npm - @wildo-ai/saas-frontend-lib - Versions diffs - 1.1.3 → 1.1.5 - Mend

@wildo-ai/saas-frontend-lib 1.1.3 → 1.1.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (2521) hide show

package/dist/esm/core/security/AuthSessionContext.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"AuthSessionContext.js","sourceRoot":"","sources":["../../../../src/core/security/AuthSessionContext.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,aAAa,EAAE,QAAQ,EAAa,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAC3G,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,OAAO,EAIL,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,WAAW,EACX,mBAAmB,GACpB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,wBAAwB,EAAE,MAAM,mFAAmF,CAAC;AAC7H,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,MAAM,oEAAoE,CAAC;AAC1I,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAC7F,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gEAAgE,CAAC;AACvG,OAAO,EAAE,qBAAqB,EAAE,MAAM,6DAA6D,CAAC;AACpG,OAAO,EAAE,QAAQ,EAAE,MAAM,0CAA0C,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,2DAA2D,CAAC;AACzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,2DAA2D,CAAC;AAChG,OAAO,EAEL,gBAAgB,GAEjB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAEL,6BAA6B,GAC9B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAE9G,MAAM,MAAM,GAA0B,qBAAqB,CAAC,SAAS,EAAE,CAAC;AACxE,MAAM,QAAQ,GAAiE,MAAM,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC;AACxH,MAAM,CAAC,mBAAmB,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;AAExD,SAAS,uBAAuB,CAAC,KAAU,EAAE,QAAgB;IAC3D,MAAM,mBAAmB,GAAG,KAAK,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW;WACnE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,WAAW,CAAC;IAC7D,IAAI,OAAO,mBAAmB,KAAK,QAAQ,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9E,OAAO,mBAAmB,CAAC;IAC7B,CAAC;IAED,MAAM,cAAc,GAAG,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC;IACtE,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpE,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,MAAM,cAAc,GAAG,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC;IAC/C,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpE,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,OAAO,KAAK,EAAE,OAAO,IAAI,QAAQ,CAAC;AACpC,CAAC;AAqED;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsD,aAAa,CAAqC,SAAS,CAAC,CAAC;AAElJ,MAAM,CAAC,MAAM,mBAAmB,GAG3B,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,gBAAgB,EAAE,EAAE,EAAE;IACpD,MAAM,YAAY,GAAG,OAAO,CAC1B,GAAG,EAAE,CAAC,gBAAgB,IAAI,IAAI,6BAA6B,EAAE,EAC7D,CAAC,gBAAgB,CAAC,CACnB,CAAC;IACF,MAAM,EAAE,YAAY,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,+BAA+B,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAChL,MAAM,EAAE,WAAW,EAAE,GAAG,QAAQ,EAAE,CAAC;IACnC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,qBAAqB,CAAC,wBAAwB,EAAE,qBAAqB,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAC;IAC7J,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACvC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,GAAG,YAAY,EAAE,CAAC;IAC5H,MAAM,EAAE,qBAAqB,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACxD,MAAM,iBAAiB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,mBAAmB,GAAG,MAAM,CAA0B,IAAI,CAAC,CAAC;IAClE,MAAM,kBAAkB,GAAG,MAAM,CAAyB,IAAI,CAAC,CAAC;IAChE,4EAA4E;IAC5E,mEAAmE;IACnE,8EAA8E;IAC9E,4EAA4E;IAC5E,MAAM,sBAAsB,GAAG,MAAM,CAAiC,IAAI,CAAC,CAAC;IAE5E,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAY;QAC1C,GAAG,gBAAgB;QACnB,WAAW,EAAE,YAAY,CAAC,cAAc,EAAE;QAC1C,8DAA8D;QAC9D,iEAAiE;QACjE,iEAAiE;QACjE,2EAA2E;QAC3E,iEAAiE;QACjE,6DAA6D;QAC7D,iEAAiE;QACjE,kCAAkC;KACnC,CAAC,CAAC;IAEH;;;;;;;;OAQG;IACH,MAAM,eAAe,GAAG,CAAC,WAA0B,EAAQ,EAAE;QAC3D,YAAY,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,WAAW,EAAE,CAAC;YAChB,qBAAqB,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC;IAEF;;;;;;;;OAQG;IACH,MAAM,kBAAkB,GAAG,WAAW,CAAC,GAAkB,EAAE;QACzD,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;YACrD,MAAM,CAAC,IAAI,CAAC,2FAA2F,CAAC,CAAC;YACzG,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC;QAChE,wEAAwE;QACxE,+DAA+D;QAC/D,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QAEvC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,mFAAmF,CAAC,CAAC;YACjG,OAAO,IAAI,CAAC;QACd,CAAC;QAED,kDAAkD;QAClD,2EAA2E;QAC3E,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAEhB;;;OAGG;IACH,MAAM,gBAAgB,GAAG,WAAW,CAAC,CAAC,KAAa,EAAE,cAA8B,EAAE,eAA+B,EAAQ,EAAE;QAC5H,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,QAAQ,CAAC,+CAA+C,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;QAEnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,QAAQ,CAAC,kDAAkD,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,OAAO,CAAC;gBACN,GAAG,EAAE,KAAK;gBACV,KAAK;gBACL,cAAc,EAAE,cAAc,IAAI,SAAS;gBAC3C,eAAe,EAAE,eAAe,IAAI,SAAS;gBAC7C,aAAa,EAAE,IAAI;gBACnB,0EAA0E;gBAC1E,2EAA2E;gBAC3E,4EAA4E;gBAC5E,uEAAuE;gBACvE,wEAAwE;gBACxE,iBAAiB,EAAE,IAAI;gBACvB,oBAAoB,EAAE,EAAE;gBACxB,yEAAyE;gBACzE,sEAAsE;gBACtE,wEAAwE;gBACxE,6DAA6D;gBAC7D,yEAAyE;gBACzE,yEAAyE;gBACzE,yEAAyE;gBACzE,gDAAgD;gBAChD,qBAAqB,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,EAAE;aAChE,CAAC,CAAC;YACH,QAAQ,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAElC;;OAEG;IACH,MAAM,wBAAwB,GAAG,WAAW,CAAC,CAAC,QAAgB,EAAE,aAAqB,EAAQ,EAAE;QAC7F,oBAAoB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAChD,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAE3B,MAAM,eAAe,GAAG,KAAK,EAAE,KAAa,EAAuC,EAAE;QACnF,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,QAAQ,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,wBAAwB,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAErE,QAAQ,CAAC,gCAAgC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YAE1E,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACZ,GAAG,CAAC;gBACJ,SAAS,EAAE,KAAK;gBAChB,cAAc,EAAE,IAAI;gBACpB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,kBAAkB,CAAC,KAAK;aAC/C,CAAC,CAAC,CAAC;YAEJ,OAAO,IAAkC,CAAC;QAC5C,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,uBAAuB,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;YAChE,WAAW,CAAC,CAAC,EAAE,uBAAuB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACjE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YACvD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,wBAAwB,GAAG,KAAK,EAAE,KAAa,EAAE,QAAgB,EAAmC,EAAE;QAC1G,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,QAAQ,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;gBAC1E,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;gBACnE,MAAM,KAAK,CAAC;YACd,CAAC;YAED,sEAAsE;YACtE,MAAM,WAAW,GAA0B;gBACzC,SAAS;gBACT,MAAM,EAAE,UAAU,CAAC,QAAQ;gBAC3B,WAAW,EAAE,eAAe,CAAC,KAAK;gBAClC,QAAQ;gBACR,UAAU,EAAE,KAAK;gBACjB,qBAAqB,EAAE,EAAE;aAC1B,CAAC;YAEF,MAAM,IAAI,GAAG,MAAM,wBAAwB,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YAExE,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC1C,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACZ,GAAG,CAAC;oBACJ,SAAS,EAAE,KAAK;oBAChB,WAAW,EAAE,IAAI;oBACjB,YAAY,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS;oBACzC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,IAAI,EAAE;oBACnD,0BAA0B,EAAE,IAAI,CAAC,0BAA0B,IAAI,EAAE;oBACjE,2BAA2B,EAAE,IAAI,CAAC,2BAA2B,IAAI,EAAE;oBACnE,yBAAyB,EAAE,IAAI,CAAC,yBAAyB,IAAI,EAAE;iBAChE,CAAC,CAAC,CAAC;gBACJ,OAAO,IAA8B,CAAC;YACxC,CAAC;YAED,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;YAE7C,eAAe,CAAC,WAAW,CAAC,CAAC;YAE7B,IAAI,WAAW,EAAE,CAAC;gBAChB,wBAAwB,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;gBACrD,qBAAqB,CAAC,WAAW,CAAC,CAAC;YACrC,CAAC;YAED,QAAQ,CAAC,2BAA2B,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAEhG,IAAI,IAAI,CAAC,OAAO,IAAI,WAAW,EAAE,CAAC;gBAChC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACZ,GAAG,CAAC;oBACJ,SAAS,EAAE,KAAK;oBAChB,WAAW;oBACX,kBAAkB,EAAE,IAAI;oBACxB,eAAe,EAAE,KAAK;oBACtB,SAAS,EAAE,IAAI;iBAChB,CAAC,CAAC,CAAC;gBAEJ,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACZ,GAAG,CAAC;oBACJ,SAAS,EAAE,KAAK;oBAChB,WAAW;oBACX,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;iBAC3C,CAAC,CAAC,CAAC;YACN,CAAC;YAED,OAAO,IAA8B,CAAC;QACxC,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,uBAAuB,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;YAChE,WAAW,CAAC,CAAC,EAAE,uBAAuB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACjE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YACvD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,KAAK,EAAE,OAA8B,EAAmC,EAAE;QAC7F,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,QAAQ,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACvG,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;YACtD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;gBAC1E,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpF,MAAM,KAAK,CAAC;YACd,CAAC;YAED,MAAM,WAAW,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAA2B,CAAC;YACvE,MAAM,IAAI,GAAG,MAAM,wBAAwB,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YAExE,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC1C,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACZ,GAAG,CAAC;oBACJ,SAAS,EAAE,KAAK;oBAChB,WAAW,EAAE,IAAI;oBACjB,YAAY,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS;oBACzC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,IAAI,EAAE;oBACnD,0BAA0B,EAAE,IAAI,CAAC,0BAA0B,IAAI,EAAE;oBACjE,2BAA2B,EAAE,IAAI,CAAC,2BAA2B,IAAI,EAAE;oBACnE,yBAAyB,EAAE,IAAI,CAAC,yBAAyB,IAAI,EAAE;iBAChE,CAAC,CAAC,CAAC;gBACJ,OAAO,IAAI,CAAC;YACd,CAAC;YAED,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;YAE7C,eAAe,CAAC,WAAW,CAAC,CAAC;YAE7B,IAAI,WAAW,EAAE,CAAC;gBAChB,wBAAwB,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;gBACrD,qBAAqB,CAAC,WAAW,CAAC,CAAC;YACrC,CAAC;YAED,QAAQ,CAAC,2BAA2B,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAExH,IAAI,IAAI,CAAC,OAAO,IAAI,WAAW,EAAE,CAAC;gBAChC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACZ,GAAG,CAAC;oBACJ,SAAS,EAAE,KAAK;oBAChB,WAAW;oBACX,kBAAkB,EAAE,IAAI;oBACxB,eAAe,EAAE,KAAK;oBACtB,SAAS,EAAE,IAAI;iBAChB,CAAC,CAAC,CAAC;gBAEJ,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACZ,GAAG,CAAC;oBACJ,SAAS,EAAE,KAAK;oBAChB,WAAW;oBACX,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;iBAC3C,CAAC,CAAC,CAAC;YACN,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,uBAAuB,CAAC,CAAC,EAAE,uBAAuB,CAAC,CAAC;YAChE,WAAW,CAAC,CAAC,EAAE,uBAAuB,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAClF,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YACvD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,KAAK,EAAE,SAAiB,EAAgB,EAAE;QAChE,QAAQ,CAAC,uBAAuB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,wBAAwB,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YACjF,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACpF,QAAQ,CAAC,yBAAyB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YACnD,OAAO,YAAY,CAAC;QACtB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,WAAW,CAAC,CAAC,EAAE,6BAA6B,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAC7D,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,GAAY,EAAE;QACpC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC5B,CAAC,CAAC;IAEF;;;;;;;;;OASG;IACH,MAAM,mBAAmB,GAAG,WAAW,CAAC,KAAK,EAAE,WAAmB,EAAE,SAAkB,EAAiB,EAAE;QACvG,QAAQ,CAAC,yBAAyB,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;QAChE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,wBAAwB,EAAE,CAAC,yBAAyB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAChH,QAAQ,CAAC,gCAAgC,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC9E,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC1C,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,CAAC,EAAE,OAAO,IAAI,iCAAiC,CAAC;YAC5D,WAAW,CAAC,CAAC,EAAE,gCAAgC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAChF,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YACvD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAElB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAkCG;IACH,MAAM,sBAAsB,GAAG,WAAW,CAAC,KAAK,EAAE,IAAY,EAAiB,EAAE;QAC/E,QAAQ,CAAC,+EAA+E,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACvH,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,wBAAwB,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACzE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,GAAG,QAAQ,CAAC;YAE1F,eAAe,CAAC,WAAW,CAAC,CAAC;YAC7B,wBAAwB,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YACrD,qBAAqB,CAAC,WAAW,CAAC,CAAC;YAEnC,uEAAuE;YACvE,oEAAoE;YACpE,sEAAsE;YACtE,iEAAiE;YACjE,iEAAiE;YACjE,uDAAuD;YACvD,mEAAmE;YACnE,6BAA6B;YAC7B,EAAE;YACF,mEAAmE;YACnE,mEAAmE;YACnE,kEAAkE;YAClE,iEAAiE;YACjE,+DAA+D;YAC/D,oEAAoE;YACpE,6CAA6C;YAC7C,kEAAkE;YAClE,8BAA8B;YAC9B,8DAA8D;YAC9D,+DAA+D;YAC/D,mEAAmE;YACnE,2CAA2C;YAC3C,MAAM,2BAA2B,GAAG,OAAO,UAAU,KAAK,QAAQ;gBAChE,CAAC,CAAC;oBACE,UAAU;oBACV,GAAG,CAAC,yBAAyB,KAAK,SAAS,IAAI,EAAE,yBAAyB,EAAE,CAAC;oBAC7E,GAAG,CAAC,gBAAgB,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,CAAC;iBAC5D;gBACH,CAAC,CAAC,SAAS,CAAC;YAEd,QAAQ,CAAC,2CAA2C,EAAE;gBACpD,sBAAsB,EAAE,2BAA2B,KAAK,SAAS;aAClE,CAAC,CAAC;YAEH,wFAAwF;YACxF,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACZ,GAAG,CAAC;gBACJ,SAAS,EAAE,KAAK;gBAChB,WAAW;gBACX,kBAAkB,EAAE,IAAI;gBACxB,eAAe,EAAE,KAAK;gBACtB,0EAA0E;gBAC1E,SAAS,EAAE,IAAI;gBACf,2BAA2B;aAC5B,CAAC,CAAC,CAAC;YAEJ,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;QACnC,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,CAAC,EAAE,OAAO,IAAI,8BAA8B,CAAC;YACzD,WAAW,CAAC,CAAC,EAAE,wBAAwB,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3D,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YACvD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,EAAE,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAC,CAAC;IAEzC;;;;;;OAMG;IACH,MAAM,uBAAuB,GAAG,WAAW,CAAC,KAAK,EAAE,KAAa,EAAE,KAAa,EAAiB,EAAE;QAChG,QAAQ,CAAC,6BAA6B,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,wBAAwB,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAE5E,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACzB,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBACtC,wBAAwB,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAC9D,qBAAqB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAE5C,QAAQ,CAAC,8CAA8C,CAAC,CAAC;gBAEzD,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACZ,GAAG,CAAC;oBACJ,SAAS,EAAE,KAAK;oBAChB,WAAW,EAAE,QAAQ,CAAC,WAAY;oBAClC,kBAAkB,EAAE,IAAI;oBACxB,eAAe,EAAE,KAAK;oBACtB,SAAS,EAAE,IAAI;iBAChB,CAAC,CAAC,CAAC;gBAEJ,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,sFAAsF,EAAE;oBAC/F,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;iBAC5B,CAAC,CAAC;gBAEH,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACZ,GAAG,CAAC;oBACJ,SAAS,EAAE,KAAK;oBAChB,SAAS,EAAE,IAAI;oBACf,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,KAAK;oBAC1C,YAAY,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;oBACxE,mBAAmB,EAAE,EAAE;oBACvB,0BAA0B,EAAE,QAAQ,CAAC,0BAA0B,IAAI,EAAE;oBACrE,2BAA2B,EAAE,EAAE;oBAC/B,yBAAyB,EAAE,EAAE;oBAC7B,KAAK,EAAE,IAAI;iBACZ,CAAC,CAAC,CAAC;YACN,CAAC;QACH,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,CAAC,EAAE,OAAO,IAAI,2BAA2B,CAAC;YACtD,WAAW,CAAC,CAAC,EAAE,2BAA2B,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9D,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YACvD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,EAAE,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAC,CAAC;IAEzC,MAAM,gBAAgB,GAAG,WAAW,CAAC,KAAK,EACxC,MAA4H,EACzD,EAAE;QACrE,QAAQ,CAAC,gCAAgC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC1H,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,wBAAwB,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAE3E,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACzB,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBACtC,wBAAwB,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAC9D,qBAAqB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAE5C,QAAQ,CAAC,iDAAiD,CAAC,CAAC;gBAE5D,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACZ,GAAG,CAAC;oBACJ,SAAS,EAAE,KAAK;oBAChB,WAAW,EAAE,QAAQ,CAAC,WAAY;oBAClC,kBAAkB,EAAE,IAAI;oBACxB,eAAe,EAAE,KAAK;oBACtB,SAAS,EAAE,IAAI;oBACf,WAAW,EAAE,KAAK;oBAClB,YAAY,EAAE,IAAI;oBAClB,mBAAmB,EAAE,EAAE;oBACvB,0BAA0B,EAAE,EAAE;oBAC9B,2BAA2B,EAAE,EAAE;oBAC/B,yBAAyB,EAAE,EAAE;oBAC7B,KAAK,EAAE,IAAI;iBACZ,CAAC,CAAC,CAAC;gBAEJ,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,mDAAmD,EAAE;oBAC5D,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;iBAC5B,CAAC,CAAC;gBAEH,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACZ,GAAG,CAAC;oBACJ,SAAS,EAAE,KAAK;oBAChB,SAAS,EAAE,IAAI;oBACf,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,KAAK;oBAC1C,YAAY,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;oBACxE,mBAAmB,EAAE,EAAE;oBACvB,0BAA0B,EAAE,QAAQ,CAAC,0BAA0B,IAAI,EAAE;oBACrE,2BAA2B,EAAE,EAAE;oBAC/B,yBAAyB,EAAE,EAAE;oBAC7B,KAAK,EAAE,IAAI;iBACZ,CAAC,CAAC,CAAC;YACN,CAAC;YAED,2FAA2F;YAC3F,0FAA0F;YAC1F,0FAA0F;YAC1F,yFAAyF;YACzF,OAAO,EAAE,0BAA0B,EAAE,QAAQ,CAAC,0BAA0B,EAAE,CAAC;QAC7E,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,CAAC,EAAE,OAAO,IAAI,8BAA8B,CAAC;YACzD,WAAW,CAAC,CAAC,EAAE,8BAA8B,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACjE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YACvD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,EAAE,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAC,CAAC;IAEzC;;;;OAIG;IACH,MAAM,qBAAqB,GAAG,WAAW,CAAC,KAAK,EAAE,KAAa,EAAE,KAAa,EAAmC,EAAE;QAChH,QAAQ,CAAC,kCAAkC,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACnF,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,wBAAwB,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAEhF,IAAI,QAAQ,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAClD,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACZ,GAAG,CAAC;oBACJ,SAAS,EAAE,KAAK;oBAChB,WAAW,EAAE,IAAI;oBACjB,YAAY,EAAE,QAAQ,CAAC,SAAS,IAAI,IAAI;oBACxC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,IAAI,EAAE;oBACvD,0BAA0B,EAAE,QAAQ,CAAC,0BAA0B,IAAI,EAAE;oBACrE,2BAA2B,EAAE,QAAQ,CAAC,2BAA2B,IAAI,EAAE;oBACvE,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB,IAAI,EAAE;iBACpE,CAAC,CAAC,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,8DAA8D;YAC9D,iEAAiE;YACjE,qDAAqD;YACrD,+DAA+D;YAC/D,yCAAyC;YACzC,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC7C,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBACtC,wBAAwB,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAC9D,qBAAqB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAE5C,QAAQ,CAAC,mDAAmD,CAAC,CAAC;gBAE9D,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACZ,GAAG,CAAC;oBACJ,SAAS,EAAE,KAAK;oBAChB,WAAW,EAAE,QAAQ,CAAC,WAAY;oBAClC,kBAAkB,EAAE,IAAI;oBACxB,eAAe,EAAE,KAAK;oBACtB,SAAS,EAAE,IAAI;iBAChB,CAAC,CAAC,CAAC;gBAEJ,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YAC7C,CAAC;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,CAAC,EAAE,OAAO,IAAI,gCAAgC,CAAC;YAC3D,WAAW,CAAC,CAAC,EAAE,gCAAgC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACnE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YACvD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,EAAE,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAC,CAAC;IAEzC;;;;OAIG;IACH,MAAM,eAAe,GAAG,WAAW,CAAC,KAAK,EAAE,SAAiB,EAAE,MAAkB,EAAE,IAAY,EAAmC,EAAE;QACjI,QAAQ,CAAC,2BAA2B,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,wBAAwB,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC;gBACzC,SAAS;gBACT,MAAM;gBACN,WAAW,EAAE,eAAe,CAAC,MAAM;gBACnC,KAAK,EAAE,IAAI;gBACX,UAAU,EAAE,KAAK;gBACjB,qBAAqB,EAAE,EAAE;aACD,CAAC,CAAC;YAE5B,mEAAmE;YACnE,0DAA0D;YAC1D,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC7C,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBACtC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAC1C,qBAAqB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAE5C,QAAQ,CAAC,4CAA4C,CAAC,CAAC;gBAEvD,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACZ,GAAG,CAAC;oBACJ,SAAS,EAAE,KAAK;oBAChB,WAAW,EAAE,QAAQ,CAAC,WAAY;oBAClC,kBAAkB,EAAE,IAAI;oBACxB,eAAe,EAAE,KAAK;oBACtB,SAAS,EAAE,IAAI;oBACf,WAAW,EAAE,KAAK;oBAClB,YAAY,EAAE,IAAI;oBAClB,mBAAmB,EAAE,EAAE;oBACvB,2BAA2B,EAAE,EAAE;oBAC/B,yBAAyB,EAAE,EAAE;iBAC9B,CAAC,CAAC,CAAC;gBAEJ,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,yBAAyB,EAAE,CAAC,CAAC,CAAC;YACjG,CAAC;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,CAAC,EAAE,OAAO,IAAI,yBAAyB,CAAC;YACpD,WAAW,CAAC,CAAC,EAAE,yBAAyB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACpE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YACvD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,EAAE,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAC,CAAC;IAEzC,MAAM,iBAAiB,GAAG,WAAW,CAAC,KAAK,EAAE,SAAiB,EAAE,cAA6B,OAAO,EAAmC,EAAE;QACvI,QAAQ,CAAC,iCAAiC,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC;QACxE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,MAAM,aAAa,GAAG,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,wBAAwB,CAAC,CAAC,CAAC,qBAAqB,CAAC,4BAA4B,CAAC;QACpJ,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,qBAAqB,CAAC;YAC/C,UAAU;YACV,aAAa;YACb,GAAG;SACJ,CAAC,CAAC;QACH,MAAM,iBAAiB,GAAG,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,aAAa,CAAC;QAClH,MAAM,qBAAqB,GAAG,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;QAC9H,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,wBAAwB,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAqD,CAAC;YAC/G,MAAM,UAAU,GAAG,MAAM,mBAAmB,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC;YACvE,MAAM,UAAU,GAAG,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;YACpE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;YAE5D,IAAI,QAAQ,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAClD,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACZ,GAAG,CAAC;oBACJ,SAAS,EAAE,KAAK;oBAChB,WAAW,EAAE,IAAI;oBACjB,YAAY,EAAE,QAAQ,CAAC,SAAS,IAAI,SAAS;oBAC7C,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,IAAI,EAAE;oBACvD,0BAA0B,EAAE,QAAQ,CAAC,0BAA0B,IAAI,EAAE;oBACrE,2BAA2B,EAAE,QAAQ,CAAC,2BAA2B,IAAI,EAAE;oBACvE,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB,IAAI,EAAE;iBACpE,CAAC,CAAC,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,mEAAmE;YACnE,0DAA0D;YAC1D,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC7C,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBACtC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAC1C,qBAAqB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAC5C,QAAQ,CAAC,kDAAkD,CAAC,CAAC;gBAC7D,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACZ,GAAG,CAAC;oBACJ,SAAS,EAAE,KAAK;oBAChB,WAAW,EAAE,QAAQ,CAAC,WAAY;oBAClC,kBAAkB,EAAE,IAAI;oBACxB,eAAe,EAAE,KAAK;oBACtB,SAAS,EAAE,IAAI;oBACf,WAAW,EAAE,KAAK;oBAClB,YAAY,EAAE,IAAI;oBAClB,mBAAmB,EAAE,EAAE;oBACvB,0BAA0B,EAAE,EAAE;oBAC9B,2BAA2B,EAAE,EAAE;oBAC/B,yBAAyB,EAAE,EAAE;iBAC9B,CAAC,CAAC,CAAC;gBACJ,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,IAAI,CAAC,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5F,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,MAAM,GAAG,GAAG,CAAwC,CAAC;YACrD,IAAI,GAAW,CAAC;YAChB,IAAI,GAAG,EAAE,IAAI,KAAK,iBAAiB,EAAE,CAAC;gBACpC,GAAG,GAAG,CAAC,CAAC,qBAAqB,CAAC,CAAC;YACjC,CAAC;iBAAM,IAAI,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClC,MAAM,IAAI,GAAG,CAAkE,CAAC;gBAChF,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,WAAW,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,iBAAiB,CAAC,CAAC;YAC/E,CAAC;iBAAM,CAAC;gBACN,GAAG,GAAG,GAAG,EAAE,OAAO,IAAI,CAAC,CAAC,iBAAiB,CAAC,CAAC;YAC7C,CAAC;YACD,WAAW,CAAC,CAAC,EAAE,+BAA+B,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7E,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YACvD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,EAAE,CAAC,qBAAqB,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;IAErD;;;;OAIG;IACH,MAAM,yBAAyB,GAAG,WAAW,CAAC,KAAK,EAAE,KAAa,EAAiB,EAAE;QACnF,QAAQ,CAAC,iCAAiC,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEvD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,wBAAwB,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAEzD,MAAM,EAAE,WAAW,EAAE,oBAAoB,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;YAEhF,eAAe,CAAC,WAAW,CAAC,CAAC;YAE7B,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YACjC,qBAAqB,CAAC,WAAW,CAAC,CAAC;YAEnC,IAAI,oBAAoB,EAAE,CAAC;gBACzB,MAAM,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;gBAChD,2BAA2B,CAAC,oBAAoB,CAAC,CAAC;YACpD,CAAC;YAED,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;gBAC3B,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YACzD,CAAC;YAED,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAC;YAE5E,OAAO,CAAC;gBACN,GAAG,gBAAgB;gBACnB,WAAW;gBACX,WAAW,EAAE,WAAW,CAAC,OAAO;gBAChC,aAAa,EAAE;oBACb,aAAa,EAAE,OAAO,CAAC,OAAO;oBAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,oBAAoB;oBACpB,cAAc;oBACd,kBAAkB,EAAE,OAAO,CAAC,SAAS,EAAE,YAAY;oBACnD,aAAa,EAAE,OAAO,CAAC,aAAa;iBACrC;gBACD,eAAe,EAAE,IAAI;aACtB,CAAC,CAAC;YAEH,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;YACjC,QAAQ,CAAC,mCAAmC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,CAAC,EAAE,OAAO,IAAI,+BAA+B,CAAC;YAC1D,WAAW,CAAC,CAAC,EAAE,+BAA+B,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAClE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YACvD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,EAAE,CAAC,YAAY,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC,CAAC;IAEtG,MAAM,MAAM,GAAG,WAAW,CAAC,GAAS,EAAE;QACpC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QAE7B,yEAAyE;QACzE,qEAAqE;QACrE,yEAAyE;QACzE,gEAAgE;QAChE,wEAAwE;QACxE,wEAAwE;QACxE,oEAAoE;QACpE,qEAAqE;QACrE,8BAA8B;QAC9B,wBAAwB,EAAE;aACvB,iBAAiB,EAAE;aACnB,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;YACX,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC,CAAC,CAAC;QAEL,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE7D,UAAU,EAAE,CAAC;QAEb,qFAAqF;QACrF,wBAAwB,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACpD,wBAAwB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC9C,2BAA2B,CAAC,IAAI,CAAC,CAAC;QAClC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE5B,YAAY,CAAC,KAAK,EAAE,CAAC;QACrB,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAE1B,iBAAiB,CAAC,OAAO,GAAG,KAAK,CAAC;QAElC,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC9C,CAAC,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,qBAAqB,EAAE,2BAA2B,CAAC,CAAC,CAAC;IAEnF;;;;;;;;OAQG;IACH,MAAM,gCAAgC,GAAG,WAAW,CAAC,GAAS,EAAE;QAC9D,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,2BAA2B,KAAK,SAAS;YACvD,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,2BAA2B,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP;;OAEG;IACH,MAAM,mBAAmB,GAAG,WAAW,CAAC,GAAS,EAAE;QACjD,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACZ,GAAG,CAAC;YACJ,eAAe,EAAE,IAAI;YACrB,kBAAkB,EAAE,KAAK;SAC1B,CAAC,CAAC,CAAC;IACN,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP;;OAEG;IACH,MAAM,mBAAmB,GAAG,WAAW,CAAC,CAAC,WAAoB,EAAQ,EAAE;QACrE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACZ,GAAG,CAAC;YACJ,kBAAkB,EAAE,WAAW;SAChC,CAAC,CAAC,CAAC;IACN,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,4EAA4E;IAC5E,0CAA0C;IAC1C,4EAA4E;IAE5E;;;;;;OAMG;IACH,MAAM,mBAAmB,GAAG,WAAW,CAAC,KAAK,IAAqB,EAAE;QAClE,kEAAkE;QAClE,IAAI,kBAAkB,CAAC,OAAO,EAAE,CAAC;YAC/B,MAAM,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;YAChF,OAAO,kBAAkB,CAAC,OAAO,CAAC;QACpC,CAAC;QAED,0EAA0E;QAC1E,qEAAqE;QACrE,yEAAyE;QACzE,oDAAoD;QACpD,MAAM,gBAAgB,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;QAEvD,4EAA4E;QAC5E,4EAA4E;QAC5E,wEAAwE;QACxE,8DAA8D;QAC9D,MAAM,2BAA2B,GAAG,GAAkB,EAAE;YACtD,MAAM,OAAO,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;YAC9C,IAAI,OAAO,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;gBAC5C,wBAAwB,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;gBACjD,qBAAqB,CAAC,OAAO,CAAC,CAAC;gBAC/B,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;gBAC/E,oBAAoB,CAAC,OAAO,CAAC,CAAC;gBAC9B,MAAM,CAAC,KAAK,CAAC,0EAA0E,CAAC,CAAC;gBACzF,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QAEF,4EAA4E;QAC5E,uEAAuE;QACvE,MAAM,qBAAqB,GAAG,KAAK,IAAqB,EAAE;YACxD,yEAAyE;YACzE,mEAAmE;YACnE,yEAAyE;YACzE,8CAA8C;YAC9C,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,MAAM,wBAAwB,EAAE,CAAC,aAAa,EAAE,CAAC;YAEhE,wEAAwE;YACxE,uEAAuE;YACvE,yEAAyE;YACzE,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAEpC,wBAAwB,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC5D,qBAAqB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAE1C,4DAA4D;YAC5D,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACZ,GAAG,CAAC;gBACJ,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC,CAAC,CAAC,CAAC;YAEJ,uEAAuE;YACvE,yEAAyE;YACzE,wEAAwE;YACxE,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC;gBACvC,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC,CAAC,CAAC;YAEH,MAAM,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;YACvE,oBAAoB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACzC,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC,CAAC;QAEF,uDAAuD;QACvD,EAAE;QACF,yEAAyE;QACzE,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,0EAA0E;QAC1E,wEAAwE;QACxE,2EAA2E;QAC3E,4EAA4E;QAC5E,mEAAmE;QACnE,MAAM,SAAS,GAAG,KAAK,IAAqB,EAAE;YAC5C,MAAM,KAAK,GAAG,OAAO,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7E,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;gBACpB,OAAO,qBAAqB,EAAE,CAAC;YACjC,CAAC;YACD,OAAO,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE;gBACpD,MAAM,OAAO,GAAG,2BAA2B,EAAE,CAAC;gBAC9C,IAAI,OAAO;oBAAE,OAAO,OAAO,CAAC;gBAC5B,OAAO,qBAAqB,EAAE,CAAC;YACjC,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,gEAAgE;QAChE,kBAAkB,CAAC,OAAO,GAAG,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACpD,kBAAkB,CAAC,OAAO,GAAG,IAAI,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,OAAO,MAAM,kBAAkB,CAAC,OAAO,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,+DAA+D;YAC/D,qEAAqE;YACrE,oEAAoE;YACpE,sEAAsE;YACtE,uEAAuE;YACvE,yEAAyE;YACzE,wEAAwE;YACxE,kEAAkE;YAClE,MAAM,aAAa,GAAG,+BAA+B,CAAC,KAAK,CAAC,CAAC;YAC7D,MAAM,UAAU,GAAG,mBAAmB,EAAE,CAAC;YAEzC,IAAI,aAAa,IAAI,CAAC,UAAU,EAAE,CAAC;gBACjC,MAAM,CAAC,IAAI,CAAC,8EAA8E,EAAE;oBAC1F,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;wBAC/B,CAAC,CAAC,KAAK,CAAC,sBAAsB;wBAC9B,CAAC,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;iBAC/D,CAAC,CAAC;gBACH,MAAM,EAAE,CAAC;YACX,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CACT,qFAAqF,EACrF;oBACE,aAAa;oBACb,UAAU;oBACV,MAAM,EAAE,aAAa;wBACnB,CAAC,CAAC,6EAA6E;wBAC/E,CAAC,CAAC,0FAA0F;iBAC/F,CACF,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,EAAE,CAAC,qBAAqB,EAAE,MAAM,EAAE,oBAAoB,EAAE,YAAY,CAAC,CAAC,CAAC;IAExE,8EAA8E;IAC9E,iFAAiF;IACjF,6CAA6C;IAC7C,SAAS,CAAC,GAAG,EAAE;QACb,sBAAsB,CAAC,OAAO,GAAG,mBAAmB,CAAC;QACrD,wBAAwB,EAAE,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;QACvE,+BAA+B,CAAC,mBAAmB,CAAC,CAAC;IACvD,CAAC,EAAE,CAAC,mBAAmB,EAAE,+BAA+B,CAAC,CAAC,CAAC;IAE3D,qDAAqD;IACrD,4EAA4E;IAC5E,sFAAsF;IACtF,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,OAAO,gBAAgB,KAAK,WAAW;YAAE,OAAO;QAEpD,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;QAC1D,mBAAmB,CAAC,OAAO,GAAG,OAAO,CAAC;QAEtC,OAAO,CAAC,SAAS,GAAG,CAAC,KAAmB,EAAE,EAAE;YAC1C,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;YAE/C,IAAI,IAAI,KAAK,iBAAiB,IAAI,WAAW,EAAE,CAAC;gBAC9C,4DAA4D;gBAC5D,8DAA8D;gBAC9D,gEAAgE;gBAChE,4DAA4D;gBAC5D,6DAA6D;gBAC7D,8DAA8D;gBAC9D,+DAA+D;gBAC/D,8DAA8D;gBAC9D,MAAM,CAAC,KAAK,CAAC,wEAAwE,CAAC,CAAC;gBACvF,eAAe,CAAC,WAAW,CAAC,CAAC;gBAC7B,wBAAwB,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;gBACrD,qBAAqB,CAAC,WAAW,CAAC,CAAC;gBACnC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;gBACtC,oBAAoB,CAAC,WAAW,CAAC,CAAC;YACpC,CAAC;YAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,QAAQ,CAAC,yCAAyC,CAAC,CAAC;gBACpD,UAAU,EAAE,CAAC;gBACb,YAAY,CAAC,KAAK,EAAE,CAAC;gBACrB,wBAAwB,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBACpD,2BAA2B,CAAC,IAAI,CAAC,CAAC;gBAClC,eAAe,CAAC,IAAI,CAAC,CAAC;gBACtB,wBAAwB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;gBAC9C,qBAAqB,CAAC,IAAI,CAAC,CAAC;gBAC5B,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC;QAEF,OAAO,GAAG,EAAE;YACV,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,mBAAmB,CAAC,OAAO,GAAG,IAAI,CAAC;QACrC,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,qBAAqB,EAAE,2BAA2B,EAAE,UAAU,EAAE,oBAAoB,EAAE,YAAY,CAAC,CAAC,CAAC;IAEzG,iDAAiD;IACjD,SAAS,CAAC,GAAG,EAAE;QACb,mCAAmC;QACnC,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,qEAAqE;QACrE,wDAAwD;QACxD,gEAAgE;QAChE,iEAAiE;QACjE,mEAAmE;QACnE,iCAAiC;QACjC,MAAM,iBAAiB,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;QAExD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,QAAQ,CAAC,8BAA8B,CAAC,CAAC;YACzC,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;YACjC,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,oDAAoD,CAAC,CAAC;QAC/D,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;QAEjC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACZ,GAAG,CAAC;YACJ,WAAW,EAAE,iBAAiB;YAC9B,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC,CAAC;QAEJ,wBAAwB,EAAE,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC;QAC3D,qBAAqB,CAAC,iBAAiB,CAAC,CAAC;QAEzC,iFAAiF;IACnF,CAAC,EAAE,CAAC,qBAAqB,EAAE,YAAY,CAAC,CAAC,CAAC;IAE1C,MAAM,KAAK,GAAG,OAAO,CAAyB,GAAG,EAAE,CAAC,CAAC;QACnD,IAAI;QACJ,YAAY;QAEZ,yBAAyB;QACzB,eAAe;QACf,wBAAwB;QACxB,YAAY;QACZ,eAAe;QACf,eAAe;QACf,MAAM;QAEN,wEAAwE;QACxE,mBAAmB;QACnB,sBAAsB;QAEtB,qBAAqB;QACrB,uBAAuB;QACvB,gBAAgB;QAEhB,0BAA0B;QAC1B,qBAAqB;QAErB,mBAAmB;QACnB,eAAe;QACf,iBAAiB;QAEjB,mCAAmC;QACnC,yBAAyB;QAEzB,oEAAoE;QACpE,gCAAgC;QAEhC,qBAAqB;QACrB,mBAAmB;QACnB,mBAAmB;QAEnB,YAAY;QACZ,gBAAgB;QAChB,wBAAwB;KACzB,CAAC,EAAE;QACF,IAAI;QACJ,YAAY;QACZ,MAAM;QACN,mBAAmB;QACnB,sBAAsB;QACtB,uBAAuB;QACvB,gBAAgB;QAChB,qBAAqB;QACrB,eAAe;QACf,iBAAiB;QACjB,yBAAyB;QACzB,gCAAgC;QAChC,mBAAmB;QACnB,mBAAmB;QACnB,gBAAgB;QAChB,wBAAwB;KACzB,CAAC,CAAC;IAEH,OAAO,KAAC,kBAAkB,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,YAAG,QAAQ,GAA+B,CAAC;AAC7F,CAAC,CAAC","sourcesContent":["import React, { createContext, useState, ReactNode, useMemo, useEffect, useCallback, useRef } from 'react';\nimport { startAuthentication } from '@simplewebauthn/browser';\nimport type { PublicKeyCredentialRequestOptionsJSON } from '@simplewebauthn/browser';\nimport {\n AuthenticationResponse,\n AuthIdentificationResponse,\n AuthenticationRequest,\n AuthMethod,\n AuthFactorLevel,\n AuthSessionPurpose,\n SessionType,\n isWildoBackendError,\n} from '@wildo-ai/saas-models';\nimport { getManualCallsHttpClient } from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { isAuthoritativeRefreshRejection, isRefreshDevLenient } from '~wildo-frontend-lib/core/requests/auth-refresh-resilience.frontend';\nimport { useResourceRegistry } from '~wildo-frontend-lib/core/resources/useResourceRegistry';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { resolveComponentLabel } from '~wildo-frontend-lib/core/i18n/component-label-resolution.utils';\nimport { LoggerFrontendService } from '~wildo-frontend-lib/core/monitoring/logger.frontend.service';\nimport { useError } from '~wildo-frontend-lib/core/errors/useError';\nimport { useApplication } from '~wildo-frontend-lib/core/runtime/useApplication';\nimport { useWebSocket } from '~wildo-frontend-lib/core/requests/websockets/useWebSocket';\nimport { useAnonymousSession } from '~wildo-frontend-lib/core/security/AnonymousSessionContext';\nimport {\n AuthState,\n EMPTY_AUTH_STATE,\n type UIFactorLevel,\n} from './security.frontend.schemas';\nimport {\n type SessionTokenStorage,\n PersistentSessionTokenStorage,\n} from './session-token-storage.frontend.service';\nimport { FrontendComponentType, MfaChallengeLabel, UserAuthLabel } from '@wildo-ai/presets-components-models';\n\nconst logger: LoggerFrontendService = LoggerFrontendService.getLogger();\nconst logDebug: (message: string, context?: Record<string, unknown>) => void = logger.debugByType('AuthSessionContext');\nlogger.setDebugTypeLogging('AuthSessionContext', false);\n\nfunction extractAuthErrorMessage(error: any, fallback: string): string {\n const guidanceExplanation = error?.wildoError?.userGuidance?.explanation\n \|\| error?.response?.data?.error?.userGuidance?.explanation;\n if (typeof guidanceExplanation === 'string' && guidanceExplanation.length > 0) {\n return guidanceExplanation;\n }\n\n const detailsMessage = error?.response?.data?.error?.details?.message;\n if (typeof detailsMessage === 'string' && detailsMessage.length > 0) {\n return detailsMessage;\n }\n\n const contextMessage = error?.context?.message;\n if (typeof contextMessage === 'string' && contextMessage.length > 0) {\n return contextMessage;\n }\n\n return error?.message \|\| fallback;\n}\n\n\n/*\n Auth Session Context\n * Manages authentication, session lifecycle, and WebSocket connection\n /\n\nexport interface AuthSessionContextType {\n // Auth state\n auth: AuthState;\n\n // Token storage strategy (persistent or ephemeral)\n tokenStorage: SessionTokenStorage;\n\n // Authentication methods\n identifyByEmail: (email: string) => Promise<AuthIdentificationResponse>;\n authenticateWithPassword: (email: string, password: string) => Promise<AuthenticationResponse>;\n authenticate: (request: AuthenticationRequest) => Promise<AuthenticationResponse>;\n getSessionState: (sessionId: string) => Promise<any>;\n isAuthenticated: () => boolean;\n logout: () => void;\n\n // OAuth2 methods\n initiateOAuth2Login: (providerRef: string, returnUrl?: string) => Promise<void>;\n handleAuthCodeExchange: (code: string) => Promise<void>;\n\n // Email verification (auto-login after registration)\n handleEmailVerification: (token: string, email: string) => Promise<void>;\n\n // Invitation acceptance. Returns the PASSKEY-at-accept WebAuthn challenge when the invitee\n // chose passkey and a session was issued (caller runs the ceremony + verify); empty otherwise.\n acceptInvitation: (params: { invitationToken: string; firstName?: string; lastName?: string; password?: string; credentialMethod?: AuthMethod }) => Promise<{ passkeyRegistrationOptions?: Record<string, unknown> }>;\n\n // Magic link verification (passwordless login)\n handleMagicLinkVerify: (token: string, email: string) => Promise<AuthenticationResponse>;\n\n // MFA second factor verification\n handleMfaVerify: (sessionId: string, method: AuthMethod, code: string) => Promise<AuthenticationResponse>;\n\n // Passkey authentication (first or second factor)\n handlePasskeyAuth: (sessionId: string, factorLevel?: UIFactorLevel) => Promise<AuthenticationResponse>;\n\n // One-off session exchange (W7.3b)\n handleOneOffTokenExchange: (token: string) => Promise<void>;\n\n // Cross-frontend handoff context (cross-app-jwt-propagation Step 5)\n /\n Clears `auth.crossFrontendHandoffContext` after the receiving component\n * has consumed it for navigation. The context is single-use by design —\n * it describes \"you just landed via a handoff\", not an ongoing session\n * property. Leaving it set indefinitely would (a) leak handoff metadata\n * to telemetry hooks long after the navigation completed and (b) confuse\n * any subsequent handoff that arrives without one of the optional\n * fields (the receiver would read stale source/target identifiers).\n * Auth_OneOffSession calls this on unmount in cross-frontend-handoff\n * mode (see component for sequencing rationale).\n /\n clearCrossFrontendHandoffContext: () => void;\n\n // Session management\n markSessionRestored: () => void;\n setSessionRestoring: (isRestoring: boolean) => void;\n\n // WebSocket\n connectWebSocket: (token: string, organizationId?: string \| null, consumableToken?: string \| null) => void;\n notifyOrganizationSwitch: (newOrgId: string, previousOrgId: string) => void;\n}\n\n/\n AuthSession Context\n * @internal - Use useAuthSession() hook instead of accessing this directly\n /\nexport const AuthSessionContext: React.Context<AuthSessionContextType \| undefined> = createContext<AuthSessionContextType \| undefined>(undefined);\n\nexport const AuthSessionProvider: React.FC<{\n children: ReactNode;\n tokenStorage?: SessionTokenStorage;\n}> = ({ children, tokenStorage: tokenStorageProp }) => {\n const tokenStorage = useMemo(\n () => tokenStorageProp ?? new PersistentSessionTokenStorage(),\n [tokenStorageProp]\n );\n const { setAuthToken: setResourcesAuthToken, setTokenRenewalHandler: setResourcesTokenRenewalHandler, setConsumableToken: setResourcesConsumableToken } = useResourceRegistry();\n const { handleError } = useError();\n const { tComponent, isReady } = useI18n({ component: [FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH, FrontendComponentType.PUBLIC_LAYOUTS_MFA_CHALLENGE] });\n const { appConfig } = useApplication();\n const { connect, disconnect, refreshAuth: refreshWebSocketAuth, switchOrganization: wsSwitchOrganization } = useWebSocket();\n const { clearAnonymousSession } = useAnonymousSession();\n const hasInitializedRef = useRef(false);\n const broadcastChannelRef = useRef<BroadcastChannel \| null>(null);\n const refreshInFlightRef = useRef<Promise<string> \| null>(null);\n // Holds the latest `tokenRenewalHandler` so `connectWebSocket` (defined far\n // earlier in this component) can hand the WebSocket layer a stable\n // `onAuthenticationError` callback without a definition-order / stale-closure\n // dependency on the handler. Kept current by the registration effect below.\n const tokenRenewalHandlerRef = useRef<(() => Promise<string>) \| null>(null);\n\n const [auth, setAuth] = useState<AuthState>({\n ...EMPTY_AUTH_STATE,\n accessToken: tokenStorage.getAccessToken(),\n // Auth-hardening Slice A Step 6 (2026-04-13) — `AuthState` no\n // longer carries a `refreshToken` field. The refresh token lives\n // exclusively in the `__wildo_refresh` `HttpOnly` cookie (set by\n // the backend, scoped `Path=/api/v1/auth`). `EphemeralSessionTokenStorage`\n // may still hold a value for one-off / test contexts via its own\n // in-memory slot but `AuthSessionContext` deliberately never\n // mirrors it into React state — the cookie is the sole source of\n // truth for the rotation channel.\n });\n\n /\n Auth-hardening Slice A Step 3 (2026-04-13) — `storeAuthTokens` now only\n * carries the access token. The refresh token travels via the\n * `__wildo_refresh` `HttpOnly` cookie (set by the backend on every issuance\n * / rotation, scoped `Path=/api/v1/auth`). We pass `null` to\n * `tokenStorage.storeTokens` so any stale localStorage refresh token from a\n * pre-migration session is wiped on the next call (and `EphemeralSessionTokenStorage`\n * stops accumulating an in-memory value that nothing reads).\n /\n const storeAuthTokens = (accessToken: string \| null): void => {\n tokenStorage.storeTokens(accessToken, null);\n if (accessToken) {\n clearAnonymousSession();\n }\n };\n\n /\n Derive WebSocket URL from appConfig runtime endpoints\n \n IMPORTANT: Always use publicUrl (never internalUrl) since browsers cannot access\n * internal Kubernetes service URLs. The publicUrl is the Traefik ingress URL\n * that the browser can reach.\n \n Returns null if URL cannot be derived - WebSocket should not connect in this case.\n /\n const deriveWebSocketUrl = useCallback((): string \| null => {\n if (!appConfig?.runtime?.endPoints?.main_backend_api) {\n logger.warn('WebSocket: Cannot derive URL - appConfig.runtime.endPoints.main_backend_api not available');\n return null;\n }\n\n const backendUrl = appConfig.runtime.endPoints.main_backend_api;\n // CRITICAL: Always use publicUrl for WebSocket connections from browser\n // internalUrl is only accessible within the Kubernetes cluster\n const urlString = backendUrl.publicUrl;\n\n if (!urlString) {\n logger.warn('WebSocket: Cannot derive URL - publicUrl not available in main_backend_api config');\n return null;\n }\n\n // Convert http:// to ws:// and https:// to wss://\n // IMPORTANT: Do NOT append /socket.io to the URL - Socket.IO automatically\n // uses /socket.io as the engine.io path. If we include it here, Socket.IO\n // interprets it as a namespace, causing \"Invalid namespace\" errors.\n const wsUrl = urlString.replace(/^http/, 'ws');\n return wsUrl;\n }, [appConfig]);\n\n /\n Connect WebSocket with current authentication token\n * Only connects if URL is available and token is valid\n /\n const connectWebSocket = useCallback((token: string, organizationId?: string \| null, consumableToken?: string \| null): void => {\n if (!token) {\n logDebug('WebSocket: Cannot connect - no token provided');\n return;\n }\n\n const wsUrl = deriveWebSocketUrl();\n\n if (!wsUrl) {\n logDebug('WebSocket: Cannot connect - URL is not available');\n return;\n }\n\n try {\n connect({\n url: wsUrl,\n token,\n organizationId: organizationId \|\| undefined,\n consumableToken: consumableToken \|\| undefined,\n autoReconnect: true,\n // Base retry delay only — the transport grows it exponentially toward its\n // 30s cap (see WebSocketContext.performActualConnect). A large budget plus\n // the connectivity supervisor (online / visibility / watchdog re-arm) means\n // the socket recovers indefinitely instead of dying after a handful of\n // attempts, so these are resilient defaults rather than a hard ceiling.\n reconnectInterval: 1000,\n maxReconnectAttempts: 15,\n // Self-heal an expired access token WITHOUT depending on HTTP traffic or\n // window focus. When the handshake is rejected for auth, the WS layer\n // calls this; `tokenRenewalHandler` performs the resilient refresh and,\n // on success, seeds the fresh token back into the socket via\n // `refreshWebSocketAuth`, so the next reconnect handshake succeeds. This\n // keeps a backgrounded/unfocused tab's real-time background jobs flowing\n // across token expiry. Read via ref because the handler is defined after\n // this callback (see `tokenRenewalHandlerRef`).\n onAuthenticationError: () => tokenRenewalHandlerRef.current?.(),\n });\n logDebug('WebSocket connection initiated', { wsUrl });\n } catch (error) {\n logger.warn('Failed to connect WebSocket', { error });\n }\n }, [connect, deriveWebSocketUrl]);\n\n /\n Notify WebSocket of organization switch\n /\n const notifyOrganizationSwitch = useCallback((newOrgId: string, previousOrgId: string): void => {\n wsSwitchOrganization(newOrgId, previousOrgId);\n }, [wsSwitchOrganization]);\n\n const identifyByEmail = async (email: string): Promise<AuthIdentificationResponse> => {\n setAuth(a => ({ ...a, isLoading: true, error: null }));\n logDebug('Identifying user by email', { email });\n try {\n const resp = await getManualCallsHttpClient().identifyByEmail(email);\n\n logDebug('User identification successful', { sessionId: resp.sessionId });\n\n setAuth(a => ({\n ...a,\n isLoading: false,\n identification: resp,\n sessionId: resp.sessionId,\n purpose: a.purpose ?? AuthSessionPurpose.LOGIN,\n }));\n\n return resp as AuthIdentificationResponse;\n } catch (e: any) {\n const msg = extractAuthErrorMessage(e, 'Identification failed');\n handleError(e, 'Identification failed', { email, message: msg });\n setAuth(a => ({ ...a, isLoading: false, error: msg }));\n throw e;\n }\n };\n\n const authenticateWithPassword = async (email: string, password: string): Promise<AuthenticationResponse> => {\n setAuth(a => ({ ...a, isLoading: true, error: null }));\n logDebug('Authenticating with password', { email, sessionId: auth.sessionId });\n try {\n const sessionId = auth.sessionId;\n if (!sessionId) {\n const error = new Error('No active session. Please identify user first.');\n logger.warn('Authentication attempted without session', { email });\n throw error;\n }\n\n // Use the general authenticate endpoint with proper request structure\n const authRequest: AuthenticationRequest = {\n sessionId,\n method: AuthMethod.PASSWORD,\n factorLevel: AuthFactorLevel.FIRST,\n password,\n rememberMe: false,\n requestedIntegrations: []\n };\n\n const resp = await getManualCallsHttpClient().authenticate(authRequest);\n\n if (resp.requiresMFA && !resp.accessToken) {\n setAuth(a => ({\n ...a,\n isLoading: false,\n mfaRequired: true,\n mfaSessionId: resp.sessionId \|\| sessionId,\n availableMfaMethods: resp.availableMFAMethods \|\| [],\n availableEnrollmentMethods: resp.availableEnrollmentMethods \|\| [],\n enrolledSecondFactorMethods: resp.enrolledSecondFactorMethods \|\| [],\n usableSecondFactorMethods: resp.usableSecondFactorMethods \|\| [],\n }));\n return resp as AuthenticationResponse;\n }\n\n const accessToken = resp.accessToken \|\| null;\n\n storeAuthTokens(accessToken);\n\n if (accessToken) {\n getManualCallsHttpClient().setAuthToken(accessToken);\n setResourcesAuthToken(accessToken);\n }\n\n logDebug('Authentication successful', { success: resp.success, hasAccessToken: !!accessToken });\n\n if (resp.success && accessToken) {\n setAuth(a => ({\n ...a,\n isLoading: false,\n accessToken,\n isRestoringSession: true,\n sessionRestored: false,\n sessionId: null,\n }));\n\n hasInitializedRef.current = true;\n } else {\n setAuth(a => ({\n ...a,\n isLoading: false,\n accessToken,\n sessionId: resp.success ? null : sessionId,\n }));\n }\n\n return resp as AuthenticationResponse;\n } catch (e: any) {\n const msg = extractAuthErrorMessage(e, 'Authentication failed');\n handleError(e, 'Authentication failed', { email, message: msg });\n setAuth(a => ({ ...a, isLoading: false, error: msg }));\n throw e;\n }\n };\n\n const authenticate = async (request: AuthenticationRequest): Promise<AuthenticationResponse> => {\n setAuth(a => ({ ...a, isLoading: true, error: null }));\n logDebug('Authenticating', { method: request.method, sessionId: request.sessionId \|\| auth.sessionId });\n try {\n const sessionId = request.sessionId \|\| auth.sessionId;\n if (!sessionId) {\n const error = new Error('No active session. Please identify user first.');\n logger.warn('Authentication attempted without session', { method: request.method });\n throw error;\n }\n\n const withSession = { ...request, sessionId } as AuthenticationRequest;\n const resp = await getManualCallsHttpClient().authenticate(withSession);\n\n if (resp.requiresMFA && !resp.accessToken) {\n setAuth(a => ({\n ...a,\n isLoading: false,\n mfaRequired: true,\n mfaSessionId: resp.sessionId \|\| sessionId,\n availableMfaMethods: resp.availableMFAMethods \|\| [],\n availableEnrollmentMethods: resp.availableEnrollmentMethods \|\| [],\n enrolledSecondFactorMethods: resp.enrolledSecondFactorMethods \|\| [],\n usableSecondFactorMethods: resp.usableSecondFactorMethods \|\| [],\n }));\n return resp;\n }\n\n const accessToken = resp.accessToken \|\| null;\n\n storeAuthTokens(accessToken);\n\n if (accessToken) {\n getManualCallsHttpClient().setAuthToken(accessToken);\n setResourcesAuthToken(accessToken);\n }\n\n logDebug('Authentication successful', { success: resp.success, hasAccessToken: !!accessToken, method: request.method });\n\n if (resp.success && accessToken) {\n setAuth(a => ({\n ...a,\n isLoading: false,\n accessToken,\n isRestoringSession: true,\n sessionRestored: false,\n sessionId: null,\n }));\n\n hasInitializedRef.current = true;\n } else {\n setAuth(a => ({\n ...a,\n isLoading: false,\n accessToken,\n sessionId: resp.success ? null : sessionId,\n }));\n }\n\n return resp;\n } catch (e: any) {\n const msg = extractAuthErrorMessage(e, 'Authentication failed');\n handleError(e, 'Authentication failed', { method: request.method, message: msg });\n setAuth(a => ({ ...a, isLoading: false, error: msg }));\n throw e;\n }\n };\n\n const getSessionState = async (sessionId: string): Promise<any> => {\n logDebug('Getting session state', { sessionId });\n try {\n const sessionState = await getManualCallsHttpClient().getSessionState(sessionId);\n setAuth(a => ({ ...a, sessionState, purpose: sessionState?.purpose ?? a.purpose }));\n logDebug('Session state retrieved', { sessionId });\n return sessionState;\n } catch (e: any) {\n handleError(e, 'Failed to get session state', { sessionId });\n throw e;\n }\n };\n\n const isAuthenticated = (): boolean => {\n return !!auth.accessToken;\n };\n\n /\n Initiate OAuth2 login by redirecting to the provider's authorization page.\n * Calls GET /auth/oauth2/authorize/:providerRef to get the authorization URL,\n * then performs a full-page redirect to that URL.\n \n Browser-only flow. The framework targets web stacks exclusively (the engine's\n * value prop is sharing TypeScript across browser-rendered surfaces — SAAS_APP,\n * STATIC_WEBSITE, TECH_DOC), so no native-SDK / Capacitor / Electron variants\n * exist for this method.\n /\n const initiateOAuth2Login = useCallback(async (providerRef: string, returnUrl?: string): Promise<void> => {\n logDebug('Initiating OAuth2 login', { providerRef, returnUrl });\n setAuth(a => ({ ...a, isLoading: true, error: null }));\n try {\n const { authorizationUrl } = await getManualCallsHttpClient().getOAuth2AuthorizationUrl(providerRef, returnUrl);\n logDebug('Redirecting to OAuth2 provider', { providerRef, authorizationUrl });\n window.location.href = authorizationUrl;\n } catch (e: any) {\n const msg = e?.message \|\| 'Failed to initiate OAuth2 login';\n handleError(e, 'OAuth2 login initiation failed', { providerRef, message: msg });\n setAuth(a => ({ ...a, isLoading: false, error: msg }));\n throw e;\n }\n }, [handleError]);\n\n /\n Exchange a single-use AUTH_CODE_EXCHANGE consumable token for a JWT pair\n * via `POST /auth/token/exchange`.\n \n Renamed from `handleOAuth2Callback` in cross-app-jwt-propagation\n * Step 5's deferred refactor pass — the method handles BOTH issuance\n * flows that mint AUTH_CODE_EXCHANGE codes, so the OAuth2-specific\n * naming was misleading:\n \n - OAuth2 callback (`AuthPage_AuthCallback` route): the backend\n * OAuth2 callback handler mints a code AFTER the user returns from\n * the IdP. The exchange response carries `{accessToken, expiresIn}`\n * only — the rotated refresh token lives in the `Set-Cookie:\n * __wildo_refresh=…` header (Auth-hardening A-Step 6 cookie-only\n * contract; pre-A-Step-6 the body also carried `refreshToken`).\n * - Cross-frontend handoff (`AuthPage_AuthExchange` route, mounted\n * at `CommonRoutePaths.authExchange = '/auth/exchange'`): the backend\n * `crossFrontendHandoff()` handler mints a code via the same\n * AUTH_CODE_EXCHANGE primitive. The exchange response ALSO carries\n * `{returnPath, sourceFrontendServiceName, targetServiceKey}` (see\n * `TokenExchangeResponseSchema`), surfaced into\n * `auth.crossFrontendHandoffContext` for the receiving component\n * (`Auth_OneOffSession` in `cross-frontend-handoff` mode) to drive\n * post-exchange navigation.\n \n Discrimination (\"did this code come from a handoff?\") is purely by\n * presence of `returnPath` in the response — see `TokenExchangeResponseSchema`\n * JSDoc for the load-bearing `typeof returnPath === 'string'` invariant.\n \n Browser-only flow. The method is intentionally decoupled from React\n * Router navigation — it accepts a `code` string and performs the\n * exchange; the page-level component extracts the code from URL params\n * and calls this. The framework targets web stacks exclusively, so no\n * native deep-link variant exists.\n /\n const handleAuthCodeExchange = useCallback(async (code: string): Promise<void> => {\n logDebug('Handling AUTH_CODE_EXCHANGE token (OAuth2 callback or cross-frontend handoff)', { codeLength: code.length });\n setAuth(a => ({ ...a, isLoading: true, error: null }));\n try {\n const response = await getManualCallsHttpClient().exchangeAuthCode(code);\n const { accessToken, returnPath, sourceFrontendServiceName, targetServiceKey } = response;\n\n storeAuthTokens(accessToken);\n getManualCallsHttpClient().setAuthToken(accessToken);\n setResourcesAuthToken(accessToken);\n\n // Cross-frontend-handoff signal: the issuer (cross-app-jwt-propagation\n // Step 2) puts `returnPath` into the consumable-token metadata; the\n // exchange handler (Step 5) round-trips it back here. OAuth2-callback\n // codes do NOT carry it, so a missing field correctly leaves the\n // context undefined for the OAuth2 path. The receiving component\n // (`Auth_OneOffSession` mounted at `/auth/exchange` in\n // cross-frontend-handoff mode) reads `crossFrontendHandoffContext`\n // and navigates accordingly.\n //\n // Discriminator invariant: `typeof returnPath === 'string'` is the\n // ONLY signal that distinguishes a handoff-issued exchange from an\n // OAuth2-callback exchange (no `kind` discriminator field is sent\n // over the wire — see `TokenExchangeResponseSchema` rationale in\n // `cross-frontend-handoff.shared.dto.schemas.ts`). The backend\n // controller is contractually required to use omit-when-absent (NOT\n // emit `null` or `''`) for OAuth2 codes; the\n // `TokenExchangeResponseSchema.parse()` call in `tokenExchange()`\n // and the integration test in\n // `cross-frontend-handoff-token-exchange.integration.test.ts`\n // jointly enforce this. If both safety nets ever regress, this\n // discriminator silently flips to false-positives and OAuth2 users\n // would land with a stale handoff context.\n const crossFrontendHandoffContext = typeof returnPath === 'string'\n ? {\n returnPath,\n ...(sourceFrontendServiceName !== undefined && { sourceFrontendServiceName }),\n ...(targetServiceKey !== undefined && { targetServiceKey }),\n }\n : undefined;\n\n logDebug('OAuth2 callback successful, tokens stored', {\n isCrossFrontendHandoff: crossFrontendHandoffContext !== undefined,\n });\n\n // Update auth state — mark as restoring so UserOrgsContext picks up and loads user data\n setAuth(a => ({\n ...a,\n isLoading: false,\n accessToken,\n isRestoringSession: true,\n sessionRestored: false,\n // Clear any previous session (OAuth2 bypasses identify/authenticate flow)\n sessionId: null,\n crossFrontendHandoffContext,\n }));\n\n hasInitializedRef.current = true;\n } catch (e: any) {\n const msg = e?.message \|\| 'OAuth2 authentication failed';\n handleError(e, 'OAuth2 callback failed', { message: msg });\n setAuth(a => ({ ...a, isLoading: false, error: msg }));\n throw e;\n }\n }, [setResourcesAuthToken, handleError]);\n\n /\n Handle email verification by exchanging the verification token for JWT tokens.\n * Called from the /confirm-email page after the user clicks the verification link.\n * Flow: Email link → /confirm-email?token=xxx → this method\n \n On success, stores tokens and updates auth state (auto-login).\n /\n const handleEmailVerification = useCallback(async (token: string, email: string): Promise<void> => {\n logDebug('Handling email verification', { tokenLength: token.length, email });\n setAuth(a => ({ ...a, isLoading: true, error: null }));\n try {\n const response = await getManualCallsHttpClient().verifyEmail(token, email);\n\n if (response.accessToken) {\n storeAuthTokens(response.accessToken);\n getManualCallsHttpClient().setAuthToken(response.accessToken);\n setResourcesAuthToken(response.accessToken);\n\n logDebug('Email verification successful, tokens stored');\n\n setAuth(a => ({\n ...a,\n isLoading: false,\n accessToken: response.accessToken!,\n isRestoringSession: true,\n sessionRestored: false,\n sessionId: null,\n }));\n\n hasInitializedRef.current = true;\n } else {\n logDebug('Email verification succeeded but tokens not issued — pipeline requires further steps', {\n state: response.state,\n nextStep: response.nextStep,\n });\n\n setAuth(a => ({\n ...a,\n isLoading: false,\n sessionId: null,\n mfaRequired: response.requiresMFA ?? false,\n mfaSessionId: response.requiresMFA ? (response.sessionId ?? null) : null,\n availableMfaMethods: [],\n availableEnrollmentMethods: response.availableEnrollmentMethods \|\| [],\n enrolledSecondFactorMethods: [],\n usableSecondFactorMethods: [],\n error: null,\n }));\n }\n } catch (e: any) {\n const msg = e?.message \|\| 'Email verification failed';\n handleError(e, 'Email verification failed', { message: msg });\n setAuth(a => ({ ...a, isLoading: false, error: msg }));\n throw e;\n }\n }, [setResourcesAuthToken, handleError]);\n\n const acceptInvitation = useCallback(async (\n params: { invitationToken: string; firstName?: string; lastName?: string; password?: string; credentialMethod?: AuthMethod },\n ): Promise<{ passkeyRegistrationOptions?: Record<string, unknown> }> => {\n logDebug('Handling invitation acceptance', { hasPassword: !!params.password, credentialMethod: params.credentialMethod });\n setAuth(a => ({ ...a, isLoading: true, error: null }));\n try {\n const response = await getManualCallsHttpClient().acceptInvitation(params);\n\n if (response.accessToken) {\n storeAuthTokens(response.accessToken);\n getManualCallsHttpClient().setAuthToken(response.accessToken);\n setResourcesAuthToken(response.accessToken);\n\n logDebug('Invitation acceptance successful, tokens stored');\n\n setAuth(a => ({\n ...a,\n isLoading: false,\n accessToken: response.accessToken!,\n isRestoringSession: true,\n sessionRestored: false,\n sessionId: null,\n mfaRequired: false,\n mfaSessionId: null,\n availableMfaMethods: [],\n availableEnrollmentMethods: [],\n enrolledSecondFactorMethods: [],\n usableSecondFactorMethods: [],\n error: null,\n }));\n\n hasInitializedRef.current = true;\n } else {\n logDebug('Invitation acceptance requires further auth steps', {\n state: response.state,\n nextStep: response.nextStep,\n });\n\n setAuth(a => ({\n ...a,\n isLoading: false,\n sessionId: null,\n mfaRequired: response.requiresMFA ?? false,\n mfaSessionId: response.requiresMFA ? (response.sessionId ?? null) : null,\n availableMfaMethods: [],\n availableEnrollmentMethods: response.availableEnrollmentMethods \|\| [],\n enrolledSecondFactorMethods: [],\n usableSecondFactorMethods: [],\n error: null,\n }));\n }\n\n // PASSKEY-enroll-at-accept: hand the pre-generated WebAuthn registration challenge back to\n // the caller so it can run the browser ceremony and complete it against the authenticated\n // `/auth/passkey/register/verify` route (the access token was just set on the HTTP client\n // above). Present only on the passkey path's session-issued branch; undefined otherwise.\n return { passkeyRegistrationOptions: response.passkeyRegistrationOptions };\n } catch (e: any) {\n const msg = e?.message \|\| 'Invitation acceptance failed';\n handleError(e, 'Invitation acceptance failed', { message: msg });\n setAuth(a => ({ ...a, isLoading: false, error: msg }));\n throw e;\n }\n }, [setResourcesAuthToken, handleError]);\n\n /\n Handle magic link verification — verifies the token and auto-logs in the user.\n * Called from the /auth/magic-link/verify page after the user clicks the email link.\n * Returns the full AuthenticationResponse so the page can handle MFA-required state.\n /\n const handleMagicLinkVerify = useCallback(async (token: string, email: string): Promise<AuthenticationResponse> => {\n logDebug('Handling magic link verification', { tokenLength: token.length, email });\n setAuth(a => ({ ...a, isLoading: true, error: null }));\n try {\n const response = await getManualCallsHttpClient().magicLinkVerify(token, email);\n\n if (response.requiresMFA && !response.accessToken) {\n setAuth(a => ({\n ...a,\n isLoading: false,\n mfaRequired: true,\n mfaSessionId: response.sessionId \|\| null,\n availableMfaMethods: response.availableMFAMethods \|\| [],\n availableEnrollmentMethods: response.availableEnrollmentMethods \|\| [],\n enrolledSecondFactorMethods: response.enrolledSecondFactorMethods \|\| [],\n usableSecondFactorMethods: response.usableSecondFactorMethods \|\| [],\n }));\n return response;\n }\n\n // Auth-hardening Slice A Step 6 (2026-04-13): the cookie-only\n // contract means `response.refreshToken` no longer exists on the\n // wire — the rotated value lives in the `Set-Cookie:\n // __wildo_refresh=…` response header (HttpOnly, JS-invisible).\n // Gate on `success && accessToken` only.\n if (response.success && response.accessToken) {\n storeAuthTokens(response.accessToken);\n getManualCallsHttpClient().setAuthToken(response.accessToken);\n setResourcesAuthToken(response.accessToken);\n\n logDebug('Magic link verification successful, tokens stored');\n\n setAuth(a => ({\n ...a,\n isLoading: false,\n accessToken: response.accessToken!,\n isRestoringSession: true,\n sessionRestored: false,\n sessionId: null,\n }));\n\n hasInitializedRef.current = true;\n } else {\n setAuth(a => ({ ...a, isLoading: false }));\n }\n\n return response;\n } catch (e: any) {\n const msg = e?.message \|\| 'Magic link verification failed';\n handleError(e, 'Magic link verification failed', { message: msg });\n setAuth(a => ({ ...a, isLoading: false, error: msg }));\n throw e;\n }\n }, [setResourcesAuthToken, handleError]);\n\n /\n Handle MFA second-factor verification.\n * Dispatches to the appropriate OTP verify method based on the selected auth method.\n * On success, stores tokens and updates auth state (auto-login).\n /\n const handleMfaVerify = useCallback(async (sessionId: string, method: AuthMethod, code: string): Promise<AuthenticationResponse> => {\n logDebug('Handling MFA verification', { sessionId, method });\n setAuth(a => ({ ...a, isLoading: true, error: null }));\n try {\n const client = getManualCallsHttpClient();\n const response = await client.authenticate({\n sessionId,\n method,\n factorLevel: AuthFactorLevel.SECOND,\n token: code,\n rememberMe: false,\n requestedIntegrations: [],\n } as AuthenticationRequest);\n\n // Auth-hardening Slice A Step 6 (2026-04-13): cookie-only contract\n // — see the magic-link gate above for the full rationale.\n if (response.success && response.accessToken) {\n storeAuthTokens(response.accessToken);\n client.setAuthToken(response.accessToken);\n setResourcesAuthToken(response.accessToken);\n\n logDebug('MFA verification successful, tokens stored');\n\n setAuth(a => ({\n ...a,\n isLoading: false,\n accessToken: response.accessToken!,\n isRestoringSession: true,\n sessionRestored: false,\n sessionId: null,\n mfaRequired: false,\n mfaSessionId: null,\n availableMfaMethods: [],\n enrolledSecondFactorMethods: [],\n usableSecondFactorMethods: [],\n }));\n\n hasInitializedRef.current = true;\n } else {\n setAuth(a => ({ ...a, isLoading: false, error: response.error \|\| 'MFA verification failed' }));\n }\n\n return response;\n } catch (e: any) {\n const msg = e?.message \|\| 'MFA verification failed';\n handleError(e, 'MFA verification failed', { method, message: msg });\n setAuth(a => ({ ...a, isLoading: false, error: msg }));\n throw e;\n }\n }, [setResourcesAuthToken, handleError]);\n\n const handlePasskeyAuth = useCallback(async (sessionId: string, factorLevel: UIFactorLevel = 'first'): Promise<AuthenticationResponse> => {\n logDebug('Handling passkey authentication', { sessionId, factorLevel });\n setAuth(a => ({ ...a, isLoading: true, error: null }));\n const componentType = factorLevel === 'first' ? FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH : FrontendComponentType.PUBLIC_LAYOUTS_MFA_CHALLENGE;\n const t = (key: string) => resolveComponentLabel({\n tComponent,\n componentType,\n key,\n });\n const passkeyErrorLabel = factorLevel === 'first' ? UserAuthLabel.PASSKEY_ERROR : MfaChallengeLabel.PASSKEY_ERROR;\n const passkeyCancelledLabel = factorLevel === 'first' ? UserAuthLabel.PASSKEY_CANCELLED : MfaChallengeLabel.PASSKEY_CANCELLED;\n try {\n const client = getManualCallsHttpClient();\n const options = await client.passkeyAuthOptions(sessionId) as unknown as PublicKeyCredentialRequestOptionsJSON;\n const credential = await startAuthentication({ optionsJSON: options });\n const verifyBody = { response: credential, sessionId, factorLevel };\n const response = await client.passkeyAuthVerify(verifyBody);\n\n if (response.requiresMFA && !response.accessToken) {\n setAuth(a => ({\n ...a,\n isLoading: false,\n mfaRequired: true,\n mfaSessionId: response.sessionId \|\| sessionId,\n availableMfaMethods: response.availableMFAMethods \|\| [],\n availableEnrollmentMethods: response.availableEnrollmentMethods \|\| [],\n enrolledSecondFactorMethods: response.enrolledSecondFactorMethods \|\| [],\n usableSecondFactorMethods: response.usableSecondFactorMethods \|\| [],\n }));\n return response;\n }\n\n // Auth-hardening Slice A Step 6 (2026-04-13): cookie-only contract\n // — see the magic-link gate above for the full rationale.\n if (response.success && response.accessToken) {\n storeAuthTokens(response.accessToken);\n client.setAuthToken(response.accessToken);\n setResourcesAuthToken(response.accessToken);\n logDebug('Passkey authentication successful, tokens stored');\n setAuth(a => ({\n ...a,\n isLoading: false,\n accessToken: response.accessToken!,\n isRestoringSession: true,\n sessionRestored: false,\n sessionId: null,\n mfaRequired: false,\n mfaSessionId: null,\n availableMfaMethods: [],\n availableEnrollmentMethods: [],\n enrolledSecondFactorMethods: [],\n usableSecondFactorMethods: [],\n }));\n hasInitializedRef.current = true;\n } else {\n setAuth(a => ({ ...a, isLoading: false, error: response.error \|\| t(passkeyErrorLabel) }));\n }\n return response;\n } catch (e: unknown) {\n const err = e as { name?: string; message?: string };\n let msg: string;\n if (err?.name === 'NotAllowedError') {\n msg = t(passkeyCancelledLabel);\n } else if (isWildoBackendError(e)) {\n const wErr = e as { userGuidance?: { explanation?: string }; message?: string };\n msg = wErr.userGuidance?.explanation \|\| wErr.message \|\| t(passkeyErrorLabel);\n } else {\n msg = err?.message \|\| t(passkeyErrorLabel);\n }\n handleError(e, 'Passkey authentication failed', { sessionId, message: msg });\n setAuth(a => ({ ...a, isLoading: false, error: msg }));\n throw e;\n }\n }, [setResourcesAuthToken, handleError, tComponent]);\n\n /\n W7.3b: Exchange a consumable token for a one-off session.\n * Authenticates via the backend exchange endpoint, sets up HTTP clients\n * with both JWT and consumable token headers, and connects WebSocket.\n /\n const handleOneOffTokenExchange = useCallback(async (token: string): Promise<void> => {\n logDebug('Handling one-off token exchange', { tokenLength: token.length });\n setAuth(a => ({ ...a, isLoading: true, error: null }));\n\n try {\n const client = getManualCallsHttpClient();\n const response = await client.exchangeOneOffToken(token);\n\n const { accessToken, consumableTokenValue, tokenExpiresAt, context } = response;\n\n storeAuthTokens(accessToken);\n\n client.setAuthToken(accessToken);\n setResourcesAuthToken(accessToken);\n\n if (consumableTokenValue) {\n client.setConsumableToken(consumableTokenValue);\n setResourcesConsumableToken(consumableTokenValue);\n }\n\n if (context.organizationId) {\n tokenStorage.setOrganizationId(context.organizationId);\n }\n\n connectWebSocket(accessToken, context.organizationId, consumableTokenValue);\n\n setAuth({\n ...EMPTY_AUTH_STATE,\n accessToken,\n sessionType: SessionType.ONE_OFF,\n oneOffContext: {\n originTokenId: context.tokenId,\n tokenType: context.tokenType,\n consumableTokenValue,\n tokenExpiresAt,\n scopedInitiatorIds: context.targeting?.initiatorIds,\n applicationId: context.applicationId,\n },\n sessionRestored: true,\n });\n\n hasInitializedRef.current = true;\n logDebug('One-off token exchange successful', { tokenType: context.tokenType });\n } catch (e: any) {\n const msg = e?.message \|\| 'One-off token exchange failed';\n handleError(e, 'One-off token exchange failed', { message: msg });\n setAuth(a => ({ ...a, isLoading: false, error: msg }));\n throw e;\n }\n }, [tokenStorage, setResourcesAuthToken, setResourcesConsumableToken, connectWebSocket, handleError]);\n\n const logout = useCallback((): void => {\n logDebug('Logging out user');\n\n // Auth-hardening Slice A Step 3 (2026-04-13) — refresh token now travels\n // via the `__wildo_refresh` `HttpOnly` cookie. JS can't read it (and\n // doesn't need to): the cookie auto-attaches via `withCredentials: true`\n // on `/auth/` because of the `authCookiesInterceptor`. Backend\n // `logout()` handler dual-reads (cookie-first, body-fallback per A-K-5)\n // and ALWAYS clears the cookie, so this fire-and-forget call works even\n // when the JS access token was lost (e.g., post tab crash). We keep\n // this unconditional now — there's no JS-visible \"is there a session\n // to revoke?\" signal anymore.\n getManualCallsHttpClient()\n .logoutFromBackend()\n .catch((e) => {\n logger.warn('Backend logout call failed (token revocation)', { error: e });\n });\n\n broadcastChannelRef.current?.postMessage({ type: 'LOGOUT' });\n\n disconnect();\n\n // Clear consumable token from HTTP client singletons (prevents stale header leakage)\n getManualCallsHttpClient().setConsumableToken(null);\n getManualCallsHttpClient().setAuthToken(null);\n setResourcesConsumableToken(null);\n setResourcesAuthToken(null);\n\n tokenStorage.clear();\n setAuth(EMPTY_AUTH_STATE);\n\n hasInitializedRef.current = false;\n\n logger.info('User logged out successfully');\n }, [disconnect, tokenStorage, setResourcesAuthToken, setResourcesConsumableToken]);\n\n /*\n Single-use clear for the cross-frontend-handoff context.\n \n Called by `Auth_OneOffSession` on unmount in cross-frontend-handoff\n * mode (which happens AFTER the post-exchange `<Navigate to>` resolves\n * and React unmounts the receiver). Unmount-cleanup timing is critical:\n * clearing earlier would race the `useMemo(targetUrl, [auth.crossFrontendHandoffContext, …])`\n * recomputation and could navigate the user to home instead of `returnPath`.\n /\n const clearCrossFrontendHandoffContext = useCallback((): void => {\n setAuth(a => (a.crossFrontendHandoffContext === undefined\n ? a\n : { ...a, crossFrontendHandoffContext: undefined }));\n }, []);\n\n /\n Mark session as restored (called by UserOrgsContext when it finishes loading user data)\n /\n const markSessionRestored = useCallback((): void => {\n setAuth(a => ({\n ...a,\n sessionRestored: true,\n isRestoringSession: false,\n }));\n }, []);\n\n /\n Set session restoring state (called by UserOrgsContext)\n /\n const setSessionRestoring = useCallback((isRestoring: boolean): void => {\n setAuth(a => ({\n ...a,\n isRestoringSession: isRestoring,\n }));\n }, []);\n\n // ─────────────────────────────────────────────────────────────────────────\n // Token refresh handler (re-entrant safe)\n // ─────────────────────────────────────────────────────────────────────────\n\n /\n Token renewal handler registered on HTTP clients.\n * Called automatically by the interceptor when a 401 OUTDATED_AUTH_JWT is received.\n \n Re-entrant safe: if multiple requests get 401 simultaneously, only one refresh\n * call is made and all callers share the same promise.\n */\n const tokenRenewalHandler = useCallback(async (): Promise<string> => {\n // If a refresh is already in flight IN THIS TAB, piggyback on it.\n if (refreshInFlightRef.current) {\n logger.debug('Auth token renewal already in flight; waiting for shared result');\n return refreshInFlightRef.current;\n }\n\n // The access token that just failed verification. Captured before we take\n // the cross-tab lock so that, once we hold it, we can detect whether\n // another tab already rotated a fresh token into shared storage while we\n // were waiting (see `adoptCrossTabRefreshedToken`).\n const staleAccessToken = tokenStorage.getAccessToken();\n\n // Adopt — WITHOUT a network call — an access token that another tab already\n // rotated into the shared store while we were queued on the cross-tab lock.\n // Returns the adopted token, or `null` if storage still holds the stale\n // token (meaning THIS tab must perform the network rotation).\n const adoptCrossTabRefreshedToken = (): string \| null => {\n const current = tokenStorage.getAccessToken();\n if (current && current !== staleAccessToken) {\n getManualCallsHttpClient().setAuthToken(current);\n setResourcesAuthToken(current);\n setAuth(a => (a.accessToken === current ? a : { ...a, accessToken: current }));\n refreshWebSocketAuth(current);\n logger.debug('Auth token renewal short-circuited; adopted token rotated by another tab');\n return current;\n }\n return null;\n };\n\n // The actual network rotation + local propagation. Assumes the caller holds\n // the cross-tab refresh lock (or that no lock primitive is available).\n const performNetworkRefresh = async (): Promise<string> => {\n // Auth-hardening Slice A Step 3 (2026-04-13) — refresh token travels via\n // the `__wildo_refresh` `HttpOnly` cookie. JS can't see the cookie\n // (`HttpOnly` blocks DOM reads), so we can't pre-check whether a refresh\n // is even possible; we just attempt the call.\n logger.debug('Auth token renewal started');\n const result = await getManualCallsHttpClient().refreshTokens();\n\n // Persist the rotated access token. The rotated refresh token landed in\n // the `__wildo_refresh` cookie via `Set-Cookie` on the same response —\n // the browser cookie store updated automatically; no JS plumbing needed.\n storeAuthTokens(result.accessToken);\n\n getManualCallsHttpClient().setAuthToken(result.accessToken);\n setResourcesAuthToken(result.accessToken);\n\n // Update React state — only the access token surfaces here.\n setAuth(a => ({\n ...a,\n accessToken: result.accessToken,\n }));\n\n // Broadcast the rotated ACCESS token so other tabs adopt it instead of\n // independently refreshing. The rotated refresh token is NOT broadcast —\n // it already landed in the shared same-origin `__wildo_refresh` cookie.\n broadcastChannelRef.current?.postMessage({\n type: 'TOKEN_REFRESHED',\n accessToken: result.accessToken,\n });\n\n logger.debug('Auth token renewal succeeded; frontend clients updated');\n refreshWebSocketAuth(result.accessToken);\n return result.accessToken;\n };\n\n // RC1 — CROSS-TAB SERIALIZATION via the Web Locks API.\n //\n // `refreshInFlightRef` only dedupes refreshes WITHIN a tab. Across tabs,\n // a mass-expiry event (e.g. a dev backend recompile expiring every tab's\n // access token at the same instant) makes every tab fire `/auth/token/\n // refresh` with the SAME current cookie. One wins and rotates the token;\n // the others present the now-rotated token a beat later, the backend's\n // reuse-detection treats that as theft and `invalidateAllTokensForUser`\n // NUKES every session. The `wildo-auth-refresh` lock ensures only ONE tab\n // performs the network rotation; the rest wait, then adopt the winner's\n // already-rotated token with no second network call. Falls back to a plain\n // refresh where Web Locks is unavailable (non-secure context / old browser;\n // localhost dev IS a secure context, so the lock is active there).\n const doRefresh = async (): Promise<string> => {\n const locks = typeof navigator !== 'undefined' ? navigator.locks : undefined;\n if (!locks?.request) {\n return performNetworkRefresh();\n }\n return locks.request('wildo-auth-refresh', async () => {\n const adopted = adoptCrossTabRefreshedToken();\n if (adopted) return adopted;\n return performNetworkRefresh();\n });\n };\n\n // Store the promise so concurrent callers in this tab share it.\n refreshInFlightRef.current = doRefresh().finally(() => {\n refreshInFlightRef.current = null;\n });\n\n try {\n return await refreshInFlightRef.current;\n } catch (error) {\n // RC2/RC3 — classify the failure. `logout()` clears the SHARED\n // `__wildo_refresh` cookie, so destroying the session on a transient\n // failure (backend restarting / 5xx / timeout) permanently logs out\n // every tab and breaks recovery. Only an AUTHORITATIVE rejection (the\n // backend explicitly refused this refresh token) warrants logout — and\n // in DEVELOPMENT not even that, because dev recompiles routinely produce\n // authoritative-looking 400/401s while the session is in fact fine once\n // the backend settles. See `auth-refresh-resilience.frontend.ts`.\n const authoritative = isAuthoritativeRefreshRejection(error);\n const devLenient = isRefreshDevLenient();\n\n if (authoritative && !devLenient) {\n logger.warn('Auth token renewal failed; refresh token was rejected and logout will follow', {\n error: isWildoBackendError(error)\n ? error.customMessageReference\n : (error instanceof Error ? error.message : 'Unknown error'),\n });\n logout();\n } else {\n logger.warn(\n 'Auth token renewal failed but session is preserved (will retry on the next request)',\n {\n authoritative,\n devLenient,\n reason: authoritative\n ? 'development leniency active — not logging out on an authoritative rejection'\n : 'transient failure (backend unreachable / 5xx / timeout) — not an authoritative rejection',\n },\n );\n }\n throw error;\n }\n }, [setResourcesAuthToken, logout, refreshWebSocketAuth, tokenStorage]);\n\n // Register the token renewal handler on both HTTP clients + expose it via ref\n // so the WebSocket `onAuthenticationError` callback (wired in `connectWebSocket`\n // above) always invokes the current handler.\n useEffect(() => {\n tokenRenewalHandlerRef.current = tokenRenewalHandler;\n getManualCallsHttpClient().setTokenRenewalHandler(tokenRenewalHandler);\n setResourcesTokenRenewalHandler(tokenRenewalHandler);\n }, [tokenRenewalHandler, setResourcesTokenRenewalHandler]);\n\n // Cross-tab token coordination via BroadcastChannel.\n // When one tab refreshes tokens, it broadcasts the new tokens so other tabs\n // adopt them instead of independently refreshing (which triggers rotation detection).\n useEffect(() => {\n if (typeof BroadcastChannel === 'undefined') return;\n\n const channel = new BroadcastChannel('wildo-auth-tokens');\n broadcastChannelRef.current = channel;\n\n channel.onmessage = (event: MessageEvent) => {\n const { type, accessToken } = event.data ?? {};\n\n if (type === 'TOKEN_REFRESHED' && accessToken) {\n // Auth-hardening Slice A Step 6 (2026-04-13) — payload only\n // carries the rotated access token. The rotated refresh token\n // landed in the shared `__wildo_refresh` cookie via the issuing\n // tab's `Set-Cookie` response, and same-origin tabs see the\n // new cookie automatically; nothing for this receiver to do.\n // Pre-Slice-A tabs that broadcast a `refreshToken` field have\n // long since aged out (A-Step 6 ships well after the dual-read\n // window closed); the destructuring above doesn't pick it up.\n logger.debug('Auth token renewal received from another tab; frontend clients updated');\n storeAuthTokens(accessToken);\n getManualCallsHttpClient().setAuthToken(accessToken);\n setResourcesAuthToken(accessToken);\n setAuth(a => ({ ...a, accessToken }));\n refreshWebSocketAuth(accessToken);\n }\n\n if (type === 'LOGOUT') {\n logDebug('Received logout signal from another tab');\n disconnect();\n tokenStorage.clear();\n getManualCallsHttpClient().setConsumableToken(null);\n setResourcesConsumableToken(null);\n storeAuthTokens(null);\n getManualCallsHttpClient().setAuthToken(null);\n setResourcesAuthToken(null);\n setAuth(EMPTY_AUTH_STATE);\n }\n };\n\n return () => {\n channel.close();\n broadcastChannelRef.current = null;\n };\n }, [setResourcesAuthToken, setResourcesConsumableToken, disconnect, refreshWebSocketAuth, tokenStorage]);\n\n // Initialize auth tokens on mount (from storage)\n useEffect(() => {\n // Prevent multiple initializations\n if (hasInitializedRef.current) {\n return;\n }\n\n // Auth-hardening Slice A Step 3 (2026-04-13) — only the access token\n // is stored client-side. The refresh token lives in the\n // `__wildo_refresh` `HttpOnly` cookie which JS can't read; it's\n // implicitly available as soon as the browser includes it on the\n // first `/auth/token/refresh` round-trip. No \"do we have a refresh\n // token?\" check needed at mount.\n const storedAccessToken = tokenStorage.getAccessToken();\n\n if (!storedAccessToken) {\n logDebug('No stored access token found');\n hasInitializedRef.current = true;\n return;\n }\n\n logDebug('Found stored access token, initializing auth state');\n hasInitializedRef.current = true;\n\n setAuth(a => ({\n ...a,\n accessToken: storedAccessToken,\n isRestoringSession: true,\n }));\n\n getManualCallsHttpClient().setAuthToken(storedAccessToken);\n setResourcesAuthToken(storedAccessToken);\n\n // UserOrgsContext will handle fetching user data and marking session as restored\n }, [setResourcesAuthToken, tokenStorage]);\n\n const value = useMemo<AuthSessionContextType>(() => ({\n auth,\n tokenStorage,\n\n // Authentication methods\n identifyByEmail,\n authenticateWithPassword,\n authenticate,\n getSessionState,\n isAuthenticated,\n logout,\n\n // OAuth2 + cross-frontend-handoff (shared AUTH_CODE_EXCHANGE primitive)\n initiateOAuth2Login,\n handleAuthCodeExchange,\n\n // Email verification\n handleEmailVerification,\n acceptInvitation,\n\n // Magic link verification\n handleMagicLinkVerify,\n\n // MFA verification\n handleMfaVerify,\n handlePasskeyAuth,\n\n // One-off session exchange (W7.3b)\n handleOneOffTokenExchange,\n\n // Cross-frontend handoff context (cross-app-jwt-propagation Step 5)\n clearCrossFrontendHandoffContext,\n\n // Session management\n markSessionRestored,\n setSessionRestoring,\n\n // WebSocket\n connectWebSocket,\n notifyOrganizationSwitch,\n }), [\n auth,\n tokenStorage,\n logout,\n initiateOAuth2Login,\n handleAuthCodeExchange,\n handleEmailVerification,\n acceptInvitation,\n handleMagicLinkVerify,\n handleMfaVerify,\n handlePasskeyAuth,\n handleOneOffTokenExchange,\n clearCrossFrontendHandoffContext,\n markSessionRestored,\n setSessionRestoring,\n connectWebSocket,\n notifyOrganizationSwitch,\n ]);\n\n return <AuthSessionContext.Provider value={value}>{children}</AuthSessionContext.Provider>;\n};\n"]}
1	+ {"version":3,"file":"AuthSessionContext.js","sourceRoot":"","sources":["../../../../../src/core/security/AuthSessionContext.tsx"],"names":[],"mappings":";AAAA,OAAc,EAAE,aAAa,EAAE,QAAQ,EAAa,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,OAAO,CAAC;AAC3G,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAEpF,OAAO,EACL,YAAY,EAIZ,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,0BAA0B,EAC1B,WAAW,EACX,mBAAmB,GAEpB,MAAM,uBAAuB,CAAC;AAU/B,OAAO,EACL,wBAAwB,GAIzB,MAAM,mFAAmF,CAAC;AAC3F,OAAO,EAAE,2BAA2B,EAAE,mBAAmB,EAAE,MAAM,uEAAuE,CAAC;AACzI,OAAO,EAAE,oCAAoC,EAAE,qCAAqC,EAAE,MAAM,0EAA0E,CAAC;AACvK,OAAO,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,MAAM,8EAA8E,CAAC;AAClJ,OAAO,EAAE,+BAA+B,EAAE,mBAAmB,EAAE,MAAM,oEAAoE,CAAC;AAC1I,OAAO,EAAE,mBAAmB,EAAE,MAAM,wDAAwD,CAAC;AAC7F,OAAO,EAAE,OAAO,EAAE,MAAM,uCAAuC,CAAC;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gEAAgE,CAAC;AACvG,OAAO,EAAE,qBAAqB,EAAE,MAAM,6DAA6D,CAAC;AACpG,OAAO,EAAE,QAAQ,EAAE,MAAM,0CAA0C,CAAC;AACpE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2DAA2D,CAAC;AACtG,OAAO,EAAE,cAAc,EAAE,MAAM,iDAAiD,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,2DAA2D,CAAC;AACzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,2DAA2D,CAAC;AAChG,OAAO,EAEL,gBAAgB,EAEhB,yBAAyB,EACzB,2BAA2B,EAAE,8BAA8B,EAC3D,sBAAsB,GACvB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAEL,6BAA6B,GAC9B,MAAM,0CAA0C,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AAE9G,MAAM,MAAM,GAA0B,qBAAqB,CAAC,SAAS,EAAE,CAAC;AACxE,MAAM,QAAQ,GAAiE,MAAM,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC;AACxH,MAAM,CAAC,mBAAmB,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;AAExD;;;;GAIG;AACH,MAAM,oCAAoC,GAA4C,IAAI,GAAG,CAAC;IAC5F,0BAA0B,CAAC,YAAY;IACvC,0BAA0B,CAAC,uBAAuB;CACnD,CAAC,CAAC;AAsJH;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsD,aAAa,CAAqC,SAAS,CAAC,CAAC;AAElJ;;;GAGG;AACH,MAAM,gCAAgC,GAAG,MAAM,CAAC;AAEhD;;;;;;;;;GASG;AACH,SAAS,8BAA8B,CAAC,IAAwB,EAAE,YAAoB;IACpF,MAAM,aAAa,GAAI,UAAuI,CAAC,mBAAmB,CAAC;IACnL,IAAI,CAAC,IAAI,IAAI,OAAO,aAAa,EAAE,uBAAuB,KAAK,UAAU;QAAE,OAAO;IAClF,KAAK,aAAa,CAAC,uBAAuB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;AAC5F,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAG3B,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,gBAAgB,EAAE,EAAE,EAAE;IACpD,MAAM,YAAY,GAAG,OAAO,CAC1B,GAAG,EAAE,CAAC,gBAAgB,IAAI,IAAI,6BAA6B,EAAE,EAC7D,CAAC,gBAAgB,CAAC,CACnB,CAAC;IACF,MAAM,EAAE,YAAY,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,+BAA+B,EAAE,kBAAkB,EAAE,2BAA2B,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAChL,MAAM,EAAE,WAAW,EAAE,GAAG,QAAQ,EAAE,CAAC;IACnC,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,EAAE,SAAS,EAAE,CAAC,qBAAqB,CAAC,wBAAwB,EAAE,qBAAqB,CAAC,4BAA4B,CAAC,EAAE,CAAC,CAAC;IAC7J,uGAAuG;IACvG,kGAAkG;IAClG,MAAM,wBAAwB,GAAG,yBAAyB,EAAE,CAAC;IAC7D,+GAA+G;IAC/G,MAAM,eAAe,GAAG,WAAW,CACjC,GAAG,EAAE,CAAC,qBAAqB,CAAC,EAAE,UAAU,EAAE,aAAa,EAAE,qBAAqB,CAAC,4BAA4B,EAAE,GAAG,EAAE,iBAAiB,CAAC,aAAa,EAAE,CAAC,EACpJ,CAAC,UAAU,CAAC,CACb,CAAC;IACF,MAAM,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,CAAC;IACvC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,GAAG,YAAY,EAAE,CAAC;IAC5H,MAAM,EAAE,qBAAqB,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACxD,MAAM,iBAAiB,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,mBAAmB,GAAG,MAAM,CAA0B,IAAI,CAAC,CAAC;IAClE,MAAM,kBAAkB,GAAG,MAAM,CAAyB,IAAI,CAAC,CAAC;IAChE,4FAA4F;IAC5F,6FAA6F;IAC7F,MAAM,2BAA2B,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IAC9C;;;;OAIG;IACH,MAAM,iCAAiC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;IACpD,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,GAAG,2BAA2B,CAAC,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzE,4EAA4E;IAC5E,mEAAmE;IACnE,8EAA8E;IAC9E,4EAA4E;IAC5E,MAAM,sBAAsB,GAAG,MAAM,CAAiC,IAAI,CAAC,CAAC;IAE5E,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,QAAQ,CAAY;QAC1C,GAAG,gBAAgB;QACnB,WAAW,EAAE,YAAY,CAAC,cAAc,EAAE;QAC1C,8DAA8D;QAC9D,iEAAiE;QACjE,iEAAiE;QACjE,2EAA2E;QAC3E,iEAAiE;QACjE,6DAA6D;QAC7D,iEAAiE;QACjE,kCAAkC;KACnC,CAAC,CAAC;IAEH;;;;;;;;OAQG;IACH,MAAM,eAAe,GAAG,CAAC,WAA0B,EAAQ,EAAE;QAC3D,YAAY,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAC5C,IAAI,WAAW,EAAE,CAAC;YAChB,qBAAqB,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC;IAEF;;;;OAIG;IACH,MAAM,kCAAkC,GAAG,CAAC,SAAiB,EAAQ,EAAE;QACrE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACZ,GAAG,CAAC;YACJ,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,IAAI;YACX,SAAS,EAAE,IAAI;YACf,mBAAmB,EAAE,SAAS;YAC9B,WAAW,EAAE,KAAK;YAClB,YAAY,EAAE,IAAI;YAClB,mBAAmB,EAAE,EAAE;YACvB,0BAA0B,EAAE,EAAE;YAC9B,2BAA2B,EAAE,EAAE;YAC/B,yBAAyB,EAAE,EAAE;SAC9B,CAAC,CAAC,CAAC;IACN,CAAC,CAAC;IAEF;;;;;;;;OAQG;IACH,MAAM,kBAAkB,GAAG,WAAW,CAAC,GAAkB,EAAE;QACzD,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;YACrD,MAAM,CAAC,IAAI,CAAC,2FAA2F,CAAC,CAAC;YACzG,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC;QAChE,wEAAwE;QACxE,+DAA+D;QAC/D,MAAM,SAAS,GAAG,UAAU,CAAC,SAAS,CAAC;QAEvC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,mFAAmF,CAAC,CAAC;YACjG,OAAO,IAAI,CAAC;QACd,CAAC;QAED,kDAAkD;QAClD,2EAA2E;QAC3E,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC/C,OAAO,KAAK,CAAC;IACf,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAEhB;;;OAGG;IACH,MAAM,gBAAgB,GAAG,WAAW,CAAC,CAAC,KAAa,EAAE,cAA8B,EAAE,eAA+B,EAAQ,EAAE;QAC5H,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,QAAQ,CAAC,+CAA+C,CAAC,CAAC;YAC1D,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;QAEnC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,QAAQ,CAAC,kDAAkD,CAAC,CAAC;YAC7D,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,OAAO,CAAC;gBACN,GAAG,EAAE,KAAK;gBACV,KAAK;gBACL,cAAc,EAAE,cAAc,IAAI,SAAS;gBAC3C,eAAe,EAAE,eAAe,IAAI,SAAS;gBAC7C,aAAa,EAAE,IAAI;gBACnB,0EAA0E;gBAC1E,2EAA2E;gBAC3E,4EAA4E;gBAC5E,uEAAuE;gBACvE,wEAAwE;gBACxE,iBAAiB,EAAE,IAAI;gBACvB,oBAAoB,EAAE,EAAE;gBACxB,yEAAyE;gBACzE,sEAAsE;gBACtE,wEAAwE;gBACxE,6DAA6D;gBAC7D,yEAAyE;gBACzE,yEAAyE;gBACzE,yEAAyE;gBACzE,gDAAgD;gBAChD,qBAAqB,EAAE,GAAG,EAAE,CAAC,sBAAsB,CAAC,OAAO,EAAE,EAAE;aAChE,CAAC,CAAC;YACH,QAAQ,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAElC;;OAEG;IACH,MAAM,wBAAwB,GAAG,WAAW,CAAC,CAAC,QAAgB,EAAE,aAAqB,EAAQ,EAAE;QAC7F,oBAAoB,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAChD,CAAC,EAAE,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAE3B,MAAM,eAAe,GAAG,KAAK,EAAE,KAAa,EAAuC,EAAE;QACnF,MAAM,UAAU,GAAG,EAAE,2BAA2B,CAAC,OAAO,CAAC;QACzD,wGAAwG;QACxG,4FAA4F;QAC5F,uBAAuB,EAAE,CAAC;QAC1B,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACZ,GAAG,CAAC;YACJ,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,IAAI;YACX,cAAc,EAAE,IAAI;YACpB,SAAS,EAAE,IAAI;YACf,YAAY,EAAE,IAAI;YAClB,mBAAmB,EAAE,IAAI;YACzB,WAAW,EAAE,KAAK;YAClB,YAAY,EAAE,IAAI;YAClB,mBAAmB,EAAE,EAAE;YACvB,0BAA0B,EAAE,EAAE;YAC9B,2BAA2B,EAAE,EAAE;YAC/B,yBAAyB,EAAE,EAAE;SAC9B,CAAC,CAAC,CAAC;QACJ,QAAQ,CAAC,2BAA2B,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,wBAAwB,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;YAErE,IAAI,UAAU,KAAK,2BAA2B,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAEpE,QAAQ,CAAC,gCAAgC,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YAE1E,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,KAAK,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrE,GAAG,CAAC;gBACJ,SAAS,EAAE,KAAK;gBAChB,cAAc,EAAE,IAAI;gBACpB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,kBAAkB,CAAC,KAAK;aAC/C,CAAC,CAAC,CAAC;YAEJ,OAAO,IAAkC,CAAC;QAC5C,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,IAAI,UAAU,KAAK,2BAA2B,CAAC,OAAO;gBAAE,MAAM,CAAC,CAAC;YAChE,MAAM,GAAG,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC;YACxC,WAAW,CAAC,CAAC,EAAE,uBAAuB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACjE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,KAAK,2BAA2B,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YAChH,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CAAC;IAEF;;;;;;;;;;;;;;;;;;OAkBG;IACH,MAAM,6BAA6B,GAAG,CAAC,IAA4B,EAAE,SAAiB,EAAQ,EAAE;QAC9F,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;QAE7C,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW;gBACzB,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE;gBAC5B,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;YAC7E,OAAO;QACT,CAAC;QAED,eAAe,CAAC,WAAW,CAAC,CAAC;QAC7B,wBAAwB,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACrD,qBAAqB,CAAC,WAAW,CAAC,CAAC;QAEnC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACZ,GAAG,CAAC;gBACJ,SAAS,EAAE,KAAK;gBAChB,WAAW;gBACX,kBAAkB,EAAE,IAAI;gBACxB,eAAe,EAAE,KAAK;gBACtB,SAAS,EAAE,IAAI;aAChB,CAAC,CAAC,CAAC;YAEJ,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACZ,GAAG,CAAC;gBACJ,SAAS,EAAE,KAAK;gBAChB,WAAW;gBACX,SAAS;aACV,CAAC,CAAC,CAAC;QACN,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,wBAAwB,GAAG,KAAK,EAAE,KAAa,EAAE,QAAgB,EAAmC,EAAE;QAC1G,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,QAAQ,CAAC,8BAA8B,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;gBAC1E,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;gBACnE,MAAM,KAAK,CAAC;YACd,CAAC;YAED,sEAAsE;YACtE,MAAM,WAAW,GAA0B;gBACzC,SAAS;gBACT,MAAM,EAAE,UAAU,CAAC,QAAQ;gBAC3B,WAAW,EAAE,eAAe,CAAC,KAAK;gBAClC,QAAQ;gBACR,UAAU,EAAE,KAAK;gBACjB,qBAAqB,EAAE,EAAE;aAC1B,CAAC;YAEF,MAAM,IAAI,GAAG,MAAM,wBAAwB,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YAExE,yGAAyG;YACzG,MAAM,yBAAyB,GAAG,qCAAqC,CAAC,IAAI,CAAC,CAAC;YAC9E,IAAI,yBAAyB,EAAE,CAAC;gBAC9B,kCAAkC,CAAC,yBAAyB,CAAC,CAAC;gBAC9D,OAAO,IAA8B,CAAC;YACxC,CAAC;YAED,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC1C,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACZ,GAAG,CAAC;oBACJ,SAAS,EAAE,KAAK;oBAChB,WAAW,EAAE,IAAI;oBACjB,YAAY,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS;oBACzC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,IAAI,EAAE;oBACnD,0BAA0B,EAAE,IAAI,CAAC,0BAA0B,IAAI,EAAE;oBACjE,2BAA2B,EAAE,IAAI,CAAC,2BAA2B,IAAI,EAAE;oBACnE,yBAAyB,EAAE,IAAI,CAAC,yBAAyB,IAAI,EAAE;iBAChE,CAAC,CAAC,CAAC;gBACJ,OAAO,IAA8B,CAAC;YACxC,CAAC;YAED,QAAQ,CAAC,2BAA2B,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;YAErG,6BAA6B,CAAC,IAA8B,EAAE,SAAS,CAAC,CAAC;YAEzE,OAAO,IAA8B,CAAC;QACxC,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC;YACxC,WAAW,CAAC,CAAC,EAAE,uBAAuB,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACjE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YACvD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,YAAY,GAAG,KAAK,EAAE,OAA8B,EAAmC,EAAE;QAC7F,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,QAAQ,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACvG,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;YACtD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;gBAC1E,MAAM,CAAC,IAAI,CAAC,0CAA0C,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;gBACpF,MAAM,KAAK,CAAC;YACd,CAAC;YAED,MAAM,WAAW,GAAG,EAAE,GAAG,OAAO,EAAE,SAAS,EAA2B,CAAC;YACvE,MAAM,IAAI,GAAG,MAAM,wBAAwB,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YAExE,yGAAyG;YACzG,MAAM,yBAAyB,GAAG,qCAAqC,CAAC,IAAI,CAAC,CAAC;YAC9E,IAAI,yBAAyB,EAAE,CAAC;gBAC9B,kCAAkC,CAAC,yBAAyB,CAAC,CAAC;gBAC9D,OAAO,IAA8B,CAAC;YACxC,CAAC;YAED,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;gBAC1C,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACZ,GAAG,CAAC;oBACJ,SAAS,EAAE,KAAK;oBAChB,WAAW,EAAE,IAAI;oBACjB,YAAY,EAAE,IAAI,CAAC,SAAS,IAAI,SAAS;oBACzC,mBAAmB,EAAE,IAAI,CAAC,mBAAmB,IAAI,EAAE;oBACnD,0BAA0B,EAAE,IAAI,CAAC,0BAA0B,IAAI,EAAE;oBACjE,2BAA2B,EAAE,IAAI,CAAC,2BAA2B,IAAI,EAAE;oBACnE,yBAAyB,EAAE,IAAI,CAAC,yBAAyB,IAAI,EAAE;iBAChE,CAAC,CAAC,CAAC;gBACJ,OAAO,IAAI,CAAC;YACd,CAAC;YAED,QAAQ,CAAC,2BAA2B,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAE7H,6BAA6B,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAE/C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC;YACxC,WAAW,CAAC,CAAC,EAAE,uBAAuB,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAClF,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YACvD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,KAAK,EAAE,SAAiB,EAAgB,EAAE;QAChE,QAAQ,CAAC,uBAAuB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,wBAAwB,EAAE,CAAC,eAAe,CAAC,SAAS,CAAC,CAAC;YACjF,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,OAAO,EAAE,YAAY,EAAE,OAAO,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACpF,QAAQ,CAAC,yBAAyB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YACnD,OAAO,YAAY,CAAC;QACtB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,WAAW,CAAC,CAAC,EAAE,6BAA6B,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;YAC7D,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,CAAC;IAEF,MAAM,eAAe,GAAG,GAAY,EAAE;QACpC,OAAO,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAC5B,CAAC,CAAC;IAEF;;;;;;;;;OASG;IACH,MAAM,mBAAmB,GAAG,WAAW,CAAC,KAAK,EAC3C,WAAmB,EACnB,SAAkB,EAClB,kCAAsD,EACvC,EAAE;QACjB,QAAQ,CAAC,yBAAyB,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;QAChE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,wBAAwB,EAAE;iBAC1D,yBAAyB,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,kCAAkC,CAAC,CAAC;YACpG,QAAQ,CAAC,gCAAgC,EAAE,EAAE,WAAW,EAAE,gBAAgB,EAAE,CAAC,CAAC;YAC9E,MAAM,CAAC,QAAQ,CAAC,IAAI,GAAG,gBAAgB,CAAC;QAC1C,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC;YACxC,WAAW,CAAC,CAAC,EAAE,gCAAgC,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAChF,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YACvD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,EAAE,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAE5C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAoCG;IACH,MAAM,sBAAsB,GAAG,WAAW,CAAC,KAAK,EAAE,IAAY,EAAiB,EAAE;QAC/E,QAAQ,CAAC,+EAA+E,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACvH,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,wBAAwB,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAEzE,sGAAsG;YACtG,MAAM,yBAAyB,GAAG,qCAAqC,CAAC,QAAQ,CAAC,CAAC;YAClF,IAAI,yBAAyB,EAAE,CAAC;gBAC9B,QAAQ,CAAC,uEAAuE,CAAC,CAAC;gBAClF,kCAAkC,CAAC,yBAAyB,CAAC,CAAC;gBAC9D,OAAO;YACT,CAAC;YACD,IAAI,CAAC,CAAC,aAAa,IAAI,QAAQ,CAAC,EAAE,CAAC;gBACjC,MAAM,IAAI,KAAK,CAAC,oFAAoF,CAAC,CAAC;YACxG,CAAC;YACD,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,GAAG,QAAQ,CAAC;YAE1F,eAAe,CAAC,WAAW,CAAC,CAAC;YAC7B,wBAAwB,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YACrD,qBAAqB,CAAC,WAAW,CAAC,CAAC;YAEnC,uEAAuE;YACvE,oEAAoE;YACpE,sEAAsE;YACtE,iEAAiE;YACjE,iEAAiE;YACjE,uDAAuD;YACvD,mEAAmE;YACnE,6BAA6B;YAC7B,EAAE;YACF,mEAAmE;YACnE,mEAAmE;YACnE,kEAAkE;YAClE,iEAAiE;YACjE,+DAA+D;YAC/D,oEAAoE;YACpE,6CAA6C;YAC7C,kEAAkE;YAClE,8BAA8B;YAC9B,8DAA8D;YAC9D,+DAA+D;YAC/D,mEAAmE;YACnE,2CAA2C;YAC3C,MAAM,2BAA2B,GAAG,OAAO,UAAU,KAAK,QAAQ;gBAChE,CAAC,CAAC;oBACE,UAAU;oBACV,GAAG,CAAC,yBAAyB,KAAK,SAAS,IAAI,EAAE,yBAAyB,EAAE,CAAC;oBAC7E,GAAG,CAAC,gBAAgB,KAAK,SAAS,IAAI,EAAE,gBAAgB,EAAE,CAAC;iBAC5D;gBACH,CAAC,CAAC,SAAS,CAAC;YAEd,QAAQ,CAAC,2CAA2C,EAAE;gBACpD,sBAAsB,EAAE,2BAA2B,KAAK,SAAS;aAClE,CAAC,CAAC;YAEH,wFAAwF;YACxF,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACZ,GAAG,CAAC;gBACJ,SAAS,EAAE,KAAK;gBAChB,WAAW;gBACX,kBAAkB,EAAE,IAAI;gBACxB,eAAe,EAAE,KAAK;gBACtB,0EAA0E;gBAC1E,SAAS,EAAE,IAAI;gBACf,2BAA2B;aAC5B,CAAC,CAAC,CAAC;YAEJ,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;QACnC,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC;YACxC,WAAW,CAAC,CAAC,EAAE,wBAAwB,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAC3D,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YACvD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,EAAE,CAAC,qBAAqB,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAEnE;;;;;;OAMG;IACH,MAAM,uBAAuB,GAAG,WAAW,CAAC,KAAK,EAAE,KAAa,EAAE,KAAa,EAAiB,EAAE;QAChG,QAAQ,CAAC,6BAA6B,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9E,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,wBAAwB,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAE5E,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACzB,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBACtC,wBAAwB,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAC9D,qBAAqB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAE5C,QAAQ,CAAC,8CAA8C,CAAC,CAAC;gBAEzD,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACZ,GAAG,CAAC;oBACJ,SAAS,EAAE,KAAK;oBAChB,WAAW,EAAE,QAAQ,CAAC,WAAY;oBAClC,kBAAkB,EAAE,IAAI;oBACxB,eAAe,EAAE,KAAK;oBACtB,SAAS,EAAE,IAAI;iBAChB,CAAC,CAAC,CAAC;gBAEJ,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;YACnC,CAAC;iBAAM,IAAI,qCAAqC,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC3D,QAAQ,CAAC,qEAAqE,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;gBAC3G,kCAAkC,CAAC,QAAQ,CAAC,SAAU,CAAC,CAAC;YAC1D,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,sFAAsF,EAAE;oBAC/F,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;iBAC5B,CAAC,CAAC;gBAEH,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACZ,GAAG,CAAC;oBACJ,SAAS,EAAE,KAAK;oBAChB,SAAS,EAAE,IAAI;oBACf,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,KAAK;oBAC1C,YAAY,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;oBACxE,mBAAmB,EAAE,EAAE;oBACvB,0BAA0B,EAAE,QAAQ,CAAC,0BAA0B,IAAI,EAAE;oBACrE,2BAA2B,EAAE,EAAE;oBAC/B,yBAAyB,EAAE,EAAE;oBAC7B,KAAK,EAAE,IAAI;iBACZ,CAAC,CAAC,CAAC;YACN,CAAC;QACH,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC;YACxC,WAAW,CAAC,CAAC,EAAE,2BAA2B,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAC9D,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YACvD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,EAAE,CAAC,qBAAqB,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAEnE,MAAM,gBAAgB,GAAG,WAAW,CAAC,KAAK,EACxC,MAA4H,EAC/B,EAAE;QAC/F,QAAQ,CAAC,gCAAgC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC1H,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,wBAAwB,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAE3E,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;gBACzB,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBACtC,wBAAwB,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAC9D,qBAAqB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAE5C,QAAQ,CAAC,iDAAiD,CAAC,CAAC;gBAE5D,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACZ,GAAG,CAAC;oBACJ,SAAS,EAAE,KAAK;oBAChB,WAAW,EAAE,QAAQ,CAAC,WAAY;oBAClC,kBAAkB,EAAE,IAAI;oBACxB,eAAe,EAAE,KAAK;oBACtB,SAAS,EAAE,IAAI;oBACf,WAAW,EAAE,KAAK;oBAClB,YAAY,EAAE,IAAI;oBAClB,mBAAmB,EAAE,EAAE;oBACvB,0BAA0B,EAAE,EAAE;oBAC9B,2BAA2B,EAAE,EAAE;oBAC/B,yBAAyB,EAAE,EAAE;oBAC7B,KAAK,EAAE,IAAI;iBACZ,CAAC,CAAC,CAAC;gBAEJ,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,QAAQ,CAAC,mDAAmD,EAAE;oBAC5D,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;iBAC5B,CAAC,CAAC;gBAEH,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACZ,GAAG,CAAC;oBACJ,SAAS,EAAE,KAAK;oBAChB,SAAS,EAAE,IAAI;oBACf,WAAW,EAAE,QAAQ,CAAC,WAAW,IAAI,KAAK;oBAC1C,YAAY,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI;oBACxE,mBAAmB,EAAE,EAAE;oBACvB,0BAA0B,EAAE,QAAQ,CAAC,0BAA0B,IAAI,EAAE;oBACrE,2BAA2B,EAAE,EAAE;oBAC/B,yBAAyB,EAAE,EAAE;oBAC7B,KAAK,EAAE,IAAI;iBACZ,CAAC,CAAC,CAAC;YACN,CAAC;YAED,2FAA2F;YAC3F,0FAA0F;YAC1F,0FAA0F;YAC1F,yFAAyF;YACzF,4HAA4H;YAC5H,OAAO,EAAE,0BAA0B,EAAE,QAAQ,CAAC,0BAA0B,EAAE,cAAc,EAAE,QAAQ,CAAC,QAAQ,KAAK,YAAY,CAAC,gBAAgB,EAAE,CAAC;QAClJ,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC;YACxC,WAAW,CAAC,CAAC,EAAE,8BAA8B,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACjE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YACvD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,EAAE,CAAC,qBAAqB,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAEnE;;;;;;;;;;;;;OAaG;IACH,MAAM,eAAe,GAAG,WAAW,CAAC,KAAK,EAAE,MAA8B,EAAgC,EAAE;QACzG,QAAQ,CAAC,8BAA8B,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7E,MAAM,QAAQ,GAAG,MAAM,wBAAwB,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnE,MAAM,OAAO,GAAG,2BAA2B,CAAC,QAAQ,CAAC,CAAC;QAEtD,IAAI,OAAO,KAAK,mBAAmB,CAAC,SAAS,EAAE,CAAC;YAC9C,MAAM,WAAW,GAAG,QAAQ,CAAC,WAAY,CAAC;YAC1C,eAAe,CAAC,WAAW,CAAC,CAAC;YAC7B,wBAAwB,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YACrD,qBAAqB,CAAC,WAAW,CAAC,CAAC;YAEnC,QAAQ,CAAC,sDAAsD,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;YAE5F,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACZ,GAAG,CAAC;gBACJ,SAAS,EAAE,KAAK;gBAChB,WAAW;gBACX,kBAAkB,EAAE,IAAI;gBACxB,eAAe,EAAE,KAAK;gBACtB,SAAS,EAAE,IAAI;gBACf,WAAW,EAAE,KAAK;gBAClB,YAAY,EAAE,IAAI;gBAClB,mBAAmB,EAAE,EAAE;gBACvB,0BAA0B,EAAE,EAAE;gBAC9B,2BAA2B,EAAE,EAAE;gBAC/B,yBAAyB,EAAE,EAAE;gBAC7B,KAAK,EAAE,IAAI;aACZ,CAAC,CAAC,CAAC;YAEJ,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;QACnC,CAAC;aAAM,IAAI,OAAO,KAAK,mBAAmB,CAAC,uBAAuB,EAAE,CAAC;YACnE,QAAQ,CAAC,6DAA6D,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;YAEhI;;;;eAIG;YACH,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACZ,GAAG,CAAC;gBACJ,SAAS,EAAE,KAAK;gBAChB,SAAS,EAAE,IAAI;gBACf,WAAW,EAAE,IAAI;gBACjB,YAAY,EAAE,QAAQ,CAAC,SAAU;gBACjC,mBAAmB,EAAE,EAAE;gBACvB,0BAA0B,EAAE,QAAQ,CAAC,0BAA0B,IAAI,EAAE;gBACrE,2BAA2B,EAAE,EAAE;gBAC/B,yBAAyB,EAAE,EAAE;gBAC7B,KAAK,EAAE,IAAI;aACZ,CAAC,CAAC,CAAC;QACN,CAAC;aAAM,IAAI,OAAO,KAAK,mBAAmB,CAAC,gCAAgC,EAAE,CAAC;YAC5E,QAAQ,CAAC,+DAA+D,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;YACrG,kCAAkC,CAAC,QAAQ,CAAC,SAAU,CAAC,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,kDAAkD,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChI,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAE5B;;;;OAIG;IACH,MAAM,qBAAqB,GAAG,WAAW,CAAC,KAAK,EAAE,KAAa,EAAE,KAAa,EAAmC,EAAE;QAChH,QAAQ,CAAC,kCAAkC,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACnF,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,wBAAwB,EAAE,CAAC,eAAe,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAEhF,yGAAyG;YACzG,MAAM,yBAAyB,GAAG,qCAAqC,CAAC,QAAQ,CAAC,CAAC;YAClF,IAAI,yBAAyB,EAAE,CAAC;gBAC9B,kCAAkC,CAAC,yBAAyB,CAAC,CAAC;gBAC9D,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,IAAI,QAAQ,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAClD,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACZ,GAAG,CAAC;oBACJ,SAAS,EAAE,KAAK;oBAChB,WAAW,EAAE,IAAI;oBACjB,YAAY,EAAE,QAAQ,CAAC,SAAS,IAAI,IAAI;oBACxC,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,IAAI,EAAE;oBACvD,0BAA0B,EAAE,QAAQ,CAAC,0BAA0B,IAAI,EAAE;oBACrE,2BAA2B,EAAE,QAAQ,CAAC,2BAA2B,IAAI,EAAE;oBACvE,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB,IAAI,EAAE;iBACpE,CAAC,CAAC,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,8DAA8D;YAC9D,iEAAiE;YACjE,qDAAqD;YACrD,+DAA+D;YAC/D,yCAAyC;YACzC,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC7C,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBACtC,wBAAwB,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAC9D,qBAAqB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAE5C,QAAQ,CAAC,mDAAmD,CAAC,CAAC;gBAE9D,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACZ,GAAG,CAAC;oBACJ,SAAS,EAAE,KAAK;oBAChB,WAAW,EAAE,QAAQ,CAAC,WAAY;oBAClC,kBAAkB,EAAE,IAAI;oBACxB,eAAe,EAAE,KAAK;oBACtB,SAAS,EAAE,IAAI;iBAChB,CAAC,CAAC,CAAC;gBAEJ,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YAC7C,CAAC;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC;YACxC,WAAW,CAAC,CAAC,EAAE,gCAAgC,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACnE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YACvD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,EAAE,CAAC,qBAAqB,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAEnE;;;;OAIG;IACH,MAAM,eAAe,GAAG,WAAW,CAAC,KAAK,EAAE,SAAiB,EAAE,MAAkB,EAAE,IAAY,EAAmC,EAAE;QACjI,QAAQ,CAAC,2BAA2B,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7D,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,wBAAwB,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC;gBACzC,SAAS;gBACT,MAAM;gBACN,WAAW,EAAE,eAAe,CAAC,MAAM;gBACnC,KAAK,EAAE,IAAI;gBACX,UAAU,EAAE,KAAK;gBACjB,qBAAqB,EAAE,EAAE;aACD,CAAC,CAAC;YAE5B,0FAA0F;YAC1F,MAAM,yBAAyB,GAAG,qCAAqC,CAAC,QAAQ,CAAC,CAAC;YAClF,IAAI,yBAAyB,EAAE,CAAC;gBAC9B,kCAAkC,CAAC,yBAAyB,CAAC,CAAC;gBAC9D,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,mEAAmE;YACnE,0DAA0D;YAC1D,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC7C,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBACtC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAC1C,qBAAqB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAE5C,QAAQ,CAAC,4CAA4C,CAAC,CAAC;gBAEvD,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACZ,GAAG,CAAC;oBACJ,SAAS,EAAE,KAAK;oBAChB,WAAW,EAAE,QAAQ,CAAC,WAAY;oBAClC,kBAAkB,EAAE,IAAI;oBACxB,eAAe,EAAE,KAAK;oBACtB,SAAS,EAAE,IAAI;oBACf,WAAW,EAAE,KAAK;oBAClB,YAAY,EAAE,IAAI;oBAClB,mBAAmB,EAAE,EAAE;oBACvB,2BAA2B,EAAE,EAAE;oBAC/B,yBAAyB,EAAE,EAAE;iBAC9B,CAAC,CAAC,CAAC;gBAEJ,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,iFAAiF;gBACjF,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;YACvG,CAAC;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,wBAAwB,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC;YAC3D,WAAW,CAAC,CAAC,EAAE,yBAAyB,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YACpE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YACvD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,EAAE,CAAC,qBAAqB,EAAE,WAAW,EAAE,wBAAwB,EAAE,eAAe,CAAC,CAAC,CAAC;IAEpF;;;;;;;;;;;OAWG;IACH,MAAM,sBAAsB,GAAG,WAAW,CAAC,CAAC,SAAiB,EAAE,YAAuD,EAAW,EAAE;QACjI,IAAI,CAAC,YAAY,EAAE,KAAK,IAAI,CAAC,oCAAoC,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1F,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACZ,GAAG,CAAC;YACJ,WAAW,EAAE,IAAI;YACjB,YAAY,EAAE,SAAS;YACvB,mBAAmB,EAAE,YAAY,CAAC,4BAA4B,IAAI,EAAE;YACpE,0BAA0B,EAAE,YAAY,CAAC,0BAA0B,IAAI,EAAE;YACzE,2BAA2B,EAAE,YAAY,CAAC,2BAA2B,IAAI,EAAE;YAC3E,yBAAyB,EAAE,YAAY,CAAC,yBAAyB,IAAI,EAAE;SACxE,CAAC,CAAC,CAAC;QACJ,OAAO,IAAI,CAAC;IACd,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP;;;;;;;OAOG;IACH,MAAM,yBAAyB,GAAG,WAAW,CAAC,CAAC,UAA2D,EAAW,EAAE;QACrH,4GAA4G;QAC5G,MAAM,yBAAyB,GAAG,qCAAqC,CAAC,UAAU,CAAC,CAAC;QACpF,IAAI,yBAAyB,EAAE,CAAC;YAC9B,QAAQ,CAAC,uEAAuE,CAAC,CAAC;YAClF,kCAAkC,CAAC,yBAAyB,CAAC,CAAC;YAC9D,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,UAAU,EAAE,WAAW,IAAI,UAAU,CAAC,KAAK,KAAK,0BAA0B,CAAC,SAAS,EAAE,CAAC;YAC1F,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,MAAM,GAAG,wBAAwB,EAAE,CAAC;QAC1C,eAAe,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QACxC,MAAM,CAAC,YAAY,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAC5C,qBAAqB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;QAE9C,QAAQ,CAAC,8DAA8D,CAAC,CAAC;QAEzE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACZ,GAAG,CAAC;YACJ,SAAS,EAAE,KAAK;YAChB,WAAW,EAAE,UAAU,CAAC,WAAY;YACpC,kBAAkB,EAAE,IAAI;YACxB,eAAe,EAAE,KAAK;YACtB,SAAS,EAAE,IAAI;YACf,WAAW,EAAE,KAAK;YAClB,YAAY,EAAE,IAAI;YAClB,mBAAmB,EAAE,EAAE;YACvB,0BAA0B,EAAE,EAAE;YAC9B,2BAA2B,EAAE,EAAE;YAC/B,yBAAyB,EAAE,EAAE;YAC7B,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC,CAAC;QAEJ,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC,EAAE,CAAC,qBAAqB,CAAC,CAAC,CAAC;IAE5B;;;;;;OAMG;IACH;;;;;OAKG;IACH,MAAM,uBAAuB,GAAG,WAAW,CAAC,KAAK,EAC/C,QAAsE,EAChC,EAAE;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,mBAAmB,CAAC;QAC3C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QAED,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACvD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,wBAAwB,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;YAC3C,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC1B,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;gBAC3C,QAAQ,CAAC,uEAAuE,EAAE,EAAE,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB,EAAE,CAAC,CAAC;gBACvI,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,CAAC,kBAAkB,IAAI,EAAE,EAAE,CAAC;YACpF,CAAC;YAED,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACtC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAC1C,qBAAqB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YAE5C,QAAQ,CAAC,qCAAqC,EAAE,EAAE,cAAc,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC;YAE7F,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACZ,GAAG,CAAC;gBACJ,SAAS,EAAE,KAAK;gBAChB,WAAW,EAAE,QAAQ,CAAC,WAAY;gBAClC,kBAAkB,EAAE,IAAI;gBACxB,eAAe,EAAE,KAAK;gBACtB,SAAS,EAAE,IAAI;gBACf,mBAAmB,EAAE,IAAI;gBACzB,WAAW,EAAE,KAAK;gBAClB,YAAY,EAAE,IAAI;gBAClB,mBAAmB,EAAE,EAAE;gBACvB,0BAA0B,EAAE,EAAE;gBAC9B,2BAA2B,EAAE,EAAE;gBAC/B,yBAAyB,EAAE,EAAE;gBAC7B,KAAK,EAAE,IAAI;aACZ,CAAC,CAAC,CAAC;YAEJ,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;YACjC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,kBAAkB,EAAE,EAAE,EAAE,CAAC;QACpD,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,yGAAyG;YACzG,qGAAqG;YACrG,4DAA4D;YAC5D,IAAI,oCAAoC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5C,oCAAoC,EAAE,CAAC;YACzC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YAC7C,CAAC;YACD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAC,CAAC;IAEtD,MAAM,8BAA8B,GAAG,WAAW,CAChD,CAAC,gBAAwB,EAAwC,EAAE,CACjE,uBAAuB,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,wBAAwB,EAAE,CAAC,qBAAqB,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,EACvH,CAAC,uBAAuB,CAAC,CAC1B,CAAC;IAEF,MAAM,yBAAyB,GAAG,WAAW,CAC3C,CAAC,SAAiB,EAAE,QAAgB,EAAwC,EAAE,CAC5E,uBAAuB,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,wBAAwB,EAAE,CAAC,yBAAyB,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,EAC9H,CAAC,uBAAuB,CAAC,CAC1B,CAAC;IAEF;;;;;;;;OAQG;IACH,MAAM,oCAAoC,GAAG,GAAS,EAAE;QACtD,2BAA2B,CAAC,OAAO,IAAI,CAAC,CAAC;QACzC,uBAAuB,EAAE,CAAC;QAC1B,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACZ,GAAG,CAAC;YACJ,SAAS,EAAE,KAAK;YAChB,KAAK,EAAE,IAAI;YACX,cAAc,EAAE,IAAI;YACpB,SAAS,EAAE,IAAI;YACf,YAAY,EAAE,IAAI;YAClB,mBAAmB,EAAE,IAAI;SAC1B,CAAC,CAAC,CAAC;IACN,CAAC,CAAC;IAEF,MAAM,6BAA6B,GAAG,WAAW,CAAC,GAAS,EAAE;QAC3D,oCAAoC,EAAE,CAAC;IACzC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP;;;;;;;;;;;OAWG;IACH,MAAM,kBAAkB,GAAG,WAAW,CAAC,KAAK,EAAE,EAC5C,SAAS,EACT,WAAW,EACX,WAAW,GAKZ,EAAmC,EAAE;QACpC,QAAQ,CAAC,iCAAiC,EAAE,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,mBAAmB,GAAG,KAAK,CAAC;QAChC,IAAI,eAAe,GAAG,KAAK,CAAC;QAC5B,MAAM,aAAa,GAAG,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,qBAAqB,CAAC,wBAAwB,CAAC,CAAC,CAAC,qBAAqB,CAAC,4BAA4B,CAAC;QACpJ,MAAM,CAAC,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,qBAAqB,CAAC;YAC/C,UAAU;YACV,aAAa;YACb,GAAG;SACJ,CAAC,CAAC;QACH,MAAM,iBAAiB,GAAG,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,aAAa,CAAC;QAClH,MAAM,qBAAqB,GAAG,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,iBAAiB,CAAC;QAC9H,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,wBAAwB,EAAE,CAAC;YAC1C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,SAAS,CAAC,CAAC;YACzD,MAAM,WAAW,GAA0C,KAAK,CAAC,OAAO,CAAC;YACzE,IAAI,WAAW,IAAI,iCAAiC,CAAC,OAAO,GAAG,CAAC,EAAE,CAAC;gBACjE,iGAAiG;gBACjG,mGAAmG;gBACnG,kGAAkG;gBAClG,+FAA+F;gBAC/F,6FAA6F;gBAC7F,8FAA8F;gBAC9F,MAAM,IAAI,8BAA8B,EAAE,CAAC;YAC7C,CAAC;YACD,8FAA8F;YAC9F,iGAAiG;YACjG,oEAAoE;YACpE,IAAI,oBAA+D,CAAC;YACpE,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,gBAAgB,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,gCAAgC,CAAC;YAC1F,MAAM,iBAAiB,GAAG,WAAW,IAAI,SAAS,GAAG,CAAC,CAAC;YACvD,8FAA8F;YAC9F,6FAA6F;YAC7F,qFAAqF;YACrF,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAChD,MAAM,cAAc,GAAG,GAAG,EAAE;gBAC1B,IAAI,eAAe;oBAAE,OAAO;gBAC5B,eAAe,GAAG,IAAI,CAAC;gBACvB,oBAAoB,CAAC,cAAc,EAAE,CAAC;YACxC,CAAC,CAAC;YACF,MAAM,aAAa,GAAG,GAAG,EAAE;gBACzB,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,gBAAgB;oBAAE,cAAc,EAAE,CAAC;YACvD,CAAC,CAAC;YACF,IAAI,iBAAiB,EAAE,CAAC;gBACtB,oBAAoB,GAAG,UAAU,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;gBAC7D,IAAI,OAAO,QAAQ,KAAK,WAAW;oBAAE,QAAQ,CAAC,gBAAgB,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;gBAClG,IAAI,OAAO,MAAM,KAAK,WAAW;oBAAE,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;YACrF,CAAC;YACD,IAAI,UAA2D,CAAC;YAChE,IAAI,CAAC;gBACH,UAAU,GAAG,MAAM,mBAAmB,CAAC,EAAE,WAAW,EAAE,kBAAkB,EAAE,WAAW,EAAE,CAAC,CAAC;YAC3F,CAAC;oBAAS,CAAC;gBACT,YAAY,CAAC,oBAAoB,CAAC,CAAC;gBACnC,IAAI,iBAAiB,EAAE,CAAC;oBACtB,IAAI,OAAO,QAAQ,KAAK,WAAW;wBAAE,QAAQ,CAAC,mBAAmB,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;oBACrG,IAAI,OAAO,MAAM,KAAK,WAAW;wBAAE,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;gBACxF,CAAC;YACH,CAAC;YACD,mBAAmB,GAAG,IAAI,CAAC;YAC3B,IAAI,WAAW,EAAE,CAAC;gBAChB,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACzD,CAAC;YACD,6FAA6F;YAC7F,iFAAiF;YACjF,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,WAAW,EAAE,yBAAyB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YAE3J,oGAAoG;YACpG,4DAA4D;YAC5D,IAAI,QAAQ,CAAC,wBAAwB,EAAE,CAAC;gBACtC,8BAA8B,CAAC,WAAW,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;YACnE,CAAC;YAED,8FAA8F;YAC9F,MAAM,yBAAyB,GAAG,qCAAqC,CAAC,QAAQ,CAAC,CAAC;YAClF,IAAI,yBAAyB,EAAE,CAAC;gBAC9B,kCAAkC,CAAC,yBAAyB,CAAC,CAAC;gBAC9D,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,IAAI,QAAQ,CAAC,WAAW,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAClD,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACZ,GAAG,CAAC;oBACJ,SAAS,EAAE,KAAK;oBAChB,WAAW,EAAE,IAAI;oBACjB,YAAY,EAAE,QAAQ,CAAC,SAAS,IAAI,SAAS;oBAC7C,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB,IAAI,EAAE;oBACvD,0BAA0B,EAAE,QAAQ,CAAC,0BAA0B,IAAI,EAAE;oBACrE,2BAA2B,EAAE,QAAQ,CAAC,2BAA2B,IAAI,EAAE;oBACvE,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB,IAAI,EAAE;iBACpE,CAAC,CAAC,CAAC;gBACJ,OAAO,QAAQ,CAAC;YAClB,CAAC;YAED,mEAAmE;YACnE,0DAA0D;YAC1D,IAAI,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;gBAC7C,eAAe,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBACtC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAC1C,qBAAqB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBAC5C,QAAQ,CAAC,kDAAkD,CAAC,CAAC;gBAC7D,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACZ,GAAG,CAAC;oBACJ,SAAS,EAAE,KAAK;oBAChB,WAAW,EAAE,QAAQ,CAAC,WAAY;oBAClC,kBAAkB,EAAE,IAAI;oBACxB,eAAe,EAAE,KAAK;oBACtB,SAAS,EAAE,IAAI;oBACf,WAAW,EAAE,KAAK;oBAClB,YAAY,EAAE,IAAI;oBAClB,mBAAmB,EAAE,EAAE;oBACvB,0BAA0B,EAAE,EAAE;oBAC9B,2BAA2B,EAAE,EAAE;oBAC/B,yBAAyB,EAAE,EAAE;iBAC9B,CAAC,CAAC,CAAC;gBACJ,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACN,qFAAqF;gBACrF,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,wBAAwB,CAAC,IAAI,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC1G,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YACpB,IAAI,WAAW,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBACxC,8FAA8F;gBAC9F,gGAAgG;gBAChG,qEAAqE;gBACrE,MAAM,eAAe,CAAC,CAAC,CAAC,IAAI,2BAA2B,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,CAAC;YACD,gGAAgG;YAChG,sGAAsG;YACtG,MAAM,GAAG,GAAI,CAA8B,EAAE,IAAI,KAAK,iBAAiB;gBACrE,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC;gBAC1B,CAAC,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC;YACtD,WAAW,CAAC,CAAC,EAAE,+BAA+B,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAC7E,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YACvD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,EAAE,CAAC,qBAAqB,EAAE,WAAW,EAAE,UAAU,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAE/E,mGAAmG;IACnG,MAAM,+BAA+B,GAAG,WAAW,CACjD,KAAK,EAAE,KAAyD,EAAmC,EAAE;QACnG,iCAAiC,CAAC,OAAO,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAC;YACH,OAAO,MAAM,kBAAkB,CAAC,EAAE,GAAG,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,CAAC;gBAAS,CAAC;YACT,iCAAiC,CAAC,OAAO,IAAI,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,EACD,CAAC,kBAAkB,CAAC,CACrB,CAAC;IAEF,MAAM,iBAAiB,GAAG,WAAW,CACnC,CAAC,SAAiB,EAAE,cAA6B,OAAO,EAAmC,EAAE,CAC3F,+BAA+B,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC,EAC7D,CAAC,+BAA+B,CAAC,CAClC,CAAC;IAEF,MAAM,iBAAiB,GAAG,WAAW,CACnC,CAAC,YAAoC,sBAAsB,CAAC,KAAK,EAAmC,EAAE,CACpG,SAAS,KAAK,sBAAsB,CAAC,WAAW;QAC9C,CAAC,CAAC,kBAAkB,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QACjE,CAAC,CAAC,+BAA+B,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,EAC/D,CAAC,kBAAkB,EAAE,+BAA+B,CAAC,CACtD,CAAC;IAEF;;;;OAIG;IACH,MAAM,yBAAyB,GAAG,WAAW,CAAC,KAAK,EAAE,KAAa,EAAiB,EAAE;QACnF,QAAQ,CAAC,iCAAiC,EAAE,EAAE,WAAW,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAEvD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,wBAAwB,EAAE,CAAC;YAC1C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAEzD,MAAM,EAAE,WAAW,EAAE,oBAAoB,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;YAEhF,eAAe,CAAC,WAAW,CAAC,CAAC;YAE7B,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;YACjC,qBAAqB,CAAC,WAAW,CAAC,CAAC;YAEnC,IAAI,oBAAoB,EAAE,CAAC;gBACzB,MAAM,CAAC,kBAAkB,CAAC,oBAAoB,CAAC,CAAC;gBAChD,2BAA2B,CAAC,oBAAoB,CAAC,CAAC;YACpD,CAAC;YAED,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;gBAC3B,YAAY,CAAC,iBAAiB,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;YACzD,CAAC;YAED,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAC;YAE5E,2BAA2B,CAAC,OAAO,IAAI,CAAC,CAAC;YACzC,OAAO,CAAC;gBACN,GAAG,gBAAgB;gBACnB,WAAW;gBACX,WAAW,EAAE,WAAW,CAAC,OAAO;gBAChC,aAAa,EAAE;oBACb,aAAa,EAAE,OAAO,CAAC,OAAO;oBAC9B,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,oBAAoB;oBACpB,cAAc;oBACd,kBAAkB,EAAE,OAAO,CAAC,SAAS,EAAE,YAAY;oBACnD,aAAa,EAAE,OAAO,CAAC,aAAa;iBACrC;gBACD,eAAe,EAAE,IAAI;aACtB,CAAC,CAAC;YAEH,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;YACjC,QAAQ,CAAC,mCAAmC,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;QAClF,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YAChB,MAAM,GAAG,GAAG,wBAAwB,CAAC,CAAC,CAAC,CAAC;YACxC,WAAW,CAAC,CAAC,EAAE,+BAA+B,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC;YAClE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YACvD,MAAM,CAAC,CAAC;QACV,CAAC;IACH,CAAC,EAAE,CAAC,YAAY,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAC,CAAC;IAEhI;;;;;;;;;;;;;OAaG;IACH,MAAM,gCAAgC,GAAG,MAAM,CAAgB,IAAI,CAAC,CAAC;IACrE,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,gBAAgB,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1F,IAAI,gBAAgB,EAAE,CAAC;YACrB,yBAAyB,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,KAAK,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC;YACpG,gCAAgC,CAAC,OAAO,GAAG,gBAAgB,CAAC;YAC5D,OAAO;QACT,CAAC;QACD,IAAI,gCAAgC,CAAC,OAAO,KAAK,IAAI,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YAC1E,uBAAuB,EAAE,CAAC;YAC1B,gCAAgC,CAAC,OAAO,GAAG,IAAI,CAAC;QAClD,CAAC;IACH,CAAC,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC;IAExF,MAAM,MAAM,GAAG,WAAW,CAAC,GAAS,EAAE;QACpC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;QAC7B,2BAA2B,CAAC,OAAO,IAAI,CAAC,CAAC;QAEzC,yEAAyE;QACzE,qEAAqE;QACrE,yEAAyE;QACzE,gEAAgE;QAChE,wEAAwE;QACxE,wEAAwE;QACxE,oEAAoE;QACpE,qEAAqE;QACrE,8BAA8B;QAC9B,wBAAwB,EAAE;aACvB,iBAAiB,EAAE;aACnB,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;YACX,MAAM,CAAC,IAAI,CAAC,+CAA+C,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC,CAAC,CAAC;QAEL,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE7D,UAAU,EAAE,CAAC;QAEb,qFAAqF;QACrF,wBAAwB,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACpD,wBAAwB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QAC9C,2BAA2B,CAAC,IAAI,CAAC,CAAC;QAClC,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAE5B,YAAY,CAAC,KAAK,EAAE,CAAC;QACrB,qGAAqG;QACrG,qGAAqG;QACrG,uBAAuB,EAAE,CAAC;QAC1B,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAE1B,iBAAiB,CAAC,OAAO,GAAG,KAAK,CAAC;QAElC,MAAM,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC9C,CAAC,EAAE,CAAC,UAAU,EAAE,YAAY,EAAE,qBAAqB,EAAE,2BAA2B,CAAC,CAAC,CAAC;IAEnF;;;;;;;;OAQG;IACH,MAAM,gCAAgC,GAAG,WAAW,CAAC,GAAS,EAAE;QAC9D,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,2BAA2B,KAAK,SAAS;YACvD,CAAC,CAAC,CAAC;YACH,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,2BAA2B,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IACzD,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP;;OAEG;IACH,MAAM,mBAAmB,GAAG,WAAW,CAAC,GAAS,EAAE;QACjD,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACZ,GAAG,CAAC;YACJ,eAAe,EAAE,IAAI;YACrB,kBAAkB,EAAE,KAAK;SAC1B,CAAC,CAAC,CAAC;IACN,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP;;OAEG;IACH,MAAM,mBAAmB,GAAG,WAAW,CAAC,CAAC,WAAoB,EAAQ,EAAE;QACrE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACZ,GAAG,CAAC;YACJ,kBAAkB,EAAE,WAAW;SAChC,CAAC,CAAC,CAAC;IACN,CAAC,EAAE,EAAE,CAAC,CAAC;IAEP,4EAA4E;IAC5E,0CAA0C;IAC1C,4EAA4E;IAE5E;;;;;;OAMG;IACH,MAAM,mBAAmB,GAAG,WAAW,CAAC,KAAK,IAAqB,EAAE;QAClE,kEAAkE;QAClE,IAAI,kBAAkB,CAAC,OAAO,EAAE,CAAC;YAC/B,MAAM,CAAC,KAAK,CAAC,iEAAiE,CAAC,CAAC;YAChF,OAAO,kBAAkB,CAAC,OAAO,CAAC;QACpC,CAAC;QAED,0EAA0E;QAC1E,qEAAqE;QACrE,yEAAyE;QACzE,oDAAoD;QACpD,MAAM,gBAAgB,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;QAEvD,4EAA4E;QAC5E,4EAA4E;QAC5E,wEAAwE;QACxE,8DAA8D;QAC9D,MAAM,2BAA2B,GAAG,GAAkB,EAAE;YACtD,MAAM,OAAO,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;YAC9C,IAAI,OAAO,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;gBAC5C,wBAAwB,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;gBACjD,qBAAqB,CAAC,OAAO,CAAC,CAAC;gBAC/B,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;gBAC/E,oBAAoB,CAAC,OAAO,CAAC,CAAC;gBAC9B,MAAM,CAAC,KAAK,CAAC,0EAA0E,CAAC,CAAC;gBACzF,OAAO,OAAO,CAAC;YACjB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC;QAEF,4EAA4E;QAC5E,uEAAuE;QACvE,MAAM,qBAAqB,GAAG,KAAK,IAAqB,EAAE;YACxD,yEAAyE;YACzE,mEAAmE;YACnE,yEAAyE;YACzE,8CAA8C;YAC9C,MAAM,CAAC,KAAK,CAAC,4BAA4B,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,MAAM,wBAAwB,EAAE,CAAC,aAAa,EAAE,CAAC;YAEhE,wEAAwE;YACxE,uEAAuE;YACvE,yEAAyE;YACzE,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAEpC,wBAAwB,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC5D,qBAAqB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAE1C,4DAA4D;YAC5D,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACZ,GAAG,CAAC;gBACJ,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC,CAAC,CAAC,CAAC;YAEJ,uEAAuE;YACvE,yEAAyE;YACzE,wEAAwE;YACxE,mBAAmB,CAAC,OAAO,EAAE,WAAW,CAAC;gBACvC,IAAI,EAAE,iBAAiB;gBACvB,WAAW,EAAE,MAAM,CAAC,WAAW;aAChC,CAAC,CAAC;YAEH,MAAM,CAAC,KAAK,CAAC,wDAAwD,CAAC,CAAC;YACvE,oBAAoB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACzC,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC,CAAC;QAEF,uDAAuD;QACvD,EAAE;QACF,yEAAyE;QACzE,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,uEAAuE;QACvE,wEAAwE;QACxE,0EAA0E;QAC1E,wEAAwE;QACxE,2EAA2E;QAC3E,4EAA4E;QAC5E,mEAAmE;QACnE,MAAM,SAAS,GAAG,KAAK,IAAqB,EAAE;YAC5C,MAAM,KAAK,GAAG,OAAO,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7E,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;gBACpB,OAAO,qBAAqB,EAAE,CAAC;YACjC,CAAC;YACD,OAAO,KAAK,CAAC,OAAO,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE;gBACpD,MAAM,OAAO,GAAG,2BAA2B,EAAE,CAAC;gBAC9C,IAAI,OAAO;oBAAE,OAAO,OAAO,CAAC;gBAC5B,OAAO,qBAAqB,EAAE,CAAC;YACjC,CAAC,CAAC,CAAC;QACL,CAAC,CAAC;QAEF,gEAAgE;QAChE,kBAAkB,CAAC,OAAO,GAAG,SAAS,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACpD,kBAAkB,CAAC,OAAO,GAAG,IAAI,CAAC;QACpC,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,OAAO,MAAM,kBAAkB,CAAC,OAAO,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,+DAA+D;YAC/D,qEAAqE;YACrE,oEAAoE;YACpE,sEAAsE;YACtE,uEAAuE;YACvE,yEAAyE;YACzE,wEAAwE;YACxE,kEAAkE;YAClE,MAAM,aAAa,GAAG,+BAA+B,CAAC,KAAK,CAAC,CAAC;YAC7D,MAAM,UAAU,GAAG,mBAAmB,EAAE,CAAC;YAEzC,IAAI,aAAa,IAAI,CAAC,UAAU,EAAE,CAAC;gBACjC,MAAM,CAAC,IAAI,CAAC,8EAA8E,EAAE;oBAC1F,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC;wBAC/B,CAAC,CAAC,KAAK,CAAC,sBAAsB;wBAC9B,CAAC,CAAC,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;iBAC/D,CAAC,CAAC;gBACH,MAAM,EAAE,CAAC;YACX,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,CACT,qFAAqF,EACrF;oBACE,aAAa;oBACb,UAAU;oBACV,MAAM,EAAE,aAAa;wBACnB,CAAC,CAAC,6EAA6E;wBAC/E,CAAC,CAAC,0FAA0F;iBAC/F,CACF,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC,EAAE,CAAC,qBAAqB,EAAE,MAAM,EAAE,oBAAoB,EAAE,YAAY,CAAC,CAAC,CAAC;IAExE,8EAA8E;IAC9E,iFAAiF;IACjF,6CAA6C;IAC7C,SAAS,CAAC,GAAG,EAAE;QACb,sBAAsB,CAAC,OAAO,GAAG,mBAAmB,CAAC;QACrD,wBAAwB,EAAE,CAAC,sBAAsB,CAAC,mBAAmB,CAAC,CAAC;QACvE,+BAA+B,CAAC,mBAAmB,CAAC,CAAC;IACvD,CAAC,EAAE,CAAC,mBAAmB,EAAE,+BAA+B,CAAC,CAAC,CAAC;IAE3D,qDAAqD;IACrD,4EAA4E;IAC5E,sFAAsF;IACtF,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,OAAO,gBAAgB,KAAK,WAAW;YAAE,OAAO;QAEpD,MAAM,OAAO,GAAG,IAAI,gBAAgB,CAAC,mBAAmB,CAAC,CAAC;QAC1D,mBAAmB,CAAC,OAAO,GAAG,OAAO,CAAC;QAEtC,OAAO,CAAC,SAAS,GAAG,CAAC,KAAmB,EAAE,EAAE;YAC1C,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC;YAE/C,IAAI,IAAI,KAAK,iBAAiB,IAAI,WAAW,EAAE,CAAC;gBAC9C,4DAA4D;gBAC5D,8DAA8D;gBAC9D,gEAAgE;gBAChE,4DAA4D;gBAC5D,6DAA6D;gBAC7D,8DAA8D;gBAC9D,+DAA+D;gBAC/D,8DAA8D;gBAC9D,MAAM,CAAC,KAAK,CAAC,wEAAwE,CAAC,CAAC;gBACvF,eAAe,CAAC,WAAW,CAAC,CAAC;gBAC7B,wBAAwB,EAAE,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;gBACrD,qBAAqB,CAAC,WAAW,CAAC,CAAC;gBACnC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;gBACtC,oBAAoB,CAAC,WAAW,CAAC,CAAC;YACpC,CAAC;YAED,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtB,QAAQ,CAAC,yCAAyC,CAAC,CAAC;gBACpD,2BAA2B,CAAC,OAAO,IAAI,CAAC,CAAC;gBACzC,UAAU,EAAE,CAAC;gBACb,YAAY,CAAC,KAAK,EAAE,CAAC;gBACrB,wBAAwB,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC;gBACpD,2BAA2B,CAAC,IAAI,CAAC,CAAC;gBAClC,eAAe,CAAC,IAAI,CAAC,CAAC;gBACtB,wBAAwB,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;gBAC9C,qBAAqB,CAAC,IAAI,CAAC,CAAC;gBAC5B,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC;QAEF,OAAO,GAAG,EAAE;YACV,OAAO,CAAC,KAAK,EAAE,CAAC;YAChB,mBAAmB,CAAC,OAAO,GAAG,IAAI,CAAC;QACrC,CAAC,CAAC;IACJ,CAAC,EAAE,CAAC,qBAAqB,EAAE,2BAA2B,EAAE,UAAU,EAAE,oBAAoB,EAAE,YAAY,CAAC,CAAC,CAAC;IAEzG,iDAAiD;IACjD,SAAS,CAAC,GAAG,EAAE;QACb,mCAAmC;QACnC,IAAI,iBAAiB,CAAC,OAAO,EAAE,CAAC;YAC9B,OAAO;QACT,CAAC;QAED,qEAAqE;QACrE,wDAAwD;QACxD,gEAAgE;QAChE,iEAAiE;QACjE,mEAAmE;QACnE,iCAAiC;QACjC,MAAM,iBAAiB,GAAG,YAAY,CAAC,cAAc,EAAE,CAAC;QAExD,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACvB,QAAQ,CAAC,8BAA8B,CAAC,CAAC;YACzC,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;YACjC,OAAO;QACT,CAAC;QAED,QAAQ,CAAC,oDAAoD,CAAC,CAAC;QAC/D,iBAAiB,CAAC,OAAO,GAAG,IAAI,CAAC;QAEjC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACZ,GAAG,CAAC;YACJ,WAAW,EAAE,iBAAiB;YAC9B,kBAAkB,EAAE,IAAI;SACzB,CAAC,CAAC,CAAC;QAEJ,wBAAwB,EAAE,CAAC,YAAY,CAAC,iBAAiB,CAAC,CAAC;QAC3D,qBAAqB,CAAC,iBAAiB,CAAC,CAAC;QAEzC,iFAAiF;IACnF,CAAC,EAAE,CAAC,qBAAqB,EAAE,YAAY,CAAC,CAAC,CAAC;IAE1C,MAAM,KAAK,GAAG,OAAO,CAAyB,GAAG,EAAE,CAAC,CAAC;QACnD,IAAI;QACJ,YAAY;QAEZ,yBAAyB;QACzB,eAAe;QACf,wBAAwB;QACxB,YAAY;QACZ,eAAe;QACf,eAAe;QACf,MAAM;QAEN,wEAAwE;QACxE,mBAAmB;QACnB,sBAAsB;QAEtB,qBAAqB;QACrB,uBAAuB;QACvB,gBAAgB;QAChB,eAAe;QAEf,0BAA0B;QAC1B,qBAAqB;QAErB,mBAAmB;QACnB,eAAe;QACf,yBAAyB;QACzB,sBAAsB;QACtB,8BAA8B;QAC9B,yBAAyB;QACzB,6BAA6B;QAC7B,iBAAiB;QACjB,iBAAiB;QAEjB,mCAAmC;QACnC,yBAAyB;QAEzB,oEAAoE;QACpE,gCAAgC;QAEhC,qBAAqB;QACrB,mBAAmB;QACnB,mBAAmB;QAEnB,YAAY;QACZ,gBAAgB;QAChB,wBAAwB;KACzB,CAAC,EAAE;QACF,IAAI;QACJ,YAAY;QACZ,MAAM;QACN,mBAAmB;QACnB,sBAAsB;QACtB,uBAAuB;QACvB,gBAAgB;QAChB,eAAe;QACf,qBAAqB;QACrB,eAAe;QACf,yBAAyB;QACzB,sBAAsB;QACtB,8BAA8B;QAC9B,yBAAyB;QACzB,6BAA6B;QAC7B,iBAAiB;QACjB,iBAAiB;QACjB,yBAAyB;QACzB,gCAAgC;QAChC,mBAAmB;QACnB,mBAAmB;QACnB,gBAAgB;QAChB,wBAAwB;KACzB,CAAC,CAAC;IAEH,OAAO,KAAC,kBAAkB,CAAC,QAAQ,IAAC,KAAK,EAAE,KAAK,YAAG,QAAQ,GAA+B,CAAC;AAC7F,CAAC,CAAC","sourcesContent":["import React, { createContext, useState, ReactNode, useMemo, useEffect, useCallback, useRef } from 'react';\nimport { startAuthentication, WebAuthnAbortService } from '@simplewebauthn/browser';\nimport type { PublicKeyCredentialRequestOptionsJSON } from '@simplewebauthn/browser';\nimport {\n AuthNextStep,\n AuthenticationResponse,\n AuthIdentificationResponse,\n AuthenticationRequest,\n AuthMethod,\n AuthFactorLevel,\n AuthSessionPurpose,\n AuthenticationSessionState,\n SessionType,\n isWildoBackendError,\n type OnboardingObligation,\n} from '@wildo-ai/saas-models';\n\n/*\n What an onboarding completion came to (#1374): the account signed in, or the session is still parked and owes\n * `pendingObligations` next. The onboarding step renders the next step from it.\n /\nexport interface OnboardingCompletionOutcome {\n signedIn: boolean;\n pendingObligations: OnboardingObligation[];\n}\nimport {\n getManualCallsHttpClient,\n type EnrollmentSessionSettlementResponse,\n type OnboardingCompletionResponse,\n type RegisterAccountRequest,\n} from '~wildo-frontend-lib/core/requests/wildo-http-client-manual-calls.frontend.service';\nimport { classifyRegistrationOutcome, RegistrationOutcome } from '~wildo-frontend-lib/core/security/registration-outcome.frontend.utils';\nimport { isSpentOrganizationOnboardingSession, parkedOrganizationOnboardingSessionId } from '~wildo-frontend-lib/core/security/organization-onboarding.frontend.utils';\nimport { forgetPendingMfaSession, rememberPendingMfaSession } from '~wildo-frontend-lib/core/security/pending-mfa-session-storage.frontend.utils';\nimport { isAuthoritativeRefreshRejection, isRefreshDevLenient } from '~wildo-frontend-lib/core/requests/auth-refresh-resilience.frontend';\nimport { useResourceRegistry } from '~wildo-frontend-lib/core/resources/useResourceRegistry';\nimport { useI18n } from '~wildo-frontend-lib/core/i18n/useI18n';\nimport { resolveComponentLabel } from '~wildo-frontend-lib/core/i18n/component-label-resolution.utils';\nimport { LoggerFrontendService } from '~wildo-frontend-lib/core/monitoring/logger.frontend.service';\nimport { useError } from '~wildo-frontend-lib/core/errors/useError';\nimport { useUserFacingErrorMessage } from '~wildo-frontend-lib/core/errors/useUserFacingErrorMessage';\nimport { useApplication } from '~wildo-frontend-lib/core/runtime/useApplication';\nimport { useWebSocket } from '~wildo-frontend-lib/core/requests/websockets/useWebSocket';\nimport { useAnonymousSession } from '~wildo-frontend-lib/core/security/AnonymousSessionContext';\nimport {\n AuthState,\n EMPTY_AUTH_STATE,\n type UIFactorLevel,\n authFactorLevelForUiLevel,\n PasskeyAutofillExpiredError, PasskeyAutofillSupersededError,\n PasskeySignInMediation,\n} from './security.frontend.schemas';\nimport {\n type SessionTokenStorage,\n PersistentSessionTokenStorage,\n} from './session-token-storage.frontend.service';\nimport { FrontendComponentType, MfaChallengeLabel, UserAuthLabel } from '@wildo-ai/presets-components-models';\n\nconst logger: LoggerFrontendService = LoggerFrontendService.getLogger();\nconst logDebug: (message: string, context?: Record<string, unknown>) => void = logger.debugByType('AuthSessionContext');\nlogger.setDebugTypeLogging('AuthSessionContext', false);\n\n/\n The session states on which the server still admits second-factor work — a challenge or an enrollment\n * ceremony. Mirrors the admission in `auth-jwt-guard.backend.service.ts` (`extractFromSessionOrJwt`), so\n * the client never adopts a session the server would refuse to act on.\n /\nconst SECOND_FACTOR_PENDING_SESSION_STATES: ReadonlySet<AuthenticationSessionState> = new Set([\n AuthenticationSessionState.MFA_REQUIRED,\n AuthenticationSessionState.MFA_ENROLLMENT_REQUIRED,\n]);\n\n/\n The fields of `GET /auth/session/:sessionId` that describe a session still owing a second factor: its\n * state, which decides adoption, and the four method lists an MFA-required authentication RESPONSE\n * carries, so a session recovered by id lands in exactly the auth state a session produced by a call would.\n /\nexport interface PendingMfaSessionState {\n state?: AuthenticationSessionState;\n availableSecondFactorMethods?: AuthState['availableMfaMethods'];\n availableEnrollmentMethods?: AuthState['availableEnrollmentMethods'];\n enrolledSecondFactorMethods?: AuthState['enrolledSecondFactorMethods'];\n usableSecondFactorMethods?: AuthState['usableSecondFactorMethods'];\n}\n\n/\n Auth Session Context\n * Manages authentication, session lifecycle, and WebSocket connection\n /\n\nexport interface AuthSessionContextType {\n // Auth state\n auth: AuthState;\n\n // Token storage strategy (persistent or ephemeral)\n tokenStorage: SessionTokenStorage;\n\n // Authentication methods\n identifyByEmail: (email: string) => Promise<AuthIdentificationResponse>;\n authenticateWithPassword: (email: string, password: string) => Promise<AuthenticationResponse>;\n authenticate: (request: AuthenticationRequest) => Promise<AuthenticationResponse>;\n getSessionState: (sessionId: string) => Promise<any>;\n isAuthenticated: () => boolean;\n logout: () => void;\n\n // OAuth2 methods\n /\n Begin a federated sign-in, carrying any governed-document releases the person accepted first.\n \n The ids are optional and absent for every sign-IN — a returning user is accepting nothing. A\n * SIGN-UP surface passes what the acceptance control gathered, and the backend stores them in the\n * server-side OAuth state token so they cannot be edited on the way to the provider and back\n * (#1383).\n /\n initiateOAuth2Login: (providerRef: string, returnUrl?: string, acceptedGovernedDocumentReleaseIds?: readonly string[]) => Promise<void>;\n handleAuthCodeExchange: (code: string) => Promise<void>;\n\n // Email verification (auto-login after registration)\n handleEmailVerification: (token: string, email: string) => Promise<void>;\n\n // Invitation acceptance. Returns the PASSKEY-at-accept WebAuthn challenge when the invitee\n // chose passkey and a session was issued (caller runs the ceremony + verify), and `signInRequired` when the invitation\n // was accepted but no session was issued (#1158).\n acceptInvitation: (params: { invitationToken: string; firstName?: string; lastName?: string; password?: string; credentialMethod?: AuthMethod }) => Promise<{ passkeyRegistrationOptions?: Record<string, unknown>; signInRequired?: boolean }>;\n\n /\n Public registration (#972). Submits the registration, classifies the answer once, adopts the auth\n * state that outcome implies — a signed-in session, or a registration session parked at the\n * second-factor enrollment gate — and returns the outcome for the screen to render. Every other\n * outcome changes no auth state. Errors propagate unhandled: the registration form renders them\n * inline, field by field.\n /\n registerAccount: (params: RegisterAccountRequest) => Promise<RegistrationOutcome>;\n\n // Magic link verification (passwordless login)\n handleMagicLinkVerify: (token: string, email: string) => Promise<AuthenticationResponse>;\n\n // MFA second factor verification\n handleMfaVerify: (sessionId: string, method: AuthMethod, code: string) => Promise<AuthenticationResponse>;\n\n /\n Adopt the outcome of an MFA enrollment ceremony. When the ceremony COMPLETED a registration or\n * invitation session (its response carried an access token; the refresh token arrived as a cookie),\n * this signs the user in exactly as a completed MFA challenge does and returns `true`. When it parked the\n * session at organization onboarding (#1090), this adopts the parked session and also returns `true`: the\n * onboarding step, not the challenge, is where the person goes next. Returns `false` — changing nothing —\n * for any other outcome, so the caller keeps routing (a login session goes on to the challenge).\n /\n completeEnrollmentSession: (settlement: EnrollmentSessionSettlementResponse \| undefined) => boolean;\n\n /\n Adopt a server-side session that still owes a second factor, recovered by its id rather than\n * produced by a response this context handled (#1033). Every other path into `mfaRequired` is a\n * response to a call made here; a hard load of an auth route has made no call, so the in-memory\n * state is empty while the session it names is valid. Returns `true` and populates the MFA state\n * when the session is in a state the server still admits second-factor work on (`MFA_REQUIRED`,\n * `MFA_ENROLLMENT_REQUIRED`); returns `false` — changing nothing — otherwise.\n /\n adoptPendingMfaSession: (sessionId: string, sessionState: PendingMfaSessionState \| null \| undefined) => boolean;\n\n /\n Name the organization the account parked at onboarding owes (`auth.onboardingSessionId`), and sign it in\n * (#1090). On success the tokens are adopted exactly as a completed sign-in adopts them and the parked\n * session is cleared. Errors propagate for the onboarding step to render. A SPENT session (expired, or\n * completed elsewhere) is also forgotten, since it can never complete; any other refusal keeps it parked so\n * the person can retry. After a spent session the person signs in again and, the obligation being durable,\n * comes straight back (#1091).\n /\n completeOrganizationOnboarding: (organizationName: string) => Promise<OnboardingCompletionOutcome>;\n\n /\n Give the names the account parked at onboarding owes (#1374), for a user type that collects them after the\n * address is proven. Same contract as {@link completeOrganizationOnboarding}: signs in when nothing else is owed,\n * otherwise leaves the session parked and answers what remains.\n /\n completeProfileOnboarding: (firstName: string, lastName: string) => Promise<OnboardingCompletionOutcome>;\n\n /\n Forget the session parked at organization onboarding without completing it, to sign in as someone else\n * (#1090). Every auth screen routes a parked context to the onboarding step, so without this a person who\n * reached it with the wrong account could not get back to sign-in short of a reload. Nothing is lost: the\n * obligation is durable on the server, so that account is returned to onboarding the next time it signs in.\n /\n abandonOrganizationOnboarding: () => void;\n\n // Passkey authentication (first or second factor)\n handlePasskeyAuth: (sessionId: string, factorLevel?: UIFactorLevel) => Promise<AuthenticationResponse>;\n /\n Username-less passkey sign-in: no email is typed, the device offers every account the person holds\n * a passkey for on this site, and the server signs in the account the chosen passkey belongs to.\n * `CONDITIONAL` is passkey autofill on the email field; `MODAL` is the explicit button.\n /\n signInWithPasskey: (mediation?: PasskeySignInMediation) => Promise<AuthenticationResponse>;\n\n // One-off session exchange (W7.3b)\n handleOneOffTokenExchange: (token: string) => Promise<void>;\n\n // Cross-frontend handoff context (cross-app-jwt-propagation Step 5)\n /\n Clears `auth.crossFrontendHandoffContext` after the receiving component\n * has consumed it for navigation. The context is single-use by design —\n * it describes \"you just landed via a handoff\", not an ongoing session\n * property. Leaving it set indefinitely would (a) leak handoff metadata\n * to telemetry hooks long after the navigation completed and (b) confuse\n * any subsequent handoff that arrives without one of the optional\n * fields (the receiver would read stale source/target identifiers).\n * Auth_OneOffSession calls this on unmount in cross-frontend-handoff\n * mode (see component for sequencing rationale).\n /\n clearCrossFrontendHandoffContext: () => void;\n\n // Session management\n markSessionRestored: () => void;\n setSessionRestoring: (isRestoring: boolean) => void;\n\n // WebSocket\n connectWebSocket: (token: string, organizationId?: string \| null, consumableToken?: string \| null) => void;\n notifyOrganizationSwitch: (newOrgId: string, previousOrgId: string) => void;\n}\n\n/\n AuthSession Context\n * @internal - Use useAuthSession() hook instead of accessing this directly\n /\nexport const AuthSessionContext: React.Context<AuthSessionContextType \| undefined> = createContext<AuthSessionContextType \| undefined>(undefined);\n\n/\n How long before its challenge expires a waiting autofill request is stopped and restarted. Long enough\n * for the restart's request to land and a fresh challenge to be issued before the old one is gone.\n /\nconst PASSKEY_AUTOFILL_REARM_MARGIN_MS = 15_000;\n\n/\n Tell the browser a passkey is unknown to this application, so it stops offering it.\n \n Feature-detected and best-effort: `PublicKeyCredential.signalUnknownCredential` is a WebAuthn Level 3\n * addition not every browser ships, and a browser that cannot hear the signal loses nothing — the\n * sign-in already failed. Called only when the server said the credential is UNKNOWN, never on a\n * signature or user-verification refusal, which would hide a passkey the application still holds.\n \n spec-cite: https://web.dev/articles/passkey-form-autofill — `PublicKeyCredential.signalUnknownCredential()`: \"Call this static method on the client-side if your server indicates that a presented credential ID is unknown.\"\n /\nfunction signalUnknownPasskeyCredential(rpId: string \| undefined, credentialId: string): void {\n const credentialApi = (globalThis as { PublicKeyCredential?: { signalUnknownCredential?: (input: { rpId: string; credentialId: string }) => Promise<void> } }).PublicKeyCredential;\n if (!rpId \|\| typeof credentialApi?.signalUnknownCredential !== 'function') return;\n void credentialApi.signalUnknownCredential({ rpId, credentialId }).catch(() => undefined);\n}\n\nexport const AuthSessionProvider: React.FC<{\n children: ReactNode;\n tokenStorage?: SessionTokenStorage;\n}> = ({ children, tokenStorage: tokenStorageProp }) => {\n const tokenStorage = useMemo(\n () => tokenStorageProp ?? new PersistentSessionTokenStorage(),\n [tokenStorageProp]\n );\n const { setAuthToken: setResourcesAuthToken, setTokenRenewalHandler: setResourcesTokenRenewalHandler, setConsumableToken: setResourcesConsumableToken } = useResourceRegistry();\n const { handleError } = useError();\n const { tComponent, isReady } = useI18n({ component: [FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH, FrontendComponentType.PUBLIC_LAYOUTS_MFA_CHALLENGE] });\n // `auth.error` is rendered verbatim by the auth screens, so every failure written into it goes through\n // the shared resolver: localized, and never the error's raw `message` / server `details.message`.\n const toUserFacingErrorMessage = useUserFacingErrorMessage();\n /* The MFA surface's own words for a failed second factor, used where the error names nothing more precise. /\n const mfaFailureLabel = useCallback(\n () => resolveComponentLabel({ tComponent, componentType: FrontendComponentType.PUBLIC_LAYOUTS_MFA_CHALLENGE, key: MfaChallengeLabel.ERROR_GENERIC }),\n [tComponent],\n );\n const { appConfig } = useApplication();\n const { connect, disconnect, refreshAuth: refreshWebSocketAuth, switchOrganization: wsSwitchOrganization } = useWebSocket();\n const { clearAnonymousSession } = useAnonymousSession();\n const hasInitializedRef = useRef(false);\n const broadcastChannelRef = useRef<BroadcastChannel \| null>(null);\n const refreshInFlightRef = useRef<Promise<string> \| null>(null);\n // Identification owns account-specific methods, session and organization branding. Only the\n // latest request may publish them; logout or provider disposal retires outstanding requests.\n const identificationGenerationRef = useRef(0);\n /\n How many passkey ceremonies the PERSON started are open (the button, a second-factor passkey step).\n * An autofill ceremony checks it after its options arrive and steps aside rather than starting a\n * WebAuthn request that would abort their prompt.\n /\n const personStartedPasskeyCeremoniesRef = useRef(0);\n useEffect(() => () => { identificationGenerationRef.current += 1; }, []);\n // Holds the latest `tokenRenewalHandler` so `connectWebSocket` (defined far\n // earlier in this component) can hand the WebSocket layer a stable\n // `onAuthenticationError` callback without a definition-order / stale-closure\n // dependency on the handler. Kept current by the registration effect below.\n const tokenRenewalHandlerRef = useRef<(() => Promise<string>) \| null>(null);\n\n const [auth, setAuth] = useState<AuthState>({\n ...EMPTY_AUTH_STATE,\n accessToken: tokenStorage.getAccessToken(),\n // Auth-hardening Slice A Step 6 (2026-04-13) — `AuthState` no\n // longer carries a `refreshToken` field. The refresh token lives\n // exclusively in the `__wildo_refresh` `HttpOnly` cookie (set by\n // the backend, scoped `Path=/api/v1/auth`). `EphemeralSessionTokenStorage`\n // may still hold a value for one-off / test contexts via its own\n // in-memory slot but `AuthSessionContext` deliberately never\n // mirrors it into React state — the cookie is the sole source of\n // truth for the rotation channel.\n });\n\n /\n Auth-hardening Slice A Step 3 (2026-04-13) — `storeAuthTokens` now only\n * carries the access token. The refresh token travels via the\n * `__wildo_refresh` `HttpOnly` cookie (set by the backend on every issuance\n * / rotation, scoped `Path=/api/v1/auth`). We pass `null` to\n * `tokenStorage.storeTokens` so any stale localStorage refresh token from a\n * pre-migration session is wiped on the next call (and `EphemeralSessionTokenStorage`\n * stops accumulating an in-memory value that nothing reads).\n /\n const storeAuthTokens = (accessToken: string \| null): void => {\n tokenStorage.storeTokens(accessToken, null);\n if (accessToken) {\n clearAnonymousSession();\n }\n };\n\n /\n An answer parked the account at organization onboarding (#1090): remember the session the onboarding step\n * completes on, and drop every second-factor continuation — nothing more is owed there, and a leftover\n * `mfaRequired` would send the screens to a challenge. Nothing is signed in and no token is touched.\n /\n const adoptOrganizationOnboardingSession = (sessionId: string): void => {\n setAuth(a => ({\n ...a,\n isLoading: false,\n error: null,\n sessionId: null,\n onboardingSessionId: sessionId,\n mfaRequired: false,\n mfaSessionId: null,\n availableMfaMethods: [],\n availableEnrollmentMethods: [],\n enrolledSecondFactorMethods: [],\n usableSecondFactorMethods: [],\n }));\n };\n\n /\n Derive WebSocket URL from appConfig runtime endpoints\n \n IMPORTANT: Always use publicUrl (never internalUrl) since browsers cannot access\n * internal Kubernetes service URLs. The publicUrl is the Traefik ingress URL\n * that the browser can reach.\n \n Returns null if URL cannot be derived - WebSocket should not connect in this case.\n /\n const deriveWebSocketUrl = useCallback((): string \| null => {\n if (!appConfig?.runtime?.endPoints?.main_backend_api) {\n logger.warn('WebSocket: Cannot derive URL - appConfig.runtime.endPoints.main_backend_api not available');\n return null;\n }\n\n const backendUrl = appConfig.runtime.endPoints.main_backend_api;\n // CRITICAL: Always use publicUrl for WebSocket connections from browser\n // internalUrl is only accessible within the Kubernetes cluster\n const urlString = backendUrl.publicUrl;\n\n if (!urlString) {\n logger.warn('WebSocket: Cannot derive URL - publicUrl not available in main_backend_api config');\n return null;\n }\n\n // Convert http:// to ws:// and https:// to wss://\n // IMPORTANT: Do NOT append /socket.io to the URL - Socket.IO automatically\n // uses /socket.io as the engine.io path. If we include it here, Socket.IO\n // interprets it as a namespace, causing \"Invalid namespace\" errors.\n const wsUrl = urlString.replace(/^http/, 'ws');\n return wsUrl;\n }, [appConfig]);\n\n /\n Connect WebSocket with current authentication token\n * Only connects if URL is available and token is valid\n /\n const connectWebSocket = useCallback((token: string, organizationId?: string \| null, consumableToken?: string \| null): void => {\n if (!token) {\n logDebug('WebSocket: Cannot connect - no token provided');\n return;\n }\n\n const wsUrl = deriveWebSocketUrl();\n\n if (!wsUrl) {\n logDebug('WebSocket: Cannot connect - URL is not available');\n return;\n }\n\n try {\n connect({\n url: wsUrl,\n token,\n organizationId: organizationId \|\| undefined,\n consumableToken: consumableToken \|\| undefined,\n autoReconnect: true,\n // Base retry delay only — the transport grows it exponentially toward its\n // 30s cap (see WebSocketContext.performActualConnect). A large budget plus\n // the connectivity supervisor (online / visibility / watchdog re-arm) means\n // the socket recovers indefinitely instead of dying after a handful of\n // attempts, so these are resilient defaults rather than a hard ceiling.\n reconnectInterval: 1000,\n maxReconnectAttempts: 15,\n // Self-heal an expired access token WITHOUT depending on HTTP traffic or\n // window focus. When the handshake is rejected for auth, the WS layer\n // calls this; `tokenRenewalHandler` performs the resilient refresh and,\n // on success, seeds the fresh token back into the socket via\n // `refreshWebSocketAuth`, so the next reconnect handshake succeeds. This\n // keeps a backgrounded/unfocused tab's real-time background jobs flowing\n // across token expiry. Read via ref because the handler is defined after\n // this callback (see `tokenRenewalHandlerRef`).\n onAuthenticationError: () => tokenRenewalHandlerRef.current?.(),\n });\n logDebug('WebSocket connection initiated', { wsUrl });\n } catch (error) {\n logger.warn('Failed to connect WebSocket', { error });\n }\n }, [connect, deriveWebSocketUrl]);\n\n /\n Notify WebSocket of organization switch\n /\n const notifyOrganizationSwitch = useCallback((newOrgId: string, previousOrgId: string): void => {\n wsSwitchOrganization(newOrgId, previousOrgId);\n }, [wsSwitchOrganization]);\n\n const identifyByEmail = async (email: string): Promise<AuthIdentificationResponse> => {\n const generation = ++identificationGenerationRef.current;\n // Starting a sign-in abandons any session this tab still remembers as owing a factor — possibly another\n // person's, in a shared tab. Explicit for the same hard-load reason `logout` gives (#1068).\n forgetPendingMfaSession();\n setAuth(a => ({\n ...a,\n isLoading: true,\n error: null,\n identification: null,\n sessionId: null,\n sessionState: null,\n onboardingSessionId: null,\n mfaRequired: false,\n mfaSessionId: null,\n availableMfaMethods: [],\n availableEnrollmentMethods: [],\n enrolledSecondFactorMethods: [],\n usableSecondFactorMethods: [],\n }));\n logDebug('Identifying user by email', { email });\n try {\n const resp = await getManualCallsHttpClient().identifyByEmail(email);\n\n if (generation !== identificationGenerationRef.current) return resp;\n\n logDebug('User identification successful', { sessionId: resp.sessionId });\n\n setAuth(a => generation !== identificationGenerationRef.current ? a : ({\n ...a,\n isLoading: false,\n identification: resp,\n sessionId: resp.sessionId,\n purpose: a.purpose ?? AuthSessionPurpose.LOGIN,\n }));\n\n return resp as AuthIdentificationResponse;\n } catch (e: any) {\n if (generation !== identificationGenerationRef.current) throw e;\n const msg = toUserFacingErrorMessage(e);\n handleError(e, 'Identification failed', { email, message: msg });\n setAuth(a => generation !== identificationGenerationRef.current ? a : ({ ...a, isLoading: false, error: msg }));\n throw e;\n }\n };\n\n /\n Adopt a factor-completion response that did not stop at an MFA challenge — shared by\n * `authenticateWithPassword` and `authenticate`, which carried two copies of this until #1009.\n \n ## A response without a token never removes one (#1009)\n \n Since #971 exactly one of two concurrent completions of the same factor mints; the other answers\n * `success: false, retryAllowed: false`. One tab can send both — a double click, a retried request — and\n * nothing orders their responses. The copies this replaces wrote `storeAuthTokens(resp.accessToken \|\| null)`\n * and `accessToken: null` on EVERY response, so a losing answer arriving after the winning one erased the\n * token the winner had just stored and the screen read as signed out (the HttpOnly refresh cookie recovered\n * it on the next refresh, which is why it was degraded rather than a lockout).\n \n A token-less response carries no information about a session this tab already holds — it only says this\n * one request did not mint — so it changes nothing but the loading flag while a token is held. Removing a\n * token belongs to the two paths that DO carry that information: an explicit sign-out (including the\n * cross-tab `LOGOUT` broadcast) and a failed refresh. Held is read from the updater's own state, never from\n * the `auth` closure, which is the render the losing call was issued from and predates the winner.\n /\n const adoptFactorCompletionResponse = (resp: AuthenticationResponse, sessionId: string): void => {\n const accessToken = resp.accessToken \|\| null;\n\n if (!accessToken) {\n setAuth(a => (a.accessToken\n ? { ...a, isLoading: false }\n : { ...a, isLoading: false, sessionId: resp.success ? null : sessionId }));\n return;\n }\n\n storeAuthTokens(accessToken);\n getManualCallsHttpClient().setAuthToken(accessToken);\n setResourcesAuthToken(accessToken);\n\n if (resp.success) {\n setAuth(a => ({\n ...a,\n isLoading: false,\n accessToken,\n isRestoringSession: true,\n sessionRestored: false,\n sessionId: null,\n }));\n\n hasInitializedRef.current = true;\n } else {\n setAuth(a => ({\n ...a,\n isLoading: false,\n accessToken,\n sessionId,\n }));\n }\n };\n\n const authenticateWithPassword = async (email: string, password: string): Promise<AuthenticationResponse> => {\n setAuth(a => ({ ...a, isLoading: true, error: null }));\n logDebug('Authenticating with password', { email, sessionId: auth.sessionId });\n try {\n const sessionId = auth.sessionId;\n if (!sessionId) {\n const error = new Error('No active session. Please identify user first.');\n logger.warn('Authentication attempted without session', { email });\n throw error;\n }\n\n // Use the general authenticate endpoint with proper request structure\n const authRequest: AuthenticationRequest = {\n sessionId,\n method: AuthMethod.PASSWORD,\n factorLevel: AuthFactorLevel.FIRST,\n password,\n rememberMe: false,\n requestedIntegrations: []\n };\n\n const resp = await getManualCallsHttpClient().authenticate(authRequest);\n\n // #1091: a sign-in by an account that still owes its organization resumes onboarding instead of minting.\n const parkedOnboardingSessionId = parkedOrganizationOnboardingSessionId(resp);\n if (parkedOnboardingSessionId) {\n adoptOrganizationOnboardingSession(parkedOnboardingSessionId);\n return resp as AuthenticationResponse;\n }\n\n if (resp.requiresMFA && !resp.accessToken) {\n setAuth(a => ({\n ...a,\n isLoading: false,\n mfaRequired: true,\n mfaSessionId: resp.sessionId \|\| sessionId,\n availableMfaMethods: resp.availableMFAMethods \|\| [],\n availableEnrollmentMethods: resp.availableEnrollmentMethods \|\| [],\n enrolledSecondFactorMethods: resp.enrolledSecondFactorMethods \|\| [],\n usableSecondFactorMethods: resp.usableSecondFactorMethods \|\| [],\n }));\n return resp as AuthenticationResponse;\n }\n\n logDebug('Authentication successful', { success: resp.success, hasAccessToken: !!resp.accessToken });\n\n adoptFactorCompletionResponse(resp as AuthenticationResponse, sessionId);\n\n return resp as AuthenticationResponse;\n } catch (e: any) {\n const msg = toUserFacingErrorMessage(e);\n handleError(e, 'Authentication failed', { email, message: msg });\n setAuth(a => ({ ...a, isLoading: false, error: msg }));\n throw e;\n }\n };\n\n const authenticate = async (request: AuthenticationRequest): Promise<AuthenticationResponse> => {\n setAuth(a => ({ ...a, isLoading: true, error: null }));\n logDebug('Authenticating', { method: request.method, sessionId: request.sessionId \|\| auth.sessionId });\n try {\n const sessionId = request.sessionId \|\| auth.sessionId;\n if (!sessionId) {\n const error = new Error('No active session. Please identify user first.');\n logger.warn('Authentication attempted without session', { method: request.method });\n throw error;\n }\n\n const withSession = { ...request, sessionId } as AuthenticationRequest;\n const resp = await getManualCallsHttpClient().authenticate(withSession);\n\n // #1091: a sign-in by an account that still owes its organization resumes onboarding instead of minting.\n const parkedOnboardingSessionId = parkedOrganizationOnboardingSessionId(resp);\n if (parkedOnboardingSessionId) {\n adoptOrganizationOnboardingSession(parkedOnboardingSessionId);\n return resp as AuthenticationResponse;\n }\n\n if (resp.requiresMFA && !resp.accessToken) {\n setAuth(a => ({\n ...a,\n isLoading: false,\n mfaRequired: true,\n mfaSessionId: resp.sessionId \|\| sessionId,\n availableMfaMethods: resp.availableMFAMethods \|\| [],\n availableEnrollmentMethods: resp.availableEnrollmentMethods \|\| [],\n enrolledSecondFactorMethods: resp.enrolledSecondFactorMethods \|\| [],\n usableSecondFactorMethods: resp.usableSecondFactorMethods \|\| [],\n }));\n return resp;\n }\n\n logDebug('Authentication successful', { success: resp.success, hasAccessToken: !!resp.accessToken, method: request.method });\n\n adoptFactorCompletionResponse(resp, sessionId);\n\n return resp;\n } catch (e: any) {\n const msg = toUserFacingErrorMessage(e);\n handleError(e, 'Authentication failed', { method: request.method, message: msg });\n setAuth(a => ({ ...a, isLoading: false, error: msg }));\n throw e;\n }\n };\n\n const getSessionState = async (sessionId: string): Promise<any> => {\n logDebug('Getting session state', { sessionId });\n try {\n const sessionState = await getManualCallsHttpClient().getSessionState(sessionId);\n setAuth(a => ({ ...a, sessionState, purpose: sessionState?.purpose ?? a.purpose }));\n logDebug('Session state retrieved', { sessionId });\n return sessionState;\n } catch (e: any) {\n handleError(e, 'Failed to get session state', { sessionId });\n throw e;\n }\n };\n\n const isAuthenticated = (): boolean => {\n return !!auth.accessToken;\n };\n\n /\n Initiate OAuth2 login by redirecting to the provider's authorization page.\n * Calls GET /auth/oauth2/authorize/:providerRef to get the authorization URL,\n * then performs a full-page redirect to that URL.\n \n Browser-only flow. The framework targets web stacks exclusively (the engine's\n * value prop is sharing TypeScript across browser-rendered surfaces — SAAS_APP,\n * STATIC_WEBSITE, TECH_DOC), so no native-SDK / Capacitor / Electron variants\n * exist for this method.\n /\n const initiateOAuth2Login = useCallback(async (\n providerRef: string,\n returnUrl?: string,\n acceptedGovernedDocumentReleaseIds?: readonly string[],\n ): Promise<void> => {\n logDebug('Initiating OAuth2 login', { providerRef, returnUrl });\n setAuth(a => ({ ...a, isLoading: true, error: null }));\n try {\n const { authorizationUrl } = await getManualCallsHttpClient()\n .getOAuth2AuthorizationUrl(providerRef, returnUrl, undefined, acceptedGovernedDocumentReleaseIds);\n logDebug('Redirecting to OAuth2 provider', { providerRef, authorizationUrl });\n window.location.href = authorizationUrl;\n } catch (e: any) {\n const msg = toUserFacingErrorMessage(e);\n handleError(e, 'OAuth2 login initiation failed', { providerRef, message: msg });\n setAuth(a => ({ ...a, isLoading: false, error: msg }));\n throw e;\n }\n }, [handleError, toUserFacingErrorMessage]);\n\n /\n Exchange a single-use AUTH_CODE_EXCHANGE consumable token for a JWT pair\n * via `POST /auth/token/exchange` — or, for a federated sign-in the backend\n * parked because the account still owes its organization (#1103), for the\n * onboarding session it must complete (`auth.onboardingSessionId`; no token).\n \n Renamed from `handleOAuth2Callback` in cross-app-jwt-propagation\n * Step 5's deferred refactor pass — the method handles BOTH issuance\n * flows that mint AUTH_CODE_EXCHANGE codes, so the OAuth2-specific\n * naming was misleading:\n \n - OAuth2 callback (`AuthPage_AuthCallback` route): the backend\n * OAuth2 callback handler mints a code AFTER the user returns from\n * the IdP. The exchange response carries `{accessToken, expiresIn}`\n * only — the rotated refresh token lives in the `Set-Cookie:\n * __wildo_refresh=…` header (Auth-hardening A-Step 6 cookie-only\n * contract; pre-A-Step-6 the body also carried `refreshToken`).\n * - Cross-frontend handoff (`AuthPage_AuthExchange` route, mounted\n * at `CommonRoutePaths.authExchange = '/auth/exchange'`): the backend\n * `crossFrontendHandoff()` handler mints a code via the same\n * AUTH_CODE_EXCHANGE primitive. The exchange response ALSO carries\n * `{returnPath, sourceFrontendServiceName, targetServiceKey}` (see\n * `TokenExchangeResponseSchema`), surfaced into\n * `auth.crossFrontendHandoffContext` for the receiving component\n * (`Auth_OneOffSession` in `cross-frontend-handoff` mode) to drive\n * post-exchange navigation.\n \n Discrimination (\"did this code come from a handoff?\") is purely by\n * presence of `returnPath` in the response — see `TokenExchangeResponseSchema`\n * JSDoc for the load-bearing `typeof returnPath === 'string'` invariant.\n \n Browser-only flow. The method is intentionally decoupled from React\n * Router navigation — it accepts a `code` string and performs the\n * exchange; the page-level component extracts the code from URL params\n * and calls this. The framework targets web stacks exclusively, so no\n * native deep-link variant exists.\n /\n const handleAuthCodeExchange = useCallback(async (code: string): Promise<void> => {\n logDebug('Handling AUTH_CODE_EXCHANGE token (OAuth2 callback or cross-frontend handoff)', { codeLength: code.length });\n setAuth(a => ({ ...a, isLoading: true, error: null }));\n try {\n const response = await getManualCallsHttpClient().exchangeAuthCode(code);\n\n // #1103: a federated sign-in by an account that still owes its organization — onboarding comes first.\n const parkedOnboardingSessionId = parkedOrganizationOnboardingSessionId(response);\n if (parkedOnboardingSessionId) {\n logDebug('Code exchange parked the federated sign-in at organization onboarding');\n adoptOrganizationOnboardingSession(parkedOnboardingSessionId);\n return;\n }\n if (!('accessToken' in response)) {\n throw new Error('The code exchange answered with neither a sign-in nor a parked onboarding session.');\n }\n const { accessToken, returnPath, sourceFrontendServiceName, targetServiceKey } = response;\n\n storeAuthTokens(accessToken);\n getManualCallsHttpClient().setAuthToken(accessToken);\n setResourcesAuthToken(accessToken);\n\n // Cross-frontend-handoff signal: the issuer (cross-app-jwt-propagation\n // Step 2) puts `returnPath` into the consumable-token metadata; the\n // exchange handler (Step 5) round-trips it back here. OAuth2-callback\n // codes do NOT carry it, so a missing field correctly leaves the\n // context undefined for the OAuth2 path. The receiving component\n // (`Auth_OneOffSession` mounted at `/auth/exchange` in\n // cross-frontend-handoff mode) reads `crossFrontendHandoffContext`\n // and navigates accordingly.\n //\n // Discriminator invariant: `typeof returnPath === 'string'` is the\n // ONLY signal that distinguishes a handoff-issued exchange from an\n // OAuth2-callback exchange (no `kind` discriminator field is sent\n // over the wire — see `TokenExchangeResponseSchema` rationale in\n // `cross-frontend-handoff.shared.dto.schemas.ts`). The backend\n // controller is contractually required to use omit-when-absent (NOT\n // emit `null` or `''`) for OAuth2 codes; the\n // `TokenExchangeResponseSchema.parse()` call in `tokenExchange()`\n // and the integration test in\n // `cross-frontend-handoff-token-exchange.integration.test.ts`\n // jointly enforce this. If both safety nets ever regress, this\n // discriminator silently flips to false-positives and OAuth2 users\n // would land with a stale handoff context.\n const crossFrontendHandoffContext = typeof returnPath === 'string'\n ? {\n returnPath,\n ...(sourceFrontendServiceName !== undefined && { sourceFrontendServiceName }),\n ...(targetServiceKey !== undefined && { targetServiceKey }),\n }\n : undefined;\n\n logDebug('OAuth2 callback successful, tokens stored', {\n isCrossFrontendHandoff: crossFrontendHandoffContext !== undefined,\n });\n\n // Update auth state — mark as restoring so UserOrgsContext picks up and loads user data\n setAuth(a => ({\n ...a,\n isLoading: false,\n accessToken,\n isRestoringSession: true,\n sessionRestored: false,\n // Clear any previous session (OAuth2 bypasses identify/authenticate flow)\n sessionId: null,\n crossFrontendHandoffContext,\n }));\n\n hasInitializedRef.current = true;\n } catch (e: any) {\n const msg = toUserFacingErrorMessage(e);\n handleError(e, 'OAuth2 callback failed', { message: msg });\n setAuth(a => ({ ...a, isLoading: false, error: msg }));\n throw e;\n }\n }, [setResourcesAuthToken, handleError, toUserFacingErrorMessage]);\n\n /\n Handle email verification by exchanging the verification token for JWT tokens.\n * Called from the /confirm-email page after the user clicks the verification link.\n * Flow: Email link → /confirm-email?token=xxx → this method\n \n On success, stores tokens and updates auth state (auto-login).\n /\n const handleEmailVerification = useCallback(async (token: string, email: string): Promise<void> => {\n logDebug('Handling email verification', { tokenLength: token.length, email });\n setAuth(a => ({ ...a, isLoading: true, error: null }));\n try {\n const response = await getManualCallsHttpClient().verifyEmail(token, email);\n\n if (response.accessToken) {\n storeAuthTokens(response.accessToken);\n getManualCallsHttpClient().setAuthToken(response.accessToken);\n setResourcesAuthToken(response.accessToken);\n\n logDebug('Email verification successful, tokens stored');\n\n setAuth(a => ({\n ...a,\n isLoading: false,\n accessToken: response.accessToken!,\n isRestoringSession: true,\n sessionRestored: false,\n sessionId: null,\n }));\n\n hasInitializedRef.current = true;\n } else if (parkedOrganizationOnboardingSessionId(response)) {\n logDebug('Email verification parked the registrant at organization onboarding', { state: response.state });\n adoptOrganizationOnboardingSession(response.sessionId!);\n } else {\n logDebug('Email verification succeeded but tokens not issued — pipeline requires further steps', {\n state: response.state,\n nextStep: response.nextStep,\n });\n\n setAuth(a => ({\n ...a,\n isLoading: false,\n sessionId: null,\n mfaRequired: response.requiresMFA ?? false,\n mfaSessionId: response.requiresMFA ? (response.sessionId ?? null) : null,\n availableMfaMethods: [],\n availableEnrollmentMethods: response.availableEnrollmentMethods \|\| [],\n enrolledSecondFactorMethods: [],\n usableSecondFactorMethods: [],\n error: null,\n }));\n }\n } catch (e: any) {\n const msg = toUserFacingErrorMessage(e);\n handleError(e, 'Email verification failed', { message: msg });\n setAuth(a => ({ ...a, isLoading: false, error: msg }));\n throw e;\n }\n }, [setResourcesAuthToken, handleError, toUserFacingErrorMessage]);\n\n const acceptInvitation = useCallback(async (\n params: { invitationToken: string; firstName?: string; lastName?: string; password?: string; credentialMethod?: AuthMethod },\n ): Promise<{ passkeyRegistrationOptions?: Record<string, unknown>; signInRequired?: boolean }> => {\n logDebug('Handling invitation acceptance', { hasPassword: !!params.password, credentialMethod: params.credentialMethod });\n setAuth(a => ({ ...a, isLoading: true, error: null }));\n try {\n const response = await getManualCallsHttpClient().acceptInvitation(params);\n\n if (response.accessToken) {\n storeAuthTokens(response.accessToken);\n getManualCallsHttpClient().setAuthToken(response.accessToken);\n setResourcesAuthToken(response.accessToken);\n\n logDebug('Invitation acceptance successful, tokens stored');\n\n setAuth(a => ({\n ...a,\n isLoading: false,\n accessToken: response.accessToken!,\n isRestoringSession: true,\n sessionRestored: false,\n sessionId: null,\n mfaRequired: false,\n mfaSessionId: null,\n availableMfaMethods: [],\n availableEnrollmentMethods: [],\n enrolledSecondFactorMethods: [],\n usableSecondFactorMethods: [],\n error: null,\n }));\n\n hasInitializedRef.current = true;\n } else {\n logDebug('Invitation acceptance requires further auth steps', {\n state: response.state,\n nextStep: response.nextStep,\n });\n\n setAuth(a => ({\n ...a,\n isLoading: false,\n sessionId: null,\n mfaRequired: response.requiresMFA ?? false,\n mfaSessionId: response.requiresMFA ? (response.sessionId ?? null) : null,\n availableMfaMethods: [],\n availableEnrollmentMethods: response.availableEnrollmentMethods \|\| [],\n enrolledSecondFactorMethods: [],\n usableSecondFactorMethods: [],\n error: null,\n }));\n }\n\n // PASSKEY-enroll-at-accept: hand the pre-generated WebAuthn registration challenge back to\n // the caller so it can run the browser ceremony and complete it against the authenticated\n // `/auth/passkey/register/verify` route (the access token was just set on the HTTP client\n // above). Present only on the passkey path's session-issued branch; undefined otherwise.\n // `signInRequired` (#1158): the invitation was accepted and no session was issued; the caller sends the invitee to sign in.\n return { passkeyRegistrationOptions: response.passkeyRegistrationOptions, signInRequired: response.nextStep === AuthNextStep.SIGN_IN_REQUIRED };\n } catch (e: any) {\n const msg = toUserFacingErrorMessage(e);\n handleError(e, 'Invitation acceptance failed', { message: msg });\n setAuth(a => ({ ...a, isLoading: false, error: msg }));\n throw e;\n }\n }, [setResourcesAuthToken, handleError, toUserFacingErrorMessage]);\n\n /\n * Public registration (#972). The registration screen used to call the HTTP client itself and\n * announce \"check your email\" whatever came back, so the two outcomes that carry a SESSION were lost:\n * a deferred-verification registrant who had just been signed in, and one whose user type requires a\n * second factor they must enroll first — who never reached the enrollment gate that completes their\n * registration session (#603).\n \n The answer is classified ONCE, by `classifyRegistrationOutcome`, and the screen renders from the same\n * value — so what the context adopted and what the screen shows cannot disagree.\n \n Deliberately NOT routed through `handleError`, and `auth.isLoading` / `auth.error` are left alone:\n * a refused registration is a form outcome (a taken slug, a password policy) the screen shows inline,\n * and a global error surface would duplicate it.\n /\n const registerAccount = useCallback(async (params: RegisterAccountRequest): Promise<RegistrationOutcome> => {\n logDebug('Handling public registration', { hasPassword: !!params.password });\n const response = await getManualCallsHttpClient().register(params);\n const outcome = classifyRegistrationOutcome(response);\n\n if (outcome === RegistrationOutcome.SIGNED_IN) {\n const accessToken = response.accessToken!;\n storeAuthTokens(accessToken);\n getManualCallsHttpClient().setAuthToken(accessToken);\n setResourcesAuthToken(accessToken);\n\n logDebug('Registration signed the registrant in, tokens stored', { state: response.state });\n\n setAuth(a => ({\n ...a,\n isLoading: false,\n accessToken,\n isRestoringSession: true,\n sessionRestored: false,\n sessionId: null,\n mfaRequired: false,\n mfaSessionId: null,\n availableMfaMethods: [],\n availableEnrollmentMethods: [],\n enrolledSecondFactorMethods: [],\n usableSecondFactorMethods: [],\n error: null,\n }));\n\n hasInitializedRef.current = true;\n } else if (outcome === RegistrationOutcome.MFA_ENROLLMENT_REQUIRED) {\n logDebug('Registration owes a second-factor enrollment before sign-in', { state: response.state, nextStep: response.nextStep });\n\n /\n * The same continuation state `handleEmailVerification` and `acceptInvitation` set for this answer.\n * A brand-new account has enrolled nothing, so nothing is usable — which is precisely what sends\n * `useMfaContinuationNavigation` to the enrollment gate rather than to a challenge.\n /\n setAuth(a => ({\n ...a,\n isLoading: false,\n sessionId: null,\n mfaRequired: true,\n mfaSessionId: response.sessionId!,\n availableMfaMethods: [],\n availableEnrollmentMethods: response.availableEnrollmentMethods \|\| [],\n enrolledSecondFactorMethods: [],\n usableSecondFactorMethods: [],\n error: null,\n }));\n } else if (outcome === RegistrationOutcome.ORGANIZATION_ONBOARDING_REQUIRED) {\n logDebug('Registration parked the registrant at organization onboarding', { state: response.state });\n adoptOrganizationOnboardingSession(response.sessionId!);\n } else {\n logDebug('Registration answered without a session to adopt', { outcome, state: response.state, nextStep: response.nextStep });\n }\n\n return outcome;\n }, [setResourcesAuthToken]);\n\n /\n Handle magic link verification — verifies the token and auto-logs in the user.\n * Called from the /auth/magic-link/verify page after the user clicks the email link.\n * Returns the full AuthenticationResponse so the page can handle MFA-required state.\n /\n const handleMagicLinkVerify = useCallback(async (token: string, email: string): Promise<AuthenticationResponse> => {\n logDebug('Handling magic link verification', { tokenLength: token.length, email });\n setAuth(a => ({ ...a, isLoading: true, error: null }));\n try {\n const response = await getManualCallsHttpClient().magicLinkVerify(token, email);\n\n // #1091 / #1089: the link signs in an account that still owes its organization — onboarding comes first.\n const parkedOnboardingSessionId = parkedOrganizationOnboardingSessionId(response);\n if (parkedOnboardingSessionId) {\n adoptOrganizationOnboardingSession(parkedOnboardingSessionId);\n return response;\n }\n\n if (response.requiresMFA && !response.accessToken) {\n setAuth(a => ({\n ...a,\n isLoading: false,\n mfaRequired: true,\n mfaSessionId: response.sessionId \|\| null,\n availableMfaMethods: response.availableMFAMethods \|\| [],\n availableEnrollmentMethods: response.availableEnrollmentMethods \|\| [],\n enrolledSecondFactorMethods: response.enrolledSecondFactorMethods \|\| [],\n usableSecondFactorMethods: response.usableSecondFactorMethods \|\| [],\n }));\n return response;\n }\n\n // Auth-hardening Slice A Step 6 (2026-04-13): the cookie-only\n // contract means `response.refreshToken` no longer exists on the\n // wire — the rotated value lives in the `Set-Cookie:\n // __wildo_refresh=…` response header (HttpOnly, JS-invisible).\n // Gate on `success && accessToken` only.\n if (response.success && response.accessToken) {\n storeAuthTokens(response.accessToken);\n getManualCallsHttpClient().setAuthToken(response.accessToken);\n setResourcesAuthToken(response.accessToken);\n\n logDebug('Magic link verification successful, tokens stored');\n\n setAuth(a => ({\n ...a,\n isLoading: false,\n accessToken: response.accessToken!,\n isRestoringSession: true,\n sessionRestored: false,\n sessionId: null,\n }));\n\n hasInitializedRef.current = true;\n } else {\n setAuth(a => ({ ...a, isLoading: false }));\n }\n\n return response;\n } catch (e: any) {\n const msg = toUserFacingErrorMessage(e);\n handleError(e, 'Magic link verification failed', { message: msg });\n setAuth(a => ({ ...a, isLoading: false, error: msg }));\n throw e;\n }\n }, [setResourcesAuthToken, handleError, toUserFacingErrorMessage]);\n\n /\n Handle MFA second-factor verification.\n * Dispatches to the appropriate OTP verify method based on the selected auth method.\n * On success, stores tokens and updates auth state (auto-login).\n /\n const handleMfaVerify = useCallback(async (sessionId: string, method: AuthMethod, code: string): Promise<AuthenticationResponse> => {\n logDebug('Handling MFA verification', { sessionId, method });\n setAuth(a => ({ ...a, isLoading: true, error: null }));\n try {\n const client = getManualCallsHttpClient();\n const response = await client.authenticate({\n sessionId,\n method,\n factorLevel: AuthFactorLevel.SECOND,\n token: code,\n rememberMe: false,\n requestedIntegrations: [],\n } as AuthenticationRequest);\n\n // #1091: the second factor completed a sign-in whose account still owes its organization.\n const parkedOnboardingSessionId = parkedOrganizationOnboardingSessionId(response);\n if (parkedOnboardingSessionId) {\n adoptOrganizationOnboardingSession(parkedOnboardingSessionId);\n return response;\n }\n\n // Auth-hardening Slice A Step 6 (2026-04-13): cookie-only contract\n // — see the magic-link gate above for the full rationale.\n if (response.success && response.accessToken) {\n storeAuthTokens(response.accessToken);\n client.setAuthToken(response.accessToken);\n setResourcesAuthToken(response.accessToken);\n\n logDebug('MFA verification successful, tokens stored');\n\n setAuth(a => ({\n ...a,\n isLoading: false,\n accessToken: response.accessToken!,\n isRestoringSession: true,\n sessionRestored: false,\n sessionId: null,\n mfaRequired: false,\n mfaSessionId: null,\n availableMfaMethods: [],\n enrolledSecondFactorMethods: [],\n usableSecondFactorMethods: [],\n }));\n\n hasInitializedRef.current = true;\n } else {\n // `response.error` is server-authored English; the MFA surface says what failed.\n setAuth(a => ({ ...a, isLoading: false, error: toUserFacingErrorMessage(null, mfaFailureLabel()) }));\n }\n\n return response;\n } catch (e: any) {\n const msg = toUserFacingErrorMessage(e, mfaFailureLabel());\n handleError(e, 'MFA verification failed', { method, message: msg });\n setAuth(a => ({ ...a, isLoading: false, error: msg }));\n throw e;\n }\n }, [setResourcesAuthToken, handleError, toUserFacingErrorMessage, mfaFailureLabel]);\n\n /\n * The enrollment gate's recovery after a hard load (#1033). The MFA challenge URL is self-sufficient —\n * it carries `sessionId` and re-reads the session from the server — but the gate it hands off to read\n * its session ONLY from this context, which a hard load leaves empty, so it bounced a valid\n * enrollment-pending session to sign-in.\n \n Keyed on the session's STATE, the same question the server asks before it lets an enrollment\n * ceremony run on a session (`auth-jwt-guard.backend.service.ts`, `extractFromSessionOrJwt`). NOT on\n * `requiresMFA`: that flag is cleared when a LOGIN's second factor completes, but a registration's\n * completion writes its terminal state without clearing it, so keying on the flag would re-open a\n * finished session as one that owes a factor — and offer enrollments the server then refuses.\n /\n const adoptPendingMfaSession = useCallback((sessionId: string, sessionState: PendingMfaSessionState \| null \| undefined): boolean => {\n if (!sessionState?.state \|\| !SECOND_FACTOR_PENDING_SESSION_STATES.has(sessionState.state)) {\n return false;\n }\n\n setAuth(a => ({\n ...a,\n mfaRequired: true,\n mfaSessionId: sessionId,\n availableMfaMethods: sessionState.availableSecondFactorMethods \|\| [],\n availableEnrollmentMethods: sessionState.availableEnrollmentMethods \|\| [],\n enrolledSecondFactorMethods: sessionState.enrolledSecondFactorMethods \|\| [],\n usableSecondFactorMethods: sessionState.usableSecondFactorMethods \|\| [],\n }));\n return true;\n }, []);\n\n /\n * The registration-time MFA enrollment's sign-in (#603). A registrant who must enroll a second factor\n * before their first session has already proven the factor by enrolling it, so the backend completes\n * the registration session inside the enrollment ceremony and returns the access token there — there\n * is no challenge to answer. This is the ONE place that token is adopted, with the same state\n * transition `handleMfaVerify` applies on a completed challenge, so the enrollment screen does not\n * re-implement token storage and the two ways of finishing MFA leave identical auth state.\n /\n const completeEnrollmentSession = useCallback((settlement: EnrollmentSessionSettlementResponse \| undefined): boolean => {\n // The enrollment settled a registration session at ONBOARDING_PENDING (#1011): the organization comes next.\n const parkedOnboardingSessionId = parkedOrganizationOnboardingSessionId(settlement);\n if (parkedOnboardingSessionId) {\n logDebug('Enrollment parked the registration session at organization onboarding');\n adoptOrganizationOnboardingSession(parkedOnboardingSessionId);\n return true;\n }\n\n if (!settlement?.accessToken \|\| settlement.state !== AuthenticationSessionState.COMPLETED) {\n return false;\n }\n\n const client = getManualCallsHttpClient();\n storeAuthTokens(settlement.accessToken);\n client.setAuthToken(settlement.accessToken);\n setResourcesAuthToken(settlement.accessToken);\n\n logDebug('Enrollment completed the registration session, tokens stored');\n\n setAuth(a => ({\n ...a,\n isLoading: false,\n accessToken: settlement.accessToken!,\n isRestoringSession: true,\n sessionRestored: false,\n sessionId: null,\n mfaRequired: false,\n mfaSessionId: null,\n availableMfaMethods: [],\n availableEnrollmentMethods: [],\n enrolledSecondFactorMethods: [],\n usableSecondFactorMethods: [],\n error: null,\n }));\n\n hasInitializedRef.current = true;\n return true;\n }, [setResourcesAuthToken]);\n\n /\n * The organization-onboarding step's completion (#1090). The parked session is the context's own\n * (`auth.onboardingSessionId`), never a screen's argument: every answer that parks one adopts it here, so the\n * step cannot be pointed at a session this tab did not receive. The completion consumes the session and mints\n * exactly once (#1008), so the tokens are adopted with the same transition every other completed sign-in\n * applies, and the parked session is cleared in the same write.\n /\n /\n Run one onboarding completion and adopt its answer (#1090, #1374). Both completion doors share it: an answer\n * carrying a token signs the account in exactly as a completed sign-in does, and clears the parked session; an\n * answer without one is the session still parked on another obligation — no longer an error since #1374 — and\n * the step moves on to what `pendingObligations` names.\n /\n const runOnboardingCompletion = useCallback(async (\n complete: (sessionId: string) => Promise<OnboardingCompletionResponse>,\n ): Promise<OnboardingCompletionOutcome> => {\n const sessionId = auth.onboardingSessionId;\n if (!sessionId) {\n throw new Error('No session is parked at onboarding.');\n }\n\n setAuth(a => ({ ...a, isLoading: true, error: null }));\n try {\n const client = getManualCallsHttpClient();\n const response = await complete(sessionId);\n if (!response.accessToken) {\n setAuth(a => ({ ...a, isLoading: false }));\n logDebug('Onboarding obligation completed; the session stays parked on the rest', { pendingObligations: response.pendingObligations });\n return { signedIn: false, pendingObligations: response.pendingObligations ?? [] };\n }\n\n storeAuthTokens(response.accessToken);\n client.setAuthToken(response.accessToken);\n setResourcesAuthToken(response.accessToken);\n\n logDebug('Onboarding completed, tokens stored', { organizationId: response.organizationId });\n\n setAuth(a => ({\n ...a,\n isLoading: false,\n accessToken: response.accessToken!,\n isRestoringSession: true,\n sessionRestored: false,\n sessionId: null,\n onboardingSessionId: null,\n mfaRequired: false,\n mfaSessionId: null,\n availableMfaMethods: [],\n availableEnrollmentMethods: [],\n enrolledSecondFactorMethods: [],\n usableSecondFactorMethods: [],\n error: null,\n }));\n\n hasInitializedRef.current = true;\n return { signedIn: true, pendingObligations: [] };\n } catch (e: any) {\n // Rendered by the onboarding step itself; `auth.error` is left alone so no global surface duplicates it.\n // A spent session can never complete, so it is forgotten — otherwise every guarded screen would keep\n // routing back to a form whose every submission is refused.\n if (isSpentOrganizationOnboardingSession(e)) {\n leaveOrganizationOnboardingForSignIn();\n } else {\n setAuth(a => ({ ...a, isLoading: false }));\n }\n throw e;\n }\n }, [auth.onboardingSessionId, setResourcesAuthToken]);\n\n const completeOrganizationOnboarding = useCallback(\n (organizationName: string): Promise<OnboardingCompletionOutcome> =>\n runOnboardingCompletion((sessionId) => getManualCallsHttpClient().completeOrgOnboarding(sessionId, organizationName)),\n [runOnboardingCompletion],\n );\n\n const completeProfileOnboarding = useCallback(\n (firstName: string, lastName: string): Promise<OnboardingCompletionOutcome> =>\n runOnboardingCompletion((sessionId) => getManualCallsHttpClient().completeProfileOnboarding(sessionId, firstName, lastName)),\n [runOnboardingCompletion],\n );\n\n /\n * Leaving onboarding without completing it is a return to a FRESH sign-in, not just forgetting the parked\n * session. A sign-in that was parked still holds the identification it started from (email, the old session\n * id), and the sign-in screen renders straight to that account's credential form when an identification is\n * present — a form whose every submission is refused, because the parked session replaced the one it needs.\n * So this resets the sign-in state exactly as starting a new identification does (`identifyByEmail`): it\n * invalidates any in-flight identification, forgets a remembered pending second factor, and clears the\n * identification with the parked session.\n /\n const leaveOrganizationOnboardingForSignIn = (): void => {\n identificationGenerationRef.current += 1;\n forgetPendingMfaSession();\n setAuth(a => ({\n ...a,\n isLoading: false,\n error: null,\n identification: null,\n sessionId: null,\n sessionState: null,\n onboardingSessionId: null,\n }));\n };\n\n const abandonOrganizationOnboarding = useCallback((): void => {\n leaveOrganizationOnboardingForSignIn();\n }, []);\n\n /\n The ONE passkey sign-in ceremony, behind three entries: an identified session's passkey method\n * (`handlePasskeyAuth`), the sign-in-with-a-passkey button and passkey autofill (`signInWithPasskey`).\n \n The server answers `{ sessionId, options }`, and the verification presents THAT session: without a\n * `sessionId` the options door opens the sign-in itself, and the challenge is bound to the session it\n * opened. The account that signs in is the one the chosen passkey belongs to.\n \n Autofill (`conditional`) differs in one respect: until the person picks a passkey nothing they did\n * has failed, so a refusal before then — the page moving on, a network error, a browser that aborts —\n * is re-thrown without touching the page's error or loading state.\n /\n const runPasskeyCeremony = useCallback(async ({\n sessionId,\n factorLevel,\n conditional,\n }: {\n sessionId?: string;\n factorLevel: UIFactorLevel;\n conditional: boolean;\n }): Promise<AuthenticationResponse> => {\n logDebug('Handling passkey authentication', { sessionId, factorLevel, conditional });\n if (!conditional) {\n setAuth(a => ({ ...a, isLoading: true, error: null }));\n }\n let credentialPresented = false;\n let autofillExpired = false;\n const componentType = factorLevel === 'first' ? FrontendComponentType.PUBLIC_LAYOUTS_USER_AUTH : FrontendComponentType.PUBLIC_LAYOUTS_MFA_CHALLENGE;\n const t = (key: string) => resolveComponentLabel({\n tComponent,\n componentType,\n key,\n });\n const passkeyErrorLabel = factorLevel === 'first' ? UserAuthLabel.PASSKEY_ERROR : MfaChallengeLabel.PASSKEY_ERROR;\n const passkeyCancelledLabel = factorLevel === 'first' ? UserAuthLabel.PASSKEY_CANCELLED : MfaChallengeLabel.PASSKEY_CANCELLED;\n try {\n const client = getManualCallsHttpClient();\n const begun = await client.passkeyAuthOptions(sessionId);\n const optionsJSON: PublicKeyCredentialRequestOptionsJSON = begun.options;\n if (conditional && personStartedPasskeyCeremoniesRef.current > 0) {\n // The person opened a passkey prompt while this autofill was still loading its options. Starting\n // our request now would abort theirs (`startAuthentication` cancels any pending ceremony), so step\n // aside. Residual: `startAuthentication` awaits the browser's `isConditionalMediationAvailable()`\n // before it creates its abort signal, so a button prompt opened DURING that browser call could\n // still be aborted. It is practically unreachable: the counter rises before the button's own\n // options request, so the button would need its whole network round trip to finish inside it.\n throw new PasskeyAutofillSupersededError();\n }\n // Autofill waits indefinitely; its challenge does not. Stop the wait just before the server's\n // challenge (and the session bound to it) runs out, so the page can start a fresh one instead of\n // letting the person pick a passkey that can no longer be redeemed.\n let autofillExpiredTimer: ReturnType<typeof setTimeout> \| undefined;\n const rearmInMs = (begun.expiresInSeconds ?? 0) 1000 - PASSKEY_AUTOFILL_REARM_MARGIN_MS;\n const armAutofillExpiry = conditional && rearmInMs > 0;\n // A WALL-CLOCK deadline as well as the timer: timers do not run while a laptop sleeps and are\n // throttled in background tabs, so a tab woken past its deadline would offer a passkey whose\n // session is already gone. The page becoming visible or focused re-checks the clock.\n const autofillDeadline = Date.now() + rearmInMs;\n const expireAutofill = () => {\n if (autofillExpired) return;\n autofillExpired = true;\n WebAuthnAbortService.cancelCeremony();\n };\n const onPageResumed = () => {\n if (Date.now() >= autofillDeadline) expireAutofill();\n };\n if (armAutofillExpiry) {\n autofillExpiredTimer = setTimeout(expireAutofill, rearmInMs);\n if (typeof document !== 'undefined') document.addEventListener('visibilitychange', onPageResumed);\n if (typeof window !== 'undefined') window.addEventListener('focus', onPageResumed);\n }\n let credential: Awaited<ReturnType<typeof startAuthentication>>;\n try {\n credential = await startAuthentication({ optionsJSON, useBrowserAutofill: conditional });\n } finally {\n clearTimeout(autofillExpiredTimer);\n if (armAutofillExpiry) {\n if (typeof document !== 'undefined') document.removeEventListener('visibilitychange', onPageResumed);\n if (typeof window !== 'undefined') window.removeEventListener('focus', onPageResumed);\n }\n }\n credentialPresented = true;\n if (conditional) {\n setAuth(a => ({ ...a, isLoading: true, error: null }));\n }\n // `factorLevel` here is the UI vocabulary; the wire carries `AuthFactorLevel`. Forwarding it\n // verbatim was a 400 on every passkey sign-in (see `authFactorLevelForUiLevel`).\n const response = await client.passkeyAuthVerify({ response: credential, sessionId: begun.sessionId, factorLevel: authFactorLevelForUiLevel(factorLevel) });\n\n // The application no longer holds this passkey (deleted, or the account is gone): tell the browser,\n // so it stops offering a credential that can never sign in.\n if (response.passkeyCredentialUnknown) {\n signalUnknownPasskeyCredential(optionsJSON?.rpId, credential.id);\n }\n\n // #1091: a passkey sign-in by an account that still owes its organization resumes onboarding.\n const parkedOnboardingSessionId = parkedOrganizationOnboardingSessionId(response);\n if (parkedOnboardingSessionId) {\n adoptOrganizationOnboardingSession(parkedOnboardingSessionId);\n return response;\n }\n\n if (response.requiresMFA && !response.accessToken) {\n setAuth(a => ({\n ...a,\n isLoading: false,\n mfaRequired: true,\n mfaSessionId: response.sessionId \|\| sessionId,\n availableMfaMethods: response.availableMFAMethods \|\| [],\n availableEnrollmentMethods: response.availableEnrollmentMethods \|\| [],\n enrolledSecondFactorMethods: response.enrolledSecondFactorMethods \|\| [],\n usableSecondFactorMethods: response.usableSecondFactorMethods \|\| [],\n }));\n return response;\n }\n\n // Auth-hardening Slice A Step 6 (2026-04-13): cookie-only contract\n // — see the magic-link gate above for the full rationale.\n if (response.success && response.accessToken) {\n storeAuthTokens(response.accessToken);\n client.setAuthToken(response.accessToken);\n setResourcesAuthToken(response.accessToken);\n logDebug('Passkey authentication successful, tokens stored');\n setAuth(a => ({\n ...a,\n isLoading: false,\n accessToken: response.accessToken!,\n isRestoringSession: true,\n sessionRestored: false,\n sessionId: null,\n mfaRequired: false,\n mfaSessionId: null,\n availableMfaMethods: [],\n availableEnrollmentMethods: [],\n enrolledSecondFactorMethods: [],\n usableSecondFactorMethods: [],\n }));\n hasInitializedRef.current = true;\n } else {\n // `response.error` is server-authored English; the passkey surface says what failed.\n setAuth(a => ({ ...a, isLoading: false, error: toUserFacingErrorMessage(null, t(passkeyErrorLabel)) }));\n }\n return response;\n } catch (e: unknown) {\n if (conditional && !credentialPresented) {\n // Autofill that never produced a passkey: the page moved on, the browser aborted the wait, or\n // its challenge was about to expire. Nothing the person did failed, so the page is left exactly\n // as it was — and only the expiry case asks the page to start again.\n throw autofillExpired ? new PasskeyAutofillExpiredError() : e;\n }\n // A cancelled browser prompt is the one failure this surface names itself. Everything else goes\n // through the shared resolver — a `400 validation` used to reach the screen as the word `validation`.\n const msg = (e as { name?: string } \| null)?.name === 'NotAllowedError'\n ? t(passkeyCancelledLabel)\n : toUserFacingErrorMessage(e, t(passkeyErrorLabel));\n handleError(e, 'Passkey authentication failed', { sessionId, message: msg });\n setAuth(a => ({ ...a, isLoading: false, error: msg }));\n throw e;\n }\n }, [setResourcesAuthToken, handleError, tComponent, toUserFacingErrorMessage]);\n\n /** A ceremony the person started: counted while open, so a loading autofill steps aside for it. /\n const runPersonStartedPasskeyCeremony = useCallback(\n async (input: { sessionId?: string; factorLevel: UIFactorLevel }): Promise<AuthenticationResponse> => {\n personStartedPasskeyCeremoniesRef.current += 1;\n try {\n return await runPasskeyCeremony({ ...input, conditional: false });\n } finally {\n personStartedPasskeyCeremoniesRef.current -= 1;\n }\n },\n [runPasskeyCeremony],\n );\n\n const handlePasskeyAuth = useCallback(\n (sessionId: string, factorLevel: UIFactorLevel = 'first'): Promise<AuthenticationResponse> =>\n runPersonStartedPasskeyCeremony({ sessionId, factorLevel }),\n [runPersonStartedPasskeyCeremony],\n );\n\n const signInWithPasskey = useCallback(\n (mediation: PasskeySignInMediation = PasskeySignInMediation.MODAL): Promise<AuthenticationResponse> =>\n mediation === PasskeySignInMediation.CONDITIONAL\n ? runPasskeyCeremony({ factorLevel: 'first', conditional: true })\n : runPersonStartedPasskeyCeremony({ factorLevel: 'first' }),\n [runPasskeyCeremony, runPersonStartedPasskeyCeremony],\n );\n\n /\n W7.3b: Exchange a consumable token for a one-off session.\n * Authenticates via the backend exchange endpoint, sets up HTTP clients\n * with both JWT and consumable token headers, and connects WebSocket.\n /\n const handleOneOffTokenExchange = useCallback(async (token: string): Promise<void> => {\n logDebug('Handling one-off token exchange', { tokenLength: token.length });\n setAuth(a => ({ ...a, isLoading: true, error: null }));\n\n try {\n const client = getManualCallsHttpClient();\n const response = await client.exchangeOneOffToken(token);\n\n const { accessToken, consumableTokenValue, tokenExpiresAt, context } = response;\n\n storeAuthTokens(accessToken);\n\n client.setAuthToken(accessToken);\n setResourcesAuthToken(accessToken);\n\n if (consumableTokenValue) {\n client.setConsumableToken(consumableTokenValue);\n setResourcesConsumableToken(consumableTokenValue);\n }\n\n if (context.organizationId) {\n tokenStorage.setOrganizationId(context.organizationId);\n }\n\n connectWebSocket(accessToken, context.organizationId, consumableTokenValue);\n\n identificationGenerationRef.current += 1;\n setAuth({\n ...EMPTY_AUTH_STATE,\n accessToken,\n sessionType: SessionType.ONE_OFF,\n oneOffContext: {\n originTokenId: context.tokenId,\n tokenType: context.tokenType,\n consumableTokenValue,\n tokenExpiresAt,\n scopedInitiatorIds: context.targeting?.initiatorIds,\n applicationId: context.applicationId,\n },\n sessionRestored: true,\n });\n\n hasInitializedRef.current = true;\n logDebug('One-off token exchange successful', { tokenType: context.tokenType });\n } catch (e: any) {\n const msg = toUserFacingErrorMessage(e);\n handleError(e, 'One-off token exchange failed', { message: msg });\n setAuth(a => ({ ...a, isLoading: false, error: msg }));\n throw e;\n }\n }, [tokenStorage, setResourcesAuthToken, setResourcesConsumableToken, connectWebSocket, handleError, toUserFacingErrorMessage]);\n\n /\n * The ONE writer of the tab-scoped pending-MFA-session copy (#1068) — see\n * `pending-mfa-session-storage.frontend.utils.ts` for why the copy lives in `sessionStorage`.\n \n Driven by auth-state TRANSITIONS rather than by the ~six call sites that set `mfaSessionId`, so a path\n * added tomorrow is remembered without anyone remembering to remember it:\n * - a session that owes a second factor and has no token → remember it;\n * - that session going away (completion, identification restarting, logout) or a token arriving → forget.\n \n The ref makes \"going away\" a transition rather than a state. On a hard load the context starts empty\n * with nothing remembered in memory, and forgetting on that EMPTY state would erase the very entry the\n * enrollment gate is about to recover. Terminal acts that must forget even then (logout, a new\n * identification) forget explicitly.\n /\n const rememberedPendingMfaSessionIdRef = useRef<string \| null>(null);\n useEffect(() => {\n const pendingSessionId = auth.mfaRequired && !auth.accessToken ? auth.mfaSessionId : null;\n if (pendingSessionId) {\n rememberPendingMfaSession({ sessionId: pendingSessionId, email: auth.identification?.email ?? '' });\n rememberedPendingMfaSessionIdRef.current = pendingSessionId;\n return;\n }\n if (rememberedPendingMfaSessionIdRef.current !== null \|\| auth.accessToken) {\n forgetPendingMfaSession();\n rememberedPendingMfaSessionIdRef.current = null;\n }\n }, [auth.mfaRequired, auth.mfaSessionId, auth.accessToken, auth.identification?.email]);\n\n const logout = useCallback((): void => {\n logDebug('Logging out user');\n identificationGenerationRef.current += 1;\n\n // Auth-hardening Slice A Step 3 (2026-04-13) — refresh token now travels\n // via the `__wildo_refresh` `HttpOnly` cookie. JS can't read it (and\n // doesn't need to): the cookie auto-attaches via `withCredentials: true`\n // on `/auth/` because of the `authCookiesInterceptor`. Backend\n // `logout()` handler dual-reads (cookie-first, body-fallback per A-K-5)\n // and ALWAYS clears the cookie, so this fire-and-forget call works even\n // when the JS access token was lost (e.g., post tab crash). We keep\n // this unconditional now — there's no JS-visible \"is there a session\n // to revoke?\" signal anymore.\n getManualCallsHttpClient()\n .logoutFromBackend()\n .catch((e) => {\n logger.warn('Backend logout call failed (token revocation)', { error: e });\n });\n\n broadcastChannelRef.current?.postMessage({ type: 'LOGOUT' });\n\n disconnect();\n\n // Clear consumable token from HTTP client singletons (prevents stale header leakage)\n getManualCallsHttpClient().setConsumableToken(null);\n getManualCallsHttpClient().setAuthToken(null);\n setResourcesConsumableToken(null);\n setResourcesAuthToken(null);\n\n tokenStorage.clear();\n // Explicit, not left to the transition effect: after a hard load nothing is remembered in memory, so\n // the effect would not see a session going away — and a signed-out tab must not recover one (#1068).\n forgetPendingMfaSession();\n setAuth(EMPTY_AUTH_STATE);\n\n hasInitializedRef.current = false;\n\n logger.info('User logged out successfully');\n }, [disconnect, tokenStorage, setResourcesAuthToken, setResourcesConsumableToken]);\n\n /*\n Single-use clear for the cross-frontend-handoff context.\n \n Called by `Auth_OneOffSession` on unmount in cross-frontend-handoff\n * mode (which happens AFTER the post-exchange `<Navigate to>` resolves\n * and React unmounts the receiver). Unmount-cleanup timing is critical:\n * clearing earlier would race the `useMemo(targetUrl, [auth.crossFrontendHandoffContext, …])`\n * recomputation and could navigate the user to home instead of `returnPath`.\n /\n const clearCrossFrontendHandoffContext = useCallback((): void => {\n setAuth(a => (a.crossFrontendHandoffContext === undefined\n ? a\n : { ...a, crossFrontendHandoffContext: undefined }));\n }, []);\n\n /\n Mark session as restored (called by UserOrgsContext when it finishes loading user data)\n /\n const markSessionRestored = useCallback((): void => {\n setAuth(a => ({\n ...a,\n sessionRestored: true,\n isRestoringSession: false,\n }));\n }, []);\n\n /\n Set session restoring state (called by UserOrgsContext)\n /\n const setSessionRestoring = useCallback((isRestoring: boolean): void => {\n setAuth(a => ({\n ...a,\n isRestoringSession: isRestoring,\n }));\n }, []);\n\n // ─────────────────────────────────────────────────────────────────────────\n // Token refresh handler (re-entrant safe)\n // ─────────────────────────────────────────────────────────────────────────\n\n /\n Token renewal handler registered on HTTP clients.\n * Called automatically by the interceptor when a 401 OUTDATED_AUTH_JWT is received.\n \n Re-entrant safe: if multiple requests get 401 simultaneously, only one refresh\n * call is made and all callers share the same promise.\n */\n const tokenRenewalHandler = useCallback(async (): Promise<string> => {\n // If a refresh is already in flight IN THIS TAB, piggyback on it.\n if (refreshInFlightRef.current) {\n logger.debug('Auth token renewal already in flight; waiting for shared result');\n return refreshInFlightRef.current;\n }\n\n // The access token that just failed verification. Captured before we take\n // the cross-tab lock so that, once we hold it, we can detect whether\n // another tab already rotated a fresh token into shared storage while we\n // were waiting (see `adoptCrossTabRefreshedToken`).\n const staleAccessToken = tokenStorage.getAccessToken();\n\n // Adopt — WITHOUT a network call — an access token that another tab already\n // rotated into the shared store while we were queued on the cross-tab lock.\n // Returns the adopted token, or `null` if storage still holds the stale\n // token (meaning THIS tab must perform the network rotation).\n const adoptCrossTabRefreshedToken = (): string \| null => {\n const current = tokenStorage.getAccessToken();\n if (current && current !== staleAccessToken) {\n getManualCallsHttpClient().setAuthToken(current);\n setResourcesAuthToken(current);\n setAuth(a => (a.accessToken === current ? a : { ...a, accessToken: current }));\n refreshWebSocketAuth(current);\n logger.debug('Auth token renewal short-circuited; adopted token rotated by another tab');\n return current;\n }\n return null;\n };\n\n // The actual network rotation + local propagation. Assumes the caller holds\n // the cross-tab refresh lock (or that no lock primitive is available).\n const performNetworkRefresh = async (): Promise<string> => {\n // Auth-hardening Slice A Step 3 (2026-04-13) — refresh token travels via\n // the `__wildo_refresh` `HttpOnly` cookie. JS can't see the cookie\n // (`HttpOnly` blocks DOM reads), so we can't pre-check whether a refresh\n // is even possible; we just attempt the call.\n logger.debug('Auth token renewal started');\n const result = await getManualCallsHttpClient().refreshTokens();\n\n // Persist the rotated access token. The rotated refresh token landed in\n // the `__wildo_refresh` cookie via `Set-Cookie` on the same response —\n // the browser cookie store updated automatically; no JS plumbing needed.\n storeAuthTokens(result.accessToken);\n\n getManualCallsHttpClient().setAuthToken(result.accessToken);\n setResourcesAuthToken(result.accessToken);\n\n // Update React state — only the access token surfaces here.\n setAuth(a => ({\n ...a,\n accessToken: result.accessToken,\n }));\n\n // Broadcast the rotated ACCESS token so other tabs adopt it instead of\n // independently refreshing. The rotated refresh token is NOT broadcast —\n // it already landed in the shared same-origin `__wildo_refresh` cookie.\n broadcastChannelRef.current?.postMessage({\n type: 'TOKEN_REFRESHED',\n accessToken: result.accessToken,\n });\n\n logger.debug('Auth token renewal succeeded; frontend clients updated');\n refreshWebSocketAuth(result.accessToken);\n return result.accessToken;\n };\n\n // RC1 — CROSS-TAB SERIALIZATION via the Web Locks API.\n //\n // `refreshInFlightRef` only dedupes refreshes WITHIN a tab. Across tabs,\n // a mass-expiry event (e.g. a dev backend recompile expiring every tab's\n // access token at the same instant) makes every tab fire `/auth/token/\n // refresh` with the SAME current cookie. One wins and rotates the token;\n // the others present the now-rotated token a beat later, the backend's\n // reuse-detection treats that as theft and `invalidateAllTokensForUser`\n // NUKES every session. The `wildo-auth-refresh` lock ensures only ONE tab\n // performs the network rotation; the rest wait, then adopt the winner's\n // already-rotated token with no second network call. Falls back to a plain\n // refresh where Web Locks is unavailable (non-secure context / old browser;\n // localhost dev IS a secure context, so the lock is active there).\n const doRefresh = async (): Promise<string> => {\n const locks = typeof navigator !== 'undefined' ? navigator.locks : undefined;\n if (!locks?.request) {\n return performNetworkRefresh();\n }\n return locks.request('wildo-auth-refresh', async () => {\n const adopted = adoptCrossTabRefreshedToken();\n if (adopted) return adopted;\n return performNetworkRefresh();\n });\n };\n\n // Store the promise so concurrent callers in this tab share it.\n refreshInFlightRef.current = doRefresh().finally(() => {\n refreshInFlightRef.current = null;\n });\n\n try {\n return await refreshInFlightRef.current;\n } catch (error) {\n // RC2/RC3 — classify the failure. `logout()` clears the SHARED\n // `__wildo_refresh` cookie, so destroying the session on a transient\n // failure (backend restarting / 5xx / timeout) permanently logs out\n // every tab and breaks recovery. Only an AUTHORITATIVE rejection (the\n // backend explicitly refused this refresh token) warrants logout — and\n // in DEVELOPMENT not even that, because dev recompiles routinely produce\n // authoritative-looking 400/401s while the session is in fact fine once\n // the backend settles. See `auth-refresh-resilience.frontend.ts`.\n const authoritative = isAuthoritativeRefreshRejection(error);\n const devLenient = isRefreshDevLenient();\n\n if (authoritative && !devLenient) {\n logger.warn('Auth token renewal failed; refresh token was rejected and logout will follow', {\n error: isWildoBackendError(error)\n ? error.customMessageReference\n : (error instanceof Error ? error.message : 'Unknown error'),\n });\n logout();\n } else {\n logger.warn(\n 'Auth token renewal failed but session is preserved (will retry on the next request)',\n {\n authoritative,\n devLenient,\n reason: authoritative\n ? 'development leniency active — not logging out on an authoritative rejection'\n : 'transient failure (backend unreachable / 5xx / timeout) — not an authoritative rejection',\n },\n );\n }\n throw error;\n }\n }, [setResourcesAuthToken, logout, refreshWebSocketAuth, tokenStorage]);\n\n // Register the token renewal handler on both HTTP clients + expose it via ref\n // so the WebSocket `onAuthenticationError` callback (wired in `connectWebSocket`\n // above) always invokes the current handler.\n useEffect(() => {\n tokenRenewalHandlerRef.current = tokenRenewalHandler;\n getManualCallsHttpClient().setTokenRenewalHandler(tokenRenewalHandler);\n setResourcesTokenRenewalHandler(tokenRenewalHandler);\n }, [tokenRenewalHandler, setResourcesTokenRenewalHandler]);\n\n // Cross-tab token coordination via BroadcastChannel.\n // When one tab refreshes tokens, it broadcasts the new tokens so other tabs\n // adopt them instead of independently refreshing (which triggers rotation detection).\n useEffect(() => {\n if (typeof BroadcastChannel === 'undefined') return;\n\n const channel = new BroadcastChannel('wildo-auth-tokens');\n broadcastChannelRef.current = channel;\n\n channel.onmessage = (event: MessageEvent) => {\n const { type, accessToken } = event.data ?? {};\n\n if (type === 'TOKEN_REFRESHED' && accessToken) {\n // Auth-hardening Slice A Step 6 (2026-04-13) — payload only\n // carries the rotated access token. The rotated refresh token\n // landed in the shared `__wildo_refresh` cookie via the issuing\n // tab's `Set-Cookie` response, and same-origin tabs see the\n // new cookie automatically; nothing for this receiver to do.\n // Pre-Slice-A tabs that broadcast a `refreshToken` field have\n // long since aged out (A-Step 6 ships well after the dual-read\n // window closed); the destructuring above doesn't pick it up.\n logger.debug('Auth token renewal received from another tab; frontend clients updated');\n storeAuthTokens(accessToken);\n getManualCallsHttpClient().setAuthToken(accessToken);\n setResourcesAuthToken(accessToken);\n setAuth(a => ({ ...a, accessToken }));\n refreshWebSocketAuth(accessToken);\n }\n\n if (type === 'LOGOUT') {\n logDebug('Received logout signal from another tab');\n identificationGenerationRef.current += 1;\n disconnect();\n tokenStorage.clear();\n getManualCallsHttpClient().setConsumableToken(null);\n setResourcesConsumableToken(null);\n storeAuthTokens(null);\n getManualCallsHttpClient().setAuthToken(null);\n setResourcesAuthToken(null);\n setAuth(EMPTY_AUTH_STATE);\n }\n };\n\n return () => {\n channel.close();\n broadcastChannelRef.current = null;\n };\n }, [setResourcesAuthToken, setResourcesConsumableToken, disconnect, refreshWebSocketAuth, tokenStorage]);\n\n // Initialize auth tokens on mount (from storage)\n useEffect(() => {\n // Prevent multiple initializations\n if (hasInitializedRef.current) {\n return;\n }\n\n // Auth-hardening Slice A Step 3 (2026-04-13) — only the access token\n // is stored client-side. The refresh token lives in the\n // `__wildo_refresh` `HttpOnly` cookie which JS can't read; it's\n // implicitly available as soon as the browser includes it on the\n // first `/auth/token/refresh` round-trip. No \"do we have a refresh\n // token?\" check needed at mount.\n const storedAccessToken = tokenStorage.getAccessToken();\n\n if (!storedAccessToken) {\n logDebug('No stored access token found');\n hasInitializedRef.current = true;\n return;\n }\n\n logDebug('Found stored access token, initializing auth state');\n hasInitializedRef.current = true;\n\n setAuth(a => ({\n ...a,\n accessToken: storedAccessToken,\n isRestoringSession: true,\n }));\n\n getManualCallsHttpClient().setAuthToken(storedAccessToken);\n setResourcesAuthToken(storedAccessToken);\n\n // UserOrgsContext will handle fetching user data and marking session as restored\n }, [setResourcesAuthToken, tokenStorage]);\n\n const value = useMemo<AuthSessionContextType>(() => ({\n auth,\n tokenStorage,\n\n // Authentication methods\n identifyByEmail,\n authenticateWithPassword,\n authenticate,\n getSessionState,\n isAuthenticated,\n logout,\n\n // OAuth2 + cross-frontend-handoff (shared AUTH_CODE_EXCHANGE primitive)\n initiateOAuth2Login,\n handleAuthCodeExchange,\n\n // Email verification\n handleEmailVerification,\n acceptInvitation,\n registerAccount,\n\n // Magic link verification\n handleMagicLinkVerify,\n\n // MFA verification\n handleMfaVerify,\n completeEnrollmentSession,\n adoptPendingMfaSession,\n completeOrganizationOnboarding,\n completeProfileOnboarding,\n abandonOrganizationOnboarding,\n handlePasskeyAuth,\n signInWithPasskey,\n\n // One-off session exchange (W7.3b)\n handleOneOffTokenExchange,\n\n // Cross-frontend handoff context (cross-app-jwt-propagation Step 5)\n clearCrossFrontendHandoffContext,\n\n // Session management\n markSessionRestored,\n setSessionRestoring,\n\n // WebSocket\n connectWebSocket,\n notifyOrganizationSwitch,\n }), [\n auth,\n tokenStorage,\n logout,\n initiateOAuth2Login,\n handleAuthCodeExchange,\n handleEmailVerification,\n acceptInvitation,\n registerAccount,\n handleMagicLinkVerify,\n handleMfaVerify,\n completeEnrollmentSession,\n adoptPendingMfaSession,\n completeOrganizationOnboarding,\n completeProfileOnboarding,\n abandonOrganizationOnboarding,\n handlePasskeyAuth,\n signInWithPasskey,\n handleOneOffTokenExchange,\n clearCrossFrontendHandoffContext,\n markSessionRestored,\n setSessionRestoring,\n connectWebSocket,\n notifyOrganizationSwitch,\n ]);\n\n return <AuthSessionContext.Provider value={value}>{children}</AuthSessionContext.Provider>;\n};\n"]}

package/dist/esm/core/security/StepUpAuthContext.d.ts CHANGED Viewed

@@ -9,6 +9,8 @@
  * On success, the interceptor retries the original request with the new X-Reauth-Token header.
  */
 import React, { ReactNode } from 'react';
+import { ReAuthenticationPurpose } from '@wildo-ai/saas-models';
+import { type StepUpProof } from '../../components/auth/StepUpAuthDialog';
 export interface StepUpAuthContextType {
     isStepUpPending: boolean;
 }
@@ -16,4 +18,14 @@ export declare const StepUpAuthContext: React.Context<StepUpAuthContextType | un
 export declare const StepUpAuthProvider: React.FC<{
     children: ReactNode;
 }>;
+/**
+ * Turn what the person supplied into a single-use step-up token.
+ *
+ * A passkey takes two round trips because WebAuthn is challenge-response: fetch the server's
+ * challenge, have the authenticator sign it, then present the assertion. Password and TOTP are one. A
+ * linked identity runs its provider in a popup and redeems the code it returns (#1441).
+ */
+export declare function obtainStepUpToken(proof: StepUpProof, purpose?: ReAuthenticationPurpose, signal?: AbortSignal): Promise<{
+    reAuthToken: string;
+}>;
 //# sourceMappingURL=StepUpAuthContext.d.ts.map

package/dist/esm/core/security/StepUpAuthContext.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"StepUpAuthContext.d.ts","sourceRoot":"","sources":["~~../../../../~~src/core/security/StepUpAuthContext.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,EAAiB,SAAS,EAAqD,MAAM,OAAO,CAAC;~~AAM3G~~,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAA+D,CAAC;AAE/I,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,EAAE,CAAC;IAAE,QAAQ,EAAE,SAAS,CAAA;CAAE,~~CAuFhE~~,CAAC"}
1	+ {"version":3,"file":"StepUpAuthContext.d.ts","sourceRoot":"","sources":["../../../../../src/core/security/StepUpAuthContext.tsx"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,EAAiB,SAAS,EAAqD,MAAM,OAAO,CAAC;AAC3G,OAAO,EAAc,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAK5E,OAAO,EAAoB,KAAK,WAAW,EAAE,MAAM,sDAAsD,CAAC;AAG1G,MAAM,WAAW,qBAAqB;IACpC,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,eAAO,MAAM,iBAAiB,EAAE,KAAK,CAAC,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAA+D,CAAC;AAE/I,eAAO,MAAM,kBAAkB,EAAE,KAAK,CAAC,EAAE,CAAC;IAAE,QAAQ,EAAE,SAAS,CAAA;CAAE,CAqGhE,CAAC;AAEF;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,WAAW,EAClB,OAAO,GAAE,uBAAyD,EAClE,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBlC"}