@vertesia/ui 1.5.0 → 1.5.1

package/src/shell/login/SigninScreen.tsx

@@ -15,6 +15,7 @@ import {
 import { useCallback, useEffect, useState } from 'react';
 import SignInAuthPending from './SignInAuthPending';
 import SignInEmailStep, { type TenantInfo } from './SignInEmailStep';
+import SignInPasswordStep from './SignInPasswordStep';
 import SignInProvidersStep from './SignInProvidersStep';
 import SignInRecoveryStep, { type SignInRecoveryKind } from './SignInRecoveryStep';
 import SignInRestrictedEnvStep from './SignInRestrictedEnvStep';
@@ -79,6 +80,7 @@ type Mode =
     | 'email'
     | 'providers'
     | 'tenant'
+    | 'password'
     | 'blocked'
     | 'returning'
     | 'pending'
@@ -185,7 +187,13 @@ function SigninScreenImpl({
     const onProceedFromEmail = useCallback((e: string, t: TenantInfo | undefined) => {
         setEmail(e);
         setTenant(t);
-        setMode(t ? 'tenant' : 'providers');
+        // A password tenant has no identity provider to pick; ask for its password directly.
+        setMode(t?.provider === 'password' ? 'password' : t ? 'tenant' : 'providers');
+    }, []);
+
+    const onPasswordRequired = useCallback((e: string) => {
+        setEmail(e);
+        setMode('password');
     }, []);
 
     const onBack = useCallback(() => {
@@ -336,6 +344,14 @@ function SigninScreenImpl({
         );
     } else if (mode === 'signup' && !localStorage.getItem('tenantName')) {
         content = <SignupForm onSignup={onSignup} goBack={startOver} />;
+    } else if (mode === 'password' && email) {
+        content = (
+            <SignInPasswordStep
+                email={email}
+                tenantName={tenant?.label || tenant?.name || storedSession?.tenantName || undefined}
+                onBack={onBack}
+            />
+        );
     } else if (mode === 'tenant' && tenant) {
         content = (
             <SignInTenantStep
@@ -343,13 +359,26 @@ function SigninScreenImpl({
                 tenant={tenant}
                 onBack={onBack}
                 onProviderClicked={() => onProviderClicked((tenant.provider ?? 'oidc') as ProviderId)}
+                onPasswordRequired={onPasswordRequired}
             />
         );
     } else if (mode === 'providers') {
-        content = <SignInProvidersStep email={email} onBack={onBack} onProviderClicked={onProviderClicked} />;
+        content = (
+            <SignInProvidersStep
+                email={email}
+                onBack={onBack}
+                onProviderClicked={onProviderClicked}
+                onPasswordRequired={onPasswordRequired}
+            />
+        );
     } else if (mode === 'returning' && storedSession) {
         content = (
-            <SignInReturningStep session={storedSession} onNotYou={onNotYou} onProviderClicked={onProviderClicked} />
+            <SignInReturningStep
+                session={storedSession}
+                onNotYou={onNotYou}
+                onProviderClicked={onProviderClicked}
+                onPasswordRequired={onPasswordRequired}
+            />
         );
     } else {
         content = <SignInEmailStep initialEmail={email} onProceed={onProceedFromEmail} />;

package/src/shell/login/signInPassword.test.ts

@@ -0,0 +1,133 @@
+import { FirebaseError } from 'firebase/app';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+
+const mocks = vi.hoisted(() => ({
+    auth: { tenantId: null as string | null },
+    setFirebaseTenant: vi.fn(),
+    signInWithEmailAndPassword: vi.fn(),
+    signInWithRedirect: vi.fn(),
+}));
+
+vi.mock('@vertesia/ui/session', () => ({
+    getFirebaseAuth: () => mocks.auth,
+    setFirebaseTenant: mocks.setFirebaseTenant,
+}));
+
+vi.mock('firebase/auth', async (importOriginal) => ({
+    ...(await importOriginal<typeof import('firebase/auth')>()),
+    signInWithEmailAndPassword: mocks.signInWithEmailAndPassword,
+    signInWithRedirect: mocks.signInWithRedirect,
+}));
+
+const { passwordFailureReason, readPendingSignin, signInWithPassword, startSignIn } = await import('./signInUtils');
+
+const PASSWORD_TENANT = {
+    label: 'Vertesia Reviewers',
+    name: 'reviewers',
+    firebaseTenantId: 'reviewers-abc12',
+    provider: 'password',
+    domain: ['reviewers.vertesia.io'],
+};
+const OIDC_TENANT = { ...PASSWORD_TENANT, label: 'Acme', name: 'acme', provider: 'oidc', domain: ['acme.com'] };
+const EMAIL = 'claude@reviewers.vertesia.io';
+
+describe('passwordFailureReason', () => {
+    // One answer for every credential failure, so the form cannot be used to probe which
+    // addresses exist or are disabled.
+    it.each([
+        'auth/invalid-credential',
+        'auth/wrong-password',
+        'auth/user-not-found',
+        'auth/user-disabled',
+        'auth/invalid-email',
+    ])('folds %s into invalid-credentials', (code) => {
+        expect(passwordFailureReason(new FirebaseError(code, code))).toBe('invalid-credentials');
+    });
+
+    it('reports throttling separately', () => {
+        expect(passwordFailureReason(new FirebaseError('auth/too-many-requests', 'throttled'))).toBe(
+            'too-many-attempts',
+        );
+    });
+
+    it('treats anything else as a generic failure', () => {
+        expect(passwordFailureReason(new FirebaseError('auth/network-request-failed', 'offline'))).toBe('failed');
+        expect(passwordFailureReason(new Error('boom'))).toBe('failed');
+        expect(passwordFailureReason(undefined)).toBe('failed');
+    });
+});
+
+describe('signInWithPassword', () => {
+    beforeEach(() => {
+        mocks.setFirebaseTenant.mockReset();
+        mocks.signInWithEmailAndPassword.mockReset();
+        mocks.signInWithRedirect.mockReset();
+    });
+
+    afterEach(() => {
+        sessionStorage.clear();
+        localStorage.clear();
+    });
+
+    it('signs a password-tenant user in place and records the pending sign-in', async () => {
+        mocks.setFirebaseTenant.mockResolvedValue(PASSWORD_TENANT);
+        mocks.signInWithEmailAndPassword.mockResolvedValue({});
+
+        await expect(signInWithPassword(EMAIL, 'secret')).resolves.toEqual({ ok: true });
+
+        expect(mocks.setFirebaseTenant).toHaveBeenCalledWith(EMAIL);
+        expect(mocks.signInWithEmailAndPassword).toHaveBeenCalledWith(mocks.auth, EMAIL, 'secret');
+        expect(readPendingSignin()).toEqual({
+            email: EMAIL,
+            provider: 'password',
+            tenantName: 'Vertesia Reviewers',
+        });
+        expect(mocks.signInWithRedirect).not.toHaveBeenCalled();
+    });
+
+    // The password form is reachable only through tenant resolution, but the helper re-checks: an
+    // address that resolves to a federated tenant must never be offered a password.
+    it('refuses an address whose tenant is not a password tenant', async () => {
+        mocks.setFirebaseTenant.mockResolvedValue(OIDC_TENANT);
+
+        await expect(signInWithPassword('someone@acme.com', 'secret')).resolves.toEqual({
+            ok: false,
+            reason: 'not-password-tenant',
+        });
+        expect(mocks.signInWithEmailAndPassword).not.toHaveBeenCalled();
+    });
+
+    it('fails without signing in when the tenant cannot be resolved', async () => {
+        mocks.setFirebaseTenant.mockResolvedValue(undefined);
+
+        await expect(signInWithPassword(EMAIL, 'secret')).resolves.toEqual({ ok: false, reason: 'failed' });
+        expect(mocks.signInWithEmailAndPassword).not.toHaveBeenCalled();
+    });
+
+    it('clears the pending sign-in when Firebase rejects the credential', async () => {
+        mocks.setFirebaseTenant.mockResolvedValue(PASSWORD_TENANT);
+        mocks.signInWithEmailAndPassword.mockRejectedValue(new FirebaseError('auth/invalid-credential', 'bad'));
+
+        await expect(signInWithPassword(EMAIL, 'wrong')).resolves.toEqual({
+            ok: false,
+            reason: 'invalid-credentials',
+        });
+        expect(readPendingSignin()).toBeNull();
+    });
+});
+
+describe('startSignIn', () => {
+    beforeEach(() => {
+        mocks.setFirebaseTenant.mockReset();
+        mocks.signInWithRedirect.mockReset();
+    });
+
+    // A returning session's stored provider can go stale; a password tenant has nowhere to redirect.
+    it('does not redirect when the address resolves to a password tenant', async () => {
+        mocks.setFirebaseTenant.mockResolvedValue(PASSWORD_TENANT);
+
+        await expect(startSignIn('google', EMAIL)).resolves.toEqual({ ok: false, reason: 'password-required' });
+        expect(mocks.signInWithRedirect).not.toHaveBeenCalled();
+        expect(readPendingSignin()).toBeNull();
+    });
+});

package/src/shell/login/signInUtils.ts

@@ -1,16 +1,21 @@
 import { getFirebaseAuth, setFirebaseTenant } from '@vertesia/ui/session';
+import { FirebaseError } from 'firebase/app';
 import {
     type AuthProvider,
     signOut as firebaseSignOut,
     GithubAuthProvider,
     GoogleAuthProvider,
     OAuthProvider,
+    signInWithEmailAndPassword,
     signInWithRedirect,
 } from 'firebase/auth';
 
 // Matches auth-tenants.json `provider` values. Tenant context is derived from
 // email resolution at sign-in time, not encoded here.
-export type ProviderId = 'google' | 'github' | 'microsoft' | 'oidc';
+export type ProviderId = 'google' | 'github' | 'microsoft' | 'oidc' | 'password';
+
+/** Providers that sign in by redirecting to an identity provider. `password` signs in in place. */
+export type RedirectProviderId = Exclude<ProviderId, 'password'>;
 
 export interface LastSuccessfulLogin {
     email: string;
@@ -140,28 +145,28 @@ const buildOidcProvider: ProviderBuilder = (email) => {
     return p;
 };
 
-const PROVIDER_BUILDERS: Record<ProviderId, ProviderBuilder> = {
+const PROVIDER_BUILDERS: Record<RedirectProviderId, ProviderBuilder> = {
     google: buildGoogleProvider,
     github: buildGithubProvider,
     microsoft: buildMicrosoftProvider,
     oidc: buildOidcProvider,
 };
 
-function buildFirebaseProvider(idp: ProviderId, email?: string, redirectTo?: string): AuthProvider {
+function buildFirebaseProvider(idp: RedirectProviderId, email?: string, redirectTo?: string): AuthProvider {
     return PROVIDER_BUILDERS[idp](email, redirectTo);
 }
 
 export async function startSignIn(
-    provider: ProviderId,
+    provider: RedirectProviderId,
     email: string,
     redirectTo?: string,
-): Promise<{ ok: true } | { ok: false; reason: 'no-email' }> {
+): Promise<{ ok: true } | { ok: false; reason: 'no-email' | 'password-required' }> {
     if (!email) return { ok: false, reason: 'no-email' };
 
     // A tenant-mapped email uses the tenant's provider (overriding `provider`); otherwise use `provider`.
     const tenant = await setFirebaseTenant(email);
     const auth = getFirebaseAuth();
-    let effectiveIdp = provider;
+    let effectiveIdp: ProviderId = provider;
     let tenantName: string | undefined;
 
     if (tenant) {
@@ -175,13 +180,61 @@ export async function startSignIn(
         if (auth.tenantId) auth.tenantId = null;
     }
 
+    // A password tenant has no identity provider to redirect to; its step collects the password.
+    if (effectiveIdp === 'password') return { ok: false, reason: 'password-required' };
+
     writePendingSignin({ email, provider: effectiveIdp, tenantName });
     void signInWithRedirect(auth, buildFirebaseProvider(effectiveIdp, email, redirectTo));
     return { ok: true };
 }
 
+export type PasswordSignInFailure = 'not-password-tenant' | 'invalid-credentials' | 'too-many-attempts' | 'failed';
+
+// Firebase reports an unknown user, a wrong password and a disabled user with distinct codes on
+// some SDK versions; they are folded into one answer so the form does not reveal which it was.
+const INVALID_CREDENTIAL_CODES = new Set([
+    'auth/invalid-credential',
+    'auth/invalid-email',
+    'auth/user-disabled',
+    'auth/user-not-found',
+    'auth/wrong-password',
+]);
+
+export function passwordFailureReason(err: unknown): Exclude<PasswordSignInFailure, 'not-password-tenant'> {
+    if (!(err instanceof FirebaseError)) return 'failed';
+    if (INVALID_CREDENTIAL_CODES.has(err.code)) return 'invalid-credentials';
+    if (err.code === 'auth/too-many-requests') return 'too-many-attempts';
+    return 'failed';
+}
+
+/**
+ * Signs in a user of a password tenant, in place — there is no redirect. Only an address whose
+ * domain resolves to a tenant configured for password sign-in may use it; the tenant is resolved
+ * again here rather than trusted from the caller, so a returning session cannot carry a stale one.
+ * On success the session's auth-state listener completes the login.
+ */
+export async function signInWithPassword(
+    email: string,
+    password: string,
+): Promise<{ ok: true } | { ok: false; reason: PasswordSignInFailure }> {
+    const tenant = await setFirebaseTenant(email);
+    if (!tenant) return { ok: false, reason: 'failed' };
+    if (tenant.provider !== 'password') return { ok: false, reason: 'not-password-tenant' };
+
+    const tenantName = tenant.label || tenant.name || undefined;
+    localStorage.setItem('tenantName', tenantName ?? '');
+    writePendingSignin({ email, provider: 'password', tenantName });
+    try {
+        await signInWithEmailAndPassword(getFirebaseAuth(), email, password);
+        return { ok: true };
+    } catch (err: unknown) {
+        clearPendingSignin();
+        return { ok: false, reason: passwordFailureReason(err) };
+    }
+}
+
 /** Starts a provider sign-in directly, skipping email/tenant resolution and clearing any tenant routing. */
-export function startSignInWithoutTenant(provider: ProviderId, redirectTo?: string): void {
+export function startSignInWithoutTenant(provider: RedirectProviderId, redirectTo?: string): void {
     const auth = getFirebaseAuth();
     localStorage.removeItem('tenantName');
     if (auth.tenantId) auth.tenantId = null;

package/lib/features/store/objects/selection/actions/StartWorkflowButton.d.ts

@@ -1,7 +0,0 @@
-/**
- * Standalone "Start Workflow" button for the content objects toolbar. Renders only when objects are
- * selected; opens a modal to pick a workflow rule and runs it on the selected object ids. Gated by
- * the caller via the `allowWorkflowRun` prop on {@link SelectionActions}.
- */
-export declare function StartWorkflowButton(): import("react").JSX.Element | null;
-//# sourceMappingURL=StartWorkflowButton.d.ts.map

package/lib/features/store/objects/selection/actions/StartWorkflowButton.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"StartWorkflowButton.d.ts","sourceRoot":"","sources":["../../../../../../src/features/store/objects/selection/actions/StartWorkflowButton.tsx"],"names":[],"mappings":"AAiBA;;;;GAIG;AACH,wBAAgB,mBAAmB,uCAelC"}

package/lib/features/store/objects/selection/actions/StartWorkflowButton.js

@@ -1,51 +0,0 @@
-import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { Button, Modal, ModalBody, ModalFooter, ModalTitle, SelectList, Spinner, useFetch, useToast, } from '@vertesia/ui/core';
-import { useUITranslation } from '@vertesia/ui/i18n';
-import { useUserSession } from '@vertesia/ui/session';
-import { useState } from 'react';
-import { useDocumentSelection } from '../../DocumentSelectionProvider.js';
-/**
- * Standalone "Start Workflow" button for the content objects toolbar. Renders only when objects are
- * selected; opens a modal to pick a workflow rule and runs it on the selected object ids. Gated by
- * the caller via the `allowWorkflowRun` prop on {@link SelectionActions}.
- */
-export function StartWorkflowButton() {
-    const { t } = useUITranslation();
-    const selection = useDocumentSelection();
-    const [isOpen, setOpen] = useState(false);
-    if (!selection?.hasSelection()) {
-        return null;
-    }
-    return (_jsxs(_Fragment, { children: [_jsx(Button, { onClick: () => setOpen(true), children: t('store.actions.startWorkflow') }), isOpen && _jsx(StartWorkflowModal, { objectIds: selection.getObjectIds(), onClose: () => setOpen(false) })] }));
-}
-function StartWorkflowModal({ objectIds, onClose }) {
-    const { t } = useUITranslation();
-    const { client } = useUserSession();
-    const toast = useToast();
-    const [selected, setSelected] = useState(undefined);
-    const [isStarting, setIsStarting] = useState(false);
-    const { data: rules, isLoading } = useFetch(() => client.store.workflows.rules.list(), []);
-    const onStart = async () => {
-        if (!selected || isStarting)
-            return;
-        setIsStarting(true);
-        try {
-            await client.store.workflows.rules.execute(selected.id, objectIds);
-            toast({ title: t('store.actions.workflowStarted'), status: 'success', duration: 3000 });
-            onClose();
-        }
-        catch (err) {
-            toast({
-                title: t('store.actions.errorStartingWorkflow'),
-                description: err instanceof Error ? err.message : undefined,
-                status: 'error',
-                duration: 9000,
-            });
-        }
-        finally {
-            setIsStarting(false);
-        }
-    };
-    return (_jsxs(Modal, { isOpen: true, onClose: onClose, size: "lg", children: [_jsx(ModalTitle, { children: t('store.actions.startWorkflowByRule') }), _jsxs(ModalBody, { children: [_jsx("div", { className: "pb-2", children: t('store.actions.chooseWorkflowRule') }), isLoading ? (_jsx("div", { className: "flex justify-center py-4", children: _jsx(Spinner, {}) })) : (_jsx("div", { className: "max-h-[420px] overflow-y-auto border-border border rounded-md", children: _jsx(SelectList, { className: "text-start w-full", options: rules ?? [], value: selected, onChange: setSelected, optionLayout: (rule) => ({ label: rule.name }) }) }))] }), _jsxs(ModalFooter, { align: "right", children: [_jsx(Button, { variant: "outline", onClick: onClose, disabled: isStarting, children: "Cancel" }), _jsx(Button, { onClick: onStart, isDisabled: !selected || isStarting, isLoading: isStarting, children: "Start" })] })] }));
-}
-//# sourceMappingURL=StartWorkflowButton.js.map

package/lib/features/store/objects/selection/actions/StartWorkflowButton.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"StartWorkflowButton.js","sourceRoot":"","sources":["../../../../../../src/features/store/objects/selection/actions/StartWorkflowButton.tsx"],"names":[],"mappings":";AACA,OAAO,EACH,MAAM,EACN,KAAK,EACL,SAAS,EACT,WAAW,EACX,UAAU,EACV,UAAU,EACV,OAAO,EACP,QAAQ,EACR,QAAQ,GACX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAE1E;;;;GAIG;AACH,MAAM,UAAU,mBAAmB;IAC/B,MAAM,EAAE,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,SAAS,GAAG,oBAAoB,EAAE,CAAC;IACzC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE1C,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO,CACH,8BACI,KAAC,MAAM,IAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,YAAG,CAAC,CAAC,6BAA6B,CAAC,GAAU,EAChF,MAAM,IAAI,KAAC,kBAAkB,IAAC,SAAS,EAAE,SAAS,CAAC,YAAY,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,GAAI,IACtG,CACN,CAAC;AACN,CAAC;AAOD,SAAS,kBAAkB,CAAC,EAAE,SAAS,EAAE,OAAO,EAA2B;IACvE,MAAM,EAAE,CAAC,EAAE,GAAG,gBAAgB,EAAE,CAAC;IACjC,MAAM,EAAE,MAAM,EAAE,GAAG,cAAc,EAAE,CAAC;IACpC,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;IACzB,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,GAAG,QAAQ,CAA+B,SAAS,CAAC,CAAC;IAClF,MAAM,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEpD,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAE3F,MAAM,OAAO,GAAG,KAAK,IAAI,EAAE;QACvB,IAAI,CAAC,QAAQ,IAAI,UAAU;YAAE,OAAO;QACpC,aAAa,CAAC,IAAI,CAAC,CAAC;QACpB,IAAI,CAAC;YACD,MAAM,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;YACnE,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,+BAA+B,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;YACxF,OAAO,EAAE,CAAC;QACd,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACpB,KAAK,CAAC;gBACF,KAAK,EAAE,CAAC,CAAC,qCAAqC,CAAC;gBAC/C,WAAW,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBAC3D,MAAM,EAAE,OAAO;gBACf,QAAQ,EAAE,IAAI;aACjB,CAAC,CAAC;QACP,CAAC;gBAAS,CAAC;YACP,aAAa,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACL,CAAC,CAAC;IAEF,OAAO,CACH,MAAC,KAAK,IAAC,MAAM,QAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAC,IAAI,aACrC,KAAC,UAAU,cAAE,CAAC,CAAC,mCAAmC,CAAC,GAAc,EACjE,MAAC,SAAS,eACN,cAAK,SAAS,EAAC,MAAM,YAAE,CAAC,CAAC,kCAAkC,CAAC,GAAO,EAClE,SAAS,CAAC,CAAC,CAAC,CACT,cAAK,SAAS,EAAC,0BAA0B,YACrC,KAAC,OAAO,KAAG,GACT,CACT,CAAC,CAAC,CAAC,CACA,cAAK,SAAS,EAAC,+DAA+D,YAC1E,KAAC,UAAU,IACP,SAAS,EAAC,mBAAmB,EAC7B,OAAO,EAAE,KAAK,IAAI,EAAE,EACpB,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,WAAW,EACrB,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,GAChD,GACA,CACT,IACO,EACZ,MAAC,WAAW,IAAC,KAAK,EAAC,OAAO,aACtB,KAAC,MAAM,IAAC,OAAO,EAAC,SAAS,EAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,uBAEvD,EACT,KAAC,MAAM,IAAC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,QAAQ,IAAI,UAAU,EAAE,SAAS,EAAE,UAAU,sBAE3E,IACC,IACV,CACX,CAAC;AACN,CAAC"}