../zyzz.config.js'\n\n/** Wraps a failure of the browser's passkey ceremony. */\nclass CeremonyError extends Error {\n  override name = 'Page.CeremonyError'\n}\n\nexport const Route = createFileRoute('/authorize')({\n  component: () => <Page {...Route.useLoaderData()} />,\n  /**\n   * Returns no request for a query that Better Auth did not sign, and redirects a visitor without a\n   * session to sign-in. Otherwise returns the request, or redirects a refused key to the app. The\n   * account that approval signs for follows as `preview`, which the page streams in after it renders.\n   */\n  loader: async (match): Promise<Page.Props> => {\n    const { searchStr } = match.location\n    // Better Auth reads the query with `URLSearchParams`, so the page reads it the same way, and a\n    // malformed escape cannot show one request and approve another.\n    const query = new URLSearchParams(searchStr)\n    // Apps start at `/oauth2/authorize`, which signs the query, so an unsigned one is no request.\n    if (!query.get('sig')) return { preview: null, request: null }\n\n    const client = Client.create()\n    const result = await (async () => {\n      try {\n        return await parseResponse(\n          client.i.authorize.request.$get({\n            query: { oauth_query: query.toString() },\n          }),\n        )\n      } catch (error) {\n        if (Client.reason(error) === 'session_required')\n          Loader.redirect({ href: `/login${searchStr}` })\n        throw error\n      }\n    })()\n    if ('redirect' in result)\n      Loader.redirect({ document: true, href: result.redirect })\n    if (!result.request) return { preview: null, request: null }\n\n    // The owners' lookup can call every realm's Privy app, so the page renders without waiting for it.\n    return {\n      preview: preview(client, { query, request: result.request }),\n      request: result.request,\n    }\n  },\n  // The loader reads the whole query, so a change to any parameter loads the page again.\n  loaderDeps: (match) => ({ search: match.search }),\n})\n\n/** Renders the page. */\nfunction Page(props: Page.Props) {\n  const client = Client.use()\n  const consent = useMutation({\n    async mutationFn(variables: Page.Decision) {\n      const json = {\n        accept: variables.accept,\n        // Approval signs for the account that the page shows.\n        ...(variables.account ? { account: variables.account } : {}),\n        oauth_query: window.location.search.slice(1),\n        session_id: props.request?.session ?? '',\n        ...(variables.skipUpgrade ? { skip_upgrade: true } : {}),\n      }\n      const decided = await parseResponse(\n        client.v1.authorize.consent.$post({ json }),\n      )\n      if (!('step' in decided)) return decided\n\n      // The passkey signs the key authorization's digest, which the step's options carry.\n      const assertion = await Authentication.sign({\n        options: { publicKey: decided.step.options.publicKey },\n      }).catch((error: unknown) => {\n        throw new CeremonyError('Passkey ceremony failed.', { cause: error })\n      })\n      const signed = await parseResponse(\n        client.v1.authorize.consent.$post({\n          json: { ...json, passkey: { assertion } },\n        }),\n      )\n      if ('step' in signed)\n        throw new Error('The approval requested a second passkey step.')\n      return signed\n    },\n    // Without a session, the page's loader sends the browser to sign-in, which continues the request.\n    onError: (error) => {\n      if (Client.reason(error) === 'session_required') window.location.reload()\n    },\n    onSuccess: (data) => window.location.assign(data.redirect),\n  })\n  // The decision holds both buttons until the browser leaves, after the request succeeds too.\n  const decided = consent.isPending || consent.isSuccess\n\n  if (!props.request || !props.preview)\n    return (\n      <main {...styles.page()}>\n        <InvalidRequest />\n      </main>\n    )\n\n  // A denial needs no account, so Deny works while the account loads. Approve waits for it.\n  const approval = (request: Page.Request, options: Page.approval.Options) => (\n    <Approval\n      account={request.account}\n      app={request.app}\n      approving={decided && consent.variables.accept}\n      checking={options.checking}\n      denying={decided && !consent.variables.accept}\n      destination={request.destination}\n      email={request.email}\n      verified={request.verified}\n      error={\n        consent.error && Client.reason(consent.error) !== 'webauthn_required'\n          ? message(consent.error)\n          : undefined\n      }\n      keyAuthorization={request.key}\n      logo={request.logo}\n      onApprove={\n        options.onApprove ??\n        (() => consent.mutate({ accept: true, account: request.key?.account }))\n      }\n      onDeny={() => consent.mutate({ accept: false })}\n      // The API's refusal names the other flows, and the screen states the step here instead.\n      refusal={\n        Client.reason(consent.error) === 'webauthn_required'\n          ? 'passkey'\n          : undefined\n      }\n    />\n  )\n\n  return (\n    <main {...styles.page()}>\n      <Await\n        fallback={approval(props.request, { checking: true })}\n        promise={props.preview}\n      >\n        {(preview) => (\n          <Previewed approval={approval} consent={consent} preview={preview} />\n        )}\n      </Await>\n    </main>\n  )\n}\n\ndeclare namespace Page {\n  namespace approval {\n    type Options = {\n      /** Whether the account that approval signs for loads, which holds Approve. */\n      checking: boolean\n      /** Runs on Approve in place of the decision, such as to show the upgrade step first. */\n      onApprove?: (() => void) | undefined\n    }\n  }\n\n  /** The user's decision on the request, which `POST /v1/authorize/consent` records. */\n  type Decision = {\n    /** Whether the user approves the request. */\n    accept: boolean\n    /** The account that the page shows for the key, if any. */\n    account?: `0x${string}` | undefined\n    /** Whether the user skipped the wallet's upgrade, so the passkey signs for the wallet as it is. */\n    skipUpgrade?: boolean | undefined\n  }\n\n  type Props = {\n    /** The request with the account that approval signs for, which follows `request`. */\n    preview: Promise<Preview> | null\n    /** `null` for a forged or expired query or an unknown app. It holds no account. */\n    request: Request | null\n  }\n\n  /** The request with the account that approval signs for. */\n  type Preview = {\n    /** The request, with its account and the key's refusal. */\n    request: Request\n    /** The wallet upgrade that approval waits for, or `null`. */\n    upgrade: Upgrade.Pending | null\n  }\n\n  /** The request that the page shows. */\n  type Request = {\n    /** Absent unless the user holds several accounts in the app's realms. */\n    account?: Approval.Account | undefined\n    /** The app's display name. */\n    app: string\n    /** The host of the app's redirect URI, or the scheme of a native app. */\n    destination: string\n    /** The signed-in user's address. */\n    email: string\n    /** Absent without a key authorization. */\n    key?: Approval.Key | undefined\n    /** The app's logo as a `data:` URL, if any. */\n    logo?: string | undefined\n    /** The signed-in session's ID, which the decision names. */\n    session: string\n    /** Whether the app is registered, which marks its name as verified. */\n    verified: boolean\n  }\n}\n\n/**\n * Renders the approval with the account that approval signs for. For a wallet.tempo passkey's\n * wallet that waits for its upgrade, Approve shows the upgrade step, since approval cannot sign the\n * key before it. Continue upgrades the wallet, and Not now signs the key for the wallet as it is.\n * Both then approve the request, so the browser returns to the app.\n */\nfunction Previewed(props: Previewed.Props) {\n  const { consent, preview } = props\n  const client = Client.use()\n  const pending = preview.upgrade ?? undefined\n  const account = preview.request.key?.account\n  const upgrade = Upgrade.use({\n    // The approval starts before the upgrade settles, so Continue holds until the browser leaves.\n    onSuccess: () => consent.mutate({ accept: true, account }),\n    pending,\n  })\n  // A session older than 10 minutes cannot upgrade. Without a session, the page's loader sends the\n  // browser to sign-in, and back to the request.\n  const signOut = useMutation({\n    mutationFn: () => parseResponse(client.v1.auth.logout.$post()),\n    onSuccess: () => window.location.reload(),\n  })\n  // Whether Approve opened the upgrade step.\n  const [opened, setOpened] = useState(false)\n  const decided = consent.isPending || consent.isSuccess\n  const skipping = decided && consent.variables.skipUpgrade === true\n\n  // A failed approval shows the request again, with its error.\n  if (pending && opened && !consent.isError)\n    return (\n      <WalletUpgrade\n        error={(() => {\n          const error = signOut.error ?? upgrade.error\n          if (!error || (upgrade.stale && !signOut.error)) return undefined\n          return Upgrade.message(error)\n        })()}\n        onContinue={() => upgrade.mutate()}\n        onSignIn={upgrade.stale ? () => signOut.mutate() : undefined}\n        onSkip={() =>\n          consent.mutate({ accept: true, account, skipUpgrade: true })\n        }\n        preparing={upgrade.preparing}\n        skipping={skipping}\n        upgrading={\n          upgrade.isPending ||\n          (decided && !skipping) ||\n          signOut.isPending ||\n          signOut.isSuccess\n        }\n      />\n    )\n\n  const { key } = preview.request\n  if (!pending || !key)\n    return props.approval(preview.request, { checking: false })\n\n  // The upgrade step resolves the key's `upgrade` refusal, so Approve stays enabled. After the\n  // upgrade, Approve repeats the approval alone, and the page shows the request while it runs.\n  return props.approval(\n    { ...preview.request, key: { ...key, refusal: undefined } },\n    {\n      checking: false,\n      onApprove: () => {\n        if (upgrade.isSuccess) {\n          setOpened(false)\n          consent.mutate({ accept: true, account })\n          return\n        }\n        consent.reset()\n        setOpened(true)\n      },\n    },\n  )\n}\n\ndeclare namespace Previewed {\n  type Props = {\n    /** Renders the approval of `request`. */\n    approval: (\n      request: Page.Request,\n      options: Page.approval.Options,\n    ) => ReactNode\n    /** The decision on the request, which the page's approval shares. */\n    consent: UseMutationResult<{ redirect: string }, Error, Page.Decision>\n    /** The request with the account that approval signs for. */\n    preview: Page.Preview\n  }\n}\n\n/**\n * Returns `request` with the account that approval signs for, the key's refusal, and the upgrade\n * that an `upgrade` refusal waits for. A failed read holds the approval of a key with `unavailable`,\n * as a failed read of the owners does.\n */\nasync function preview(\n  client: Client.Client,\n  options: preview.Options,\n): Promise<Page.Preview> {\n  const result = await parseResponse(\n    client.v1.authorize.request.$get({\n      query: { oauth_query: options.query.toString() },\n    }),\n  ).catch(() => undefined)\n  const read = result && 'request' in result ? result.request : undefined\n  if (!read) {\n    const { key } = options.request\n    return {\n      request: {\n        ...options.request,\n        ...(key ? { key: { ...key, refusal: 'unavailable' } } : {}),\n      },\n      upgrade: null,\n    }\n  }\n\n  // An `upgrade` refusal names the account to upgrade on the key's chain, or none for a passkey of\n  // the email that has not linked.\n  const key = read.key\n  const upgrade =\n    key?.refusal === 'upgrade'\n      ? await Upgrade.forKey(client, {\n          account: key.account,\n          chain: key.chain.name,\n        })\n      : undefined\n  return { request: read, upgrade: upgrade ?? null }\n}\n\ndeclare namespace preview {\n  type Options = {\n    /** The approval page's signed query. */\n    query: URLSearchParams\n    /** The request that the page renders first. */\n    request: Page.Request\n  }\n}\n\n/** Returns the message for `error`, such as for a canceled ceremony. */\nfunction message(error: unknown) {\n  if (Client.reason(error) === 'webauthn_rejected')\n    return 'Your passkey did not sign the approval. Approve again, or deny the request.'\n  if (!(error instanceof CeremonyError)) return Client.message(error)\n  if (names(error).includes('NotAllowedError'))\n    return 'The passkey request was canceled. Approve again, or deny the request.'\n  return 'Your passkey did not sign the approval. Approve again, or deny the request.'\n}\n\n/** Returns the names of `error` and its causes. */\nfunction names(error: unknown): readonly string[] {\n  if (!(error instanceof Error)) return []\n  return [error.name, ...names(error.cause)]\n}\n\nnamespace styles {\n  export const page = style({\n    alignItems: 'center',\n    display: 'flex',\n    justifyContent: 'center',\n    minHeight: '100dvh !custom',\n    paddingBlock: '64',\n    paddingInline: '16',\n  })\n}\n"],"ignoreList":[0,1],"mappings":"A,ijBAOA,IAAMqH,EAAuB,OAAO,IAAI,sBAAsB,EAa9D,SAASC,EAAM,EAAU,EAAS,CACjC,IAAMC,EAAUC,EAahB,OAZID,EAAQF,KACZ,EAAQA,GAAwB,CAAE,OAAQ,SAAU,EACpDE,EAAQ,KAAM,GAAS,CACtB,EAAQF,EAAqB,CAAC,OAAS,UACvC,EAAQA,EAAqB,CAAC,KAAOI,CACtC,CAAC,CAAC,CAAC,MAAO,GAAU,CACnB,EAAQJ,EAAqB,CAAC,OAAS,QACvC,EAAQA,EAAqB,CAAC,MAAQ,CACrC,MAAOK,GAAS,gBAAkBlB,EAAA,CAAuBmB,CAAK,EAC9D,gBAAiB,EAClB,CACD,CAAC,GACMJ,CACR,C,qBC7BA,SAASO,EAAW,CAAE,QAASN,GAAY,CAC1C,GAAIf,EAAU,OAAOA,EAASe,CAAQ,EACtC,IAAMD,EAAUD,EAAME,CAAQ,EAC9B,GAAID,EAAQF,EAAqB,CAAC,SAAW,UAAW,MAAME,EAC9D,GAAIA,EAAQF,EAAqB,CAAC,SAAW,QAAS,MAAME,EAAQF,EAAqB,CAAC,MAC1F,OAAOE,EAAQF,EAAqB,CAAC,IACtC,CAKA,SAASU,EAAM,EAAO,CACrB,IAAMC,GAAwB,EAAAH,EAAA,IAAA,CAAII,EAAY,CAAE,GAAGC,CAAM,CAAC,EAK1D,OAJIA,EAAM,UAAiC,EAAAL,EAAA,IAAA,CAAAD,EAAY,SAAU,CAChE,SAAUM,EAAM,SAChB,SAAUF,CACX,CAAC,EACMA,CACR,CACA,SAASC,EAAW,EAAO,CAC1B,IAAMR,EAAOK,EAAWI,CAAK,EAC7B,OAAOA,EAAM,SAAST,CAAI,CAC3B,CCVA,IAAM9G,EAAN,cAA4BC,KAAM,CAChCC,KAAgB,oBAClB,EA8CA,SAASE,EAAKC,EAAmB,CAC/B,IAAMC,EAASZ,EAAW,EACpBc,EAAUnB,EAAY,CAC1B,MAAMoB,WAAWC,EAA0B,CACzC,IAAMC,EAAO,CACXC,OAAQF,EAAUE,OAElB,GAAIF,EAAUG,QAAU,CAAEA,QAASH,EAAUG,OAAQ,EAAI,CAAC,EAC1DC,YAAaC,OAAOC,SAASC,OAAOC,MAAM,CAAC,EAC3CC,WAAYd,EAAMe,SAASC,SAAW,GACtC,GAAIX,EAAUY,YAAc,CAAEC,aAAc,EAAK,EAAI,CAAC,CACxD,EACMC,EAAU,MAAMjC,EACpBe,EAAOmB,GAAGC,UAAUlB,QAAQmB,MAAM,CAAEhB,MAAK,CAAC,CAC5C,EACA,GAAI,EAAE,SAAUa,GAAU,OAAOA,EAGjC,IAAMI,EAAY,MAAMnC,EAAoB,CAC1CqC,QAAS,CAAEC,UAAWP,EAAQQ,KAAKF,QAAQC,SAAU,CACvD,CAAC,CAAC,CAACE,MAAOC,GAAmB,CAC3B,MAAM,IAAIlC,EAAc,2BAA4B,CAAEmC,MAAOD,CAAM,CAAC,CACtE,CAAC,EACKE,EAAS,MAAM7C,EACnBe,EAAOmB,GAAGC,UAAUlB,QAAQmB,MAAM,CAChChB,KAAM,CAAE,GAAGA,EAAM0B,QAAS,CAAET,WAAU,CAAE,CAC1C,CAAC,CACH,EACA,GAAI,SAAUQ,EACZ,MAAUnC,MAAM,+CAA+C,EACjE,OAAOmC,CACT,EAEAE,QAAUJ,GAAU,CACdxC,EAAcwC,CAAK,IAAM,oBAAoBnB,OAAOC,SAASwB,OAAO,CAC1E,EACAC,UAAYC,GAAS3B,OAAOC,SAAS2B,OAAOD,EAAKE,QAAQ,CAC3D,CAAC,EAEKpB,EAAUhB,EAAQqC,WAAarC,EAAQsC,UAE7C,GAAI,CAACzC,EAAMe,SAAW,CAACf,EAAM0C,QAC3B,OACE,EAAAmE,EAAA,IAAA,CAAC,OAAD,CAAM,UAAAlE,EAAAC,KAAA,gHAAAD,EAAAC,KAAA,CAAA,CAAAC,UACJ,UAAA,EAAAgE,EAAA,IAAA,CAACX,EAAD,CAAC,CAAA,CACD,CAAA,EAIN,IAAMpD,GAAY/B,EAAuBU,KACvC,EAAAoF,EAAA,IAAA,CAACV,EAAD,CACE,QAASpF,EAAQP,QACjB,IAAKO,EAAQgC,IACb,UAAW5B,GAAWhB,EAAQE,UAAUE,OACxC,SAAUkB,EAAQuB,SAClB,QAAS7B,GAAW,CAAChB,EAAQE,UAAUE,OACvC,YAAaQ,EAAQkC,YACrB,MAAOlC,EAAQmC,MACf,SAAUnC,EAAQoC,SAClB,MACEhD,EAAQ0B,OAASxC,EAAcc,EAAQ0B,KAAK,IAAM,oBAC9CuB,EAAQjD,EAAQ0B,KAAK,EACrBwB,IAAAA,GAEN,iBAAkBtC,EAAQuC,IAC1B,KAAMvC,EAAQwC,KACd,UACE9B,EAAQ+B,gBACDrD,EAAQsD,OAAO,CAAElD,OAAQ,GAAMC,QAASO,EAAQuC,KAAK9C,OAAQ,CAAC,GAEvE,WAAcL,EAAQsD,OAAO,CAAElD,OAAQ,EAAM,CAAC,EAE9C,QACElB,EAAcc,EAAQ0B,KAAK,IAAM,oBAC7B,UACAwB,IAAAA,EAAA,CAAA,EAKV,OACE,EAAAwD,EAAA,IAAA,CAAC,OAAD,CAAM,UAAAlE,EAAAC,KAAA,gHAAAD,EAAAC,KAAA,CAAA,CAAAC,UACJ,UAAA,EAAAgE,EAAA,IAAA,CAACE,EAAD,CACE,SAAUjE,EAAS9C,EAAMe,QAAS,CAAEiC,SAAU,EAAK,CAAC,EACpD,QAAShD,EAAM0C,QAEbA,SAAAA,IACA,EAAAmE,EAAA,IAAA,CAACoB,EAAD,CAAqBnF,WAAmB3C,UAAkBuC,SAAA,CAAA,CAE5D,CAAA,CACF,CAAA,CAEN,CAgEA,SAASgB,EAAU1D,EAAwB,CACzC,GAAM,CAAEG,UAASuC,WAAY1C,EACvBC,EAASZ,EAAW,EACpBsE,EAAUjB,EAAQkB,SAAWP,IAAAA,GAC7B7C,EAAUkC,EAAQ3B,QAAQuC,KAAK9C,QAC/BoD,EAAUtE,EAAY,CAE1B8C,cAAiBjC,EAAQsD,OAAO,CAAElD,OAAQ,GAAMC,SAAQ,CAAC,EACzDmD,SACF,CAAC,EAGKE,EAAU7E,EAAY,CAC1BoB,eAAkBlB,EAAce,EAAOmB,GAAG0C,KAAKC,OAAOzC,MAAM,CAAC,EAC7Dc,cAAiB1B,OAAOC,SAASwB,OAAO,CAC1C,CAAC,EAEK,CAAC6B,EAAQC,IAAAA,EAAa9E,EAAAA,SAAAA,CAAS,EAAK,EACpCgC,EAAUhB,EAAQqC,WAAarC,EAAQsC,UACvCyB,EAAW/C,GAAWhB,EAAQE,UAAUY,cAAgB,GAG9D,GAAI0C,GAAWK,GAAU,CAAC7D,EAAQgE,QAChC,OACE,EAAA0C,EAAA,IAAA,CAACT,EAAD,CACE,WAAc,CACZ,IAAMvE,EAAQgC,EAAQhC,OAAS+B,EAAQ/B,MACvC,GAAI,GAACA,GAAU+B,EAAQQ,OAAS,CAACP,EAAQhC,OACzC,OAAOvC,EAAgBuC,CAAK,CAC9B,EAAA,CAAG,EACH,eAAkB+B,EAAQH,OAAO,EACjC,SAAUG,EAAQQ,UAAcP,EAAQJ,OAAO,EAAIJ,IAAAA,GACnD,WACElD,EAAQsD,OAAO,CAAElD,OAAQ,GAAMC,UAASS,YAAa,EAAK,CAAC,EAE7D,UAAW2C,EAAQS,UACTH,WACV,UACEN,EAAQpB,WACPrB,GAAW,CAAC+C,GACbL,EAAQrB,WACRqB,EAAQpB,SAAA,CAAA,EAKhB,GAAM,CAAEa,OAAQZ,EAAQ3B,QAMxB,MALI,CAAC4C,GAAW,CAACL,EACRtD,EAAM8C,SAASJ,EAAQ3B,QAAS,CAAEiC,SAAU,EAAM,CAAC,EAIrDhD,EAAM8C,SACX,CAAE,GAAGJ,EAAQ3B,QAASuC,IAAK,CAAE,GAAGA,EAAKgB,QAASjB,IAAAA,EAAU,CAAE,EAC1D,CACEL,SAAU,GACVQ,cAAiB,CACXI,EAAQnB,WACVwB,EAAU,EAAK,EACf9D,EAAQsD,OAAO,CAAElD,OAAQ,GAAMC,SAAQ,CAAC,IAG1CL,EAAQoE,MAAM,EACdN,EAAU,EAAI,EAChB,CACF,CACF,CACF,CAiEA,SAASb,EAAQvB,EAAgB,CAM/B,OALIxC,EAAcwC,CAAK,IAAM,oBACpB,8EACHA,aAAiBlC,EACnB6E,EAAM3C,CAAK,CAAC,CAAC4C,SAAS,iBAAiB,EAClC,wEACF,8EAHuCpF,EAAewC,CAAK,CAIpE,CAGA,SAAS2C,EAAM3C,EAAmC,CAEhD,OADMA,aAAiBjC,MAChB,CAACiC,EAAMhC,KAAM,GAAG2E,EAAM3C,EAAMC,KAAK,CAAC,EADH,CAAA,CAExC,CAEA,IAAUa,GAAV,SAAA+B,EAAA,CACeA,EAAA9B,KAAO,CAQtB,EAAA,CAAAD,AAAAA,IAAA,CAAA,CAAA,E,WAnWmB,EAAAkE,EAAA,IAAA,CAACO,EAAD,CAAM,GAAItH,EAAM8E,cAAc,CAAC,CAAA,E"}