@tempoxyz/id 0.0.0-stage → 0.0.1

package/dist/client/actions/redirect.js

@@ -0,0 +1,311 @@
+/**
+ * Signs the user in on Tempo ID's pages, which redirect back with a code. `start` and `complete`
+ * keep the redirect's state in `storage`, and, with the default storage, its PKCE verifier in the
+ * tab's `sessionStorage` too. `createUrl` and `handleCallback` leave it to the app.
+ * @module
+ */
+import { Base64, Bytes, Hash } from 'ox';
+import { ChallengeWithoutKeyError, RequestError } from '../Auth.js';
+import * as AccessKey from '../internal/accessKey.js';
+import * as Api from '../internal/api.js';
+import { keyAuthorization } from '../internal/request.js';
+import * as Store from '../internal/store.js';
+import * as Verifier from '../internal/verifier.js';
+import * as Pending from '../Pending.js';
+/** `complete` received a `key` other than the one that `start` received. */
+export class KeyMismatchError extends Error {
+    name = 'Actions.redirect.KeyMismatchError';
+    constructor(options) {
+        super(options.stored
+            ? 'The redirect authorized a key, but `complete` received `key: false`. Pass the `key` that `start` received.'
+            : 'The redirect authorized no key, but `complete` did not receive `key: false`. Pass the `key` that `start` received.');
+    }
+}
+/**
+ * Finishes a {@link start} when the page loads with Tempo ID's callback, and returns `undefined`
+ * otherwise. It redeems the code once, however often the page calls it. With the default storage,
+ * it sends the code exchange at once, from the tab's copy of the verifier, before IndexedDB returns
+ * the rest of the redirect's state. A callback that denies the
+ * redirect, such as `error=access_denied`, throws a `RequestError` with that `code` and status 0.
+ *
+ * @example
+ * ```ts
+ * const authorization =
+ *   (await Actions.redirect.complete(auth)) ??
+ *   (await Actions.authorize(auth))
+ * ```
+ */
+export function complete(auth, options = {}) {
+    completed ??= (async () => {
+        const url = new URL(window.location.href);
+        // The tab's ticket starts the code exchange before the storage's first read, which waits behind
+        // the page's first tasks. It runs only for this page's own redirect, with the `key` it began
+        // with, so the checks below refuse nothing that it redeemed.
+        const ticket = Verifier.take(auth);
+        const early = ticket &&
+            url.searchParams.has('code') &&
+            url.searchParams.get('state') === ticket.state &&
+            ticket.key === (options.key !== false)
+            ? redeem(auth, { pending: ticket, url })
+            : undefined;
+        // A refusal surfaces from the await below, after the checks of the stored redirect.
+        early?.catch(() => undefined);
+        const store = Store.get(auth);
+        const stored = (await store.getItem(storageKey));
+        // A registered redirect URI may hold its own `error`, which the app keeps. Only an `error` that
+        // the callback added after it belongs to the authorization response.
+        const redirectUri = stored?.redirectUri ?? url.origin;
+        const registered = new URL(redirectUri).searchParams;
+        const added = (name) => response(url, { name, redirectUri });
+        // A custom `storage` may return `null` for a missing item.
+        const ours = stored != null && url.searchParams.get('state') === stored.state;
+        // The result's type follows `key`, so a redirect that `start` began with another `key` fails. The
+        // state and the URL stay, so a page load that passes the right `key` finishes the redirect.
+        if (ours &&
+            url.searchParams.has('code') &&
+            (stored.key === false) !== (options.key === false))
+            throw new KeyMismatchError({ stored: stored.key !== false });
+        await store.removeItem(storageKey);
+        // The app keeps its own query and fragment, without the callback's parameters. A code this page
+        // did not request is dropped too, since it redeems for whoever crafted its request. A page that is
+        // no callback of this page keeps its own `state` and `error` parameters.
+        const callback = [
+            'code',
+            'error',
+            'error_description',
+            'error_uri',
+            'state',
+        ];
+        if (ours || url.searchParams.has('code')) {
+            const clean = new URL(url);
+            for (const name of callback) {
+                clean.searchParams.delete(name);
+                for (const value of registered.getAll(name))
+                    clean.searchParams.append(name, value);
+            }
+            window.history.replaceState(null, '', clean.pathname + clean.search + clean.hash);
+        }
+        // A denial of this page's redirect throws, so the app never mistakes it for a page load
+        // without a callback and authorizes another way.
+        const error = added('error');
+        if (ours && error)
+            throw new RequestError({
+                code: error,
+                message: added('error_description') ?? error,
+                status: 0,
+                uri: added('error_uri'),
+            });
+        if (!url.searchParams.has('code') || !stored)
+            return undefined;
+        return finish({
+            accessKey: options.accessKey,
+            body: await (ours && early
+                ? early
+                : redeem(auth, { pending: stored, url })),
+            pending: stored,
+        });
+    })();
+    // The check above holds the stored redirect to `key`, which types the result.
+    return completed;
+}
+/**
+ * Returns the authorization URL, `/oauth2/authorize`, which redirects to Tempo ID's sign-in or
+ * approval page, and the `Pending` state to keep until the callback. {@link handleCallback} redeems
+ * the code.
+ *
+ * @example
+ * ```ts
+ * const { pending, url } = await Actions.redirect.createUrl(auth, {
+ *   redirectUri: 'https://app.example/auth/callback',
+ * })
+ * await seal(c, 'oauth', pending)
+ * return c.redirect(url)
+ * ```
+ */
+export async function createUrl(auth, options = {}) {
+    if (options.key === false && options.challenge !== undefined)
+        throw new ChallengeWithoutKeyError();
+    const redirectUri = options.redirectUri ?? auth.redirectUri ?? `${window.location.origin}/`;
+    const key = options.key === false
+        ? undefined
+        : await AccessKey.resolve(options.accessKey);
+    const pending = Pending.from({
+        ...(key ? key.material : { key: false }),
+        redirectUri,
+        // `Bytes.random` needs only `crypto.getRandomValues`, which React Native polyfills.
+        state: Base64.fromBytes(Bytes.random(16), base64url),
+        verifier: Base64.fromBytes(Bytes.random(32), base64url),
+    });
+    const authorization = key
+        ? keyAuthorization(auth, {
+            accessKey: key.accessKey,
+            permissions: options.permissions,
+        })
+        : undefined;
+    // The issuer's endpoint redirects to the sign-in page at once. `/authorize` redirects here first.
+    const url = new URL('/oauth2/authorize', auth.url);
+    url.search = new URLSearchParams({
+        ...(options.challenge === undefined
+            ? {}
+            : { challenge: options.challenge }),
+        client_id: auth.clientId,
+        code_challenge: Base64.fromBytes(Hash.sha256(Bytes.fromString(pending.verifier)), base64url),
+        code_challenge_method: 'S256',
+        ...(authorization
+            ? {
+                key_authorization: Base64.fromString(JSON.stringify(authorization), base64url),
+            }
+            : {}),
+        redirect_uri: redirectUri,
+        response_type: 'code',
+        scope: auth.scope,
+        state: pending.state,
+    }).toString();
+    // `options.key` decides both the type and the runtime value of `pending`.
+    return { pending, url: url.href };
+}
+/**
+ * Checks the callback's `state`, and redeems its code for the authorization. Throws a
+ * `RequestError` for a forged `state`, a callback without a `code`, or a refused code.
+ *
+ * @example
+ * ```ts
+ * const authorization = await Actions.redirect.handleCallback(auth, {
+ *   pending: await unseal(c, 'oauth'),
+ *   url: c.req.url,
+ * })
+ * ```
+ */
+export async function handleCallback(auth, options) {
+    return finish({
+        accessKey: options.accessKey,
+        body: await redeem(auth, {
+            pending: options.pending,
+            url: new URL(options.url),
+        }),
+        pending: options.pending,
+    });
+}
+/**
+ * Checks the callback's `state`, and redeems its code with the verifier of `pending`. Throws a
+ * `RequestError` for a forged `state`, a callback without a `code`, or a refused code.
+ */
+async function redeem(auth, options) {
+    const { redirectUri, state, verifier } = options.pending;
+    const { url } = options;
+    const added = (name) => response(url, { name, redirectUri });
+    // State comes first, so a forged link cannot supply the error an app shows.
+    if (url.searchParams.get('state') !== state)
+        throw new RequestError({
+            code: 'invalid_request',
+            field: 'state',
+            message: 'Invalid `state` in the callback URL. Start sign-in again from this app.',
+            status: 400,
+        });
+    const code = url.searchParams.get('code');
+    if (!code)
+        throw new RequestError({
+            code: added('error') ?? 'invalid_request',
+            field: 'code',
+            message: added('error_description') ??
+                'Missing `code` in the callback URL. Start sign-in again.',
+            status: 400,
+        });
+    return await Api.token(auth, {
+        code,
+        code_verifier: verifier,
+        grant_type: 'authorization_code',
+        redirect_uri: redirectUri,
+    });
+}
+/**
+ * Returns the authorization of a redeemed code, with the key of `pending`, or the tokens and the
+ * user for a `Pending.WithoutKey`. Throws a `RequestError` when a redirect with a key receives no
+ * key authorization.
+ */
+function finish(options) {
+    const { body } = options;
+    // The exchange's fields stay out of the key's material.
+    const { key, redirectUri: _redirectUri, state: _state, verifier: _verifier, ...material } = options.pending;
+    // `pending.key` decides both the type and the runtime value of the result.
+    if (key === false) {
+        const tokens = Api.tokens(body);
+        return { ...tokens, user: Api.user(tokens) };
+    }
+    if (!body.account || !body.key_authorization)
+        throw new RequestError({
+            code: 'invalid_grant',
+            message: 'Missing key authorization in the token response. The code was already redeemed, or did not request a key. Start sign-in again.',
+            status: 400,
+        });
+    return Api.authorization({
+        account: body.account,
+        key_authorization: body.key_authorization,
+        tokens: body,
+    }, { accessKey: options.accessKey, material });
+}
+/**
+ * Prefetches the scripts and style sheets of Tempo ID's sign-in page, from `GET /v1/auth/assets`, so
+ * the page that {@link start} opens loads them from the browser's cache. A browser partitions its
+ * cache by site, so only a page on Tempo ID's site, such as `app.tempo.xyz` for `id.tempo.xyz`,
+ * gains. Returns the URLs of the assets. Outside a browser, it prefetches nothing.
+ *
+ * It never throws. A failed read returns no URLs, and the sign-in page loads its assets itself.
+ *
+ * @example
+ * ```ts
+ * // Once the sign-in button shows:
+ * void Actions.redirect.prefetch(auth)
+ * ```
+ */
+export async function prefetch(auth) {
+    const urls = await (async () => {
+        // The list is public, so the request carries no cookie.
+        const { assets } = await Api.json(await (auth.fetch ?? fetch)(new URL('/v1/auth/assets', auth.url)));
+        return assets.map((path) => new URL(path, auth.url).href);
+    })().catch(() => []);
+    if (typeof document === 'undefined')
+        return urls;
+    const linked = new Set([...document.querySelectorAll('link[rel="prefetch"]')].map((link) => link.href));
+    for (const href of urls) {
+        if (linked.has(href))
+            continue;
+        const link = document.createElement('link');
+        link.href = href;
+        link.rel = 'prefetch';
+        document.head.appendChild(link);
+    }
+    return urls;
+}
+/**
+ * Sends the browser to Tempo ID's pages to sign in, and keeps the redirect's state in `storage`.
+ * With the default storage, it also keeps the `state`, the redirect URI, and the PKCE verifier in
+ * the tab's `sessionStorage`, without the key's material. {@link complete} finishes it when the
+ * browser returns.
+ *
+ * @example
+ * ```ts
+ * await Actions.redirect.start(auth)
+ * ```
+ */
+export async function start(auth, options = {}) {
+    const { pending, url } = await createUrl(auth, options);
+    await Store.get(auth).setItem(storageKey, pending);
+    Verifier.save(auth, pending);
+    window.location.assign(url);
+}
+/** Unpadded URL-safe Base64, as PKCE and `key_authorization` use. */
+const base64url = { pad: false, url: true };
+/** The redirect this page load returns from, so its code is redeemed once. */
+let completed;
+/** Where a redirect keeps its state in `storage`. */
+const storageKey = 'tempo-id:redirect';
+/**
+ * Returns the first value of `name` that the authorization response added to the callback URL. The
+ * issuer appends its parameters after the registered redirect URI's own.
+ */
+function response(url, options) {
+    const registered = new URL(options.redirectUri).searchParams.getAll(options.name).length;
+    return url.searchParams.getAll(options.name)[registered];
+}
+//# sourceMappingURL=redirect.js.map

package/dist/client/actions/redirect.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redirect.js","sourceRoot":"","sources":["../../../src/client/actions/redirect.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,IAAI,CAAA;AAExC,OAAO,EAAa,wBAAwB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAE9E,OAAO,KAAK,SAAS,MAAM,0BAA0B,CAAA;AACrD,OAAO,KAAK,GAAG,MAAM,oBAAoB,CAAA;AACzC,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,KAAK,KAAK,MAAM,sBAAsB,CAAA;AAC7C,OAAO,KAAK,QAAQ,MAAM,yBAAyB,CAAA;AACnD,OAAO,KAAK,OAAO,MAAM,eAAe,CAAA;AAGxC,4EAA4E;AAC5E,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACvB,IAAI,GAAG,mCAAmC,CAAA;IAE5D,YAAY,OAA4B;QACtC,KAAK,CACH,OAAO,CAAC,MAAM;YACZ,CAAC,CAAC,4GAA4G;YAC9G,CAAC,CAAC,oHAAoH,CACzH,CAAA;IACH,CAAC;CACF;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,QAAQ,CACtB,IAAU,EACV,OAAO,GAA0B,EAAE;IAEnC,SAAS,KAAK,CAAC,KAAK,IAAI,EAAE;QACxB,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QACzC,gGAAgG;QAChG,6FAA6F;QAC7F,6DAA6D;QAC7D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAClC,MAAM,KAAK,GACT,MAAM;YACN,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;YAC5B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,KAAK;YAC9C,MAAM,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC;YACpC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YACxC,CAAC,CAAC,SAAS,CAAA;QACf,oFAAoF;QACpF,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC7B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,IAAI,CAAE,CAAA;QAC9B,MAAM,MAAM,GAAG,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAIlC,CAAA;QACb,gGAAgG;QAChG,qEAAqE;QACrE,MAAM,WAAW,GAAG,MAAM,EAAE,WAAW,IAAI,GAAG,CAAC,MAAM,CAAA;QACrD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,YAAY,CAAA;QACpD,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAA;QACpE,2DAA2D;QAC3D,MAAM,IAAI,GACR,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,MAAM,CAAC,KAAK,CAAA;QAClE,kGAAkG;QAClG,4FAA4F;QAC5F,IACE,IAAI;YACJ,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC;YAC5B,CAAC,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,KAAK,KAAK,CAAC;YAElD,MAAM,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC,CAAA;QAE9D,MAAM,KAAK,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;QAClC,gGAAgG;QAChG,mGAAmG;QACnG,yEAAyE;QACzE,MAAM,QAAQ,GAAG;YACf,MAAM;YACN,OAAO;YACP,mBAAmB;YACnB,WAAW;YACX,OAAO;SACR,CAAA;QACD,IAAI,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;YAC1B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC5B,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;gBAC/B,KAAK,MAAM,KAAK,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;oBACzC,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YAC1C,CAAC;YACD,MAAM,CAAC,OAAO,CAAC,YAAY,CACzB,IAAI,EACJ,EAAE,EACF,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,IAAI,CAC3C,CAAA;QACH,CAAC;QAED,wFAAwF;QACxF,iDAAiD;QACjD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAA;QAC5B,IAAI,IAAI,IAAI,KAAK;YACf,MAAM,IAAI,YAAY,CAAC;gBACrB,IAAI,EAAE,KAAK;gBACX,OAAO,EAAE,KAAK,CAAC,mBAAmB,CAAC,IAAI,KAAK;gBAC5C,MAAM,EAAE,CAAC;gBACT,GAAG,EAAE,KAAK,CAAC,WAAW,CAAC;aACxB,CAAC,CAAA;QACJ,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM;YAAE,OAAO,SAAS,CAAA;QAC9D,OAAO,MAAM,CAAC;YACZ,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,KAAK;gBACxB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3C,OAAO,EAAE,MAAM;SAChB,CAAC,CAAA;IACJ,CAAC,CAAC,EAAE,CAAA;IACJ,8EAA8E;IAC9E,OAAO,SAA8C,CAAA;AACvD,CAAC;AAgBD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,IAAU,EACV,OAAO,GAA2B,EAAE;IAEpC,IAAI,OAAO,CAAC,GAAG,KAAK,KAAK,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;QAC1D,MAAM,IAAI,wBAAwB,EAAE,CAAA;IACtC,MAAM,WAAW,GACf,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAA;IACzE,MAAM,GAAG,GACP,OAAO,CAAC,GAAG,KAAK,KAAK;QACnB,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IAChD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;QAC3B,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACxC,WAAW;QACX,oFAAoF;QACpF,KAAK,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC;QACpD,QAAQ,EAAE,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,SAAS,CAAC;KACxD,CAAC,CAAA;IACF,MAAM,aAAa,GAAG,GAAG;QACvB,CAAC,CAAC,gBAAgB,CAAC,IAAI,EAAE;YACrB,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,WAAW,EAAE,OAAO,CAAC,WAAW;SACjC,CAAC;QACJ,CAAC,CAAC,SAAS,CAAA;IACb,kGAAkG;IAClG,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAA;IAClD,GAAG,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC;QAC/B,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS;YACjC,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QACrC,SAAS,EAAE,IAAI,CAAC,QAAQ;QACxB,cAAc,EAAE,MAAM,CAAC,SAAS,CAC9B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAC/C,SAAS,CACV;QACD,qBAAqB,EAAE,MAAM;QAC7B,GAAG,CAAC,aAAa;YACf,CAAC,CAAC;gBACE,iBAAiB,EAAE,MAAM,CAAC,UAAU,CAClC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,EAC7B,SAAS,CACV;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,YAAY,EAAE,WAAW;QACzB,aAAa,EAAE,MAAM;QACrB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC,CAAC,QAAQ,EAAE,CAAA;IACb,0EAA0E;IAC1E,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,EAA+B,CAAA;AAChE,CAAC;AA8BD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAGlC,IAAU,EACV,OAAwC;IAExC,OAAO,MAAM,CAAC;QACZ,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,IAAI,EAAE,MAAM,MAAM,CAAC,IAAI,EAAE;YACvB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,EAAE,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC;SAC1B,CAAC;QACF,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAuC,CAAA;AAC1C,CAAC;AA2BD;;;GAGG;AACH,KAAK,UAAU,MAAM,CAAC,IAAU,EAAE,OAAuB;IACvD,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,OAAO,CAAA;IACxD,MAAM,EAAE,GAAG,EAAE,GAAG,OAAO,CAAA;IACvB,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAA;IACpE,4EAA4E;IAC5E,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK;QACzC,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,iBAAiB;YACvB,KAAK,EAAE,OAAO;YACd,OAAO,EACL,yEAAyE;YAC3E,MAAM,EAAE,GAAG;SACZ,CAAC,CAAA;IACJ,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACzC,IAAI,CAAC,IAAI;QACP,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,iBAAiB;YACzC,KAAK,EAAE,MAAM;YACb,OAAO,EACL,KAAK,CAAC,mBAAmB,CAAC;gBAC1B,0DAA0D;YAC5D,MAAM,EAAE,GAAG;SACZ,CAAC,CAAA;IAEJ,OAAO,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;QAC3B,IAAI;QACJ,aAAa,EAAE,QAAQ;QACvB,UAAU,EAAE,oBAAoB;QAChC,YAAY,EAAE,WAAW;KAC1B,CAAC,CAAA;AACJ,CAAC;AAWD;;;;GAIG;AACH,SAAS,MAAM,CACb,OAAuB;IAEvB,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAA;IACxB,wDAAwD;IACxD,MAAM,EACJ,GAAG,EACH,WAAW,EAAE,YAAY,EACzB,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,SAAS,EACnB,GAAG,QAAQ,EACZ,GAAG,OAAO,CAAC,OAAO,CAAA;IACnB,2EAA2E;IAC3E,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QAC/B,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAA;IAC9C,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,iBAAiB;QAC1C,MAAM,IAAI,YAAY,CAAC;YACrB,IAAI,EAAE,eAAe;YACrB,OAAO,EACL,gIAAgI;YAClI,MAAM,EAAE,GAAG;SACZ,CAAC,CAAA;IACJ,OAAO,GAAG,CAAC,aAAa,CACtB;QACE,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,MAAM,EAAE,IAAI;KACb,EACD,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,CAC3C,CAAA;AACH,CAAC;AAaD;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,IAAU;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE;QAC7B,wDAAwD;QACxD,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAC/B,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAClE,CAAA;QACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAA;IAC3D,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;IACpB,IAAI,OAAO,QAAQ,KAAK,WAAW;QAAE,OAAO,IAAI,CAAA;IAEhD,MAAM,MAAM,GAAG,IAAI,GAAG,CACpB,CAAC,GAAG,QAAQ,CAAC,gBAAgB,CAAkB,sBAAsB,CAAC,CAAC,CAAC,GAAG,CACzE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CACpB,CACF,CAAA;IACD,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,SAAQ;QAC9B,MAAM,IAAI,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,CAAC,CAAA;QAC3C,IAAI,CAAC,IAAI,GAAG,IAAI,CAAA;QAChB,IAAI,CAAC,GAAG,GAAG,UAAU,CAAA;QACrB,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAA;IACjC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAOD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,IAAU,EACV,OAAO,GAAkB,EAAE;IAE3B,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACvD,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,CAAA;IACnD,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAC5B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;AAC7B,CAAC;AAkBD,qEAAqE;AACrE,MAAM,SAAS,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAW,CAAA;AAEpD,8EAA8E;AAC9E,IAAI,SAA4D,CAAA;AAEhE,qDAAqD;AACrD,MAAM,UAAU,GAAG,mBAAmB,CAAA;AAEtC;;;GAGG;AACH,SAAS,QAAQ,CAAC,GAAQ,EAAE,OAAyB;IACnD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,YAAY,CAAC,MAAM,CACjE,OAAO,CAAC,IAAI,CACb,CAAC,MAAM,CAAA;IACR,OAAO,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,CAAA;AAC1D,CAAC"}

package/dist/client/internal/accessKey.d.ts

@@ -0,0 +1,21 @@
+import { Account } from 'viem/tempo';
+import type * as Key from '../Key.js';
+/**
+ * Returns the app's key, or creates one: a non-extractable `CryptoKey` in a browser, or else a
+ * secp256k1 key.
+ */
+export declare function resolve(accessKey: Account.Account | undefined): Promise<resolve.ReturnType>;
+/**
+ * Rebuilds a key that {@link resolve} generated from its material. Returns `undefined` for the
+ * empty material of the app's own key.
+ */
+export declare function restore(material: Key.Material): resolve.ReturnType | undefined;
+export declare namespace resolve {
+    type ReturnType = {
+        /** A Viem account that signs with the key. */
+        accessKey: Account.Account;
+        /** What the authorization keeps to rebuild the key. Empty for the app's own key. */
+        material: Key.Material;
+    };
+}
+//# sourceMappingURL=accessKey.d.ts.map

package/dist/client/internal/accessKey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessKey.d.ts","sourceRoot":"","sources":["../../../src/client/internal/accessKey.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,OAAO,EAAa,MAAM,YAAY,CAAA;AAC/C,OAAO,KAAK,KAAK,GAAG,MAAM,WAAW,CAAA;AAErC;;;GAGG;AACH,wBAAsB,OAAO,CAC3B,SAAS,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,GACrC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAgB7B;AAED;;;GAGG;AACH,wBAAgB,OAAO,CACrB,QAAQ,EAAE,GAAG,CAAC,QAAQ,GACrB,OAAO,CAAC,UAAU,GAAG,SAAS,CAMhC;AAED,MAAM,CAAC,OAAO,WAAW,OAAO,CAAC;IAC/B,KAAK,UAAU,GAAG;QAChB,8CAA8C;QAC9C,SAAS,EAAE,OAAO,CAAC,OAAO,CAAA;QAC1B,oFAAoF;QACpF,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAA;KACvB,CAAA;CACF"}

package/dist/client/internal/accessKey.js

@@ -0,0 +1,38 @@
+/**
+ * Resolves the access key that a sign-in authorizes: the app's own, or a new one.
+ * @module
+ */
+import { WebCryptoP256 } from 'ox';
+import { Account, Secp256k1 } from 'viem/tempo';
+/**
+ * Returns the app's key, or creates one: a non-extractable `CryptoKey` in a browser, or else a
+ * secp256k1 key.
+ */
+export async function resolve(accessKey) {
+    if (accessKey)
+        return { accessKey, material: {} };
+    if (typeof indexedDB !== 'undefined') {
+        const keyPair = await WebCryptoP256.createKeyPair();
+        return {
+            accessKey: Account.fromWebCryptoP256(keyPair),
+            material: { keyPair },
+        };
+    }
+    const privateKey = Secp256k1.randomPrivateKey();
+    return {
+        accessKey: Account.fromSecp256k1(privateKey),
+        material: { privateKey },
+    };
+}
+/**
+ * Rebuilds a key that {@link resolve} generated from its material. Returns `undefined` for the
+ * empty material of the app's own key.
+ */
+export function restore(material) {
+    if (material.keyPair)
+        return { accessKey: Account.fromWebCryptoP256(material.keyPair), material };
+    if (material.privateKey)
+        return { accessKey: Account.fromSecp256k1(material.privateKey), material };
+    return undefined;
+}
+//# sourceMappingURL=accessKey.js.map

package/dist/client/internal/accessKey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessKey.js","sourceRoot":"","sources":["../../../src/client/internal/accessKey.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,aAAa,EAAE,MAAM,IAAI,CAAA;AAClC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAG/C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,SAAsC;IAEtC,IAAI,SAAS;QAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IAEjD,IAAI,OAAO,SAAS,KAAK,WAAW,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,aAAa,EAAE,CAAA;QACnD,OAAO;YACL,SAAS,EAAE,OAAO,CAAC,iBAAiB,CAAC,OAAO,CAAC;YAC7C,QAAQ,EAAE,EAAE,OAAO,EAAE;SACtB,CAAA;IACH,CAAC;IAED,MAAM,UAAU,GAAG,SAAS,CAAC,gBAAgB,EAAE,CAAA;IAC/C,OAAO;QACL,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,UAAU,CAAC;QAC5C,QAAQ,EAAE,EAAE,UAAU,EAAE;KACzB,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,OAAO,CACrB,QAAsB;IAEtB,IAAI,QAAQ,CAAC,OAAO;QAClB,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,CAAA;IAC7E,IAAI,QAAQ,CAAC,UAAU;QACrB,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,CAAA;IAC5E,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/client/internal/account.d.ts

@@ -0,0 +1,17 @@
+/**
+ * The state of an `Auth.account()`, which the `tempoId` extension reads and writes through
+ * {@link key}.
+ * @module
+ */
+import type { Account } from 'viem/tempo';
+import type * as Key from '../Key.js';
+/** Holds an `Auth.account()`'s state. Other accounts lack it. */
+export declare const key: unique symbol;
+/** What an `Auth.account()` signs as. */
+export type State = {
+    /** The signed-in access key account, or `undefined` while signed out. */
+    account: Account.AccessKeyAccount | undefined;
+    /** The same key as data, which `client.auth.account.upgrade` registers, or `undefined`. */
+    key: Key.Key | undefined;
+};
+//# sourceMappingURL=account.d.ts.map

package/dist/client/internal/account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../../src/client/internal/account.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,KAAK,KAAK,GAAG,MAAM,WAAW,CAAA;AAErC,iEAAiE;AACjE,eAAO,MAAM,GAAG,eAA6B,CAAA;AAE7C,yCAAyC;AACzC,MAAM,MAAM,KAAK,GAAG;IAClB,yEAAyE;IACzE,OAAO,EAAE,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAA;IAC7C,2FAA2F;IAC3F,GAAG,EAAE,GAAG,CAAC,GAAG,GAAG,SAAS,CAAA;CACzB,CAAA"}

package/dist/client/internal/account.js

@@ -0,0 +1,3 @@
+/** Holds an `Auth.account()`'s state. Other accounts lack it. */
+export const key = Symbol('tempo-id.account');
+//# sourceMappingURL=account.js.map

package/dist/client/internal/account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.js","sourceRoot":"","sources":["../../../src/client/internal/account.ts"],"names":[],"mappings":"AAQA,iEAAiE;AACjE,MAAM,CAAC,MAAM,GAAG,GAAG,MAAM,CAAC,kBAAkB,CAAC,CAAA"}

package/dist/client/internal/api.d.ts

@@ -0,0 +1,110 @@
+import type { KeyAuthorization } from 'ox/tempo';
+import type { Account } from 'viem/tempo';
+import { type Auth, RequestError } from '../Auth.js';
+import type { Authorization } from '../Authorization.js';
+import * as Key from '../Key.js';
+import type { TempoAccount } from '../TempoAccount.js';
+import type { Tokens } from '../Tokens.js';
+import type { User } from '../User.js';
+/**
+ * Builds an authorization from Tempo ID's response and the sign-in's key: generated material, or
+ * the app's `accessKey`. Throws `server_error` for a response without the key authorization.
+ */
+export declare function authorization<chainId extends number = number>(body: Headless, options: {
+    accessKey?: Account.Account | undefined;
+    material: Key.Material;
+}): Authorization<chainId>;
+/** What the headless API returns for an authorization. */
+export type Headless = {
+    /** The Tempo Account the key acts for, present for a request with a key. */
+    account?: Key.Key['account'] | undefined;
+    /** The signed key authorization, in RPC format, present for a request with a key. */
+    key_authorization?: KeyAuthorization.Rpc | undefined;
+    /** The issued tokens, raw from the token endpoint or already read into `Tokens`. */
+    tokens: TokenResponse | Tokens;
+    /** Present when the key's account waits for its upgrade, so the key signed as its own. */
+    upgrade_available?: true | undefined;
+};
+/** Reads a JSON response, and throws a {@link RequestError} for a refusal. */
+export declare function json<value = unknown>(response: Response): Promise<value>;
+/** An OAuth error response, with Tempo ID's extension members. */
+export type ErrorBody = {
+    /** The OAuth error code, which `reason` determines. */
+    error: string;
+    /** The fault and its fix. Its wording may change. */
+    error_description?: string | undefined;
+    /** The errors page, at the refusal's `reason`. */
+    error_uri?: string | undefined;
+    /** The request field at fault, as a dotted path. */
+    field?: string | undefined;
+    /** The values the refusal compared. Base units are decimal strings. */
+    meta?: Readonly<Record<string, number | string>> | undefined;
+    /** A stable name for the refusal. The issuer's own errors carry none. */
+    reason?: RequestError.Reason | undefined;
+};
+/** Returns a {@link RequestError} for an OAuth error response, or a refusal without a body. */
+export declare function error(body: Partial<ErrorBody>, options: {
+    status: number;
+}): RequestError;
+/** Posts JSON to Tempo ID's API with the session cookie. */
+export declare function post(auth: Auth, path: string, options: {
+    json: unknown;
+}): Promise<Response>;
+/** Posts a form to the token endpoint, with the client ID and any client secret. */
+export declare function token(auth: Auth, body: Record<string, string>): Promise<TokenResponse>;
+/** Reads the account's address, its owners, the type of the owner that signs its keys, and its realm. */
+export declare function tempoAccount(account: TempoAccountResponse): TempoAccount;
+/** A Tempo Account as the API returns it, with the fields that the package reads. */
+export type TempoAccountResponse = {
+    /** The account's address on the chain of the request. */
+    address: `0x${string}`;
+    /** The account's configuration. */
+    config: {
+        /** The owners in the API's order, each with its address and key type, such as `privy`. */
+        owners: readonly [Owner, ...Owner[]];
+    };
+    /** The account's realm. */
+    realm: {
+        /** `default`, or a realm that an app's settings name, such as `tempo-cash`. */
+        id: string;
+        /** The display name, such as `Tempo Cash`. */
+        name: string;
+    };
+};
+/** What the token endpoint returns. A redirect's code adds its key authorization. */
+export type TokenResponse = {
+    /** The access token for the app's API requests. */
+    access_token: string;
+    /** The Tempo Account the key acts for, present with `key_authorization`. */
+    account?: Key.Key['account'] | undefined;
+    /** The access token's lifetime, in seconds. */
+    expires_in: number;
+    /** The OIDC ID token, which names the user. A refresh may omit it. */
+    id_token?: string | undefined;
+    /** The signed key authorization that the user approved, if any. */
+    key_authorization?: KeyAuthorization.Rpc | undefined;
+    /** Exchanges for new tokens through `Actions.refresh`. It rotates on every refresh. */
+    refresh_token?: string | undefined;
+};
+/** Reads the signed-in user from the ID token of `tokens`. */
+export declare function user(tokens: Tokens): User;
+/** Reads a token response into `Tokens`. */
+export declare function tokens(response: TokenResponse): Tokens;
+/**
+ * Rethrows an error after a sign-in verified as a {@link RequestError} marked `signedIn`. An error
+ * without a response, such as a network error, has status 0 and the original as its `cause`.
+ */
+export declare function signedIn(error: unknown): never;
+/** Reads an authorization without a key: the tokens and the user. */
+export declare function withoutKey(body: Headless): WithoutKey;
+/** An authorization without a key: the tokens and the user. */
+export type WithoutKey = Omit<Authorization, 'account' | 'key'>;
+/** One owner of a Tempo Account, as the API returns it. */
+type Owner = {
+    /** The address of the owner key. */
+    owner: `0x${string}`;
+    /** The kind of key that holds it, such as `privy` or `webAuthn`. */
+    type: string;
+};
+export {};
+//# sourceMappingURL=api.d.ts.map

package/dist/client/internal/api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../../../src/client/internal/api.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAChD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AACzC,OAAO,EAAE,KAAK,IAAI,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACxD,OAAO,KAAK,GAAG,MAAM,WAAW,CAAA;AAChC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAA;AAC1C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAEtC;;;GAGG;AACH,wBAAgB,aAAa,CAAC,OAAO,SAAS,MAAM,GAAG,MAAM,EAC3D,IAAI,EAAE,QAAQ,EACd,OAAO,EAAE;IACP,SAAS,CAAC,EAAE,OAAO,CAAC,OAAO,GAAG,SAAS,CAAA;IACvC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAA;CACvB,GACA,aAAa,CAAC,OAAO,CAAC,CAuBxB;AAED,0DAA0D;AAC1D,MAAM,MAAM,QAAQ,GAAG;IACrB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,SAAS,CAAA;IACxC,qFAAqF;IACrF,iBAAiB,CAAC,EAAE,gBAAgB,CAAC,GAAG,GAAG,SAAS,CAAA;IACpD,oFAAoF;IACpF,MAAM,EAAE,aAAa,GAAG,MAAM,CAAA;IAC9B,0FAA0F;IAC1F,iBAAiB,CAAC,EAAE,IAAI,GAAG,SAAS,CAAA;CACrC,CAAA;AAED,8EAA8E;AAC9E,wBAAsB,IAAI,CAAC,KAAK,GAAG,OAAO,EACxC,QAAQ,EAAE,QAAQ,GACjB,OAAO,CAAC,KAAK,CAAC,CAMhB;AAED,kEAAkE;AAClE,MAAM,MAAM,SAAS,GAAG;IACtB,uDAAuD;IACvD,KAAK,EAAE,MAAM,CAAA;IACb,qDAAqD;IACrD,iBAAiB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IACtC,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC9B,oDAAoD;IACpD,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC1B,uEAAuE;IACvE,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;IAC5D,yEAAyE;IACzE,MAAM,CAAC,EAAE,YAAY,CAAC,MAAM,GAAG,SAAS,CAAA;CACzC,CAAA;AAED,+FAA+F;AAC/F,wBAAgB,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,gBAa1E;AAED,4DAA4D;AAC5D,wBAAgB,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,IAAI,EAAE,OAAO,CAAA;CAAE,qBAOxE;AAED,oFAAoF;AACpF,wBAAsB,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,0BAWnE;AAED,yGAAyG;AACzG,wBAAgB,YAAY,CAAC,OAAO,EAAE,oBAAoB,GAAG,YAAY,CAexE;AAED,qFAAqF;AACrF,MAAM,MAAM,oBAAoB,GAAG;IACjC,yDAAyD;IACzD,OAAO,EAAE,KAAK,MAAM,EAAE,CAAA;IACtB,mCAAmC;IACnC,MAAM,EAAE;QACN,0FAA0F;QAC1F,MAAM,EAAE,SAAS,CAAC,KAAK,EAAE,GAAG,KAAK,EAAE,CAAC,CAAA;KACrC,CAAA;IACD,2BAA2B;IAC3B,KAAK,EAAE;QACL,+EAA+E;QAC/E,EAAE,EAAE,MAAM,CAAA;QACV,8CAA8C;QAC9C,IAAI,EAAE,MAAM,CAAA;KACb,CAAA;CACF,CAAA;AAED,qFAAqF;AACrF,MAAM,MAAM,aAAa,GAAG;IAC1B,mDAAmD;IACnD,YAAY,EAAE,MAAM,CAAA;IACpB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,SAAS,CAAA;IACxC,+CAA+C;IAC/C,UAAU,EAAE,MAAM,CAAA;IAClB,sEAAsE;IACtE,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAC7B,mEAAmE;IACnE,iBAAiB,CAAC,EAAE,gBAAgB,CAAC,GAAG,GAAG,SAAS,CAAA;IACpD,uFAAuF;IACvF,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACnC,CAAA;AAED,8DAA8D;AAC9D,wBAAgB,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAKzC;AAED,4CAA4C;AAC5C,wBAAgB,MAAM,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,CAOtD;AAED;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,CAqB9C;AAED,qEAAqE;AACrE,wBAAgB,UAAU,CAAC,IAAI,EAAE,QAAQ,GAAG,UAAU,CAIrD;AAED,+DAA+D;AAC/D,MAAM,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,GAAG,KAAK,CAAC,CAAA;AAE/D,2DAA2D;AAC3D,KAAK,KAAK,GAAG;IACX,oCAAoC;IACpC,KAAK,EAAE,KAAK,MAAM,EAAE,CAAA;IACpB,oEAAoE;IACpE,IAAI,EAAE,MAAM,CAAA;CACb,CAAA"}