@cauthyhq/node 1.2.1 → 1.3.0

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/cookies.ts","../src/seal.ts","../src/types.ts","../src/url.ts","../src/contract.ts","../src/keys.ts","../src/rootkey.ts","../src/deadline.ts","../src/permissions.ts","../src/system.ts","../src/theme.ts","../src/validate.ts","../src/webhook.ts","../src/sha256.ts","../src/cauthykey.ts","../src/protocol.ts","../src/verify.ts","../src/json.ts","../src/deprecate.ts","../src/keyderive.ts","../src/identity.ts","../src/mount.ts","../src/cauthy.ts","../src/connect.ts"],"sourcesContent":["export { createCauthy, type Cauthy, type CauthyPact, type Resolved } from './cauthy'\nexport { composeKey, KEY_REPLACES, parseKey, type CauthyKey } from './cauthykey'\nexport { type Identity } from './identity'\nexport { failClosed, readContract, STANDARD_VARIABLES, type ContractOptions, type PactItem, type PactStatus, type ResolvedContract } from './contract'\nexport { type KeyStore, type PactKeys, type StoredKey } from './keys'\nexport {\n  CauthyConfigError,\n  CauthyKeyError,\n  type CauthyKeyReason,\n  type CauthyOptions,\n  type CheckQuestion,\n  type CheckResult,\n  type CheckRule,\n  type ConditionalPermission,\n  type JsonValue,\n  type OrganizationRef,\n  type PublicSession,\n  type Session,\n  type SessionOrganization,\n  type SessionStatus,\n  type SessionUser,\n} from './types'\nexport { pushTheme, themeFromStackmyth, tokensFromStackmyth, type StackmythTokens, type CauthyTheme, type ImportedTheme, type PushThemeOptions, type StackmythThemeOptions, type ThemeFont, type ThemeTexts } from './theme'\nexport { can, definePolicy, policySource, pullCatalog, pullPolicy, pushCatalog, pushPolicy, type AttributeType, type CatalogResource, type CheckOf, type Permitted, type PermissionOf, type Policy, type PolicyDefinition, type PolicyPermission, type PolicyRole, type PushPolicyOptions, type RoleOf, type SystemPolicy } from './permissions'\nexport { memoryReplayStore, verifyWebhook, CauthyWebhookError, type CauthyEvent, type ReplayStore, type VerifyWebhookOptions } from './webhook'\nexport { createSystem, CauthyApiError, type CauthySystem, type NewMember, type Organization, type OrganizationMember, type SystemKey, type SystemOptions } from './system'\nexport { connectSystem, type ConnectOptions, type Connected } from './connect'\nexport { MIN_PASSWORD, DEFAULT_PASSWORD_POLICY, checkCode, checkEmail, checkName, checkNewPassword, checkPassword, describePasswordPolicy, explainPasswordProblems, passwordPolicyOf, passwordProblems, type AuthField, type FieldProblem, type PasswordClass, type PasswordLocale, type PasswordPolicy, type PasswordReason } from './validate'\nexport { verifyToken, createTokenVerifier, createVerifierFromEnv, remoteKeys, CauthyTokenError, CauthyUnavailableError, type TokenIdentity, type TokenRefusal, type VerifyTokenOptions } from './verify'\nexport { PROTOCOL_VERSION, type NextStep } from './protocol'\nexport { type MountTarget } from './mount'\n","// Cookies, by hand: reading the Cookie header and writing Set-Cookie.\n//\n// A session can outgrow one cookie (browsers stop near 4 KB), so a value is\n// written in numbered parts — name.0, name.1 — and read back in order.\n\nconst PART = 3500\n\nexport function readCookies(header: string | null | undefined): Map<string, string> {\n  const out = new Map<string, string>()\n  for (const pair of (header ?? '').split(';')) {\n    const i = pair.indexOf('=')\n    if (i > 0) out.set(pair.slice(0, i).trim(), pair.slice(i + 1).trim())\n  }\n  return out\n}\n\n/** A value written in parts, or null when the cookie is not there. */\nexport function readParts(cookies: Map<string, string>, name: string): string | null {\n  let value = ''\n  for (let i = 0; cookies.has(`${name}.${i}`); i++) value += cookies.get(`${name}.${i}`)\n  return value === '' ? null : value\n}\n\nexport interface CookieAttributes {\n  secure: boolean\n  maxAge?: number // seconds; 0 deletes; none makes a cookie that ends with the browser session\n  path?: string\n}\n\nfunction attributes(a: CookieAttributes): string {\n  // httpOnly: script never reads it. SameSite=Lax: it rides the navigation\n  // that comes back from Cauthy, and no cross-site form post.\n  return `Path=${a.path ?? '/'}; HttpOnly; SameSite=Lax${a.maxAge === undefined ? '' : `; Max-Age=${a.maxAge}`}${a.secure ? '; Secure' : ''}`\n}\n\nexport function writeCookie(name: string, value: string, a: CookieAttributes): string {\n  return `${name}=${value}; ${attributes(a)}`\n}\n\n/**\n * The Set-Cookie headers that store a value in parts and delete whatever\n * parts an earlier, longer value left behind.\n */\nexport function writeParts(name: string, value: string, a: CookieAttributes, had: Map<string, string>): string[] {\n  const out: string[] = []\n  let n = 0\n  for (let i = 0; i < value.length; i += PART) out.push(writeCookie(`${name}.${n++}`, value.slice(i, i + PART), a))\n  for (let i = n; had.has(`${name}.${i}`); i++) out.push(writeCookie(`${name}.${i}`, '', { ...a, maxAge: 0 }))\n  return out\n}\n\nexport function clearParts(name: string, a: CookieAttributes, had: Map<string, string>): string[] {\n  const out: string[] = []\n  for (let i = 0; had.has(`${name}.${i}`) || i === 0; i++) out.push(writeCookie(`${name}.${i}`, '', { ...a, maxAge: 0 }))\n  return out\n}\n","// The session cookie's envelope: encrypted and authenticated with a key only\n// the server has, so the browser carries the session without being able to\n// read or change it.\n\nimport { CompactEncrypt, compactDecrypt } from 'jose'\n\nconst encoder = new TextEncoder()\nconst decoder = new TextDecoder()\n\n/** The 256-bit key a secret stands for. */\nexport async function keyOf(secret: string): Promise<Uint8Array> {\n  return new Uint8Array(await crypto.subtle.digest('SHA-256', encoder.encode(secret)))\n}\n\nexport async function seal(value: unknown, key: Uint8Array): Promise<string> {\n  return new CompactEncrypt(encoder.encode(JSON.stringify(value)))\n    .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })\n    .encrypt(key)\n}\n\n/** The value sealed, or null for anything that is not a cookie this key made. */\nexport async function unseal<T>(sealed: string, key: Uint8Array): Promise<T | null> {\n  try {\n    const { plaintext } = await compactDecrypt(sealed, key, {\n      keyManagementAlgorithms: ['dir'],\n      contentEncryptionAlgorithms: ['A256GCM'],\n    })\n    return JSON.parse(decoder.decode(plaintext)) as T\n  } catch {\n    return null\n  }\n}\n\n/** The value sealed with any key of the ring (the newest first), or null. */\nexport async function unsealAny<T>(sealed: string, ring: Uint8Array[]): Promise<T | null> {\n  return (await unsealIndexed<T>(sealed, ring))?.value ?? null\n}\n\n/** The value and the position in the ring of the key that opened it, or null. */\nexport async function unsealIndexed<T>(sealed: string, ring: Uint8Array[]): Promise<{ value: T; index: number } | null> {\n  for (let index = 0; index < ring.length; index++) {\n    const value = await unseal<T>(sealed, ring[index])\n    if (value !== null) return { value, index }\n  }\n  return null\n}\n","/** How an application is set up to sign its people in with Cauthy. */\nexport interface CauthyOptions {\n  /**\n   * The application's CAUTHY_KEY, made in Cauthy's dashboard: Cauthy's\n   * address, the application's client and its secret, in one value. Default:\n   * `CAUTHY_KEY`. With it nothing else is read: the workspace, the system and\n   * the application's addresses come from Cauthy (`GET /v1/connect/self`),\n   * and passing `issuer`, `clientId`, `clientSecret`, `secret`, `system`,\n   * `tenant`, `audience`, `tenantId`, `systemKey` or `rootKey` is refused.\n   */\n  key?: string\n  /** The key being replaced, during a rotation: read, never written with. Default: `CAUTHY_KEY_PREVIOUS`. */\n  keyPrevious?: string\n  /** Cauthy's public address, e.g. `https://id.example.com`. Default: `CAUTHY_ISSUER`. */\n  issuer?: string\n  /** The application's OAuth client id. Default: `CAUTHY_CLIENT_ID`. */\n  clientId?: string\n  /** Its secret, when the client is confidential. Default: `CAUTHY_CLIENT_SECRET`. */\n  clientSecret?: string\n  /**\n   * The key the session cookie is encrypted with: any string of 32 characters\n   * or more, kept on the server. Default: `CAUTHY_SECRET`.\n   */\n  secret?: string\n  /**\n   * The system this application is, as its organizations are filed under in\n   * Cauthy (`\"acme-crm\"`). When set, a session's organizations are that\n   * system's. Default: `CAUTHY_SYSTEM`.\n   */\n  system?: string\n  /**\n   * The workspace's slug in Cauthy. Needed for the application's own sign-in\n   * screens (`signIn.email`, `signUp.email`…), which sign people in through\n   * the application's server instead of Cauthy's page. Default: `CAUTHY_TENANT`.\n   */\n  tenant?: string\n  /** Where the routes are mounted. Default: `/api/auth`. */\n  basePath?: string\n  /**\n   * What happens to a POST without `X-Cauthy-Request: 1` (every POST but\n   * `/logout`). `required`, the default, answers `403 csrf_required`, as\n   * protocol level strict asks. `warn` lets it through and says so once per\n   * process: for the one deploy that moves an application whose browser still\n   * runs cauthy-auth 0.42, which does not send the header. Remove it once the\n   * browser runs cauthy-auth 0.43 or @cauthyhq/js.\n   */\n  requestHeader?: 'required' | 'warn'\n  /**\n   * The audience of the access tokens `auth.verifyToken` accepts: the\n   * deployment's `JWT_AUDIENCE`, which Cauthy requires its operator to set and\n   * has no default for. Default: `CAUTHY_AUDIENCE`.\n   */\n  audience?: string\n  /**\n   * The workspace's id (a lowercase UUID) for `auth.verifyToken`. By contract\n   * it comes from the link's `tenant_id`; otherwise: this, or `CAUTHY_TENANT_ID`.\n   */\n  tenantId?: string\n  /**\n   * The application's own public origin (`https://app.example.com`): the\n   * redirect URI, the cookies' `Secure` flag and which forms are its own come\n   * from it. Default: `CAUTHY_BASE_URL`, else the origin of each request, with\n   * the scheme a proxy names in `x-forwarded-proto`. Set it whenever a proxy\n   * also changes the host or the port.\n   */\n  baseURL?: string\n  /** Where a person lands after signing in, when no `return_to` was asked. Default: `/`. */\n  afterSignIn?: string\n  /** Where a person lands after signing out. Default: `/`. */\n  afterSignOut?: string\n  /** Name of the session cookie. Default: `cauthy_session`. */\n  cookieName?: string\n  /**\n   * A key the application proves who it is with when it acts on its own\n   * (`auth.system`), instead of its secret. Default: `CAUTHY_SYSTEM_KEY` and\n   * `CAUTHY_SYSTEM_KEY_ID`.\n   */\n  systemKey?: import('./system').SystemKey\n  /**\n   * The application's own pages for what arrives by mail. A link Cauthy mails\n   * opens the page named here, with a `token` to give back; with none, it\n   * opens Cauthy's own page.\n   *\n   *   signIn         where `<SignIn />` is: a sign-in link opens it\n   *   resetPassword  where `<ResetPassword />` is\n   *   verifyEmail    where `<VerifyEmail />` is\n   *   acceptInvite   where `<AcceptInvite />` is: an invitation opens it\n   *\n   * An invitation sent by `auth.system.members.add` or `auth.system.invite`\n   * opens `acceptInvite` only when the application knows its public origin\n   * (`baseURL`): that call has no request to read it from.\n   */\n  pages?: { signIn?: string; resetPassword?: string; verifyEmail?: string; acceptInvite?: string }\n  /**\n   * The address of the person a request comes from, passed on to Cauthy so\n   * its limits on attempts count the person and not this server. Default: the\n   * last address in `X-Forwarded-For`, which is the one the proxy in front of\n   * the application wrote. With several proxies, or none, give your own.\n   */\n  clientIp?: (request: Request) => string | undefined\n  /** `fetch` to reach Cauthy with. Default: the global one. */\n  fetch?: typeof fetch\n  /**\n   * How long a call to Cauthy may take before it fails, in milliseconds.\n   * `system`: the application's own calls (`auth.system`, and the proof its\n   * sign-ins carry). Default 2000. `request`: the sign-in screens' calls and\n   * the code, refresh and userinfo calls of a session. Default 5000. The\n   * push-approval event stream has no deadline.\n   */\n  timeouts?: { system?: number; request?: number }\n  /**\n   * Run by contract: the issuer, the workspace, the clients and where the\n   * application's keys are published all come from its link in the network's\n   * context graph, and none of the CAUTHY_* variables may be set. See\n   * \"Connect a system by contract\".\n   *\n   *   createCauthy({ contract: { graph, system: 'acme-crm' }, keys: postgresKeyStore(query) })\n   */\n  contract?: import('./contract').ContractOptions\n  /** Where the application keeps its own key, with a contract (@cauthyhq/node/keys). */\n  keys?: import('./keys').KeyStore\n  /**\n   * The one secret of a contracted application: every key it needs is\n   * derived from it. 32 random bytes or more. Default: `PACT_ROOT_KEY`.\n   */\n  rootKey?: string\n  /** The root key before the current one, while rotating it. Default: `PACT_ROOT_KEY_PREVIOUS`. */\n  rootKeyPrevious?: string\n  /**\n   * Where `auth.webhook` remembers the deliveries it took, so one sent twice\n   * is refused. Default: this process's memory. Give a shared one (a table)\n   * when the application runs on several instances.\n   */\n  webhookReplay?: import('./webhook').ReplayStore\n}\n\n/** The person signed in. Every moment is UTC. */\nexport interface SessionUser {\n  id: string\n  email: string\n  name: string\n  emailVerified: boolean\n  /**\n   * True when the account ran out of time to confirm its address: let it read\n   * and refuse its writes.\n   */\n  restricted: boolean\n  /** When an unconfirmed address stops being enough (ISO 8601, UTC), if there is a deadline. */\n  emailVerifyBy?: string\n  /** The language the person reads in (\"es\", \"en-US\"), when Cauthy knows it. */\n  locale?: string\n  /** A guest: a visitor's session before they sign up. No email; `account.upgrade` makes it an account, keeping `id`. */\n  isAnonymous?: boolean\n}\n\n/** A value JSON can carry. What crosses from server to browser is typed as this, never `unknown`. */\nexport type JsonValue = string | number | boolean | null | JsonValue[] | { [key: string]: JsonValue }\n\n/** An organization the person belongs to, with their role in it. */\nexport interface SessionOrganization {\n  id: string\n  system: string\n  name: string\n  kind: string\n  externalId?: string\n  role: string\n  /** What the system keeps about the organization, as it filed it in Cauthy. */\n  metadata: Record<string, JsonValue>\n  /**\n   * What the person may do here, as \"resource:action\" entries (\"*\" is any):\n   * their role's permissions, what it inherits, and anything given to them\n   * apart from it. Absent when the system keeps no catalog of roles in Cauthy.\n   * Check with `can(organization, resource, action)`.\n   */\n  permissions?: string[]\n  /** What the person is denied here, whatever else allows it. */\n  denied?: string[]\n  /**\n   * Permissions that hold only when their condition does (an amount under a\n   * limit, the person's own records…). They are in neither list above: `can`\n   * answers no for them, and `auth.check` asks Cauthy. Present, maybe empty,\n   * whenever `permissions` is.\n   */\n  conditional?: ConditionalPermission[]\n}\n\n/** A permission with a condition: Cauthy decides it per question (`auth.check`). */\nexport interface ConditionalPermission {\n  resource: string\n  action: string\n  effect: 'allow' | 'deny'\n}\n\n/** What to ask Cauthy about: an action on a resource, with what the conditions read of it. */\nexport interface CheckQuestion {\n  resource: string\n  action: string\n  /** What a condition reads as `resource.attrs`: `{ amount: 500 }`. */\n  attributes?: Record<string, unknown>\n  /** The record's id, as a condition reads it (`resource.id`). */\n  resourceId?: string\n  /** Whose the record is (`resource.owner_id`): `resource.owner_id == subject.id`. */\n  ownerId?: string\n}\n\n/** An organization, by its id or as the session has it. */\nexport type OrganizationRef = string | { id: string }\n\n/** The rule that decided a check. */\nexport interface CheckRule {\n  /** A permission of the person's role, or an exception given to the person. */\n  source: 'role' | 'exception'\n  /** The role, when `source` is `role`. */\n  role?: string\n  kind: string\n  resource: string\n  action: string\n  effect: 'allow' | 'deny'\n  condition?: string\n}\n\n/** Cauthy's answer to a check. */\nexport interface CheckResult {\n  allowed: boolean\n  /** Why, in words: \"allowed by role accountant: invoices:approve\". */\n  reason: string\n  /** The rule that decided; absent when none did (nothing allows it). */\n  rule?: CheckRule\n}\n\n/** A signed-in person, as the server sees them. */\nexport interface Session {\n  user: SessionUser\n  /** The Cauthy tenant the account is of. */\n  tenantId: string\n  /** The roles the account holds in that tenant. */\n  roles: string[]\n  /**\n   * Cauthy's access token for this person: send it as `Authorization: Bearer`\n   * to another service that verifies Cauthy's tokens. Never give it to the browser.\n   */\n  accessToken: string\n  /** When the access token expires and the session is checked with Cauthy again (ISO 8601, UTC). */\n  expiresAt: string\n}\n\n/** What the browser is told of a session: who, and their organizations — never a token. */\nexport interface PublicSession {\n  user: SessionUser\n  tenantId: string\n  roles: string[]\n  organizations: SessionOrganization[]\n  expiresAt: string\n}\n\n/** Why there is no session. */\nexport type SessionStatus =\n  | 'authenticated'\n  | 'unauthenticated' // nobody is signed in\n  | 'expired' // signed in, but the session must be renewed first (see `Cauthy.resolve`)\n\nexport class CauthyConfigError extends Error {\n  constructor(message: string) {\n    super(`@cauthyhq/node: ${message}`)\n    this.name = 'CauthyConfigError'\n  }\n}\n\n/** Why a CAUTHY_KEY was refused (key/cauthy-key.md §3, §8, §9). */\nexport type CauthyKeyReason = 'key_format' | 'key_version' | 'key_checksum' | 'key_issuer' | 'key_client' | 'key_secret'\n  | 'key_contract_issuer' | 'key_previous_mismatch'\n\n/** A refused CAUTHY_KEY. The message names the reason, never the key. */\nexport class CauthyKeyError extends CauthyConfigError {\n  constructor(readonly reason: CauthyKeyReason, message: string) {\n    super(`CAUTHY_KEY: ${message} (${reason})`)\n    this.name = 'CauthyKeyError'\n  }\n}\n","/**\n * The address without its trailing slashes: `https://auth.example.com/` and\n * `https://auth.example.com` name the same issuer. A loop, not `/\\/+$/`,\n * which backtracks over a long run of slashes.\n */\nexport function withoutTrailingSlashes(s: string): string {\n  let end = s.length\n  while (end > 0 && s.charCodeAt(end - 1) === 47) end--\n  return s.slice(0, end)\n}\n","// Contract mode: everything an application needs to know about Cauthy, read\n// from the network's context graph (core-contracts' graph.json), never typed.\n//\n// A link of the contracts repository says \"this system signs its people in\n// with Cauthy, returns to these addresses, and acts on its own with the keys\n// it publishes there\". Cauthy applies that link — its clients are made with\n// the ids the link names — and the application reads the same link: the\n// issuer, the workspace, the sign-in client, the system's own client, where\n// its keys are published. Both ends read one file, so nothing is copied.\n\nimport { CauthyConfigError } from './types'\nimport { withoutTrailingSlashes } from './url'\n\n/** What createCauthy is given to run by contract. */\nexport interface ContractOptions {\n  /** The context graph, as `cauthy contracts pull` writes it (contracts/graph.json). */\n  graph: unknown\n  /** This application's system in the graph: `\"acme-crm\"`. */\n  system: string\n  /** The link to read, when the system has more than one with Cauthy. */\n  link?: string\n  /** Cauthy's system in the graph. Default: `\"cauthy\"`. */\n  provider?: string\n}\n\n/** What an application reads of its contract. */\nexport interface ResolvedContract {\n  system: string\n  link: string\n  /** Cauthy's public address. */\n  issuer: string\n  /** The workspace's id, and its slug (what the application's own screens send). */\n  tenantId: string\n  tenant: string\n  /** The public client people sign in with: `pact.<link>`. */\n  clientId: string\n  /** Where people may return after signing in. */\n  redirectUris: string[]\n  /** Whether Cauthy asks the system's proof on the code exchange now (`systemProof` is `required`). */\n  requireSystemProof: boolean\n  /** How the link asks for the proof: never, from the first proved sign-in on (`auto`), or always. */\n  systemProof: 'off' | 'auto' | 'required'\n  /** Whether Cauthy issues no token through this link before the address is confirmed. */\n  requireVerifiedEmail: boolean\n  /** Whether the link lets its people ask to stay signed in. */\n  persistentSessions: boolean\n  /** The system's own client, when the link gives it one: `pact.<link>.service`. */\n  serviceClientId?: string\n  /** Where the system publishes its keys, and the path of that address. */\n  jwksUrl?: string\n  jwksPath?: string\n  /** Where the system receives Cauthy's events, when it says. */\n  eventsUrl?: string\n}\n\n/**\n * The variables of the standard mode. With a contract none may be set: two\n * sources of the same thing, one silently winning, is how a system ends up\n * signing people in through a client nobody meant.\n */\nexport const STANDARD_VARIABLES = [\n  'CAUTHY_ISSUER', 'CAUTHY_CLIENT_ID', 'CAUTHY_CLIENT_SECRET', 'CAUTHY_SECRET',\n  'CAUTHY_SYSTEM', 'CAUTHY_TENANT', 'CAUTHY_SYSTEM_KEY', 'CAUTHY_SYSTEM_KEY_ID',\n] as const\n\n/** Refuses to run by contract with a variable of the standard mode set: names it. */\nexport function failClosed(environment: Record<string, string | undefined> | undefined): void {\n  const set = STANDARD_VARIABLES.filter(name => (environment?.[name] ?? '') !== '')\n  if (set.length > 0) {\n    throw new CauthyConfigError(`the application runs by contract, and ${set.join(', ')} ${set.length === 1 ? 'is' : 'are'} also set: ` +\n      'remove ' + (set.length === 1 ? 'it' : 'them') + ' from the environment. Everything comes from the contract.')\n  }\n}\n\nconst SLUG = /^[a-z0-9]+(?:[-_][a-z0-9]+)*$/\nconst UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\nconst NIL_UUID = '00000000-0000-0000-0000-000000000000'\n\ninterface GraphNode {\n  id?: unknown\n  type?: unknown\n  url?: unknown\n  events_url?: unknown\n  jwks_url?: unknown\n  tenants?: { id?: unknown; slug?: unknown }[] | null\n}\n\ninterface GraphEdge {\n  from?: unknown\n  relation?: unknown\n  to?: unknown\n  link?: unknown\n  identity?: { tenant?: unknown; subject?: unknown; tenant_id?: unknown; create_tenant?: unknown }\n  sign_in?: { client_id?: unknown; redirect_uris?: unknown; require_system_proof?: unknown; system_proof?: unknown; require_verified_email?: unknown; persistent_sessions?: unknown } | null\n  service?: { client_id?: unknown; system?: unknown; jwks_url?: unknown } | null\n}\n\nconst text = (v: unknown) => (typeof v === 'string' ? v : '')\n\nfunction httpsAddress(raw: string, what: string): URL {\n  let u: URL\n  try {\n    u = new URL(raw)\n  } catch {\n    throw new CauthyConfigError(`the contract's ${what} is not an address: ${JSON.stringify(raw)}`)\n  }\n  const local = u.hostname === 'localhost' || u.hostname === '127.0.0.1'\n  if (u.protocol !== 'https:' && !(u.protocol === 'http:' && local)) {\n    throw new CauthyConfigError(`the contract's ${what} must be https: ${raw}`)\n  }\n  return u\n}\n\n/** Reads what the graph says of the system's link with Cauthy. */\nexport function readContract(options: ContractOptions): ResolvedContract {\n  const { system } = options\n  const provider = options.provider ?? 'cauthy'\n  if (!SLUG.test(system ?? '')) throw new CauthyConfigError('contract.system must be the system\\'s id in the graph, e.g. \"acme-crm\"')\n  const graph = (options.graph && typeof options.graph === 'object' && 'default' in options.graph && !('edges' in options.graph)\n    ? (options.graph as { default: unknown }).default\n    : options.graph) as { nodes?: GraphNode[]; edges?: GraphEdge[] } | null\n  if (!graph || !Array.isArray(graph.edges) || !Array.isArray(graph.nodes)) {\n    throw new CauthyConfigError('contract.graph is not a context graph: pass the graph.json that `cauthy contracts pull` writes')\n  }\n  const node = (id: string) => graph.nodes?.find(n => n.type === 'system' && n.id === id)\n  const own = node(system)\n  if (!own) throw new CauthyConfigError(`the graph has no system \"${system}\"`)\n  const cauthy = node(provider)\n  if (!cauthy) throw new CauthyConfigError(`the graph has no system \"${provider}\"`)\n\n  const links = graph.edges.filter(e => e.relation === 'links' && e.from === system && e.to === provider && e.sign_in)\n    .filter(e => options.link === undefined || e.link === options.link)\n  if (links.length === 0) {\n    throw new CauthyConfigError(options.link\n      ? `the graph has no link \"${options.link}\" from ${system} to ${provider} with sign_in`\n      : `no link of the graph signs ${system}'s people in with ${provider}: merge one in the contracts repository, then pull the graph again`)\n  }\n  if (links.length > 1) {\n    throw new CauthyConfigError(`${system} has ${links.length} links to ${provider}: name the one to read (contract.link): ${links.map(l => text(l.link)).join(', ')}`)\n  }\n  const e = links[0]\n  const link = text(e.link)\n  // The link names its workspace by id (the graph lists its slug) or by slug\n  // (the graph pins its id as tenant_id). A slug with no tenant_id is a\n  // workspace Cauthy has not created yet, or a graph pulled before it was.\n  const named = text(e.identity?.tenant)\n  const pinned = text(e.identity?.tenant_id)\n  if (named === NIL_UUID || pinned === NIL_UUID) throw new CauthyConfigError(`the link ${link} names the nil UUID as its workspace: name the workspace by its slug`)\n  let tenantId: string\n  let tenant: string\n  if (UUID.test(named)) {\n    if (pinned !== '' && pinned.toLowerCase() !== named.toLowerCase()) {\n      throw new CauthyConfigError(`the link ${link} names the workspace ${named} and its tenant_id ${pinned} does not match: pull the graph again`)\n    }\n    tenantId = named\n    tenant = text((cauthy.tenants ?? []).find(t => t.id === named)?.slug)\n    if (tenant === '') throw new CauthyConfigError(`the graph does not name the slug of the workspace ${named} that the link ${link} uses`)\n  } else {\n    if (!SLUG.test(named)) throw new CauthyConfigError(`the link ${link} names no workspace: identity.tenant is a UUID or a slug`)\n    if (!UUID.test(pinned)) {\n      throw new CauthyConfigError(e.identity?.create_tenant === true\n        ? `the link ${link} asks Cauthy for a new workspace \"${named}\", and the graph has no tenant_id for it yet: once Cauthy has created it and core-contracts lists it, pull the graph again`\n        : `the link ${link} names the workspace \"${named}\" by its slug, and the graph carries no tenant_id for it: pull the graph again`)\n    }\n    tenantId = pinned\n    tenant = named\n  }\n  const issuer = withoutTrailingSlashes(httpsAddress(text(cauthy.url), `address of ${provider}`).href)\n  const signIn = e.sign_in ?? {}\n  const clientId = text(signIn.client_id) || `pact.${link}`\n  const redirectUris = Array.isArray(signIn.redirect_uris) ? signIn.redirect_uris.map(text).filter(Boolean) : []\n  if (redirectUris.length === 0) throw new CauthyConfigError(`the link ${link} names no redirect URI`)\n\n  // system_proof says the whole of it; a graph from before it has only the boolean.\n  const proof = text(signIn.system_proof)\n  if (signIn.system_proof !== undefined && proof !== 'off' && proof !== 'auto' && proof !== 'required') {\n    throw new CauthyConfigError(`the link ${link} has system_proof ${JSON.stringify(signIn.system_proof)}: it is off, auto or required. Update @cauthyhq/node, or pull the graph again`)\n  }\n  const systemProof: ResolvedContract['systemProof'] = proof === 'off' || proof === 'auto' || proof === 'required'\n    ? proof\n    : signIn.require_system_proof === true ? 'required' : 'off'\n  if (systemProof !== 'off' && !e.service) {\n    throw new CauthyConfigError(`the link ${link} asks for the system's proof (${systemProof}) and gives ${system} no identity to make it with: it needs a service block`)\n  }\n\n  const out: ResolvedContract = {\n    system, link, issuer, tenantId, tenant, clientId, redirectUris,\n    requireSystemProof: systemProof === 'required',\n    systemProof,\n    requireVerifiedEmail: signIn.require_verified_email === true,\n    persistentSessions: signIn.persistent_sessions === true,\n  }\n  if (e.service) {\n    out.serviceClientId = text(e.service.client_id) || `pact.${link}.service`\n    const jwks = text(e.service.jwks_url) || text(own.jwks_url)\n    if (jwks === '') throw new CauthyConfigError(`the link ${link} gives ${system} its own identity, and ${system} names no jwks_url`)\n    out.jwksUrl = httpsAddress(jwks, 'jwks_url').href\n    out.jwksPath = new URL(out.jwksUrl).pathname\n  }\n  if (text(own.events_url) !== '') out.eventsUrl = httpsAddress(text(own.events_url), 'events_url').href\n  return out\n}\n\n/** One difference between a contract and what Cauthy holds. */\nexport interface PactItem {\n  kind: 'client' | 'redirect_uri' | 'grant_type' | 'role' | 'organization' | 'require_system_proof' | 'persistent_sessions' | 'jwks_url'\n  client_id?: string\n  value: string\n  detail?: string\n}\n\n/** How the system stands against its contract, as Cauthy checks it (GET /v1/pact/status). Moments are UTC. */\nexport interface PactStatus {\n  system: string\n  tenant_id: string\n  checked_at: string\n  /** When Cauthy's daily reconciliation last checked it; null before the first. */\n  reconciled_at: string | null\n  in_step: boolean\n  /** In Cauthy, and the contract does not name it. Nothing is ever deleted for it. */\n  outside: PactItem[]\n  /** Named by the contract, and Cauthy does not hold it as it says. */\n  missing: PactItem[]\n  contract: { clients: { client_id: string; link: string; purpose: 'sign_in' | 'service'; redirect_uris?: string[]; grant_types: string[]; require_system_proof?: boolean; jwks_url?: string }[]; roles?: Record<string, string[]> }\n  held: { clients: Record<string, unknown>[]; roles: string[]; organizations: Record<string, number> }\n}\n","// The application's own key: made by the application, kept in its own\n// database, its public half published, its private half sealed at rest.\n//\n// A contracted application proves who it is to Cauthy with an assertion it\n// signs (private_key_jwt). Nobody hands it that key: the first time it needs\n// one it makes it, seals the private half with the key derived from its root\n// key (pact/seal/v1) and keeps it in a KeyStore — a table of its database, a\n// file while developing. Its public half is served at the jwks_url its\n// manifest names, where Cauthy reads it.\n//\n// Rotating: `rotate()` makes a new key, published at once. It signs once it\n// has been published longer than anyone caches the keys (SIGN_AFTER_MS):\n// Cauthy, meeting a key it does not know, reads the keys again, and a copy\n// cached on the way must already hold it. The one before it stays published\n// 24 hours, so an assertion signed a moment ago, or by an instance that has\n// not seen the new key yet, still verifies.\n//\n// The first key is made by whichever instance needs it first: the store keeps\n// it only while it holds none (addFirst), so instances starting together end\n// with one key. A store without addFirst may end with several; every one is\n// published, and every instance settles on the same one within seconds.\n\nimport { calculateJwkThumbprint, exportJWK, generateKeyPair, importJWK, type JWK, type KeyLike } from 'jose'\nimport { seal, unseal } from './seal'\nimport type { KeyRing } from './rootkey'\nimport { CauthyConfigError } from './types'\n\n/** A key as a KeyStore keeps it. Nothing in it is secret but sealed. */\nexport interface StoredKey {\n  /** Its id, as published (the JWK thumbprint). */\n  kid: string\n  /** Its public half, as published. */\n  publicJwk: JWK\n  /** Its private half, sealed with the key derived from the root key. */\n  sealed: string\n  /** When it was made (ISO 8601, UTC). The newest signs. */\n  createdAt: string\n}\n\n/** Where the application keeps its keys: a table, a file. */\nexport interface KeyStore {\n  /** Every key kept. */\n  list(): Promise<StoredKey[]>\n  /** Keeps a new key. A kid already kept is left as it is. */\n  add(key: StoredKey): Promise<void>\n  /** Keeps the key only while the store holds none, in one step: instances starting together make one key. */\n  addFirst?(key: StoredKey): Promise<void>\n  /** Replaces a key's sealed private half (after the root key was rotated). */\n  update(key: StoredKey): Promise<void>\n  /** Forgets a key no longer published. */\n  remove(kid: string): Promise<void>\n}\n\n/** How long a key stays published after a newer one appears. */\nexport const RETIRE_AFTER_MS = 24 * 60 * 60 * 1000\n/** How long a key that is no longer published is kept before it is forgotten. */\nconst FORGET_AFTER_MS = 7 * 24 * 60 * 60 * 1000\n/** How long the key that signs is remembered before the store is read again. */\nconst CURRENT_TTL_MS = 5 * 60 * 1000\n/** How long the published keys may be cached (the jwks_url's max-age). */\nexport const JWKS_MAX_AGE_S = 300\n/** How long a new key is published before it signs: longer than any cached copy of the keys. */\nexport const SIGN_AFTER_MS = (JWKS_MAX_AGE_S + 60) * 1000\n/** While every key is younger than that, the store is read again this often, so instances settle on one. */\nconst SETTLING_TTL_MS = 5 * 1000\n\n/** The application's keys, as auth.pact.keys gives them. */\nexport interface PactKeys {\n  /** The key that signs now, made the first time there is none: the newest that has been published long enough. */\n  current(): Promise<{ kid: string; privateKey: KeyLike | Uint8Array }>\n  /** The public keys to publish: the one that signs, and the one before it for 24 hours after. */\n  published(): Promise<{ keys: JWK[] }>\n  /** Makes a new key, published at once and signing once SIGN_AFTER_MS has passed. Answers its id. */\n  rotate(): Promise<string>\n  /** Seals every key again with the current root key; answers how many changed. */\n  reseal(): Promise<number>\n}\n\nconst newestFirst = (keys: StoredKey[]) => [...keys].sort((a, b) => b.createdAt.localeCompare(a.createdAt) || b.kid.localeCompare(a.kid))\n\nfunction published(key: StoredKey): JWK {\n  const { kty, n, e } = key.publicJwk\n  return { kty, n, e, kid: key.kid, alg: 'RS256', use: 'sig' }\n}\n\nexport function pactKeys(store: KeyStore, sealKeys: Promise<KeyRing>, now: () => number = Date.now): PactKeys {\n  let remembered: { kid: string; privateKey: KeyLike | Uint8Array; until: number } | undefined\n  let making: Promise<StoredKey> | undefined\n\n  async function make(after?: StoredKey): Promise<StoredKey> {\n    const { publicKey, privateKey } = await generateKeyPair('RS256', { modulusLength: 2048, extractable: true })\n    const publicJwk = await exportJWK(publicKey)\n    const kid = await calculateJwkThumbprint(publicJwk)\n    // Always newer than the key it follows, however fast the rotation.\n    const at = Math.max(now(), after ? Date.parse(after.createdAt) + 1 : 0)\n    const key: StoredKey = { kid, publicJwk, sealed: await seal(await exportJWK(privateKey), (await sealKeys)[0]), createdAt: new Date(at).toISOString() }\n    if (!after && store.addFirst) await store.addFirst(key)\n    else await store.add(key)\n    return key\n  }\n\n  const age = (key: StoredKey) => now() - Date.parse(key.createdAt)\n\n  // The key that signs: the newest published long enough. When none is (the\n  // first minutes of the first key, or a race of first keys), the oldest, read\n  // again shortly so every instance lands on the same one.\n  function signer(kept: StoredKey[]): { key: StoredKey; until: number } {\n    const ripe = kept.find(k => age(k) >= SIGN_AFTER_MS)\n    if (!ripe) return { key: kept[kept.length - 1], until: now() + SETTLING_TTL_MS }\n    // A newer key ripens later: read again then, not after the usual while.\n    const until = ripe === kept[0] ? now() + CURRENT_TTL_MS : Math.min(now() + CURRENT_TTL_MS, Date.parse(kept[0].createdAt) + SIGN_AFTER_MS)\n    return { key: ripe, until }\n  }\n\n  async function open(key: StoredKey): Promise<{ jwk: JWK; fresh: boolean } | null> {\n    const ring = await sealKeys\n    for (let i = 0; i < ring.length; i++) {\n      const jwk = await unseal<JWK>(key.sealed, ring[i])\n      if (jwk !== null) return { jwk, fresh: i === 0 }\n    }\n    return null\n  }\n\n  // Every key kept, newest first; the first one is made when there is none.\n  async function keptKeys(): Promise<StoredKey[]> {\n    const kept = newestFirst(await store.list())\n    if (kept.length > 0) return kept\n    // Two callers at once make one key; two instances at once, one with\n    // addFirst, and otherwise several that are all published.\n    making ??= make().finally(() => { making = undefined })\n    await making\n    const again = newestFirst(await store.list())\n    if (again.length === 0) throw new CauthyConfigError('the key store kept no key: check that it writes')\n    return again\n  }\n\n  return {\n    async current() {\n      if (remembered && remembered.until > now()) return remembered\n      const { key, until } = signer(await keptKeys())\n      if (remembered?.kid === key.kid) {\n        remembered.until = until\n        return remembered\n      }\n      const opened = await open(key)\n      if (opened === null) {\n        throw new CauthyConfigError(`the key ${key.kid} cannot be opened with the root key (PACT_ROOT_KEY): ` +\n          'if the root key was rotated, set the previous one as PACT_ROOT_KEY_PREVIOUS')\n      }\n      remembered = { kid: key.kid, privateKey: await importJWK(opened.jwk, 'RS256'), until }\n      return remembered\n    },\n    async published() {\n      // Asked before anything was signed: the key is made now, so what is\n      // published is the key that will sign.\n      const kept = await keptKeys()\n      const out: JWK[] = []\n      for (let i = 0; i < kept.length; i++) {\n        // The newest is published; an older one while its successor is young.\n        if (i === 0 || now() - Date.parse(kept[i - 1].createdAt) < RETIRE_AFTER_MS) out.push(published(kept[i]))\n        else if (now() - Date.parse(kept[i - 1].createdAt) > FORGET_AFTER_MS) await store.remove(kept[i].kid)\n      }\n      return { keys: out }\n    },\n    async rotate() {\n      const key = await make(newestFirst(await store.list())[0])\n      remembered = undefined\n      return key.kid\n    },\n    async reseal() {\n      let changed = 0\n      const ring = await sealKeys\n      for (const key of await store.list()) {\n        const opened = await open(key)\n        if (opened === null || opened.fresh) continue\n        await store.update({ ...key, sealed: await seal(opened.jwk, ring[0]) })\n        changed++\n      }\n      return changed\n    },\n  }\n}\n\n/** Keys kept in memory: for tests, and for trying contract mode out. Gone on restart. */\nexport function memoryKeyStore(): KeyStore {\n  const keys = new Map<string, StoredKey>()\n  return {\n    async list() { return [...keys.values()] },\n    async add(k) { if (!keys.has(k.kid)) keys.set(k.kid, k) },\n    async addFirst(k) { if (keys.size === 0) keys.set(k.kid, k) },\n    async update(k) { keys.set(k.kid, k) },\n    async remove(kid) { keys.delete(kid) },\n  }\n}\n\n/**\n * The table postgresKeyStore keeps the keys in, for the application's own\n * migrations (Drizzle, Prisma, plain SQL). The store never creates it.\n */\nexport function pactKeysTableSql(table = 'cauthy_pact_keys'): string {\n  checkTable(table)\n  return `CREATE TABLE IF NOT EXISTS ${table} (\n  kid        TEXT        PRIMARY KEY,\n  public_jwk JSONB       NOT NULL,\n  sealed     TEXT        NOT NULL,\n  created_at TIMESTAMPTZ NOT NULL\n);`\n}\n\nfunction checkTable(table: string): void {\n  if (!/^[a-z_][a-z0-9_]{0,62}$/.test(table)) throw new CauthyConfigError(`the key table's name must be a plain SQL identifier: ${table}`)\n}\n\n/**\n * Runs one SQL statement with $1, $2… parameters and answers its rows: what\n * the application's own database client does. With node-postgres,\n * `(text, params) => pool.query(text, params)`; with postgres.js,\n * `(text, params) => sql.unsafe(text, params)`.\n */\nexport type Query = (text: string, params: unknown[]) => Promise<{ rows: unknown[] } | unknown[]>\n\n/** Keys kept in a table of the application's Postgres database (see pactKeysTableSql). */\nexport function postgresKeyStore(query: Query, options: { table?: string } = {}): KeyStore {\n  const table = options.table ?? 'cauthy_pact_keys'\n  checkTable(table)\n  const rows = async (text: string, params: unknown[]) => {\n    const out = await query(text, params)\n    return (Array.isArray(out) ? out : out.rows) as Record<string, unknown>[]\n  }\n  const at = (v: unknown) => (v instanceof Date ? v.toISOString() : new Date(String(v)).toISOString())\n  return {\n    async list() {\n      return (await rows(`SELECT kid, public_jwk, sealed, created_at FROM ${table}`, [])).map(r => ({\n        kid: String(r.kid),\n        publicJwk: (typeof r.public_jwk === 'string' ? JSON.parse(r.public_jwk) : r.public_jwk) as JWK,\n        sealed: String(r.sealed),\n        createdAt: at(r.created_at),\n      }))\n    },\n    async add(k) {\n      await rows(`INSERT INTO ${table} (kid, public_jwk, sealed, created_at) VALUES ($1, $2, $3, $4) ON CONFLICT (kid) DO NOTHING`,\n        [k.kid, JSON.stringify(k.publicJwk), k.sealed, k.createdAt])\n    },\n    async addFirst(k) {\n      // One statement: a key another instance committed a moment ago is seen.\n      await rows(`INSERT INTO ${table} (kid, public_jwk, sealed, created_at) SELECT $1, $2, $3, $4 WHERE NOT EXISTS (SELECT 1 FROM ${table}) ON CONFLICT (kid) DO NOTHING`,\n        [k.kid, JSON.stringify(k.publicJwk), k.sealed, k.createdAt])\n    },\n    async update(k) {\n      await rows(`UPDATE ${table} SET sealed = $2 WHERE kid = $1`, [k.kid, k.sealed])\n    },\n    async remove(kid) {\n      await rows(`DELETE FROM ${table} WHERE kid = $1`, [kid])\n    },\n  }\n}\n","// One secret, many keys.\n//\n// A contracted application keeps one secret in its environment, its root key\n// (PACT_ROOT_KEY). Each job gets a key of its own derived from it with HKDF\n// and a label, so no key does two jobs:\n//\n//   pact/seal/v1    seals the application's private key at rest\n//   pact/cookie/v1  encrypts the session cookie\n//   pact/flow/v1    encrypts what a sign-in carries between its steps\n//\n// Rotating the root: set the new one as PACT_ROOT_KEY and the old one as\n// PACT_ROOT_KEY_PREVIOUS for a deploy. What is written uses the new root;\n// what is read is tried with the new root, then the previous one. Sessions\n// survive, and `auth.pact.keys.reseal()` seals the private key again with the\n// new root. Then the previous one is removed.\n\nimport { CauthyConfigError } from './types'\n\n/** What each derived key is for. */\nexport type KeyPurpose = 'seal' | 'cookie' | 'flow'\n\nconst encoder = new TextEncoder()\n\n/** The least a root key may be: 32 characters, as 32 random bytes in base64url are 43. */\nexport const MIN_ROOT_KEY = 32\n\n/** The keys of one purpose: the first writes, every one is tried to read. */\nexport type KeyRing = Uint8Array[]\n\nasync function derive(root: string, purpose: KeyPurpose): Promise<Uint8Array> {\n  const ikm = await crypto.subtle.importKey('raw', encoder.encode(root), 'HKDF', false, ['deriveBits'])\n  const bits = await crypto.subtle.deriveBits(\n    { name: 'HKDF', hash: 'SHA-256', salt: new Uint8Array(0), info: encoder.encode(`pact/${purpose}/v1`) }, ikm, 256)\n  return new Uint8Array(bits)\n}\n\n/** The keys a root key (and the one before it, while rotating) stand for. */\nexport interface DerivedKeys {\n  seal: Promise<KeyRing>\n  cookie: Promise<KeyRing>\n  flow: Promise<KeyRing>\n}\n\nexport function deriveKeys(root: string, previous?: string): DerivedKeys {\n  if (root.length < MIN_ROOT_KEY) {\n    throw new CauthyConfigError(`rootKey (PACT_ROOT_KEY) must be at least ${MIN_ROOT_KEY} characters: 32 random bytes, e.g. openssl rand -base64 32`)\n  }\n  if (previous !== undefined && previous !== '' && previous.length < MIN_ROOT_KEY) {\n    throw new CauthyConfigError(`the previous root key (PACT_ROOT_KEY_PREVIOUS) must be at least ${MIN_ROOT_KEY} characters`)\n  }\n  const roots = previous && previous !== root ? [root, previous] : [root]\n  const ring = (purpose: KeyPurpose) => Promise.all(roots.map(r => derive(r, purpose)))\n  return { seal: ring('seal'), cookie: ring('cookie'), flow: ring('flow') }\n}\n","// A deadline for a call to Cauthy that does not get in the way of the caller's\n// own cancellation: the call fails with a `TimeoutError` when Cauthy has not\n// answered in time, and with the caller's own reason when the caller gave up.\n// For a stream (`accept: text/event-stream`) the deadline covers the first\n// response only: the stream then lives as long as its caller wants it.\n\nexport const DEFAULT_DEADLINE_MS = 5000\n\n/** Whether `err` is the deadline of `deadline()` passing, and not a caller giving up. */\nexport const isTimeout = (err: unknown): boolean => (err as { name?: unknown } | null)?.name === 'TimeoutError'\n\nexport function deadline(base: typeof fetch | undefined, ms: number): typeof fetch {\n  return async (input, init = {}) => {\n    const send = base ?? fetch\n    const stream = new Headers(init.headers).get('accept')?.includes('text/event-stream') === true\n    if (!stream) {\n      // The whole answer, body included, is inside the deadline.\n      const limit = AbortSignal.timeout(ms)\n      return send(input, { ...init, signal: init.signal ? anySignal([init.signal, limit]) : limit })\n    }\n    const own = new AbortController()\n    const timer = setTimeout(() => own.abort(new DOMException(`Cauthy did not answer within ${ms} ms`, 'TimeoutError')), ms)\n    try {\n      return await send(input, { ...init, signal: init.signal ? anySignal([init.signal, own.signal]) : own.signal })\n    } finally {\n      clearTimeout(timer)\n    }\n  }\n}\n\nfunction anySignal(signals: AbortSignal[]): AbortSignal {\n  if (typeof AbortSignal.any === 'function') return AbortSignal.any(signals)\n  // Node 20.0 to 20.2: no AbortSignal.any.\n  const controller = new AbortController()\n  for (const signal of signals) {\n    if (signal.aborted) {\n      controller.abort(signal.reason)\n      break\n    }\n    signal.addEventListener('abort', () => controller.abort(signal.reason), { once: true })\n  }\n  return controller.signal\n}\n","// What a person may do in an organization.\n//\n// When a system keeps its catalog of roles in Cauthy, each of a person's\n// organizations arrives with what their role — and anything given or denied to\n// them apart from it — lets them do. Checking is a lookup in that list: no\n// call to Cauthy, on the server or in the browser.\n\nimport type { CheckQuestion, CheckResult, CheckRule, ConditionalPermission, OrganizationRef } from './types'\nimport { deadline, DEFAULT_DEADLINE_MS } from './deadline'\nimport { withoutTrailingSlashes } from './url'\n\n/** The part of an organization that says what its member may do. */\nexport interface Permitted {\n  /** \"resource:action\" entries the person is allowed; \"*\" is any. Absent when the system keeps no catalog in Cauthy. */\n  permissions?: string[]\n  /** Entries the person is denied whatever else allows them. */\n  denied?: string[]\n  /** Permissions with a condition: in neither list, so `can` never counts them. Ask with `auth.check`. */\n  conditional?: ConditionalPermission[]\n}\n\nfunction matches(entry: string, resource: string, action: string): boolean {\n  // The resource may itself hold a colon: the action is what follows the last one.\n  const i = entry.lastIndexOf(':')\n  if (i < 0) return false\n  const r = entry.slice(0, i)\n  const a = entry.slice(i + 1)\n  return (r === '*' || r === resource) && (a === '*' || a === action)\n}\n\n/**\n * Whether the person may do an action on a resource in an organization:\n * allowed by some entry, and denied by none. A denial wins.\n *\n * An organization of a system that keeps no catalog in Cauthy carries no\n * permissions, and the answer is `false`: decide by its `role` instead.\n *\n * A permission with a condition (`organization.conditional`) is not in the\n * lists, so `can` answers `false` for what only it allows: the condition reads\n * the record at hand, which only Cauthy can weigh. Ask with `auth.check`\n * (`organizations.check` in the browser).\n *\n *   if (!can(organization, 'invoicing', 'write')) return forbidden()\n */\nexport function can(organization: Permitted | null | undefined, resource: string, action: string): boolean {\n  if (!organization?.permissions) return false\n  if ((organization.denied ?? []).some((d) => matches(d, resource, action))) return false\n  return organization.permissions.some((p) => matches(p, resource, action))\n}\n\n// ── A system's catalog of roles ────────────────────────────────────────────\n\n/** Something a role may do: an action on a resource, in organizations of a kind (\"*\", the default, is every kind). */\nexport interface PolicyPermission {\n  kind?: string\n  resource: string\n  action: string\n  /**\n   * When it holds, in CEL: `resource.attrs.amount <= 1000000`. A permission\n   * with one is decided by Cauthy per question (`auth.check`), never by `can`.\n   */\n  condition?: string\n}\n\n/** The type of an attribute a condition may read: `list` is any JSON array. */\nexport type AttributeType = 'string' | 'number' | 'bool' | 'list'\n\n/** A resource of a system's catalog: the actions done on it and the attributes its conditions read. */\nexport interface CatalogResource {\n  resource: string\n  description?: string\n  actions: string[]\n  /** Name → type, as `resource.attrs.<name>` in a condition. */\n  attributes?: Record<string, AttributeType>\n}\n\nexport interface PolicyRole {\n  role: string\n  name?: string\n  description?: string\n  /** Roles whose permissions this one has as well. */\n  inherits?: string[]\n  permissions?: PolicyPermission[]\n}\n\n// ── The catalog, with its types ────────────────────────────────────────────\n//\n// A catalog written down once gives the roles and the permissions their\n// names: `can(org, 'ledger:write')` then takes only a permission the catalog\n// has, the editor offers them, and a typo does not compile.\n//\n//   export const policy = definePolicy([\n//     { role: 'reader', permissions: [{ resource: 'ledger', action: 'read' }] },\n//     { role: 'accountant', inherits: ['reader'], permissions: [{ resource: 'ledger', action: 'write' }] },\n//   ])\n//   export const { can, hasRole } = policy\n//\n//   can(organization, 'ledger:write')        // 'ledger:wirte' does not compile\n//   hasRole(organization, 'accountant')\n//\n// A system that declares its resources gives them too, with their actions and\n// the attributes a condition reads, and a check is typed by them:\n//\n//   export const policy = definePolicy({\n//     catalog: [{ resource: 'invoices', actions: ['read', 'approve'], attributes: { amount: 'number' } }],\n//     roles: [{ role: 'accountant', permissions: [{ resource: 'invoices', action: 'approve', condition: 'resource.attrs.amount <= 1000' }] }],\n//   })\n//\n//   await policy.check(auth, request, { organization, resource: 'invoices', action: 'approve', attributes: { amount: 500 } })\n//\n// Write it by hand, or let `pullPolicy` write it from the\n// catalog Cauthy has.\n\ntype PermissionShape = { readonly kind?: string; readonly resource: string; readonly action: string; readonly condition?: string }\n\n/** A role as `definePolicy` reads it: any `PolicyRole`, kept as written. */\ntype RoleShape = {\n  readonly role: string\n  readonly name?: string\n  readonly description?: string\n  readonly inherits?: readonly string[]\n  readonly permissions?: readonly PermissionShape[]\n}\n\n/** A resource as `definePolicy` reads it: any `CatalogResource`, kept as written. */\ntype ResourceShape = {\n  readonly resource: string\n  readonly description?: string\n  readonly actions: readonly string[]\n  readonly attributes?: { readonly [name: string]: AttributeType }\n}\n\n// \"*\" in a catalog is \"any\": the name it stands for is any text.\ntype Named<S extends string> = S extends '*' ? string : S\n\ntype PermissionsIn<R> = R extends { readonly permissions: readonly (infer P)[] }\n  ? P extends { readonly resource: infer Res extends string; readonly action: infer Act extends string } ? `${Named<Res>}:${Named<Act>}` : never\n  : never\n\ntype ValueOf<T> = T extends 'string' ? string : T extends 'number' ? number : T extends 'bool' ? boolean : T extends 'list' ? unknown[] : never\n\n/** What a check may say about one declared resource. */\ntype QuestionAbout<E> = E extends { readonly resource: infer R extends string; readonly actions: readonly (infer A extends string)[] }\n  ? {\n      resource: R\n      action: A\n      attributes?: E extends { readonly attributes: infer T } ? { [K in keyof T]?: ValueOf<T[K]> } : Record<string, never>\n      resourceId?: string\n      ownerId?: string\n    }\n  : never\n\n/**\n * What a role of a catalog that declares its resources may name: a declared\n * resource with one of its actions, or \"*\", or one of Cauthy's own powers.\n */\ntype PermissionFor<C extends readonly ResourceShape[]> = { readonly kind?: string; readonly condition?: string } & (\n  | (C[number] extends infer E ? E extends { readonly resource: infer R extends string; readonly actions: readonly (infer A extends string)[] } ? { readonly resource: R; readonly action: A | '*' } : never : never)\n  | { readonly resource: '*'; readonly action: string }\n  | { readonly resource: `cauthy:${string}`; readonly action: string }\n)\ntype RoleFor<C extends readonly ResourceShape[]> = Omit<RoleShape, 'permissions'> & { readonly permissions?: readonly PermissionFor<C>[] }\n\n/** The roles a catalog names: `RoleOf<typeof policy>`. */\nexport type RoleOf<P> = P extends Policy<infer R, any, any> ? R : never\n/** The \"resource:action\" permissions a catalog names: `PermissionOf<typeof policy>`. */\nexport type PermissionOf<P> = P extends Policy<any, infer X, any> ? X : never\n/** What a check about this catalog may ask: `CheckOf<typeof policy>`. Any resource when it declares none. */\nexport type CheckOf<P> = P extends Policy<any, any, infer Q> ? Q : never\n\n/** The fields of a question: whatever else the asker takes (the organization, the person) passes through. */\ntype QuestionKeys = keyof CheckQuestion\n\nexport interface Policy<Role extends string = string, Permission extends string = string, Question extends CheckQuestion = CheckQuestion> {\n  /** The catalog as Cauthy takes it: `pushPolicy({ roles: policy.roles })`. */\n  roles: PolicyRole[]\n  /** The resources the system declares, as Cauthy takes them; empty when it declares none. */\n  catalog: CatalogResource[]\n  /** Every role's name. */\n  roleNames: Role[]\n  /** Every permission some role has, as \"resource:action\". */\n  permissions: Permission[]\n  /**\n   * Whether the person may do this in the organization: `can(org, 'ledger:write')`.\n   * It reads what Cauthy sent with the session, so a catalog edited in Cauthy\n   * since this file was written is still what decides. A permission with a\n   * condition is not there: ask with `check`.\n   */\n  can(organization: Permitted | null | undefined, permission: Permission): boolean\n  /** Whether the person's role in the organization is one of these. */\n  hasRole(organization: { role: string } | null | undefined, ...roles: Role[]): boolean\n  /**\n   * What a role may do by this catalog, with what it inherits: for showing a\n   * role, never for deciding about a person (their exceptions are not here).\n   */\n  permissionsOf(role: Role): Permission[]\n  /**\n   * Asks Cauthy, with the resource, action and attributes typed by the\n   * catalog. Give it whoever asks: the server's `auth` with the request,\n   * the browser's `organizations`, or the application's `system`.\n   *\n   *   await policy.check(auth, request, { organization, resource: 'invoices', action: 'approve', attributes: { amount: 500 } })\n   *   await policy.check(auth.system, { organizationId, userId, resource: 'invoices', action: 'read' })\n   */\n  check<I extends CheckQuestion>(asker: { check(input: I): Promise<CheckResult> }, input: Omit<I, QuestionKeys> & Question): Promise<CheckResult>\n  check<R, I extends CheckQuestion>(asker: { check(request: R, input: I): Promise<CheckResult> }, request: R, input: Omit<I, QuestionKeys> & Question): Promise<CheckResult>\n}\n\n/** A catalog with its resources declared, for `definePolicy`. */\nexport interface PolicyDefinition<C extends readonly ResourceShape[], T extends readonly RoleShape[]> {\n  catalog: C\n  roles: T\n}\n\n/** Gives a catalog of roles its types. See the top of this section. */\nexport function definePolicy<const T extends readonly RoleShape[]>(roles: T): Policy<T[number]['role'], PermissionsIn<T[number]>>\n/** Gives a catalog of resources and roles its types: a role names only what the catalog declares. */\nexport function definePolicy<const C extends readonly ResourceShape[], const T extends readonly RoleFor<C>[]>(\n  definition: PolicyDefinition<C, T>,\n): Policy<T[number]['role'], PermissionsIn<T[number]>, QuestionAbout<C[number]>>\nexport function definePolicy(given: readonly RoleShape[] | PolicyDefinition<readonly ResourceShape[], readonly RoleShape[]>): Policy {\n  const roles: readonly RoleShape[] = Array.isArray(given) ? given : (given as PolicyDefinition<readonly ResourceShape[], readonly RoleShape[]>).roles\n  const resources: readonly ResourceShape[] = Array.isArray(given) ? [] : (given as PolicyDefinition<readonly ResourceShape[], readonly RoleShape[]>).catalog ?? []\n  const entry = (p: { resource: string; action: string }) => `${p.resource}:${p.action}`\n  const byName = new Map(roles.map((r) => [r.role, r]))\n  const split = (permission: string): [string, string] => {\n    const i = permission.lastIndexOf(':')\n    return i < 0 ? [permission, ''] : [permission.slice(0, i), permission.slice(i + 1)]\n  }\n  return {\n    roles: roles.map((r) => ({\n      role: r.role,\n      ...(r.name !== undefined ? { name: r.name } : {}),\n      ...(r.description !== undefined ? { description: r.description } : {}),\n      ...(r.inherits ? { inherits: [...r.inherits] } : {}),\n      ...(r.permissions ? { permissions: r.permissions.map((p) => ({ ...p })) } : {}),\n    })),\n    catalog: resources.map((c) => ({\n      resource: c.resource,\n      ...(c.description !== undefined ? { description: c.description } : {}),\n      actions: [...c.actions],\n      ...(c.attributes ? { attributes: { ...c.attributes } } : {}),\n    })),\n    roleNames: roles.map((r) => r.role),\n    permissions: [...new Set(roles.flatMap((r) => (r.permissions ?? []).map(entry)))],\n    can(organization, permission) {\n      const [resource, action] = split(permission)\n      return can(organization, resource, action)\n    },\n    hasRole(organization, ...wanted) {\n      return organization != null && wanted.includes(organization.role)\n    },\n    permissionsOf(role) {\n      const seen = new Set<string>()\n      const out = new Set<string>()\n      const walk = (name: string) => {\n        if (seen.has(name)) return // a catalog that inherits in a circle still ends\n        seen.add(name)\n        const r = byName.get(name)\n        for (const p of r?.permissions ?? []) out.add(entry(p))\n        for (const parent of r?.inherits ?? []) walk(parent)\n      }\n      walk(role)\n      return [...out]\n    },\n    // The types did the work; this only hands the question on, as a method of\n    // the asker so it keeps its `this`.\n    check(asker: { check(...args: unknown[]): Promise<CheckResult> }, ...args: unknown[]) {\n      return asker.check(...args)\n    },\n  }\n}\n\nconst IDENT = /^[A-Za-z_$][A-Za-z0-9_$]*$/\n\n/** A system's policy as Cauthy has it: the resources it declares (maybe none) and its roles. */\nexport interface SystemPolicy {\n  catalog: CatalogResource[]\n  roles: PolicyRole[]\n}\n\n/**\n * A TypeScript module that defines the catalog given, for `pullPolicy` to\n * write: the application's types then come from the catalog\n * Cauthy has. With resources declared it is `definePolicy({ catalog, roles })`;\n * without, the list of roles alone, as it always was.\n */\nexport function policySource(system: string, read: PolicyRole[] | { catalog?: CatalogResource[]; roles: PolicyRole[] }): string {\n  const roles = Array.isArray(read) ? read : read.roles\n  const catalog = Array.isArray(read) ? [] : (read.catalog ?? [])\n  const text = (v: string) => JSON.stringify(v)\n  const key = (k: string) => (IDENT.test(k) ? k : text(k))\n  const one = (r: PolicyRole, pad: string) => {\n    const parts = [`role: ${text(r.role)}`]\n    if (r.name) parts.push(`name: ${text(r.name)}`)\n    if (r.description) parts.push(`description: ${text(r.description)}`)\n    if (r.inherits?.length) parts.push(`inherits: [${r.inherits.map(text).join(', ')}]`)\n    if (r.permissions?.length) {\n      const list = r.permissions.map((p) => `${pad}      { ${[\n        ...(p.kind && p.kind !== '*' ? [`${key('kind')}: ${text(p.kind)}`] : []),\n        `resource: ${text(p.resource)}`,\n        `action: ${text(p.action)}`,\n        ...(p.condition ? [`condition: ${text(p.condition)}`] : []),\n      ].join(', ')} },`)\n      parts.push(`permissions: [\\n${list.join('\\n')}\\n${pad}    ]`)\n    }\n    return `${pad}  {\\n${pad}    ${parts.join(`,\\n${pad}    `)},\\n${pad}  },`\n  }\n  const resource = (c: CatalogResource) => {\n    const parts = [`resource: ${text(c.resource)}`]\n    if (c.description) parts.push(`description: ${text(c.description)}`)\n    parts.push(`actions: [${c.actions.map(text).join(', ')}]`)\n    const attrs = Object.entries(c.attributes ?? {})\n    if (attrs.length) parts.push(`attributes: { ${attrs.map(([k, v]) => `${key(k)}: ${text(v)}`).join(', ')} }`)\n    return `    { ${parts.join(', ')} },`\n  }\n  const head = `// The catalog of roles of ${text(system)}, as Cauthy has it.\n// Written by \\`pullPolicy\\`: run it again after the catalog\n// changes, and do not edit this file by hand.\n`\n  if (catalog.length === 0) {\n    return `${head}\nimport { definePolicy, type PermissionOf, type RoleOf } from '@cauthyhq/node'\n\nexport const policy = definePolicy([\n${roles.map((r) => one(r, '')).join('\\n')}\n])\n\nexport const { can, hasRole } = policy\nexport type Role = RoleOf<typeof policy>\nexport type Permission = PermissionOf<typeof policy>\n`\n  }\n  return `${head}\nimport { definePolicy, type CheckOf, type PermissionOf, type RoleOf } from '@cauthyhq/node'\n\nexport const policy = definePolicy({\n  catalog: [\n${catalog.map(resource).join('\\n')}\n  ],\n  roles: [\n${roles.map((r) => one(r, '  ')).join('\\n')}\n  ],\n})\n\nexport const { can, hasRole } = policy\nexport type Role = RoleOf<typeof policy>\nexport type Permission = PermissionOf<typeof policy>\n/** What a check may ask: \\`policy.check(auth, request, { organization, ...question })\\`. */\nexport type Check = CheckOf<typeof policy>\n`\n}\n\n/** Who reads or writes a system's policy: Cauthy's address, the workspace, a person's token. */\ninterface Reach {\n  issuer: string\n  system: string\n  tenant: string\n  token: string\n  fetch: typeof fetch\n}\n\nfunction reach(o: Omit<PushPolicyOptions, 'roles'>, doing: string): Reach {\n  const env = (n: string) => (typeof process !== 'undefined' ? process.env?.[n] : undefined)\n  const r = {\n    issuer: withoutTrailingSlashes(o.issuer ?? env('CAUTHY_ISSUER') ?? ''),\n    system: o.system ?? env('CAUTHY_SYSTEM') ?? '',\n    tenant: o.tenant ?? env('CAUTHY_TENANT') ?? '',\n    token: o.token ?? env('CAUTHY_TOKEN') ?? '',\n  }\n  for (const [name, v] of Object.entries({ CAUTHY_ISSUER: r.issuer, CAUTHY_SYSTEM: r.system, CAUTHY_TENANT: r.tenant, CAUTHY_TOKEN: r.token })) {\n    if (v === '') throw new Error(`@cauthyhq/node: ${name} is required to ${doing}`)\n  }\n  return { ...r, fetch: deadline(o.fetch, o.timeoutMs ?? DEFAULT_DEADLINE_MS) }\n}\n\nasync function systemCall(r: Reach, method: 'GET' | 'PUT', what: 'policy' | 'catalog', body?: unknown): Promise<any> {\n  const res = await r.fetch(`${r.issuer}/v1/systems/${encodeURIComponent(r.system)}/${what}`, {\n    ...(method === 'PUT' ? { method } : {}),\n    headers: {\n      authorization: `Bearer ${r.token}`, 'x-tenant-key': r.tenant,\n      ...(body === undefined ? { accept: 'application/json' } : { 'content-type': 'application/json' }),\n    },\n    ...(body === undefined ? {} : { body: JSON.stringify(body) }),\n  })\n  const answer = (await res.json().catch(() => null)) as { data?: any; errors?: { message?: string }[] } | null\n  if (!res.ok) {\n    const verb = method === 'GET' ? `refused to give the ${what}` : `refused the ${what}`\n    throw new Error(`@cauthyhq/node: Cauthy ${verb} (${res.status}): ${answer?.errors?.[0]?.message ?? res.statusText}`)\n  }\n  return answer?.data\n}\n\n/** Reads a system's catalog of roles from Cauthy, with a personal access token. */\nexport async function pullPolicy(o: Omit<PushPolicyOptions, 'roles'> = {}): Promise<PolicyRole[]> {\n  const data = await systemCall(reach(o, 'read a policy'), 'GET', 'policy')\n  return (data?.roles as PolicyRole[] | undefined) ?? []\n}\n\n/** Reads the resources a system declares (empty when it declares none), with a personal access token. */\nexport async function pullCatalog(o: Omit<PushPolicyOptions, 'roles'> = {}): Promise<CatalogResource[]> {\n  const data = await systemCall(reach(o, 'read a catalog'), 'GET', 'catalog')\n  return (data?.resources as CatalogResource[] | undefined) ?? []\n}\n\nexport interface PushPolicyOptions {\n  /** The system whose catalog this is. Default: `CAUTHY_SYSTEM`. */\n  system?: string\n  roles: PolicyRole[]\n  /**\n   * The resources the system declares. Given, they are sent before the roles,\n   * which Cauthy then checks against them; left out, the catalog Cauthy has\n   * stays as it is.\n   */\n  catalog?: CatalogResource[]\n  /** Cauthy's address. Default: `CAUTHY_ISSUER`. */\n  issuer?: string\n  /** The workspace's slug. Default: `CAUTHY_TENANT`. */\n  tenant?: string\n  /**\n   * A personal access token: `organizations:manage` reads, and changing a\n   * policy or a catalog takes `systems:policy`. Default: `CAUTHY_TOKEN`.\n   */\n  token?: string\n  fetch?: typeof fetch\n  /** How long the call may take, in milliseconds, before it fails with a `TimeoutError`. Default: 5000. */\n  timeoutMs?: number\n}\n\n/**\n * Gives Cauthy a system's catalog of roles, replacing the one it has. It is\n * the way to load a first catalog from what a system already had; from then on\n * the catalog is Cauthy's, edited in its dashboard, and pushing again would\n * overwrite what was edited there. With `catalog` the declared resources go\n * first: the roles are checked against them.\n */\nexport async function pushPolicy(o: PushPolicyOptions): Promise<void> {\n  const r = reach(o, 'push a policy')\n  if (o.catalog !== undefined) await systemCall(r, 'PUT', 'catalog', { resources: o.catalog })\n  await systemCall(r, 'PUT', 'policy', { roles: o.roles })\n}\n\n/**\n * Gives Cauthy the resources a system declares, replacing the ones it has.\n * Cauthy refuses (`catalog_in_use`) to drop a resource or an action the\n * policy still names.\n */\nexport async function pushCatalog(o: Omit<PushPolicyOptions, 'roles' | 'catalog'> & { resources: CatalogResource[] }): Promise<CatalogResource[]> {\n  const data = await systemCall(reach(o, 'push a catalog'), 'PUT', 'catalog', { resources: o.resources })\n  return (data?.resources as CatalogResource[] | undefined) ?? []\n}\n\n/** What a policy file holds: the roles alone (as it used to), or `{ catalog, roles }`. */\nexport function readPolicyFile(parsed: unknown): SystemPolicy {\n  if (Array.isArray(parsed)) return { catalog: [], roles: parsed as PolicyRole[] }\n  const o = (parsed ?? {}) as { roles?: unknown; catalog?: unknown }\n  if (!Array.isArray(o.roles)) throw new Error('no \"roles\" list')\n  if (o.catalog !== undefined && !Array.isArray(o.catalog)) throw new Error('\"catalog\" is not a list')\n  return { catalog: (o.catalog as CatalogResource[] | undefined) ?? [], roles: o.roles as PolicyRole[] }\n}\n\n// ── Asking Cauthy ──────────────────────────────────────────────────────────\n\n/** A check's question as Cauthy reads it. */\nexport function checkWire(q: CheckQuestion): Record<string, unknown> {\n  return {\n    resource: q.resource,\n    action: q.action,\n    ...(q.resourceId !== undefined ? { resource_id: q.resourceId } : {}),\n    ...(q.ownerId !== undefined ? { owner_id: q.ownerId } : {}),\n    ...(q.attributes !== undefined ? { attributes: q.attributes } : {}),\n  }\n}\n\n/** Cauthy's answer to a check, as the SDK gives it. Anything but a plain yes is a no. */\nexport function checkResultOf(d: any): CheckResult {\n  const r = d?.rule\n  const rule: CheckRule | undefined = r && typeof r === 'object'\n    ? {\n        source: r.source === 'exception' ? 'exception' : 'role',\n        ...(r.role ? { role: String(r.role) } : {}),\n        kind: String(r.kind ?? '*'),\n        resource: String(r.resource ?? ''),\n        action: String(r.action ?? ''),\n        effect: r.effect === 'allow' ? 'allow' : 'deny',\n        ...(r.condition ? { condition: String(r.condition) } : {}),\n      }\n    : undefined\n  return { allowed: d?.allowed === true, reason: String(d?.reason ?? ''), ...(rule ? { rule } : {}) }\n}\n\n/** The id of an organization given by its id or as the session has it. */\nexport function organizationIdOf(o: OrganizationRef | null | undefined): string {\n  return typeof o === 'string' ? o : typeof o?.id === 'string' ? o.id : ''\n}\n","// The application acting on its own: creating its organizations, adding their\n// members, inviting people. No person's token is involved — the application\n// is somebody in Cauthy, and what it may touch is its own system's\n// organizations and nothing else.\n//\n// It proves who it is with the client's secret, or with a key it holds and\n// whose public half it publishes (`publicJwks`): then nothing secret is ever\n// shared with Cauthy.\n\nimport { exportJWK, importJWK, importPKCS8, SignJWT, type JWK, type KeyLike } from 'jose'\nimport { deadline, isTimeout } from './deadline'\nimport { checkResultOf, checkWire, type CatalogResource, type PolicyRole } from './permissions'\nimport { fromWire, type CauthyTheme } from './theme'\nimport { CauthyConfigError, type CheckQuestion, type CheckResult, type JsonValue } from './types'\nimport type { Signer } from './keyderive'\nimport { withoutTrailingSlashes } from './url'\n\nconst ASSERTION_TYPE = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'\n/** Ask for a new token this long before the one held runs out. */\nconst SKEW_MS = 30_000\n\n/** The key an application signs its assertions with. */\nexport interface SystemKey {\n  /** The private key: PKCS#8 PEM, or a JWK (as an object or its JSON). RSA, for RS256. */\n  privateKey: string | JWK\n  /** The id the public key is published under (`kid`). */\n  keyId: string\n  /**\n   * The client the key belongs to, when it is not the one people sign in\n   * with: a public sign-in client has no key of its own, and the system's\n   * identity is a confidential client beside it. Default: the client id.\n   */\n  clientId?: string\n}\n\nexport interface SystemOptions {\n  /** Cauthy's address. Default: `CAUTHY_ISSUER`. */\n  issuer?: string\n  /** The application's client id. Default: `CAUTHY_CLIENT_ID`. */\n  clientId?: string\n  /** Its secret. Default: `CAUTHY_CLIENT_SECRET`. Not needed with `key`. */\n  clientSecret?: string\n  /**\n   * The key to prove who the application is with, instead of the secret.\n   * Default: `CAUTHY_SYSTEM_KEY` (the private key) and `CAUTHY_SYSTEM_KEY_ID`.\n   */\n  key?: SystemKey\n  /** The application's system, which `check` asks about. Default: `CAUTHY_SYSTEM`. */\n  system?: string\n  /**\n   * The application's own page for accepting an invitation, as an absolute\n   * address (`https://app.example.com/accept-invite`, where `<AcceptInvite />`\n   * is). The invitations `members.add` and `invite` send open it; without it,\n   * they open Cauthy's own page. Cauthy follows it only on an origin the\n   * client registered to be sent back to. Default: `CAUTHY_ACCEPT_INVITE_URL`.\n   */\n  acceptInviteUrl?: string\n  /**\n   * The application's own keys, kept in its database (contract mode): it\n   * signs with the newest and publishes them. Takes the place of `key`.\n   */\n  keys?: import('./keys').PactKeys\n  /** The client the keys prove: the system's own, beside the sign-in client. */\n  keysClientId?: string\n  /**\n   * CAUTHY_KEY's Ed25519 key (key/cauthy-key.md §6) and the client it proves:\n   * every token is asked with an EdDSA assertion. Takes the place of `key`,\n   * `keys` and the secret.\n   */\n  signer?: { clientId: string; signer: Promise<Signer> }\n  /** The system `check` asks about when it is known only later (CAUTHY_KEY: from Cauthy's answer). */\n  currentSystem?: () => string\n  fetch?: typeof fetch\n  /** How long a call to Cauthy may take before it fails with `503 unavailable`, in milliseconds. Default: 2000. */\n  timeoutMs?: number\n}\n\n/** Cauthy refused a request of the application's own. */\nexport class CauthyApiError extends Error {\n  constructor(\n    readonly status: number,\n    /** Cauthy's code for what went wrong: `organization_not_found`, `other_system`, `outside_system_scope`, `member_exists`… */\n    readonly code: string,\n    message: string,\n  ) {\n    super(`@cauthyhq/node: ${message}`)\n    this.name = 'CauthyApiError'\n  }\n}\n\n/** An organization of the application's system. Every moment is UTC. */\nexport interface Organization {\n  id: string\n  system: string\n  name: string\n  kind: string\n  /** The id the application knows it by. */\n  externalId?: string\n  status: 'active' | 'archived'\n  metadata: Record<string, JsonValue>\n  members: number\n  createdAt: string\n  updatedAt: string\n}\n\nexport interface OrganizationMember {\n  userId: string\n  email: string\n  name: string\n  /** The account's status: a disabled member is still listed. */\n  status: string\n  role: string\n  /** True when the address had no account: one was made and invited. */\n  invited?: boolean\n}\n\n/** Who to add: an account by its id, or anybody by their address (invited when new). */\nexport type NewMember = {\n  role: string\n  name?: string\n  locale?: string\n  /**\n   * Adds and nothing else (the default): a person who already belongs keeps\n   * their role, and the call throws `CauthyApiError` with code\n   * `member_exists` (409). `false` sets the role of whoever is already\n   * there, as `setRole` does.\n   */\n  onlyNew?: boolean\n} & ({ userId: string; email?: undefined } | { email: string; userId?: undefined })\n\nexport interface CauthySystem {\n  /** The application's own token, asked for when needed and kept until it is about to run out. */\n  token(): Promise<string>\n  /** Any route the application's token may call; answers what Cauthy put under `data`. */\n  request<T = unknown>(method: string, path: string, body?: unknown): Promise<T>\n  organizations: {\n    list(query?: { q?: string; status?: 'active' | 'archived'; limit?: number; offset?: number }): Promise<{ items: Organization[]; total: number }>\n    create(input: { name: string; kind?: string; externalId?: string; metadata?: Record<string, JsonValue> }): Promise<Organization>\n    get(id: string): Promise<Organization>\n    update(id: string, patch: { name?: string; kind?: string; status?: 'active' | 'archived'; metadata?: Record<string, JsonValue> }): Promise<Organization>\n    /** Removes the organization and every membership of it, for good. */\n    remove(id: string): Promise<void>\n  }\n  members: {\n    list(organizationId: string): Promise<OrganizationMember[]>\n    /** Adds a person; one who already belongs throws `member_exists` unless `onlyNew: false`. */\n    add(organizationId: string, member: NewMember): Promise<OrganizationMember>\n    setRole(organizationId: string, userId: string, role: string): Promise<OrganizationMember>\n    remove(organizationId: string, userId: string): Promise<void>\n  }\n  /** Invites a person who has no account yet; answers the account made for them. */\n  invite(person: { email: string; name?: string; locale?: string }): Promise<{ id: string; email: string }>\n  /**\n   * How the application looks on Cauthy's pages, read. It is decided in\n   * Cauthy's dashboard, by a person: an application never changes it.\n   */\n  theme: {\n    get(clientId?: string): Promise<CauthyTheme>\n  }\n  /** The catalog of roles of one of the application's systems, as Cauthy has it. */\n  policy: {\n    get(system: string): Promise<PolicyRole[]>\n  }\n  /**\n   * The resources one of the application's systems declares, with their\n   * actions and the attributes conditions read; empty when it declares none.\n   */\n  catalog: {\n    get(system: string): Promise<CatalogResource[]>\n    /** Replaces them. Cauthy refuses (`catalog_in_use`) to drop one the policy still names. */\n    set(system: string, resources: CatalogResource[]): Promise<CatalogResource[]>\n  }\n  /**\n   * Asks Cauthy whether a member of one of the system's organizations may do\n   * an action on a resource, conditions weighed. A person who is not a member\n   * is a no; an organization of another system throws (`organization_not_found`).\n   */\n  check(question: CheckQuestion & { organizationId: string; userId: string; system?: string }): Promise<CheckResult>\n  /** The public half of `key`, to serve at the address Cauthy was given (`jwks_uri`). Empty with a secret. */\n  publicJwks(): Promise<{ keys: JWK[] }>\n}\n\nfunction env(name: string): string | undefined {\n  return typeof process !== 'undefined' ? process.env?.[name] : undefined\n}\n\ninterface OrgWire {\n  id: string; system: string; name: string; kind: string; external_id?: string; status: 'active' | 'archived'\n  metadata: Record<string, JsonValue>; members: number; created_at: string; updated_at: string\n}\n\nfunction toOrganization(o: OrgWire): Organization {\n  return { id: o.id, system: o.system, name: o.name, kind: o.kind, externalId: o.external_id, status: o.status,\n    metadata: o.metadata ?? {}, members: o.members, createdAt: o.created_at, updatedAt: o.updated_at }\n}\n\ninterface MemberWire { user_id: string; email: string; name: string; status: string; role: string; invited?: boolean }\n\nfunction toMember(m: MemberWire): OrganizationMember {\n  return { userId: m.user_id, email: m.email, name: m.name, status: m.status, role: m.role, ...(m.invited === undefined ? {} : { invited: m.invited }) }\n}\n\nfunction asJwk(k: SystemKey): JWK | undefined {\n  if (typeof k.privateKey !== 'string') return k.privateKey\n  return k.privateKey.includes('BEGIN') ? undefined : (JSON.parse(k.privateKey) as JWK)\n}\n\nasync function loadKey(k: SystemKey): Promise<KeyLike | Uint8Array> {\n  const jwk = asJwk(k)\n  // Extractable, so its public half can be published (publicJwks).\n  return jwk ? importJWK(jwk, 'RS256') : importPKCS8(k.privateKey as string, 'RS256', { extractable: true })\n}\n\nexport function createSystem(given: SystemOptions = {}): CauthySystem {\n  const issuer = withoutTrailingSlashes(given.issuer ?? env('CAUTHY_ISSUER') ?? '')\n  const clientId = given.clientId ?? env('CAUTHY_CLIENT_ID') ?? ''\n  const clientSecret = given.clientSecret ?? env('CAUTHY_CLIENT_SECRET') ?? ''\n  const envKey = env('CAUTHY_SYSTEM_KEY')\n  const key = given.key ?? (envKey ? { privateKey: envKey, keyId: env('CAUTHY_SYSTEM_KEY_ID') ?? '' } : undefined)\n  const ownSystem = given.system ?? env('CAUTHY_SYSTEM') ?? ''\n  const acceptInviteUrl = given.acceptInviteUrl ?? env('CAUTHY_ACCEPT_INVITE_URL') ?? ''\n  // What a call that sends an invitation says of the page it opens: the\n  // application names itself, and the page, the same as its own screens do.\n  const inviteHeaders: Record<string, string> = /^https?:\\/\\//.test(acceptInviteUrl)\n    ? { 'x-cauthy-client-id': clientId, 'x-cauthy-link-to': acceptInviteUrl }\n    : {}\n  const timeoutMs = given.timeoutMs ?? 2000\n  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) throw new CauthyConfigError('timeoutMs must be a positive number of milliseconds')\n  // Every call has a deadline: a Cauthy that does not answer must not hold a\n  // sign-in (the proof it carries) or a job of the application forever.\n  const limited = deadline(given.fetch, timeoutMs)\n  const doFetch: typeof fetch = async (input, init) => {\n    try {\n      return await limited(input, init)\n    } catch (err) {\n      // Only the deadline is Cauthy's failure to answer; a caller giving up is the caller's.\n      if (isTimeout(err)) throw new CauthyApiError(503, 'unavailable', `Cauthy did not answer within ${timeoutMs} ms`)\n      throw err\n    }\n  }\n  const tokenEndpoint = `${issuer}/v1/oauth/token`\n\n  // Checked when it is first used, not when it is made: an application that\n  // only signs people in never needs any of this.\n  function configured(): void {\n    if (given.signer) return\n    if (!/^https?:\\/\\//.test(issuer)) throw new CauthyConfigError('issuer (CAUTHY_ISSUER) must be Cauthy\\'s address')\n    if (clientId === '') throw new CauthyConfigError('clientId (CAUTHY_CLIENT_ID) is required')\n    if (given.keys) {\n      if (!given.keysClientId) throw new CauthyConfigError('the contract gives the system no identity of its own: its link needs a service block')\n      return\n    }\n    if (key ? key.keyId === '' : clientSecret === '') {\n      throw new CauthyConfigError(key ? 'the key needs its id (CAUTHY_SYSTEM_KEY_ID)'\n        : 'to act on its own the application needs its secret (CAUTHY_CLIENT_SECRET) or a key (CAUTHY_SYSTEM_KEY)')\n    }\n  }\n\n  let imported: Promise<KeyLike | Uint8Array> | undefined\n  const signingKey = () => (imported ??= loadKey(key as SystemKey))\n\n  // The token endpoint refuses as OAuth does ({error, error_description});\n  // every other route in Cauthy's envelope ({errors: [{code, message}]}).\n  async function fail(res: Response, what: string): Promise<never> {\n    const body = (await res.json().catch(() => null)) as\n      { error?: string; error_description?: string; errors?: { code?: string; message?: string }[] } | null\n    const first = body?.errors?.[0]\n    const code = typeof body?.error === 'string' ? body.error : first?.code\n    const message = typeof body?.error === 'string' ? body.error_description : first?.message\n    throw new CauthyApiError(res.status, code ?? 'error', `Cauthy refused ${what} (${res.status}): ${message ?? res.statusText}`)\n  }\n\n  let held: { value: string; until: number } | undefined\n  let asking: Promise<string> | undefined\n\n  async function ask(): Promise<string> {\n    configured()\n    const self = given.signer ? given.signer.clientId : given.keys ? (given.keysClientId as string) : key?.clientId || clientId\n    const form = new URLSearchParams({ grant_type: 'client_credentials', client_id: self })\n    if (given.signer) {\n      const s = await given.signer.signer\n      form.set('client_assertion_type', ASSERTION_TYPE)\n      form.set('client_assertion', await s.assertion(self, tokenEndpoint))\n    } else if (given.keys || key) {\n      const signer = given.keys ? await given.keys.current() : { kid: (key as SystemKey).keyId, privateKey: await signingKey() }\n      const assertion = await new SignJWT({})\n        .setProtectedHeader({ alg: 'RS256', kid: signer.kid })\n        .setIssuer(self).setSubject(self).setAudience(tokenEndpoint)\n        .setJti(crypto.randomUUID()).setIssuedAt().setExpirationTime('2m')\n        .sign(signer.privateKey)\n      form.set('client_assertion_type', ASSERTION_TYPE)\n      form.set('client_assertion', assertion)\n    } else {\n      form.set('client_secret', clientSecret)\n    }\n    const res = await doFetch(tokenEndpoint, { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: form })\n    if (!res.ok) await fail(res, 'the application\\'s own token')\n    const t = (await res.json()) as { access_token: string; expires_in: number }\n    held = { value: t.access_token, until: Date.now() + t.expires_in * 1000 - SKEW_MS }\n    return t.access_token\n  }\n\n  function token(): Promise<string> {\n    if (held && Date.now() < held.until) return Promise.resolve(held.value)\n    // One request, however many callers arrive while it is out.\n    return (asking ??= ask().finally(() => { asking = undefined }))\n  }\n\n  async function call(method: string, path: string, body?: unknown, extra: Record<string, string> = {}): Promise<unknown> {\n    const send = async () => doFetch(`${issuer}${path}`, {\n      method,\n      headers: { authorization: `Bearer ${await token()}`, ...extra, ...(body === undefined ? {} : { 'content-type': 'application/json' }) },\n      body: body === undefined ? undefined : JSON.stringify(body),\n    })\n    let res = await send()\n    if (res.status === 401 && held) {\n      // The token was taken back early (the client's keys or secret changed): once more, with a new one.\n      held = undefined\n      res = await send()\n    }\n    if (!res.ok) await fail(res, `${method} ${path}`)\n    return res.status === 204 ? undefined : res.json()\n  }\n\n  const data = async <T>(method: string, path: string, body?: unknown, extra?: Record<string, string>) => ((await call(method, path, body, extra)) as { data: T } | undefined)?.data as T\n  const id = encodeURIComponent\n\n  return {\n    token,\n    request: data,\n    organizations: {\n      async list(query = {}) {\n        const q = new URLSearchParams()\n        for (const [k, v] of Object.entries(query)) if (v !== undefined) q.set(k, String(v))\n        const out = (await call('GET', `/v1/organizations${q.size ? `?${q}` : ''}`)) as { data: OrgWire[]; total_count: number }\n        return { items: out.data.map(toOrganization), total: out.total_count }\n      },\n      async create(input) {\n        return toOrganization(await data<OrgWire>('POST', '/v1/organizations',\n          { name: input.name, kind: input.kind, external_id: input.externalId, metadata: input.metadata }))\n      },\n      async get(orgId) {\n        return toOrganization(await data<OrgWire>('GET', `/v1/organizations/${id(orgId)}`))\n      },\n      async update(orgId, patch) {\n        return toOrganization(await data<OrgWire>('PATCH', `/v1/organizations/${id(orgId)}`, patch))\n      },\n      async remove(orgId) {\n        await call('DELETE', `/v1/organizations/${id(orgId)}`)\n      },\n    },\n    members: {\n      async list(orgId) {\n        return (await data<MemberWire[]>('GET', `/v1/organizations/${id(orgId)}/members`)).map(toMember)\n      },\n      async add(orgId, m) {\n        return toMember(await data<MemberWire>('POST', `/v1/organizations/${id(orgId)}/members`,\n          { role: m.role, user_id: m.userId, email: m.email, name: m.name, locale: m.locale, client_id: clientId, only_new: m.onlyNew !== false }, inviteHeaders))\n      },\n      async setRole(orgId, userId, role) {\n        return toMember(await data<MemberWire>('PUT', `/v1/organizations/${id(orgId)}/members/${id(userId)}`, { role }))\n      },\n      async remove(orgId, userId) {\n        await call('DELETE', `/v1/organizations/${id(orgId)}/members/${id(userId)}`)\n      },\n    },\n    async invite(person) {\n      // The invitation leads back to this application once it is accepted.\n      const u = await data<{ id: string; email: string }>('POST', '/v1/users', { ...person, client_id: clientId }, inviteHeaders)\n      return { id: u.id, email: u.email }\n    },\n    theme: {\n      async get(of = clientId) {\n        return fromWire(await data<Record<string, unknown>>('GET', `/v1/oauth/clients/${id(of)}/theme`))\n      },\n    },\n    policy: {\n      async get(system) {\n        return (await data<{ roles?: PolicyRole[] }>('GET', `/v1/systems/${id(system)}/policy`)).roles ?? []\n      },\n    },\n    catalog: {\n      async get(system) {\n        return (await data<{ resources?: CatalogResource[] }>('GET', `/v1/systems/${id(system)}/catalog`)).resources ?? []\n      },\n      async set(system, resources) {\n        return (await data<{ resources?: CatalogResource[] }>('PUT', `/v1/systems/${id(system)}/catalog`, { resources })).resources ?? []\n      },\n    },\n    async check(q) {\n      const system = q.system ?? (ownSystem || given.currentSystem?.() || '')\n      if (system === '') throw new CauthyConfigError('name the system to check in (system, or CAUTHY_SYSTEM)')\n      return checkResultOf(await data('POST', `/v1/systems/${id(system)}/check`, { organization_id: q.organizationId, user_id: q.userId, ...checkWire(q) }))\n    },\n    async publicJwks() {\n      if (given.keys) return given.keys.published()\n      if (!key) return { keys: [] }\n      const { kty, n, e } = asJwk(key) ?? (await exportJWK(await signingKey()))\n      return { keys: [{ kty, n, e, kid: key.keyId, alg: 'RS256', use: 'sig' }] }\n    },\n  }\n}\n","// An application's look, for Cauthy's hosted pages.\n//\n// Cauthy's pages — sign-in, sign-up, the account page — can take the colours,\n// corners, typeface and logo of the application that sends its people there,\n// so signing in reads as a page of the application. A theme is a short list of\n// values, which Cauthy checks one by one; it is never CSS.\n//\n// An application built with Stackmyth already has those values, as its\n// `--sm-*` tokens. `themeFromStackmyth` reads them out of its stylesheets.\n\nimport { deadline, DEFAULT_DEADLINE_MS } from './deadline'\nimport { withoutTrailingSlashes } from './url'\n\n/** How an application looks on Cauthy's hosted pages. Every value is optional. */\n/** One font file the application serves: a family in one weight (or a range) and one style. */\nexport interface ThemeFont {\n  family: string\n  /** An https address of a `.woff2` file. It must answer with `Access-Control-Allow-Origin` for Cauthy's origin. */\n  url: string\n  /** `400`, or `\"100 900\"` for a variable font. Default: 400. */\n  weight?: number | string\n  style?: 'normal' | 'italic'\n}\n\n/** What an application says on its sign-in page, in one language. */\nexport interface ThemeTexts {\n  /** Replaces \"Sign in\". */\n  heading?: string\n  /** Replaces \"to continue to …\". */\n  subheading?: string\n  /** The messages of the split layout's panel, shown one at a time (up to 5). */\n  panel?: string[]\n  /** Links at the foot of the split layout: privacy, terms (up to 4). */\n  links?: { label: string; url: string }[]\n}\n\nexport interface CauthyTheme {\n  /** The page. Colours are `#rrggbb` or `rgba(r, g, b, a)`. */\n  background?: string\n  /** The card, and inputs. */\n  surface?: string\n  /** Headings and what is typed. */\n  text?: string\n  /** Paragraphs, labels, small print. */\n  textMuted?: string\n  border?: string\n  /** The fields and the secondary buttons, when they are not the card's colours. */\n  inputBackground?: string\n  inputBorder?: string\n  /** The main button, and what is written on it. */\n  primary?: string\n  primaryText?: string\n  /** Links, and the focus ring. */\n  accent?: string\n  error?: string\n  errorBackground?: string\n  success?: string\n  successBackground?: string\n  /** Corners of cards and inputs, in pixels (0–40). */\n  radius?: number\n  /** Corners of buttons, in pixels (0–40). */\n  buttonRadius?: number\n  /** A CSS font-family list: the application's typeface first, a system font after it. */\n  fontFamily?: string\n  /** The files of the typefaces `fontFamily` names, for people who do not have them installed. */\n  fonts?: ThemeFont[]\n  /** An image shown where \"Cauthy\" is, over https. */\n  logoUrl?: string\n  /**\n   * How the sign-in pages are laid out: `card` (the default, one card in the\n   * middle) or `split` (the form on one side, a panel that presents the\n   * application on the other).\n   */\n  layout?: 'card' | 'split'\n  /** The colours the split layout's backdrop blends, one to four. */\n  panelColors?: string[]\n  /** The colour of what is written on the panel. */\n  panelText?: string\n  /** An https image shown over the panel's messages. */\n  panelIconUrl?: string\n  /** The application's own words on the sign-in page, by language (`en`, `es`). */\n  texts?: Record<string, ThemeTexts>\n  /**\n   * The application's Stackmyth tokens (`--sm-*`), from `tokensFromStackmyth`.\n   * Cauthy's pages are drawn with Stackmyth's components, so these make its\n   * buttons and fields the application's own. They are laid over the named values.\n   */\n  tokens?: Record<string, string>\n}\n\nexport interface StackmythThemeOptions {\n  /**\n   * The named theme to read, when the stylesheet keeps several under\n   * `[data-theme=…]` (`\"acme\"`). Without it only what applies to every\n   * page (`:root`) is read.\n   */\n  theme?: string\n  /** Which of the application's two modes to take. Default: `light`. */\n  mode?: 'light' | 'dark'\n  logoUrl?: string\n}\n\nexport interface ImportedTheme {\n  theme: CauthyTheme\n  /** Tokens that were there and could not be carried over, and why. */\n  warnings: string[]\n}\n\nconst MAX_RADIUS = 40\n\n// ── Reading custom properties out of CSS ───────────────────────────────────\n\ninterface Declaration {\n  name: string\n  value: string\n  /** The selectors and at-rules it sits inside, outermost first. */\n  within: string[]\n}\n\n// The stylesheet without its /* comments */, read in one pass. An unclosed\n// comment runs to the end, as a browser reads it.\nfunction withoutComments(css: string): string {\n  let out = ''\n  let i = 0\n  for (;;) {\n    const open = css.indexOf('/*', i)\n    if (open < 0) return out + css.slice(i)\n    out += css.slice(i, open)\n    const close = css.indexOf('*/', open + 2)\n    if (close < 0) return out\n    i = close + 2\n  }\n}\n\nfunction declarations(css: string): Declaration[] {\n  const text = withoutComments(css)\n  const out: Declaration[] = []\n  const within: string[] = []\n  let chunk = ''\n  let quote = ''\n  let depth = 0 // parentheses, so a `;` inside url(…) does not end anything\n  const flush = () => {\n    const m = /^\\s*(--[\\w-]+)\\s*:\\s*([\\s\\S]+?)\\s*$/.exec(chunk)\n    if (m) out.push({ name: m[1], value: m[2].replace(/\\s+/g, ' ').replace(/\\s*!important$/, ''), within: [...within] })\n    chunk = ''\n  }\n  for (const ch of text) {\n    if (quote) {\n      chunk += ch\n      if (ch === quote) quote = ''\n      continue\n    }\n    if (ch === '\"' || ch === \"'\") {\n      quote = ch\n      chunk += ch\n    } else if (ch === '(') {\n      depth++\n      chunk += ch\n    } else if (ch === ')') {\n      depth = Math.max(0, depth - 1)\n      chunk += ch\n    } else if (ch === '{' && depth === 0) {\n      within.push(chunk.trim().replace(/\\s+/g, ' '))\n      chunk = ''\n    } else if (ch === '}' && depth === 0) {\n      flush()\n      within.pop()\n    } else if (ch === ';' && depth === 0) {\n      flush()\n    } else {\n      chunk += ch\n    }\n  }\n  return out\n}\n\nconst DARK = /prefers-color-scheme:\\s*dark|data-(mode|theme|color-scheme)=[\"']?dark|\\.dark\\b/i\nconst LIGHT = /prefers-color-scheme:\\s*light|data-(mode|theme|color-scheme)=[\"']?light|\\.light\\b/i\nconst NAMED = /data-theme=[\"']?([\\w-]+)/i\n\n/** Whether a declaration applies to the page being themed. */\nfunction applies(d: Declaration, o: Required<Pick<StackmythThemeOptions, 'mode'>> & { theme?: string }): boolean {\n  for (const scope of d.within) {\n    if (o.mode === 'light' && DARK.test(scope)) return false\n    if (o.mode === 'dark' && LIGHT.test(scope)) return false\n    const named = NAMED.exec(scope)\n    if (named && !/^(dark|light)$/i.test(named[1]) && named[1] !== o.theme) return false\n    // Component-level rules (`.btn { --sm-… }`) are not the page's theme;\n    // the class a mode is switched with (`.dark`, as shadcn/ui does) is.\n    if (!scope.startsWith('@') && !/:root|^html\\b|^body\\b|\\[data-|^\\*$|:host|^\\.(dark|light)\\b/.test(scope)) return false\n  }\n  return true\n}\n\n// ── Tokens ─────────────────────────────────────────────────────────────────\n\n/** What a token's value may be written with, as Cauthy checks it. */\nconst TOKEN_CHARS = /^[A-Za-z0-9 #%.,()/'\"_+*-]+$/\nconst TOKEN_FUNCS = new Set(['var', 'calc', 'min', 'max', 'clamp', 'rgb', 'rgba', 'hsl', 'hsla', 'hwb', 'lab', 'lch', 'oklab', 'oklch', 'color',\n  'color-mix', 'light-dark', 'cubic-bezier', 'steps', 'linear', 'linear-gradient', 'radial-gradient', 'conic-gradient',\n  'repeating-linear-gradient', 'repeating-radial-gradient', 'drop-shadow', 'blur', 'translate', 'translatex', 'translatey', 'scale', 'rotate'])\n\nfunction tokenValue(value: string): string | null {\n  const v = value.replace(/\\s+/g, ' ').trim()\n  if (v === '' || v.length > 400 || !TOKEN_CHARS.test(v)) return null\n  for (const m of v.matchAll(/([A-Za-z-]+)\\(/g)) if (!TOKEN_FUNCS.has(m[1].toLowerCase())) return null\n  if (/^\\(|[ ,(]\\(/.test(v)) return null\n  return v\n}\n\n/** A scope that is the page's theme itself: the root, or the theme and mode attributes — never a component inside it. */\nconst THEME_SELECTOR = /^(?::root|html|body|\\[data-(?:theme|mode|color-scheme)(?:=[\"']?[\\w-]+[\"']?)?\\])$/i\n// Checked a selector at a time (split on commas and spaces) rather than with\n// one pattern over the list, which backtracks on a long one.\nconst isThemeScope = (selectors: string) => {\n  const parts = selectors.split(/[\\s,]+/).filter(Boolean)\n  return parts.length > 0 && parts.every((one) => THEME_SELECTOR.test(one))\n}\n\nexport interface StackmythTokens {\n  /** Every `--sm-*` token the stylesheets set for the page, ready for `theme.tokens`. */\n  tokens: Record<string, string>\n  /** Tokens that were there and Cauthy would not take, and why. */\n  warnings: string[]\n}\n\n/**\n * Reads an application's Stackmyth tokens out of its stylesheets: every\n * `--sm-*` custom property its theme sets, in the order the sheets are given\n * (a later one wins). Its own names — a brand palette the tokens point at —\n * are written in, so what comes out stands on Stackmyth's names alone.\n *\n * Cauthy's sign-in pages are drawn with Stackmyth's components: these tokens\n * are what makes them look like the application.\n */\nexport function tokensFromStackmyth(css: string | string[], options: StackmythThemeOptions = {}): StackmythTokens {\n  const mode = options.mode ?? 'light'\n  const all = (Array.isArray(css) ? css : [css]).flatMap(declarations)\n  const named = options.theme ?? all.map((d) => d.within.map((w) => NAMED.exec(w)?.[1]).find((n) => n && !/^(dark|light)$/i.test(n))).find(Boolean)\n  const vars = new Map<string, string>()\n  for (const d of all) {\n    if (!applies(d, { mode, theme: named })) continue\n    if (!d.within.every((w) => w.startsWith('@') || isThemeScope(w))) continue\n    vars.set(d.name, d.value)\n  }\n  // The application's own names are written in; Stackmyth's are left as references.\n  const inline = (value: string, depth = 0): string | null => {\n    if (depth > 16) return null\n    let failed = false\n    let out = value\n    for (let guard = 0; guard < 64; guard++) {\n      const next = out.replace(/var\\(\\s*(--(?!sm-)[\\w-]+)\\s*(?:,\\s*([^()]*(?:\\([^()]*\\)[^()]*)*))?\\)/, (_m, name: string, fallback?: string) => {\n        const known = vars.get(name)\n        const got = known !== undefined ? inline(known, depth + 1) : fallback !== undefined ? inline(fallback.trim(), depth + 1) : null\n        if (got === null) failed = true\n        return got ?? ''\n      })\n      if (failed) return null\n      if (next === out) break\n      out = next\n    }\n    return out\n  }\n  const tokens: Record<string, string> = {}\n  const warnings: string[] = []\n  for (const [name, raw] of vars) {\n    if (!/^--sm-[a-z0-9]+(?:-[a-z0-9]+)*$/.test(name)) continue\n    const written = inline(raw)\n    const value = written === null ? null : tokenValue(written)\n    if (value === null) warnings.push(`${name}: \"${raw.length > 60 ? raw.slice(0, 57) + '…' : raw}\" is not a value Cauthy takes`)\n    else tokens[name] = value\n  }\n  if (Object.keys(tokens).length === 0) warnings.push('no --sm-* token was found in these stylesheets')\n  return { tokens, warnings }\n}\n\n// ── Values ─────────────────────────────────────────────────────────────────\n\nfunction resolve(value: string, vars: Map<string, string>, seen = 0): string | null {\n  if (seen > 16) return null\n  let unresolved = false\n  // Innermost var() first: fallbacks may hold another var().\n  let out = value\n  for (let guard = 0; guard < 32 && /var\\(/.test(out); guard++) {\n    out = out.replace(/var\\(\\s*(--[\\w-]+)\\s*(?:,\\s*([^()]*(?:\\([^()]*\\)[^()]*)*))?\\)/, (_m, name: string, fallback?: string) => {\n      const known = vars.get(name)\n      const next = known !== undefined ? resolve(known, vars, seen + 1) : fallback !== undefined ? resolve(fallback.trim(), vars, seen + 1) : null\n      if (next === null) unresolved = true\n      return next ?? ''\n    })\n    if (unresolved) return null\n  }\n  return /var\\(/.test(out) ? null : out.trim()\n}\n\nconst clamp01 = (n: number) => Math.min(1, Math.max(0, n))\nconst hex2 = (n: number) => Math.round(clamp01(n) * 255).toString(16).padStart(2, '0')\nconst gamma = (c: number) => (c <= 0.0031308 ? 12.92 * c : 1.055 * Math.pow(c, 1 / 2.4) - 0.055)\n\nfunction out(r: number, g: number, b: number, a = 1): string {\n  if (a >= 1) return `#${hex2(r)}${hex2(g)}${hex2(b)}`\n  return `rgba(${Math.round(clamp01(r) * 255)}, ${Math.round(clamp01(g) * 255)}, ${Math.round(clamp01(b) * 255)}, ${Math.round(clamp01(a) * 1000) / 1000})`\n}\n\nconst alpha = (s: string | undefined) => (s === undefined ? 1 : s.endsWith('%') ? parseFloat(s) / 100 : parseFloat(s))\n\nconst KEYWORDS: Record<string, string> = { white: '#ffffff', black: '#000000' }\n\n/** A colour as Cauthy takes it — `#rrggbb` or `rgba(…)` — or null when it is none it can read. */\nexport function toColor(value: string): string | null {\n  const v = value.trim().toLowerCase()\n  if (KEYWORDS[v]) return KEYWORDS[v]\n  if (/^#([0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$/.test(v)) return v\n  let m = /^rgba?\\(\\s*([\\d.]+%?)[\\s,]+([\\d.]+%?)[\\s,]+([\\d.]+%?)(?:\\s*[,/]\\s*([\\d.]+%?))?\\s*\\)$/.exec(v)\n  if (m) {\n    const ch = (s: string) => (s.endsWith('%') ? parseFloat(s) / 100 : parseFloat(s) / 255)\n    return out(ch(m[1]), ch(m[2]), ch(m[3]), alpha(m[4]))\n  }\n  m = /^hsla?\\(\\s*([\\d.]+)(?:deg)?[\\s,]+([\\d.]+)%[\\s,]+([\\d.]+)%(?:\\s*[,/]\\s*([\\d.]+%?))?\\s*\\)$/.exec(v)\n  if (m) {\n    const h = ((parseFloat(m[1]) % 360) + 360) % 360\n    const s = parseFloat(m[2]) / 100\n    const l = parseFloat(m[3]) / 100\n    const f = (n: number) => {\n      const k = (n + h / 30) % 12\n      return l - s * Math.min(l, 1 - l) * Math.max(-1, Math.min(k - 3, 9 - k, 1))\n    }\n    return out(f(0), f(8), f(4), alpha(m[4]))\n  }\n  m = /^oklch\\(\\s*([\\d.]+%?)\\s+([\\d.]+%?)\\s+([\\d.]+)(?:deg)?(?:\\s*\\/\\s*([\\d.]+%?))?\\s*\\)$/.exec(v)\n  if (m) {\n    const L = m[1].endsWith('%') ? parseFloat(m[1]) / 100 : parseFloat(m[1])\n    const C = m[2].endsWith('%') ? (parseFloat(m[2]) / 100) * 0.4 : parseFloat(m[2])\n    const H = (parseFloat(m[3]) * Math.PI) / 180\n    const a = C * Math.cos(H)\n    const b = C * Math.sin(H)\n    const l = Math.pow(L + 0.3963377774 * a + 0.2158037573 * b, 3)\n    const mm = Math.pow(L - 0.1055613458 * a - 0.0638541728 * b, 3)\n    const s = Math.pow(L - 0.0894841775 * a - 1.291485548 * b, 3)\n    return out(\n      gamma(4.0767416621 * l - 3.3077115913 * mm + 0.2309699292 * s),\n      gamma(-1.2684380046 * l + 2.6097574011 * mm - 0.3413193965 * s),\n      gamma(-0.0041960863 * l - 0.7034186147 * mm + 1.707614701 * s),\n      alpha(m[4]),\n    )\n  }\n  return null\n}\n\n/** A length in pixels, within what Cauthy takes, or null. */\nfunction toRadius(value: string): number | null {\n  const m = /^([\\d.]+)(px|rem|em)?$/.exec(value.trim())\n  if (!m) return null\n  const px = parseFloat(m[1]) * (m[2] === 'rem' || m[2] === 'em' ? 16 : 1)\n  return Number.isFinite(px) ? Math.min(MAX_RADIUS, Math.max(0, Math.round(px))) : null\n}\n\n/** A font list as Cauthy takes it, or null. */\nfunction toFont(value: string): string | null {\n  const v = value.trim()\n  return /^[A-Za-z0-9 ,'\"_-]{1,200}$/.test(v) && (v.match(/\"/g)?.length ?? 0) % 2 === 0 && (v.match(/'/g)?.length ?? 0) % 2 === 0 ? v : null\n}\n\n// ── Stackmyth ──────────────────────────────────────────────────────────────\n\n/** Which Stackmyth token each value of a theme is read from, first found wins. */\nconst COLORS: [keyof CauthyTheme, string[]][] = [\n  ['background', ['--sm-bg-surface', '--sm-surface']],\n  ['surface', ['--sm-bg-surface-raised', '--sm-surface-raised']],\n  ['text', ['--sm-text-primary', '--sm-surface-text']],\n  ['textMuted', ['--sm-text-secondary']],\n  ['border', ['--sm-border-default', '--sm-surface-border']],\n  ['primary', ['--sm-primary', '--sm-bg-interactive']],\n  ['primaryText', ['--sm-primary-text', '--sm-text-inverse']],\n  ['accent', ['--sm-text-brand', '--sm-border-focus', '--sm-accent']],\n  ['error', ['--sm-error-soft-text', '--sm-error']],\n  ['errorBackground', ['--sm-error-soft']],\n  ['success', ['--sm-success-soft-text', '--sm-success']],\n  ['successBackground', ['--sm-success-soft']],\n]\n\n/**\n * Reads an application's Stackmyth theme out of its stylesheets.\n *\n * Give it the CSS that declares the tokens, in the order the application\n * loads it — Stackmyth's own (`@stackmyth/core/core.vars.css`, or a theme\n * file) and then the application's brand file that re-points them. Tokens\n * that point at the application's own variables are followed. The\n * application's dark mode is left out unless asked for.\n */\nexport function themeFromStackmyth(css: string | string[], options: StackmythThemeOptions = {}): ImportedTheme {\n  const o = { mode: options.mode ?? 'light', theme: options.theme }\n  const vars = new Map<string, string>()\n  for (const sheet of Array.isArray(css) ? css : [css]) {\n    for (const d of declarations(sheet)) if (applies(d, o)) vars.set(d.name, d.value)\n  }\n  const theme: CauthyTheme = {}\n  const warnings: string[] = []\n\n  const read = <T>(tokens: string[], to: (v: string) => T | null, what: string): T | undefined => {\n    for (const token of tokens) {\n      const raw = vars.get(token)\n      if (raw === undefined) continue\n      const value = resolve(raw, vars)\n      const got = value === null ? null : to(value)\n      if (got !== null) return got\n      warnings.push(`${token}: \"${raw}\" is not ${what} Cauthy can take`)\n    }\n    return undefined\n  }\n\n  for (const [field, tokens] of COLORS) {\n    const c = read(tokens, toColor, 'a colour')\n    if (c !== undefined) (theme as Record<string, unknown>)[field] = c\n  }\n  const radius = read(['--sm-radius-container', '--sm-radius-md'], toRadius, 'a length')\n  if (radius !== undefined) theme.radius = radius\n  const button = read(['--sm-radius-interactive', '--sm-radius-sm'], toRadius, 'a length')\n  if (button !== undefined) theme.buttonRadius = button\n  const font = read(['--sm-font-family'], toFont, 'a font list')\n  if (font !== undefined) theme.fontFamily = font\n  if (options.logoUrl) theme.logoUrl = options.logoUrl\n\n  if (vars.size === 0) warnings.push('no custom properties were found: is this the stylesheet that declares the --sm-* tokens?')\n  else if (![...vars.keys()].some((k) => k.startsWith('--sm-'))) warnings.push('no --sm-* token was found in these stylesheets')\n  return { theme, warnings }\n}\n\n// ── Any stylesheet ─────────────────────────────────────────────────────────\n\n/** The values of a theme a stylesheet can say. */\nexport type ThemeField =\n  | 'background' | 'surface' | 'text' | 'textMuted' | 'border' | 'inputBackground' | 'inputBorder'\n  | 'primary' | 'primaryText' | 'accent' | 'error' | 'errorBackground' | 'success' | 'successBackground'\n  | 'radius' | 'buttonRadius' | 'fontFamily'\n\n/** How a stylesheet names its look: Stackmyth's tokens, shadcn/ui's (and Tailwind's), or the application's own. */\nexport type CssFormat = 'stackmyth' | 'shadcn' | 'custom'\n\nexport interface CssThemeOptions {\n  /** Which names to read. Default: `auto`, told from the stylesheet itself. */\n  format?: CssFormat | 'auto'\n  /** Which of the application's two modes to take. Default: `light`. */\n  mode?: 'light' | 'dark'\n  /** The named theme to read, when the stylesheet keeps several under `[data-theme=…]`. */\n  theme?: string\n  /** For `custom`: the variable each value is read from, `{ primary: '--brand' }`. */\n  map?: Partial<Record<ThemeField, string>>\n}\n\nexport interface CssImportedTheme extends ImportedTheme {\n  /** The names that were read. */\n  format: CssFormat\n}\n\nconst RADII: ThemeField[] = ['radius', 'buttonRadius']\n\n/** shadcn/ui's names, as Tailwind 3 (`--primary`) and Tailwind 4 (`--color-primary`) write them. */\nconst SHADCN: [ThemeField, string[]][] = [\n  ['background', ['--background', '--color-background']],\n  ['surface', ['--card', '--color-card', '--popover', '--color-popover']],\n  ['text', ['--foreground', '--color-foreground']],\n  ['textMuted', ['--muted-foreground', '--color-muted-foreground']],\n  ['border', ['--border', '--color-border']],\n  ['inputBorder', ['--input', '--color-input']],\n  ['primary', ['--primary', '--color-primary']],\n  ['primaryText', ['--primary-foreground', '--color-primary-foreground']],\n  ['accent', ['--ring', '--color-ring', '--primary', '--color-primary']],\n  ['error', ['--destructive', '--color-destructive']],\n  ['radius', ['--radius']],\n  ['buttonRadius', ['--radius']],\n  ['fontFamily', ['--font-sans', '--font-family']],\n]\n\n/** A colour as shadcn/ui writes it on Tailwind 3 — `222.2 84% 4.9%`, the inside of hsl() — or any other. */\nfunction shadcnColor(value: string): string | null {\n  return /^[\\d.]+(?:deg)?\\s+[\\d.]+%\\s+[\\d.]+%(?:\\s*\\/\\s*[\\d.]+%?)?$/.test(value.trim()) ? toColor(`hsl(${value.trim()})`) : toColor(value)\n}\n\n/** Every custom property a stylesheet sets for the page, the last one winning. */\nfunction pageVariables(css: string | string[], mode: 'light' | 'dark', theme?: string): Map<string, string> {\n  const vars = new Map<string, string>()\n  for (const sheet of Array.isArray(css) ? css : [css]) {\n    for (const d of declarations(sheet)) if (applies(d, { mode, theme })) vars.set(d.name, d.value)\n  }\n  return vars\n}\n\n/** The custom properties a stylesheet sets for the page, by name: what a person picks from to map their own. */\nexport function cssVariables(css: string | string[], options: Pick<CssThemeOptions, 'mode' | 'theme'> = {}): string[] {\n  return [...pageVariables(css, options.mode ?? 'light', options.theme).keys()].sort()\n}\n\n/**\n * Reads an application's look out of its stylesheets, whatever names it uses:\n * Stackmyth's tokens, shadcn/ui's (`--primary`, `--radius`, on Tailwind 3 or\n * 4), or the application's own variables given in `map`. What comes out is a\n * theme of named values, never CSS.\n */\nexport function themeFromCss(css: string | string[], options: CssThemeOptions = {}): CssImportedTheme {\n  const mode = options.mode ?? 'light'\n  const vars = pageVariables(css, mode, options.theme)\n  const names = [...vars.keys()]\n  let format: CssFormat\n  if (options.format && options.format !== 'auto') format = options.format\n  else if (options.map && Object.keys(options.map).length > 0) format = 'custom'\n  else if (names.some((n) => n.startsWith('--sm-'))) format = 'stackmyth'\n  else if (names.some((n) => /^--(color-)?(primary|background|foreground)$/.test(n))) format = 'shadcn'\n  else format = 'custom'\n\n  if (format === 'stackmyth') return { ...themeFromStackmyth(css, { mode, theme: options.theme }), format }\n\n  const spec: [ThemeField, string[]][] = format === 'shadcn'\n    ? SHADCN\n    : Object.entries(options.map ?? {}).filter(([, v]) => v).map(([k, v]) => [k as ThemeField, [String(v).startsWith('--') ? String(v) : `--${v}`]])\n  const theme: CauthyTheme = {}\n  const warnings: string[] = []\n  for (const [field, tokens] of spec) {\n    for (const token of tokens) {\n      const raw = vars.get(token)\n      if (raw === undefined) continue\n      const value = resolve(raw, vars)\n      const got = value === null ? null\n        : RADII.includes(field) ? toRadius(value)\n        : field === 'fontFamily' ? toFont(value)\n        : format === 'shadcn' ? shadcnColor(value) : toColor(value)\n      if (got !== null) {\n        (theme as Record<string, unknown>)[field] = got\n        break\n      }\n      warnings.push(`${token}: \"${raw.length > 60 ? raw.slice(0, 57) + '…' : raw}\" is not ${RADII.includes(field) ? 'a length' : field === 'fontFamily' ? 'a font list' : 'a colour'} Cauthy can take`)\n    }\n  }\n  if (vars.size === 0) warnings.push('no custom properties were found in these stylesheets')\n  else if (format === 'custom' && spec.length === 0) warnings.push('these stylesheets use names of their own: say which variable each value is read from')\n  return { theme, warnings, format }\n}\n\n// ── On the application's own screens ───────────────────────────────────────\n\n/**\n * A theme as the CSS variables of `@cauthyhq/react/styles.css` (stage 5) (`--cauthy-*`), for\n * the forms an application shows on its own pages. The page's own background,\n * the layout and the words are Cauthy's pages' matter, and left out.\n */\nexport function themeVariables(theme: CauthyTheme): Record<string, string> {\n  const vars: Record<string, string> = {}\n  const put = (name: string, v: string | number | undefined) => {\n    if (v === undefined || v === '') return\n    vars[`--cauthy-${name}`] = typeof v === 'number' ? `${v}px` : v\n  }\n  put('surface', theme.surface)\n  put('text', theme.text)\n  put('text-muted', theme.textMuted)\n  put('border', theme.border)\n  put('input-background', theme.inputBackground)\n  put('input-border', theme.inputBorder)\n  put('primary', theme.primary)\n  put('primary-text', theme.primaryText)\n  put('accent', theme.accent)\n  put('error', theme.error)\n  put('error-background', theme.errorBackground)\n  put('success', theme.success)\n  put('success-background', theme.successBackground)\n  put('radius', theme.radius)\n  put('button-radius', theme.buttonRadius)\n  put('font', theme.fontFamily)\n  return vars\n}\n\n// ── Sending it to Cauthy ───────────────────────────────────────────────────\n\n/** A theme as Cauthy's API names its values. */\nexport function toWire(theme: CauthyTheme): Record<string, unknown> {\n  const names: Record<keyof CauthyTheme, string> = {\n    background: 'background', surface: 'surface', text: 'text', textMuted: 'text_muted', border: 'border',\n    primary: 'primary', primaryText: 'primary_text', accent: 'accent', error: 'error', errorBackground: 'error_background',\n    success: 'success', successBackground: 'success_background', radius: 'radius', buttonRadius: 'button_radius',\n    fontFamily: 'font_family', logoUrl: 'logo_url', fonts: 'fonts', layout: 'layout', panelColors: 'panel_colors',\n    panelText: 'panel_text', panelIconUrl: 'panel_icon_url', texts: 'texts', inputBackground: 'input_background', inputBorder: 'input_border', tokens: 'tokens',\n  }\n  const wire: Record<string, unknown> = {}\n  for (const [k, v] of Object.entries(theme)) {\n    if (v === undefined || v === '' || (Array.isArray(v) && v.length === 0)) continue\n    wire[names[k as keyof CauthyTheme]] = v\n  }\n  return wire\n}\n\n/** A theme as Cauthy answers it, in this package's names. */\nexport function fromWire(wire: Record<string, unknown>): CauthyTheme {\n  const names: Record<string, keyof CauthyTheme> = {\n    background: 'background', surface: 'surface', text: 'text', text_muted: 'textMuted', border: 'border',\n    primary: 'primary', primary_text: 'primaryText', accent: 'accent', error: 'error', error_background: 'errorBackground',\n    success: 'success', success_background: 'successBackground', radius: 'radius', button_radius: 'buttonRadius',\n    font_family: 'fontFamily', logo_url: 'logoUrl', fonts: 'fonts', layout: 'layout', panel_colors: 'panelColors',\n    panel_text: 'panelText', panel_icon_url: 'panelIconUrl', texts: 'texts', input_background: 'inputBackground', input_border: 'inputBorder', tokens: 'tokens',\n  }\n  const theme: Record<string, unknown> = {}\n  for (const [k, v] of Object.entries(wire ?? {})) if (names[k] && v !== undefined && v !== null && v !== '') theme[names[k]] = v\n  return theme as CauthyTheme\n}\n\nexport interface PushThemeOptions {\n  /** Cauthy's address. Default: `CAUTHY_ISSUER`. */\n  issuer?: string\n  /** The application's client id. Default: `CAUTHY_CLIENT_ID`. */\n  clientId?: string\n  /** The workspace's slug. Default: `CAUTHY_TENANT`. */\n  tenant?: string\n  /**\n   * A personal access token with `oauth_clients:manage`. Default:\n   * `CAUTHY_TOKEN`. It belongs in the deploy pipeline, never in the application.\n   */\n  token?: string\n  theme: CauthyTheme\n  fetch?: typeof fetch\n  /** How long the call may take, in milliseconds, before it fails with a `TimeoutError`. Default: 5000. */\n  timeoutMs?: number\n}\n\n/**\n * Gives the application its look on Cauthy's pages. It replaces the theme: a\n * value left out goes back to Cauthy's own. Run it when the brand changes —\n * from a script or the deploy — not on every request.\n */\nexport async function pushTheme(o: PushThemeOptions): Promise<void> {\n  const env = (n: string) => (typeof process !== 'undefined' ? process.env?.[n] : undefined)\n  const issuer = withoutTrailingSlashes(o.issuer ?? env('CAUTHY_ISSUER') ?? '')\n  const clientId = o.clientId ?? env('CAUTHY_CLIENT_ID') ?? ''\n  const tenant = o.tenant ?? env('CAUTHY_TENANT') ?? ''\n  const token = o.token ?? env('CAUTHY_TOKEN') ?? ''\n  for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_CLIENT_ID: clientId, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {\n    if (v === '') throw new Error(`@cauthyhq/node: ${name} is required to push a theme`)\n  }\n  const res = await deadline(o.fetch, o.timeoutMs ?? DEFAULT_DEADLINE_MS)(`${issuer}/v1/oauth/clients/${encodeURIComponent(clientId)}/theme`, {\n    method: 'PUT',\n    headers: { authorization: `Bearer ${token}`, 'x-tenant-key': tenant, 'content-type': 'application/json' },\n    body: JSON.stringify(toWire(o.theme)),\n  })\n  if (!res.ok) {\n    const body = (await res.json().catch(() => null)) as { errors?: { message?: string }[] } | null\n    throw new Error(`@cauthyhq/node: Cauthy refused the theme (${res.status}): ${body?.errors?.[0]?.message ?? res.statusText}`)\n  }\n}\n","// What a sign-in or sign-up form is checked for before anything is sent, in\n// the browser and again on the server: the same rules in both places, so the\n// form says what the server would.\n\nexport type AuthField = 'email' | 'password' | 'newPassword' | 'name' | 'code' | 'organization'\n\n/** A value of a form that cannot be sent as it is. */\nexport interface FieldProblem {\n  field: AuthField\n  /**\n   * Stable, for translating: `required`, `invalid_email`, `too_short`,\n   * `too_long`, and for a new password the rule of the workspace it fails:\n   * `needs_lowercase`, `needs_uppercase`, `needs_digit`, `needs_symbol`,\n   * `needs_classes`.\n   */\n  code: 'required' | 'invalid_email' | PasswordReason\n  message: string\n}\n\n/** The shortest password Cauthy takes by default: a workspace's policy may ask otherwise (`methods().password`). */\nexport const MIN_PASSWORD = 12\n/** The longest: the API bounds what Argon2id is given, whatever the workspace asks. */\nconst MAX_PASSWORD = 128\n/** The shortest any workspace may allow. */\nconst FLOOR_PASSWORD = 8\nconst MAX_NAME = 120\n\n/** A kind of character a workspace's password policy can ask for. */\nexport type PasswordClass = 'lowercase' | 'uppercase' | 'digit' | 'symbol'\n\n/** Why a new password is refused: the API's `weak_password` `meta.reasons`. */\nexport type PasswordReason = 'too_short' | 'too_long' | 'needs_lowercase' | 'needs_uppercase' | 'needs_digit' | 'needs_symbol' | 'needs_classes' | 'breached'\n\n/**\n * What a new password must be in the workspace, as `methods().password` says\n * it. Length is counted in bytes of UTF-8, as Cauthy counts it. A symbol is\n * any character that is neither a letter nor a digit, a space included.\n */\nexport interface PasswordPolicy {\n  min: number\n  max: number\n  /** The kinds the password must each carry at least once. */\n  requires: PasswordClass[]\n  /** At least this many of the four kinds; 0 asks none. */\n  min_classes: number\n  /** Cauthy refuses a password found in a published breach (checked by Cauthy alone). */\n  reject_breached: boolean\n}\n\nconst CLASSES: PasswordClass[] = ['lowercase', 'uppercase', 'digit', 'symbol']\n\n/** The policy of a workspace that set none: what every one asked before they could choose. */\nexport const DEFAULT_PASSWORD_POLICY: PasswordPolicy = Object.freeze({ min: MIN_PASSWORD, max: MAX_PASSWORD, requires: [], min_classes: 0, reject_breached: false }) as PasswordPolicy\n\nconst int = (v: unknown, fallback: number) => (typeof v === 'number' && Number.isFinite(v) ? Math.trunc(v) : fallback)\n\n/**\n * A password policy as Cauthy sent it — `{ min_length, max_length, … }` from\n * the sign-in settings, or `{ min, max, … }` from `methods()` — made safe to\n * use: the defaults where nothing is said, and never outside 8–128.\n */\nexport function passwordPolicyOf(raw: unknown): PasswordPolicy {\n  const r = (raw && typeof raw === 'object' ? raw : {}) as Record<string, unknown>\n  const min = Math.min(Math.max(int(r.min ?? r.min_length, MIN_PASSWORD) || MIN_PASSWORD, FLOOR_PASSWORD), MAX_PASSWORD)\n  const max = Math.max(Math.min(int(r.max ?? r.max_length, MAX_PASSWORD) || MAX_PASSWORD, MAX_PASSWORD), min)\n  const asked = Array.isArray(r.requires) ? r.requires : []\n  return {\n    min, max,\n    requires: CLASSES.filter((c) => asked.includes(c)),\n    min_classes: Math.min(Math.max(int(r.min_classes ?? r.minClasses, 0), 0), CLASSES.length),\n    reject_breached: (r.reject_breached ?? r.rejectBreached) === true,\n  }\n}\n\n/** Bytes of UTF-8: what Cauthy counts a password's length in. */\nfunction utf8Length(v: string): number {\n  let n = 0\n  for (const ch of v) {\n    const c = ch.codePointAt(0)!\n    n += c < 0x80 ? 1 : c < 0x800 ? 2 : c < 0x10000 ? 3 : 4\n  }\n  return n\n}\n\n/** Which of the four kinds a password carries, as Cauthy tells them apart. */\nfunction classesOf(v: string): Set<PasswordClass> {\n  const has = new Set<PasswordClass>()\n  for (const ch of v) {\n    if (/\\p{Ll}/u.test(ch)) has.add('lowercase')\n    else if (/\\p{Lu}/u.test(ch)) has.add('uppercase')\n    else if (/\\p{Nd}/u.test(ch)) has.add('digit')\n    else if (!/\\p{L}/u.test(ch)) has.add('symbol') // a letter without case is neither\n  }\n  return has\n}\n\n/**\n * Every rule of the policy a new password fails, as the API names them;\n * empty when it meets them all. Whether it was in a breach only Cauthy knows.\n */\nexport function passwordProblems(value: string, policy: PasswordPolicy = DEFAULT_PASSWORD_POLICY): PasswordReason[] {\n  const p = passwordPolicyOf(policy)\n  const out: PasswordReason[] = []\n  const length = utf8Length(value)\n  if (length < p.min) out.push('too_short')\n  if (length > p.max) out.push('too_long')\n  const has = classesOf(value)\n  for (const c of p.requires) if (!has.has(c)) out.push(`needs_${c}` as PasswordReason)\n  if (p.min_classes > 0 && CLASSES.filter((c) => has.has(c)).length < p.min_classes) out.push('needs_classes')\n  return out\n}\n\n/** The languages the rule is said in. */\nexport type PasswordLocale = 'en' | 'es'\n\nconst RULES: Record<PasswordLocale, {\n  between: string; requires: string; classes: string; breached: string; and: string; kinds: Record<PasswordClass, string>\n  reasons: Record<PasswordReason, string>\n}> = {\n  en: {\n    between: 'Between {min} and {max} characters.', requires: 'Include {kinds}.', and: 'and',\n    classes: 'Use at least {n} of these: lowercase letters, uppercase letters, digits, symbols.',\n    breached: 'Passwords found in known data breaches are not accepted.',\n    kinds: { lowercase: 'a lowercase letter', uppercase: 'an uppercase letter', digit: 'a digit', symbol: 'a symbol' },\n    reasons: {\n      too_short: 'Use at least {min} characters.', too_long: 'Use at most {max} characters.',\n      needs_lowercase: 'Include a lowercase letter.', needs_uppercase: 'Include an uppercase letter.', needs_digit: 'Include a digit.', needs_symbol: 'Include a symbol.',\n      needs_classes: 'Use at least {n} of these: lowercase letters, uppercase letters, digits, symbols.',\n      breached: 'This password appears in a known data breach. Choose a different one.',\n    },\n  },\n  es: {\n    between: 'Entre {min} y {max} caracteres.', requires: 'Incluye {kinds}.', and: 'y',\n    classes: 'Usa al menos {n} de estos tipos: minúsculas, mayúsculas, números, símbolos.',\n    breached: 'No se aceptan contraseñas que aparecen en filtraciones de datos conocidas.',\n    kinds: { lowercase: 'una minúscula', uppercase: 'una mayúscula', digit: 'un número', symbol: 'un símbolo' },\n    reasons: {\n      too_short: 'Usa al menos {min} caracteres.', too_long: 'Usa como máximo {max} caracteres.',\n      needs_lowercase: 'Incluye una minúscula.', needs_uppercase: 'Incluye una mayúscula.', needs_digit: 'Incluye un número.', needs_symbol: 'Incluye un símbolo.',\n      needs_classes: 'Usa al menos {n} de estos tipos: minúsculas, mayúsculas, números, símbolos.',\n      breached: 'Esta contraseña aparece en una filtración de datos conocida. Elige otra.',\n    },\n  },\n}\n\nconst fill = (s: string, p: PasswordPolicy) => s.replace('{min}', String(p.min)).replace('{max}', String(p.max)).replace('{n}', String(p.min_classes))\n\n/** What a new password must be, said for the person choosing it: \"Between 12 and 128 characters. Include a digit.\" */\nexport function describePasswordPolicy(policy: PasswordPolicy = DEFAULT_PASSWORD_POLICY, locale: PasswordLocale = 'en'): string {\n  const p = passwordPolicyOf(policy)\n  const t = RULES[locale] ?? RULES.en\n  const parts = [fill(t.between, p)]\n  if (p.requires.length > 0) {\n    const kinds = p.requires.map((c) => t.kinds[c])\n    const listed = kinds.length === 1 ? kinds[0] : `${kinds.slice(0, -1).join(', ')} ${t.and} ${kinds[kinds.length - 1]}`\n    parts.push(t.requires.replace('{kinds}', listed))\n  }\n  if (p.min_classes > 0) parts.push(fill(t.classes, p))\n  if (p.reject_breached) parts.push(t.breached)\n  return parts.join(' ')\n}\n\n/** Why a new password was refused, rule by rule, for the person who typed it. */\nexport function explainPasswordProblems(reasons: readonly string[], policy: PasswordPolicy = DEFAULT_PASSWORD_POLICY, locale: PasswordLocale = 'en'): string {\n  const p = passwordPolicyOf(policy)\n  const t = RULES[locale] ?? RULES.en\n  const said = reasons.filter((r): r is PasswordReason => r in t.reasons).map((r) => fill(t.reasons[r], p))\n  return said.length > 0 ? said.join(' ') : describePasswordPolicy(p, locale)\n}\n\n// One @, something on each side, a dot in the domain, no spaces: what catches\n// a typo. Whether the address exists is Cauthy's to find out.\nconst EMAIL = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/\n\nexport function checkEmail(value: unknown): FieldProblem | null {\n  const v = typeof value === 'string' ? value.trim() : ''\n  if (v === '') return { field: 'email', code: 'required', message: 'Enter your email address.' }\n  if (v.length > 254 || !EMAIL.test(v)) return { field: 'email', code: 'invalid_email', message: 'That does not look like an email address.' }\n  return null\n}\n\n/** A password being typed to sign in: only that there is one. */\nexport function checkPassword(value: unknown): FieldProblem | null {\n  if (typeof value !== 'string' || value === '') return { field: 'password', code: 'required', message: 'Enter your password.' }\n  if (value.length > MAX_PASSWORD) return { field: 'password', code: 'too_long', message: 'That password is too long.' }\n  return null\n}\n\n/**\n * A password being chosen for a new account, or a new one for an account.\n * Held to the workspace's policy when it is given (`methods().password`),\n * otherwise to the defaults: 12 to 128 characters.\n */\nexport function checkNewPassword(value: unknown, policy?: PasswordPolicy | null): FieldProblem | null {\n  if (typeof value !== 'string' || value === '') return { field: 'password', code: 'required', message: 'Enter your password.' }\n  const p = policy ? passwordPolicyOf(policy) : DEFAULT_PASSWORD_POLICY\n  const reasons = passwordProblems(value, p)\n  if (reasons.length === 0) return null\n  return { field: 'password', code: reasons[0], message: explainPasswordProblems(reasons, p) }\n}\n\nexport function checkName(value: unknown): FieldProblem | null {\n  if (value === undefined || value === null || value === '') return null\n  if (typeof value !== 'string' || value.trim().length > MAX_NAME) return { field: 'name', code: 'too_long', message: `Use at most ${MAX_NAME} characters.` }\n  return null\n}\n\n/** The company's name a sign-up carries when the application's system makes an organization per sign-up. */\nexport const MAX_ORGANIZATION = 120\n\nexport function checkOrganization(value: unknown, required = false): FieldProblem | null {\n  const v = typeof value === 'string' ? value.trim() : ''\n  if (v === '') return required ? { field: 'organization', code: 'required', message: \"Enter your company's name.\" } : null\n  if (v.length > MAX_ORGANIZATION) return { field: 'organization', code: 'too_long', message: `Use at most ${MAX_ORGANIZATION} characters.` }\n  return null\n}\n\n/** An organization's new name, when a member renames it: the same rule as at sign-up, always required. */\nexport function checkOrganizationName(value: unknown): FieldProblem | null {\n  const v = typeof value === 'string' ? value.trim() : ''\n  if (v === '') return { field: 'name', code: 'required', message: \"Enter the organization's name.\" }\n  if (v.length > MAX_ORGANIZATION) return { field: 'name', code: 'too_long', message: `Use at most ${MAX_ORGANIZATION} characters.` }\n  return null\n}\n\nexport function checkCode(value: unknown): FieldProblem | null {\n  const v = typeof value === 'string' ? value.trim() : ''\n  if (v === '') return { field: 'code', code: 'required', message: 'Enter the code.' }\n  if (v.length > 40) return { field: 'code', code: 'too_long', message: 'That is not a code.' }\n  return null\n}\n\n/** The first problem of a form, or null when it can be sent. */\nexport function firstProblem(...checks: (FieldProblem | null)[]): FieldProblem | null {\n  return checks.find((c) => c !== null) ?? null\n}\n","// Hearing from Cauthy: verifying a webhook delivery.\n//\n// Cauthy signs every delivery with its own key — the one its tokens are\n// signed with, published at /.well-known/jwks.json — so there is no secret to\n// receive, store or rotate. Verifying is one call:\n//\n//   const event = await auth.webhook(request)      // throws if it is not Cauthy's\n//\n// What is checked: the signature, against Cauthy's published keys; that the\n// delivery was meant for THIS endpoint (a signature anyone can verify must say\n// who it is for); that it is recent; and that the body is, byte for byte, the\n// one that was signed.\n\nimport { createRemoteJWKSet, jwtVerify, type JWTVerifyGetKey } from 'jose'\nimport type { JsonValue } from './types'\nimport { parseKey } from './cauthykey'\nimport { withoutTrailingSlashes } from './url'\n\n/** Something that happened in Cauthy, as a subscriber is told. Moments are UTC. */\nexport interface CauthyEvent {\n  /** This delivery's id: the same event delivered again carries the same one. */\n  id: string\n  /** What happened: \"organization.member_added\". */\n  type: string\n  tenantId: string\n  createdAt: string\n  /** The person it happened to, when it is about one. */\n  userId?: string\n  /** Who did it. */\n  actorId?: string\n  /** What the event says: for an organization, its id, system, external_id, role… */\n  data: Record<string, JsonValue>\n}\n\nexport class CauthyWebhookError extends Error {\n  constructor(readonly reason: string) {\n    super(`@cauthyhq/node: webhook refused: ${reason}`)\n    this.name = 'CauthyWebhookError'\n  }\n}\n\nexport interface VerifyWebhookOptions {\n  /** Cauthy's address. Default: the one `CAUTHY_KEY` names, else `CAUTHY_ISSUER`. */\n  issuer?: string\n  /**\n   * This endpoint's own public address, exactly as it is registered in Cauthy.\n   * Default: the request's URL, which is right unless a proxy changes it.\n   */\n  url?: string\n  /** Cauthy's keys. Default: fetched from the issuer and cached. */\n  jwks?: JWTVerifyGetKey\n  /** The moment to verify at. Default: now. */\n  now?: Date\n  /**\n   * Where deliveries already taken are remembered, so the same signed\n   * delivery sent twice is refused. Default for verifyWebhook: none;\n   * `auth.webhook` remembers them in memory unless it is given one.\n   */\n  replay?: ReplayStore\n}\n\n/**\n * Remembers what was already taken. `claim` answers true the first time a\n * key is claimed and false after, until `until` passes.\n *\n * A delivery Cauthy sends again after a failure is signed again, and passes:\n * what is refused is the very same signed delivery arriving twice. Make what\n * an event does safe to do twice anyway (its `id` stays the same).\n */\nexport interface ReplayStore {\n  claim(key: string, until: Date): Promise<boolean>\n}\n\n/** Deliveries remembered in this process's memory: enough with one instance. */\nexport function memoryReplayStore(now: () => number = Date.now): ReplayStore {\n  const seen = new Map<string, number>()\n  return {\n    async claim(key, until) {\n      const t = now()\n      if (seen.size > 10_000) for (const [k, u] of seen) if (u <= t) seen.delete(k)\n      const held = seen.get(key)\n      if (held !== undefined && held > t) return false\n      seen.set(key, until.getTime())\n      return true\n    },\n  }\n}\n\nconst keys = new Map<string, JWTVerifyGetKey>()\n\nfunction keysOf(issuer: string): JWTVerifyGetKey {\n  let set = keys.get(issuer)\n  if (set === undefined) {\n    set = createRemoteJWKSet(new URL(`${issuer}/.well-known/jwks.json`), { cooldownDuration: 30_000 })\n    keys.set(issuer, set)\n  }\n  return set\n}\n\nconst hex = (s: unknown) => (typeof s === 'string' && s !== '' ? s : undefined)\n\n/**\n * Verifies a delivery and answers the event it carries. Throws\n * `CauthyWebhookError` for anything that is not a delivery Cauthy made for\n * this endpoint just now: answer it 401 and nothing else.\n */\nexport async function verifyWebhook(request: Request, options: VerifyWebhookOptions = {}): Promise<CauthyEvent> {\n  // CAUTHY_KEY names Cauthy; without it, CAUTHY_ISSUER does (deprecated).\n  const key = typeof process !== 'undefined' ? process.env?.CAUTHY_KEY : undefined\n  const env = key ? parseKey(key).issuer : typeof process !== 'undefined' ? process.env?.CAUTHY_ISSUER : undefined\n  const issuer = withoutTrailingSlashes(options.issuer ?? env ?? '')\n  if (issuer === '') throw new CauthyWebhookError('issuer (CAUTHY_ISSUER) is not set')\n  const signature = request.headers.get('x-cauthy-signature-jwt')\n  if (!signature) throw new CauthyWebhookError('no signature')\n\n  // The bytes as they arrived: what was signed is their hash, not a re-encoding.\n  const raw = new Uint8Array(await request.arrayBuffer())\n  const audience = options.url ?? request.url.split('?')[0]\n\n  let claims: Record<string, unknown>\n  try {\n    const verified = await jwtVerify(signature, options.jwks ?? keysOf(issuer), {\n      algorithms: ['RS256'],\n      audience,\n      typ: 'cauthy-webhook+jwt',\n      requiredClaims: ['exp', 'iat', 'jti', 'body_sha256'],\n      currentDate: options.now,\n      clockTolerance: 30,\n    })\n    claims = verified.payload as Record<string, unknown>\n  } catch (err) {\n    throw new CauthyWebhookError(err instanceof Error ? err.message : 'bad signature')\n  }\n  // Signed by Cauthy, for this issuer: Cauthy's own address, or the\n  // workspace's custom domain (domain_iss) when that is the issuer here.\n  if (claims.iss !== issuer && claims.domain_iss !== issuer) {\n    throw new CauthyWebhookError('unexpected \"iss\" claim value')\n  }\n\n  // Not from the future either: a clock that far off is not Cauthy's.\n  const now = Math.floor((options.now ?? new Date()).getTime() / 1000)\n  if (typeof claims.iat !== 'number' || claims.iat > now + 30) throw new CauthyWebhookError('signed in the future')\n\n  const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', raw))\n  let b64 = ''\n  for (const b of digest) b64 += String.fromCharCode(b)\n  const hash = btoa(b64).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')\n  if (hash !== claims.body_sha256) throw new CauthyWebhookError('the body is not the one that was signed')\n\n  let body: Record<string, any>\n  try {\n    body = JSON.parse(new TextDecoder().decode(raw))\n  } catch {\n    throw new CauthyWebhookError('the body is not JSON')\n  }\n  // The envelope and the signature must tell the same story.\n  if (body.id !== claims.jti || body.event !== claims.evt || body.tenant_id !== claims.tid) {\n    throw new CauthyWebhookError('the body and its signature disagree')\n  }\n  if (options.replay) {\n    // The same signature twice is a replay; a delivery sent again is signed again.\n    const exp = typeof claims.exp === 'number' ? claims.exp : now + 300\n    if (!(await options.replay.claim(`${String(claims.jti)}:${String(claims.iat)}`, new Date(exp * 1000)))) {\n      throw new CauthyWebhookError('this delivery was already taken')\n    }\n  }\n  const inner = (body.data ?? {}) as Record<string, any>\n  return {\n    id: String(body.id),\n    type: String(body.event),\n    tenantId: String(body.tenant_id),\n    createdAt: String(inner.created_at ?? body.created_at ?? ''),\n    ...(hex(inner.user_id) ? { userId: inner.user_id } : {}),\n    ...(hex(inner.actor_id) ? { actorId: inner.actor_id } : {}),\n    data: (inner.data ?? {}) as Record<string, JsonValue>,\n  }\n}\n","// SHA-256 (FIPS 180-4), synchronous and dependency-free: CAUTHY_KEY's\n// checksum is checked when createCauthy runs, before any await. Used for\n// nothing else; WebCrypto does every other hash.\nconst K = new Uint32Array([\n  0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,\n  0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,\n  0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,\n  0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,\n  0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,\n  0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,\n  0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,\n  0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,\n])\n\nexport function sha256(data: Uint8Array): Uint8Array {\n  const h = new Uint32Array([0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19])\n  const len = data.length\n  const padded = new Uint8Array(((len + 9 + 63) >> 6) << 6)\n  padded.set(data)\n  padded[len] = 0x80\n  const view = new DataView(padded.buffer)\n  view.setUint32(padded.length - 8, Math.floor(len / 0x20000000))\n  view.setUint32(padded.length - 4, (len << 3) >>> 0)\n  const w = new Uint32Array(64)\n  const rotr = (x: number, n: number) => (x >>> n) | (x << (32 - n))\n  for (let off = 0; off < padded.length; off += 64) {\n    for (let i = 0; i < 16; i++) w[i] = view.getUint32(off + i * 4)\n    for (let i = 16; i < 64; i++) {\n      const s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ (w[i - 15] >>> 3)\n      const s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ (w[i - 2] >>> 10)\n      w[i] = (w[i - 16] + s0 + w[i - 7] + s1) >>> 0\n    }\n    let [a, b, c, d, e, f, g, hh] = h\n    for (let i = 0; i < 64; i++) {\n      const t1 = (hh + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + ((e & f) ^ (~e & g)) + K[i] + w[i]) >>> 0\n      const t2 = ((rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + ((a & b) ^ (a & c) ^ (b & c))) >>> 0\n      hh = g; g = f; f = e; e = (d + t1) >>> 0; d = c; c = b; b = a; a = (t1 + t2) >>> 0\n    }\n    h[0] += a; h[1] += b; h[2] += c; h[3] += d; h[4] += e; h[5] += f; h[6] += g; h[7] += hh\n  }\n  const out = new Uint8Array(32)\n  const ov = new DataView(out.buffer)\n  for (let i = 0; i < 8; i++) ov.setUint32(i * 4, h[i])\n  return out\n}\n","// CAUTHY_KEY (key/cauthy-key.md in cauthy-sdk-spec): parsing and composing,\n// synchronously. Derivation and signing are in keyderive.ts.\nimport { sha256 } from './sha256'\nimport { CauthyConfigError, CauthyKeyError, type CauthyKeyReason } from './types'\n\nexport const KEY_PREFIX = 'cauthy1'\n\n/**\n * The variables CAUTHY_KEY replaces: set beside it, each is a second source\n * of the same thing, and the application refuses to start (key/cauthy-key.md §10).\n */\nexport const KEY_REPLACES = ['CAUTHY_ISSUER', 'CAUTHY_CLIENT_ID', 'CAUTHY_CLIENT_SECRET', 'CAUTHY_SYSTEM', 'CAUTHY_TENANT',\n  'CAUTHY_SYSTEM_KEY', 'CAUTHY_SYSTEM_KEY_ID', 'CAUTHY_BASE_URL', 'CAUTHY_AUDIENCE', 'CAUTHY_TENANT_ID'] as const\n\n/** Names the KEY_REPLACES variables set in `environment`, refusing them beside CAUTHY_KEY. */\nexport function refuseBesideKey(environment: Record<string, string | undefined> | undefined): void {\n  const set = KEY_REPLACES.filter(n => (environment?.[n] ?? '') !== '')\n  if (set.length > 0) {\n    throw new CauthyConfigError(`the application runs on CAUTHY_KEY, and ${set.join(', ')} ${set.length === 1 ? 'is' : 'are'} also set: ` +\n      `remove ${set.length === 1 ? 'it' : 'them'} from the environment. Everything comes from the key.`)\n  }\n}\nconst MAX_LEN = 512\nconst enc = new TextEncoder()\nconst dec = new TextDecoder('utf-8', { fatal: true })\n\n/** What a CAUTHY_KEY names. Never logged, never printed. */\nexport interface CauthyKey {\n  /** Cauthy's origin, e.g. https://cauthy.api.example.com */\n  issuer: string\n  clientId: string\n  /** The 43-character secret segment: the HKDF input, as text. */\n  secret: string\n}\n\nexport function b64uEncode(b: Uint8Array): string {\n  let bin = ''\n  for (const x of b) bin += String.fromCharCode(x)\n  return btoa(bin).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')\n}\n\n/** Strict base64url: no padding, alphabet only, canonical. Null when it is not. */\nexport function b64uDecode(s: string): Uint8Array | null {\n  if (!/^[A-Za-z0-9_-]*$/.test(s) || s.length % 4 === 1) return null\n  const bin = atob(s.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat((4 - (s.length % 4)) % 4))\n  const out = Uint8Array.from(bin, c => c.charCodeAt(0))\n  return b64uEncode(out) === s ? out : null\n}\n\nfunction checksum(body: string): string {\n  return b64uEncode(sha256(enc.encode(body)).slice(0, 6))\n}\n\nfunction printableAscii(s: string): boolean {\n  return /^[\\x21-\\x7e]*$/.test(s)\n}\n\n/**\n * An origin as key/cauthy-key.md §3 rule 5 accepts it: exactly as a WHATWG\n * URL serializes its origin, https (http only on loopback), never an\n * IPv4-mapped IPv6 address.\n */\nexport function validIssuer(s: string): boolean {\n  if (s === '' || !printableAscii(s)) return false\n  let u: URL\n  try { u = new URL(s) } catch { return false }\n  if (u.origin !== s) return false\n  if (/^\\[::ffff:/i.test(u.host)) return false\n  if (u.protocol === 'https:') return true\n  return u.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(u.hostname)\n}\n\nconst fail = (reason: CauthyKeyReason, message: string): never => {\n  throw new CauthyKeyError(reason, message)\n}\n\nconst NOT_A_KEY = 'not a Cauthy key (copy it again from the dashboard)'\n\n/** Reads a CAUTHY_KEY; throws CauthyKeyError with the reason, never the value. */\nexport function parseKey(text: string): CauthyKey {\n  const s = text.replace(/^[ \\t\\r\\n]+|[ \\t\\r\\n]+$/g, '')\n  if (s === '' || s.length > MAX_LEN || !printableAscii(s)) fail('key_format', NOT_A_KEY)\n  const head = s.split('.', 1)[0]\n  if (head !== KEY_PREFIX) {\n    if (/^cauthy[0-9]+$/.test(head)) fail('key_version', `this key is for a newer SDK (${head}): update @cauthyhq/node`)\n    fail('key_format', NOT_A_KEY)\n  }\n  const parts = s.split('.')\n  if (parts.length !== 5 || parts.some(p => p === '')) fail('key_format', NOT_A_KEY)\n  if (!constantTimeEqual(checksum(parts.slice(0, 4).join('.')), parts[4])) {\n    fail('key_checksum', 'the key is damaged (part of it is missing or changed): copy it again from the dashboard')\n  }\n  const issuerBytes = b64uDecode(parts[1])\n  let issuer = ''\n  try { issuer = issuerBytes ? dec.decode(issuerBytes) : '' } catch { issuer = '' }\n  if (!validIssuer(issuer)) fail('key_issuer', 'the key names no valid Cauthy address')\n  const clientBytes = b64uDecode(parts[2])\n  const clientId = clientBytes ? String.fromCharCode(...clientBytes) : ''\n  if (!/^[A-Za-z0-9._-]{1,128}$/.test(clientId)) fail('key_client', 'the key names no valid client')\n  const secret = b64uDecode(parts[3])\n  if (parts[3].length !== 43 || !secret || secret.length !== 32) fail('key_secret', 'the key\\'s secret is not 32 bytes')\n  return { issuer, clientId, secret: parts[3] }\n}\n\n/** Writes a CAUTHY_KEY (what the dashboard does in the browser; here for tests and tools). */\nexport function composeKey(issuer: string, clientId: string, secret: string): string {\n  const body = `${KEY_PREFIX}.${b64uEncode(enc.encode(issuer))}.${b64uEncode(enc.encode(clientId))}.${secret}`\n  const key = `${body}.${checksum(body)}`\n  parseKey(key) // refuses what a reader would\n  return key\n}\n\nfunction constantTimeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) return false\n  let d = 0\n  for (let i = 0; i < a.length; i++) d |= a.charCodeAt(i) ^ b.charCodeAt(i)\n  return d === 0\n}\n","// The auth-bff protocol, version 1, as every answer of the handler carries\n// it: the version header, no caching, and on a sign-in answer the step that\n// comes next — so a client never guesses which screen follows.\n\nexport const PROTOCOL_VERSION = '1'\n\n/**\n * What the screen does after a sign-in answer:\n *\n * - `done`: signed in; go on.\n * - `mfa`: ask for the second step (the code, or the push's approval).\n * - `verify_email`: the address must be confirmed first.\n * - `code`: a code (or link) was mailed; ask for the code.\n * - `passkey`: run the passkey ceremony with the options in the answer.\n * - `one_tap`: show Google's prompt with the client and nonce in the answer,\n *   then post the credential it gives.\n * - `redirect`: go to the URL the answer carries. Reserved for answers that\n *   have one; no route of version 1 answers it yet.\n */\nexport type NextStep = 'done' | 'mfa' | 'verify_email' | 'code' | 'passkey' | 'one_tap' | 'redirect'\n\n/** The routes whose answers are sign-in answers (auth-bff.md, \"Sign-in answers\"). */\nexport const SIGN_IN_ROUTES: ReadonlySet<string> = new Set([\n  '/sign-in/email', '/sign-in/mfa', '/sign-in/mfa/send', '/sign-in/mfa/email', '/sign-in/mfa/push', '/sign-in/mfa/push/finish',\n  '/sign-up/email', '/invitation/accept', '/sign-in/magic-link', '/sign-in/email-code', '/sign-in/magic-link/verify',\n  '/sign-in/passkey/begin', '/sign-in/passkey/finish', '/sign-in/google-one-tap/begin', '/sign-in/google-one-tap',\n  '/sign-in/anonymous', '/me/upgrade',\n])\n\n/** The step after a sign-in answer of `route`, or undefined when `status` is not one. */\nexport function nextOf(route: string, status: unknown): NextStep | undefined {\n  switch (status) {\n    case 'signed_in': return 'done'\n    case 'mfa_required': return 'mfa'\n    case 'verification_required': return 'verify_email'\n    // A code went out: the second step's, or the one that comes with a sign-in link.\n    case 'sent': return route.startsWith('/sign-in/mfa') ? 'mfa' : 'code'\n    // A ceremony began: the page shows Google's prompt and posts what it gives, or runs the passkey's.\n    case 'started': return route === '/sign-in/google-one-tap/begin' ? 'one_tap' : 'passkey'\n    default: return undefined\n  }\n}\n\n/**\n * The answer as the protocol sends it: `Cauthy-Protocol: 1` always,\n * `Cache-Control: no-store` unless it is `cacheable` (the published keys)\n * or already says no-store, and `next` on a successful JSON sign-in answer\n * of `route` (null: outside the routes).\n */\nexport async function finish(res: Response, route: string | null, cacheable = false): Promise<Response> {\n  const headers = new Headers()\n  res.headers.forEach((value, name) => {\n    if (name !== 'set-cookie') headers.set(name, value)\n  })\n  for (const cookie of res.headers.getSetCookie()) headers.append('set-cookie', cookie)\n  headers.set('cauthy-protocol', PROTOCOL_VERSION)\n  if (!cacheable && !(headers.get('cache-control') ?? '').includes('no-store')) headers.set('cache-control', 'no-store')\n\n  let body: BodyInit | null = res.body\n  if (route !== null && SIGN_IN_ROUTES.has(route) && res.ok && (headers.get('content-type') ?? '').startsWith('application/json')) {\n    const text = await res.text()\n    body = text\n    try {\n      const parsed = JSON.parse(text) as Record<string, unknown> | null\n      const next = nextOf(route, parsed?.status)\n      if (parsed !== null && next !== undefined) body = JSON.stringify({ ...parsed, next })\n    } catch {\n      // Not JSON after all: it goes as it came.\n    }\n    headers.delete('content-length')\n  }\n  return new Response(body, { status: res.status, statusText: res.statusText, headers })\n}\n","// A backend that is handed a Cauthy access token: is it real, and whose is it?\n//\n//   const who = await verifyToken(request)        // or the token itself\n//   who.userId, who.tenantId, who.roles\n//\n// Cauthy signs its tokens with a key it publishes (/.well-known/jwks.json), so\n// checking one needs no secret and no call to Cauthy per request: the keys are\n// fetched once and cached. Throws `CauthyTokenError` for anything else: answer\n// it 401, and read `reason`, one of the closed list of codes in the spec's\n// verification/rules.md.\n\nimport { compactVerify, createLocalJWKSet, type CompactVerifyGetKey, type JSONWebKeySet, type JWTVerifyGetKey } from 'jose'\nimport { parseStrict } from './json'\nimport { CauthyConfigError } from './types'\nimport { deprecated } from './deprecate'\nimport { parseKey, refuseBesideKey } from './cauthykey'\nimport { deriveFromKey } from './keyderive'\nimport { createIdentity } from './identity'\nimport { createSystem } from './system'\nimport { deadline } from './deadline'\nimport { withoutTrailingSlashes } from './url'\n\n/** Who a verified access token belongs to. */\nexport interface TokenIdentity {\n  /** The person. For a system's own token, the client it identifies as. */\n  userId: string\n  tenantId: string\n  email?: string\n  /** What the token says of the address, when it says (a boolean; absent otherwise). */\n  emailVerified?: boolean\n  roles: string[]\n  /** Set when the token is a system's own and not a person's (only with `allowSystem`). */\n  system?: string\n  /** Set when the token is a guest's (only with `allowAnonymous`). */\n  anonymous?: true\n  /** The client a person's token was issued through (`azp`); absent when none was named. */\n  authorizedParty?: string\n  /**\n   * The token's `client_id`: on a client's own token (only with\n   * `allowClientTokens`), the client's public id; on an AI agent's, the agent's.\n   */\n  clientId?: string\n  /** UTC, ISO 8601. */\n  expiresAt: string\n  /** The token as it arrived, to pass on. */\n  token: string\n}\n\n/** Why a token was refused: the closed list of verification/rules.md, and `no_token` when none was given. */\nexport type TokenRefusal =\n  | 'no_token' | 'too_large' | 'malformed' | 'alg_not_allowed' | 'unsupported_header' | 'missing_kid' | 'unknown_kid' | 'weak_key'\n  | 'bad_signature' | 'missing_claim' | 'invalid_claim' | 'wrong_issuer' | 'wrong_audience' | 'expired' | 'not_yet_valid'\n  | 'issued_in_future' | 'wrong_tenant' | 'system_token' | 'client_token' | 'anonymous_token' | 'wrong_client'\n\n/**\n * Cauthy's keys could not be fetched (or are not a key set): the token may be\n * good, and the application cannot tell. Answer 503, not 401. It is not a\n * `CauthyTokenError`: it says nothing about the token.\n */\nexport class CauthyUnavailableError extends Error {\n  constructor(detail: string) {\n    super(`@cauthyhq/node: Cauthy's keys are unavailable: ${detail}`)\n    this.name = 'CauthyUnavailableError'\n  }\n}\n\nexport class CauthyTokenError extends Error {\n  constructor(readonly reason: TokenRefusal, readonly detail?: string) {\n    super(`@cauthyhq/node: token refused: ${reason}${detail ? ` (${detail})` : ''}`)\n    this.name = 'CauthyTokenError'\n  }\n}\n\nexport interface VerifyTokenOptions {\n  /** Cauthy's address. Default: `CAUTHY_ISSUER`. */\n  issuer?: string\n  /**\n   * Further issuers a token may name, e.g. a workspace's custom domain. The\n   * keys always come from `issuer`. Default: none.\n   */\n  issuers?: string[]\n  /** The audience the tokens must carry. Required: this or `CAUTHY_AUDIENCE`. */\n  audience?: string\n  /** The workspace's id, a lowercase UUID. Required: this or `CAUTHY_TENANT_ID`. */\n  tenantId?: string\n  /** Cauthy's keys. Default: fetched from the issuer and cached (see `remoteKeys`). */\n  jwks?: JWTVerifyGetKey\n  /** The fetch to get the keys with. Default: the global one. */\n  fetch?: typeof fetch\n  /** The moment to verify at. Default: now. */\n  now?: Date\n  /** Clock tolerance in seconds, 0 to 60. Default: 30. */\n  leeway?: number\n  /**\n   * Accept a system's own token (a `sys` claim) too: for an endpoint another\n   * system calls. Default: false, so a system's token never stands for a\n   * person (rule R13 of the spec's verification/rules.md).\n   */\n  allowSystem?: boolean\n  /** Accept a guest's token (`anon: true`). Default: false (rule R14). */\n  allowAnonymous?: boolean\n  /**\n   * Accept a client's own token (a `token_use` claim, from a\n   * `client_credentials` grant) too: for a backend that serves machines as\n   * well as people. Default: false, so a machine never passes as a person\n   * (rule R13). The identity then carries `clientId`.\n   */\n  allowClientTokens?: boolean\n  /**\n   * The client this backend signs people in through. When set, a person's\n   * token issued through another client (an `azp` naming another) is refused\n   * with `wrong_client` (rule R15); a token with no `azp` passes. In contract\n   * mode it is the link's sign-in client. Default: none, and `azp` is not checked.\n   */\n  clientId?: string\n}\n\nconst MAX_TOKEN_BYTES = 8192\nconst UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/\nconst NIL_UUID = '00000000-0000-0000-0000-000000000000'\nconst SEGMENT = /^[A-Za-z0-9_-]+$/\n\nconst MAX_KEYS_BYTES = 64 * 1024\nconst KEYS_TIMEOUT_MS = 5000\nconst KEYS_COOLDOWN_MS = 30_000\nconst KEYS_DEFAULT_TTL_S = 300\nconst KEYS_MIN_TTL_S = 60\nconst KEYS_MAX_TTL_S = 3600\n\n/**\n * Cauthy's published keys (K1 to K5 of verification/rules.md): fetched with a\n * GET that follows no redirect, within 5 seconds, from `<issuer>/.well-known/jwks.json`;\n * only a 200 of at most 64 KiB counts. Kept for the answer's max-age (at most\n * an hour and at least a minute, 5 minutes when it names none); a `kid` the set lacks fetches again\n * only if the last fetch is older than 30 seconds; one fetch at a time; a\n * failed fetch keeps the last good set, and with none it is\n * `CauthyUnavailableError`.\n */\nexport function remoteKeys(issuer: string, fetchKeys: typeof fetch = fetch): JWTVerifyGetKey {\n  let set: JWTVerifyGetKey | undefined\n  let startedAt = 0\n  let expiresAt = 0\n  let inflight: Promise<void> | undefined\n\n  const load = async (): Promise<void> => {\n    startedAt = Date.now()\n    try {\n      const res = await fetchKeys(`${issuer}/.well-known/jwks.json`, { redirect: 'manual', signal: AbortSignal.timeout(KEYS_TIMEOUT_MS), headers: { accept: 'application/json' } })\n      if (res.status !== 200) throw new Error(`answered ${res.status}`)\n      const bytes = await readCapped(res, MAX_KEYS_BYTES)\n      const parsed = JSON.parse(new TextDecoder().decode(bytes)) as JSONWebKeySet\n      if (!parsed || !Array.isArray(parsed.keys)) throw new Error('not a key set')\n      // K6: two usable keys with one kid make the whole set untrustworthy.\n      const seen = new Set<string>()\n      for (const k of parsed.keys) {\n        const usable = k?.kty === 'RSA' && (k.use === undefined || k.use === 'sig') && (k.alg === undefined || k.alg === 'RS256')\n        if (!usable || typeof k.kid !== 'string') continue\n        if (seen.has(k.kid)) throw new Error(`two usable keys share the kid ${JSON.stringify(k.kid)}`)\n        seen.add(k.kid)\n      }\n      set = createLocalJWKSet(parsed)\n      const maxAge = /max-age=(\\d+)/.exec(res.headers.get('cache-control') ?? '')\n      // At least a minute: max-age=0 must not mean a fetch for every token.\n      const ttl = Math.max(KEYS_MIN_TTL_S, Math.min(maxAge ? Number(maxAge[1]) : KEYS_DEFAULT_TTL_S, KEYS_MAX_TTL_S))\n      expiresAt = Date.now() + ttl * 1000\n    } catch (err) {\n      // The last good set stands, and is not asked for again before the cooldown:\n      // an outage must not cost a wait on every verification. With none, the\n      // application cannot tell.\n      if (set === undefined) throw new CauthyUnavailableError(err instanceof Error ? err.message : 'unreachable')\n      expiresAt = Math.max(expiresAt, Date.now() + KEYS_COOLDOWN_MS)\n    }\n  }\n  const refresh = (): Promise<void> => {\n    inflight ??= load().finally(() => {\n      inflight = undefined\n    })\n    return inflight\n  }\n\n  return async (header, token) => {\n    if (set === undefined || Date.now() >= expiresAt) await refresh()\n    try {\n      return await set!(header, token)\n    } catch (err) {\n      const unknown = (err as { code?: unknown } | null)?.code === 'ERR_JWKS_NO_MATCHING_KEY'\n      if (unknown && Date.now() - startedAt >= KEYS_COOLDOWN_MS) {\n        await refresh()\n        return set!(header, token)\n      }\n      throw err\n    }\n  }\n}\n\nasync function readCapped(res: Response, max: number): Promise<Uint8Array> {\n  const reader = res.body?.getReader()\n  if (!reader) return new Uint8Array()\n  const chunks: Uint8Array[] = []\n  let size = 0\n  for (;;) {\n    const { done, value } = await reader.read()\n    if (done) break\n    size += value.length\n    if (size > max) {\n      await reader.cancel()\n      throw new Error(`over ${max} bytes`)\n    }\n    chunks.push(value)\n  }\n  const out = new Uint8Array(size)\n  let at = 0\n  for (const c of chunks) {\n    out.set(c, at)\n    at += c.length\n  }\n  return out\n}\n\nconst published = new Map<string, JWTVerifyGetKey>()\nconst withFetch = new WeakMap<typeof fetch, Map<string, JWTVerifyGetKey>>()\n\nfunction remoteKeysFor(issuer: string, fetchKeys: typeof fetch): JWTVerifyGetKey {\n  let byIssuer = withFetch.get(fetchKeys)\n  if (!byIssuer) withFetch.set(fetchKeys, (byIssuer = new Map()))\n  let set = byIssuer.get(issuer)\n  if (!set) byIssuer.set(issuer, (set = remoteKeys(issuer, fetchKeys)))\n  return set\n}\n\n/** Cauthy's published keys, fetched once per issuer and kept (see `remoteKeys`). */\nexport function keysOf(issuer: string): JWTVerifyGetKey {\n  let set = published.get(issuer)\n  if (set === undefined) {\n    set = remoteKeys(issuer)\n    published.set(issuer, set)\n  }\n  return set\n}\n\nfunction env(name: string): string | undefined {\n  return typeof process !== 'undefined' ? process.env?.[name] : undefined\n}\n\nfunction bearer(from: string | Request | Headers): string {\n  // A raw token is taken as it is: surrounding whitespace is the caller's mistake (R2).\n  if (typeof from === 'string') return from.replace(/^Bearer\\s+/i, '')\n  const header = (from instanceof Headers ? from : from.headers).get('authorization') ?? ''\n  return /^Bearer\\s+/i.test(header) ? header.replace(/^Bearer\\s+/i, '').trim() : ''\n}\n\nfunction issuerAddress(value: string, what: string): string {\n  let url: URL\n  try {\n    url = new URL(value)\n  } catch {\n    throw new CauthyConfigError(`${what} must be an https address, e.g. https://id.example.com`)\n  }\n  // http is for a developer's own machine: localhost, 127.0.0.1, *.localhost and *.test.\n  const local = url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname.endsWith('.localhost') || url.hostname.endsWith('.test')\n  if (url.protocol !== 'https:' && !(url.protocol === 'http:' && local)) throw new CauthyConfigError(`${what} must be https (http only for localhost, *.localhost and *.test)`)\n  if (url.search !== '' || url.hash !== '') throw new CauthyConfigError(`${what} must have no query or fragment`)\n  return withoutTrailingSlashes(value)\n}\n\nconst isObject = (v: unknown): v is Record<string, unknown> => typeof v === 'object' && v !== null && !Array.isArray(v)\n\nfunction decodeJson(segment: string): unknown {\n  const padded = segment.replace(/-/g, '+').replace(/_/g, '/')\n  return parseStrict(Buffer.from(padded, 'base64').toString('utf8'))\n}\n\n/**\n * A verifier for access tokens, configured once. Refuses to be made without\n * an issuer, an audience and a workspace: a verifier that checks none of\n * them would accept a token of any other application or workspace.\n */\nexport function createTokenVerifier(options: VerifyTokenOptions = {}): (from: string | Request | Headers) => Promise<TokenIdentity> {\n  // Read from the environment, these three leave in 2.0: CAUTHY_KEY says them all.\n  const fromEnv = (['CAUTHY_ISSUER', 'CAUTHY_AUDIENCE', 'CAUTHY_TENANT_ID'] as const)\n    .filter((name, i) => [options.issuer, options.audience, options.tenantId][i] === undefined && (env(name) ?? '') !== '')\n  if (fromEnv.length > 0) {\n    deprecated('Reading CAUTHY_ISSUER, CAUTHY_AUDIENCE and CAUTHY_TENANT_ID to verify tokens', 'Set CAUTHY_KEY and use createVerifierFromEnv().')\n  }\n  const issuerGiven = options.issuer ?? env('CAUTHY_ISSUER') ?? ''\n  if (issuerGiven === '') throw new CauthyConfigError('issuer (CAUTHY_ISSUER) is not set')\n  const issuer = issuerAddress(issuerGiven, 'issuer')\n  const issuers = [issuer, ...(options.issuers ?? []).map((i) => issuerAddress(i, 'issuers'))]\n  const audience = options.audience ?? env('CAUTHY_AUDIENCE') ?? ''\n  if (audience === '') throw new CauthyConfigError('audience (CAUTHY_AUDIENCE) is not set: without it a token issued for another application would be accepted')\n  const tenant = options.tenantId ?? env('CAUTHY_TENANT_ID') ?? ''\n  if (tenant === '') throw new CauthyConfigError('tenantId (CAUTHY_TENANT_ID) is not set: without it a token of another workspace would be accepted')\n  if (!UUID.test(tenant) || tenant === NIL_UUID) throw new CauthyConfigError('tenantId must be the workspace\\'s id, a lowercase UUID that is not the nil UUID')\n  const leeway = options.leeway ?? 30\n  if (!Number.isFinite(leeway) || leeway < 0 || leeway > 60) throw new CauthyConfigError('leeway must be 0 to 60 seconds')\n\n  return async (from) => {\n    const token = bearer(from)\n    if (token === '') throw new CauthyTokenError('no_token')\n    // R1\n    if (Buffer.byteLength(token) > MAX_TOKEN_BYTES) throw new CauthyTokenError('too_large')\n    // R2\n    const parts = token.split('.')\n    if (parts.length !== 3 || !parts.every((p) => SEGMENT.test(p) || p === '')) throw new CauthyTokenError('malformed', 'not three base64url segments')\n    let header: unknown\n    try {\n      header = decodeJson(parts[0])\n    } catch {\n      throw new CauthyTokenError('malformed', 'the header is not JSON')\n    }\n    if (!isObject(header)) throw new CauthyTokenError('malformed', 'the header is not an object')\n    // R3, R4, R5: the algorithm is the verifier's, never the token's.\n    if (header.alg !== 'RS256') throw new CauthyTokenError('alg_not_allowed')\n    if ('crit' in header) throw new CauthyTokenError('unsupported_header')\n    // R4: typ is not required, but when present it is JWT or at+jwt, in any case.\n    if ('typ' in header && !(typeof header.typ === 'string' && ['jwt', 'at+jwt'].includes(header.typ.toLowerCase()))) {\n      throw new CauthyTokenError('unsupported_header', 'typ')\n    }\n    if (typeof header.kid !== 'string' || header.kid === '') throw new CauthyTokenError('missing_kid')\n\n    // R5, R6\n    let payloadBytes: Uint8Array\n    try {\n      const verified = await compactVerify(token, (options.jwks ?? (options.fetch ? remoteKeysFor(issuer, options.fetch) : keysOf(issuer))) as CompactVerifyGetKey, { algorithms: ['RS256'] })\n      payloadBytes = verified.payload\n    } catch (err) {\n      // By code, not by class: the keys may come from another copy of jose.\n      const code = (err as { code?: unknown } | null)?.code\n      if (code === 'ERR_JWKS_NO_MATCHING_KEY') throw new CauthyTokenError('unknown_kid')\n      if (code === 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED') throw new CauthyTokenError('bad_signature')\n      if (err instanceof TypeError && /2048/.test(err.message)) throw new CauthyTokenError('weak_key')\n      if (code === 'ERR_JWS_INVALID') throw new CauthyTokenError('malformed', err instanceof Error ? err.message : undefined)\n      if (err instanceof CauthyUnavailableError) throw err\n      throw new CauthyTokenError('bad_signature', err instanceof Error ? err.message : undefined)\n    }\n\n    // R7\n    let claims: unknown\n    try {\n      claims = parseStrict(new TextDecoder().decode(payloadBytes), ['exp', 'iat', 'nbf'])\n    } catch {\n      throw new CauthyTokenError('malformed', 'the payload is not JSON')\n    }\n    if (!isObject(claims)) throw new CauthyTokenError('malformed', 'the payload is not an object')\n    for (const name of ['iss', 'sub', 'aud', 'exp', 'iat', 'tid']) {\n      if (claims[name] === undefined) throw new CauthyTokenError('missing_claim', name)\n    }\n    // R8: no claim is null but roles.\n    const bad = (name: string): never => {\n      throw new CauthyTokenError('invalid_claim', name)\n    }\n    if (typeof claims.iss !== 'string') bad('iss')\n    if (typeof claims.sub !== 'string' || !UUID.test(claims.sub)) bad('sub')\n    if (typeof claims.tid !== 'string' || !UUID.test(claims.tid)) bad('tid')\n    const aud = claims.aud\n    if (!(typeof aud === 'string' || (Array.isArray(aud) && aud.length > 0 && aud.every((a) => typeof a === 'string')))) bad('aud')\n    for (const name of ['exp', 'iat', 'nbf']) if (claims[name] !== undefined && !Number.isInteger(claims[name])) bad(name)\n    if (claims.roles !== undefined && claims.roles !== null && !(Array.isArray(claims.roles) && claims.roles.every((r) => typeof r === 'string'))) bad('roles')\n    if (claims.email !== undefined && typeof claims.email !== 'string') bad('email')\n    for (const name of ['email_verified', 'anon']) if (claims[name] !== undefined && typeof claims[name] !== 'boolean') bad(name)\n    for (const name of ['token_use', 'azp']) if (claims[name] !== undefined && typeof claims[name] !== 'string') bad(name)\n\n    // R9, R10\n    if (!issuers.includes(claims.iss as string)) throw new CauthyTokenError('wrong_issuer')\n    if (!(Array.isArray(aud) ? aud.includes(audience) : aud === audience)) throw new CauthyTokenError('wrong_audience')\n    // R11\n    const now = (options.now ?? new Date()).getTime() / 1000\n    if (now >= (claims.exp as number) + leeway) throw new CauthyTokenError('expired')\n    if (claims.nbf !== undefined && now < (claims.nbf as number) - leeway) throw new CauthyTokenError('not_yet_valid')\n    if (now < (claims.iat as number) - leeway) throw new CauthyTokenError('issued_in_future')\n    // R12\n    if (claims.tid !== tenant) throw new CauthyTokenError('wrong_tenant')\n    // R13, R14\n    // Its presence is the mark, whatever the value (null and false included).\n    if ('sys' in claims && !options.allowSystem) throw new CauthyTokenError('system_token')\n    // A client's own token stands for a machine: present is the mark, as for sys.\n    if ('token_use' in claims && !options.allowClientTokens) throw new CauthyTokenError('client_token')\n    if (claims.anon === true && !options.allowAnonymous) throw new CauthyTokenError('anonymous_token')\n    // R15: a person's token issued through another client than the one named.\n    if (options.clientId && typeof claims.azp === 'string' && claims.azp !== '' && claims.azp !== options.clientId) throw new CauthyTokenError('wrong_client')\n\n    return {\n      userId: claims.sub as string,\n      tenantId: claims.tid as string,\n      ...(typeof claims.email === 'string' && claims.email !== '' ? { email: claims.email } : {}),\n      ...(typeof claims.email_verified === 'boolean' ? { emailVerified: claims.email_verified } : {}),\n      roles: Array.isArray(claims.roles) ? (claims.roles as string[]) : [],\n      ...(typeof claims.sys === 'string' && claims.sys !== '' ? { system: claims.sys } : {}),\n      ...(claims.anon === true ? { anonymous: true as const } : {}),\n      ...(typeof claims.azp === 'string' && claims.azp !== '' ? { authorizedParty: claims.azp } : {}),\n      ...(typeof claims.client_id === 'string' && claims.client_id !== '' ? { clientId: claims.client_id } : {}),\n      expiresAt: new Date((claims.exp as number) * 1000).toISOString(),\n      token,\n    }\n  }\n}\n\n/**\n * Verifies an access token (or the `Authorization: Bearer` of a request) and\n * answers who it belongs to, by the rules of the spec's verification/rules.md.\n * Needs an issuer, an audience and a workspace (see `createTokenVerifier`,\n * which checks them once, at startup).\n */\nexport async function verifyToken(from: string | Request | Headers, options: VerifyTokenOptions = {}): Promise<TokenIdentity> {\n  return createTokenVerifier(options)(from)\n}\n\n/**\n * A verifier made from the environment. With `CAUTHY_KEY` the issuer, the\n * audience and the workspace are Cauthy's answer to `GET /v1/connect/self`\n * (asked with the key's assertion, once); nothing else is read, and any of\n * `issuer`, `audience`, `tenantId` given beside it is refused. Without it,\n * `CAUTHY_ISSUER`, `CAUTHY_AUDIENCE` and `CAUTHY_TENANT_ID`, deprecated.\n *\n *   const verify = await createVerifierFromEnv()\n *   const who = await verify(request)\n */\nexport async function createVerifierFromEnv(\n  options: Omit<VerifyTokenOptions, 'issuers'> & { key?: string } = {},\n): Promise<(from: string | Request | Headers) => Promise<TokenIdentity>> {\n  const text = options.key ?? env('CAUTHY_KEY')\n  if (text === undefined || text === '') return createTokenVerifier(options)\n  refuseBesideKey(typeof process !== 'undefined' ? process.env : undefined)\n  for (const name of ['issuer', 'audience', 'tenantId'] as const) {\n    if (options[name] !== undefined) throw new CauthyConfigError(`with CAUTHY_KEY, ${name} comes from CAUTHY_KEY: do not pass it`)\n  }\n  const key = parseKey(text)\n  const system = createSystem({ issuer: key.issuer, clientId: key.clientId, signer: { clientId: key.clientId, signer: deriveFromKey(key).signer }, fetch: options.fetch })\n  const id = await createIdentity({ issuer: key.issuer, token: () => system.token(), fetch: deadline(options.fetch, KEYS_TIMEOUT_MS) }).ready()\n  const { key: _, ...rest } = options\n  return createTokenVerifier({ ...rest, issuer: id.issuer, audience: id.audience, tenantId: id.tenant.id })\n}\n","// A strict JSON reader for what a token carries: it refuses what JSON.parse\n// accepts and verification/rules.md (R2) does not — an object that repeats a\n// name, at any depth, since two readers could then see two different tokens.\n// An integer literal beyond 2^53 reads as NaN, so the claim check refuses it\n// (R8) instead of rounding it into range.\n\nconst SPACE = new Set([' ', '\\t', '\\n', '\\r'])\nconst LIMIT = 2n ** 53n\n\nexport function parseStrict(text: string, integerMembers: readonly string[] = []): unknown {\n  let i = 0\n  let depth = 0\n  const fail = (what: string): never => {\n    throw new SyntaxError(`${what} at ${i}`)\n  }\n  const skip = () => {\n    while (i < text.length && SPACE.has(text[i])) i++\n  }\n  const value = (integer = false): unknown => {\n    skip()\n    const c = text[i]\n    if (c === '{') return object()\n    if (c === '[') return array()\n    if (c === '\"') return string()\n    if (c === '-' || (c >= '0' && c <= '9')) return number(integer)\n    for (const [word, v] of [['true', true], ['false', false], ['null', null]] as const) {\n      if (text.startsWith(word, i)) {\n        i += word.length\n        return v\n      }\n    }\n    return fail('unexpected character')\n  }\n  const string = (): string => {\n    const start = i\n    i++\n    while (i < text.length && text[i] !== '\"') i += text[i] === '\\\\' ? 2 : 1\n    if (text[i] !== '\"') fail('unterminated string')\n    i++\n    return JSON.parse(text.slice(start, i)) as string\n  }\n  const number = (integer: boolean): number => {\n    const m = /^-?(0|[1-9]\\d*)(\\.\\d+)?([eE][+-]?\\d+)?/.exec(text.slice(i))\n    if (!m) return fail('bad number')\n    i += m[0].length\n    // Where the claim must be an integer, 2.0 and 1e3 are not integer literals.\n    if (integer && (m[2] !== undefined || m[3] !== undefined)) return Number.NaN\n    if (m[2] === undefined && m[3] === undefined) {\n      const big = BigInt(m[0])\n      if (big > LIMIT || big < -LIMIT) return Number.NaN\n    }\n    return Number(m[0])\n  }\n  const array = (): unknown[] => {\n    i++\n    depth++\n    const out: unknown[] = []\n    skip()\n    if (text[i] === ']') {\n      i++\n      depth--\n      return out\n    }\n    for (;;) {\n      out.push(value())\n      skip()\n      if (text[i] === ',') i++\n      else if (text[i] === ']') {\n        i++\n        depth--\n        return out\n      } else fail('expected , or ]')\n    }\n  }\n  const object = (): Record<string, unknown> => {\n    i++\n    depth++\n    const out: Record<string, unknown> = {}\n    const seen = new Set<string>()\n    skip()\n    if (text[i] === '}') {\n      i++\n      depth--\n      return out\n    }\n    for (;;) {\n      skip()\n      if (text[i] !== '\"') fail('expected a name')\n      const name = string()\n      if (seen.has(name)) fail(`repeated name ${JSON.stringify(name)}`)\n      seen.add(name)\n      skip()\n      if (text[i] !== ':') fail('expected :')\n      i++\n      Object.defineProperty(out, name, { value: value(depth === 1 && integerMembers.includes(name)), enumerable: true, writable: true, configurable: true })\n      skip()\n      if (text[i] === ',') i++\n      else if (text[i] === '}') {\n        i++\n        depth--\n        return out\n      } else fail('expected , or }')\n    }\n  }\n  const result = value()\n  skip()\n  if (i < text.length) fail('trailing characters')\n  return result\n}\n","// What leaves in 2.0 says so once per process, as Node's own deprecations do\n// (silenced with --no-deprecation, thrown with --throw-deprecation).\nconst told = new Set<string>()\n\n/** Says once per process that `what` is deprecated, and what to use instead. */\nexport function deprecated(what: string, instead: string): void {\n  if (told.has(what)) return\n  told.add(what)\n  const message = `@cauthyhq/node: ${what} is deprecated and leaves in 2.0. ${instead}`\n  // Edge runtimes have no `process`: the console says it there.\n  if (typeof process !== 'undefined' && typeof process.emitWarning === 'function') {\n    process.emitWarning(message, { type: 'DeprecationWarning', code: 'CAUTHY_DEPRECATED' })\n  } else {\n    console.warn(message)\n  }\n}\n","// Everything a CAUTHY_KEY stands for (key/cauthy-key.md §4–§6): the cookie\n// and flow rings (rootkey.ts's derivation, with the secret segment as the\n// root) and the Ed25519 key the application proves itself with.\n//\n// The assertion is written by hand, member by member, as §6 fixes it: the\n// vectors pin it byte for byte. WebCrypto signs; nothing here needs node:crypto.\nimport { b64uEncode, type CauthyKey } from './cauthykey'\nimport { deriveKeys, type KeyRing } from './rootkey'\n\nconst enc = new TextEncoder()\nconst PKCS8_ED25519 = Uint8Array.from([0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x04, 0x22, 0x04, 0x20])\n\nexport const ASSERTION_TYPE = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'\n\nexport type PublicJwk = { kty: 'OKP'; crv: 'Ed25519'; x: string }\n\nexport interface Signer {\n  kid: string\n  publicJwk: PublicJwk\n  /** §6's assertion. iat in seconds; jti a fresh UUID v4. */\n  assertion(clientId: string, tokenEndpoint: string, jti?: string, iat?: number): Promise<string>\n}\n\nexport interface KeyDerived {\n  cookie: Promise<KeyRing>\n  flow: Promise<KeyRing>\n  signer: Promise<Signer>\n  /** The previous key's public JWK, published during a rotation (contract). */\n  previousJwk?: Promise<PublicJwk & { kid: string }>\n}\n\nasync function seedOf(secret: string): Promise<Uint8Array> {\n  const ikm = await crypto.subtle.importKey('raw', enc.encode(secret), 'HKDF', false, ['deriveBits'])\n  return new Uint8Array(await crypto.subtle.deriveBits(\n    { name: 'HKDF', hash: 'SHA-256', salt: new Uint8Array(0), info: enc.encode('cauthy/sign/v1') }, ikm, 256))\n}\n\n/** RFC 7638 thumbprint of an Ed25519 public key. */\nexport async function thumbprint(x: string): Promise<string> {\n  return b64uEncode(new Uint8Array(await crypto.subtle.digest('SHA-256', enc.encode(`{\"crv\":\"Ed25519\",\"kty\":\"OKP\",\"x\":\"${x}\"}`))))\n}\n\nasync function signerOf(secret: string): Promise<Signer> {\n  const seed = await seedOf(secret)\n  const der = new Uint8Array(PKCS8_ED25519.length + 32)\n  der.set(PKCS8_ED25519)\n  der.set(seed, PKCS8_ED25519.length)\n  // Extractable only to read x; the key that signs from here on is not.\n  const readable = await crypto.subtle.importKey('pkcs8', der, { name: 'Ed25519' }, true, ['sign'])\n  const { x } = await crypto.subtle.exportKey('jwk', readable)\n  const signing = await crypto.subtle.importKey('pkcs8', der, { name: 'Ed25519' }, false, ['sign'])\n  der.fill(0)\n  seed.fill(0)\n  const publicJwk: PublicJwk = { kty: 'OKP', crv: 'Ed25519', x: x as string }\n  const kid = await thumbprint(publicJwk.x)\n  const header = b64uEncode(enc.encode(JSON.stringify({ alg: 'EdDSA', kid })))\n  return {\n    kid,\n    publicJwk,\n    async assertion(clientId, tokenEndpoint, jti = crypto.randomUUID(), iat = Math.floor(Date.now() / 1000)) {\n      const claims = { iss: clientId, sub: clientId, aud: tokenEndpoint, jti, iat, exp: iat + 120 }\n      const input = `${header}.${b64uEncode(enc.encode(JSON.stringify(claims)))}`\n      const sig = new Uint8Array(await crypto.subtle.sign({ name: 'Ed25519' }, signing, enc.encode(input)))\n      return `${input}.${b64uEncode(sig)}`\n    },\n  }\n}\n\n/** The rings and the signer of a key, and of the one it replaces during a rotation. */\nexport function deriveFromKey(key: CauthyKey, previous?: CauthyKey): KeyDerived {\n  const other = previous && previous.secret !== key.secret ? previous : undefined\n  const rings = deriveKeys(key.secret, other?.secret)\n  return {\n    cookie: rings.cookie,\n    flow: rings.flow,\n    signer: signerOf(key.secret),\n    ...(other ? { previousJwk: signerOf(other.secret).then(s => ({ ...s.publicJwk, kid: s.kid })) } : {}),\n  }\n}\n","// Who the application is, asked of Cauthy (key/cauthy-key.md §7): once at\n// start, then revalidated every five minutes with If-None-Match. Cauthy down:\n// the last answer stands; never one yet: the auth routes say 503 unavailable\n// until it comes. Cauthy refusing the key (invalid_client): 503 misconfigured,\n// logged once with the kid.\nimport { CauthyApiError } from './system'\n\n/** What `GET /v1/connect/self` answers. */\nexport interface Identity {\n  issuer: string\n  audience: string\n  tenant: { id: string; slug: string }\n  system: string\n  client_id: string\n  sign_in_client_id: string\n  app_urls: string[]\n  callback_path: string\n  key: { kid: string; retires_at: string | null } | null\n  contract: { link: string; system_proof?: 'off' | 'auto' | 'required'; require_verified_email?: boolean; in_step?: boolean; checked_at?: string } | null\n}\n\nexport interface IdentityOptions {\n  issuer: string\n  /** The application's own access token (the system client's). */\n  token: () => Promise<string>\n  fetch?: typeof globalThis.fetch\n  now?: () => number\n  /** Backoff between first attempts, ms; the last repeats. */\n  retryMs?: number[]\n  /** For the log line when Cauthy refuses the key. */\n  kid?: string | (() => string | undefined)\n  log?: (message: string) => void\n}\n\nexport interface IdentityCache {\n  /** The identity, waiting for the first answer. Rejects with 503 misconfigured when Cauthy refuses the key. */\n  ready(): Promise<Identity>\n  /** The last answer, or undefined before the first. */\n  current(): Identity | undefined\n  /** Revalidates now; keeps the last answer on any failure. */\n  refresh(): Promise<void>\n  /** True while there is no answer yet and the last attempt failed (the retries go on). */\n  failing(): boolean\n  /** Settles when the first-answer attempt now out ends: true when it brought the answer. */\n  attempt(): Promise<boolean>\n}\n\nexport const REVALIDATE_MS = 300_000\n\nconst sleep = (ms: number) => new Promise<void>((resolve) => {\n  const t = setTimeout(resolve, ms)\n  ;(t as { unref?: () => void }).unref?.()\n})\n\nexport function createIdentity(o: IdentityOptions): IdentityCache {\n  const doFetch = o.fetch ?? globalThis.fetch\n  const now = o.now ?? Date.now\n  const retry = o.retryMs ?? [1000, 2000, 5000, 10_000, 30_000]\n  let held: Identity | undefined\n  let etag: string | undefined\n  let checkedAt = 0\n  let first: Promise<Identity> | undefined\n  let refused: CauthyApiError | undefined\n  let refreshing: Promise<void> | undefined\n  let failed = false\n  let attemptEnded: ((ok: boolean) => void) | undefined\n  let attemptOut: Promise<boolean> | undefined\n  const kid = () => (typeof o.kid === 'function' ? o.kid() : o.kid) ?? '?'\n\n  async function ask(): Promise<Identity | 'same'> {\n    const headers: Record<string, string> = { authorization: `Bearer ${await o.token()}`, accept: 'application/json' }\n    if (etag && held) headers['if-none-match'] = etag\n    const res = await doFetch(`${o.issuer}/v1/connect/self`, { headers })\n    if (res.status === 304 && held) return 'same'\n    if (res.status === 410) throw Object.assign(new Error('client_inactive'), { code: 'client_inactive' })\n    if (!res.ok) throw new CauthyApiError(503, 'unavailable', `Cauthy answered ${res.status} to /v1/connect/self`)\n    const body = (await res.json()) as { data?: Identity }\n    if (!body?.data || typeof body.data.client_id !== 'string') throw new CauthyApiError(503, 'unavailable', 'Cauthy\\'s answer to /v1/connect/self has no identity')\n    etag = res.headers.get('etag') ?? undefined\n    return body.data\n  }\n\n  /** Cauthy refuses the key itself: not a failure to reach it. */\n  function refusalOf(e: unknown): CauthyApiError | undefined {\n    const code = (e as { code?: string } | null)?.code\n    if (code !== 'invalid_client' && code !== 'client_inactive') return undefined\n    const message = code === 'client_inactive'\n      ? `Cauthy says this application's client is no longer active (kid ${kid()}). Connect it again in Cauthy's dashboard.`\n      : `Cauthy refuses this application's key (kid ${kid()}): it was revoked or never registered. Make a new key in Cauthy's dashboard.`\n    return new CauthyApiError(503, 'misconfigured', message)\n  }\n\n  function refuse(err: CauthyApiError): CauthyApiError {\n    if (refused === undefined) o.log?.(err.message.replace(/^@cauthyhq\\/node: /, ''))\n    refused = err\n    // Asked again at the next revalidation, not before: a refused key does not loop.\n    checkedAt = now()\n    return err\n  }\n\n  async function firstAnswer(): Promise<Identity> {\n    for (let attempt = 0; ; attempt++) {\n      attemptOut = new Promise<boolean>(resolve => { attemptEnded = resolve })\n      try {\n        const got = await ask()\n        if (got !== 'same') held = got\n        checkedAt = now()\n        failed = false\n        attemptEnded?.(true)\n        return held as Identity\n      } catch (e) {\n        const r = refusalOf(e)\n        failed = true\n        attemptEnded?.(false)\n        if (r) throw refuse(r)\n        await sleep(retry[Math.min(attempt, retry.length - 1)])\n      }\n    }\n  }\n\n  async function refresh(): Promise<void> {\n    checkedAt = now()\n    try {\n      const got = await ask()\n      if (got !== 'same') held = got\n      refused = undefined\n    } catch (e) {\n      const r = refusalOf(e)\n      if (r) refuse(r)\n      // Otherwise the last answer stands.\n    }\n  }\n\n  return {\n    ready(): Promise<Identity> {\n      if ((held || refused) && now() - checkedAt >= REVALIDATE_MS) {\n        refreshing ??= refresh().finally(() => { refreshing = undefined })\n      }\n      if (refused) return Promise.reject(refused)\n      if (held) return Promise.resolve(held)\n      first ??= firstAnswer()\n      return first\n    },\n    current: () => held,\n    refresh: () => (refreshing ??= refresh().finally(() => { refreshing = undefined })),\n    failing: () => held === undefined && failed && refused === undefined,\n    attempt: () => (held !== undefined ? Promise.resolve(true) : attemptOut ?? Promise.resolve(false)),\n  }\n}\n","// Is it this handler that answers under basePath? Another route there — a\n// catch-all of another auth library, a proxy rule, a route registered first —\n// takes the requests silently. Every answer of the handler carries\n// Cauthy-Protocol and nothing else's does: three requests that reach nothing\n// in Cauthy tell them apart.\n\nimport { PROTOCOL_VERSION } from './protocol'\nimport { CauthyConfigError } from './types'\nimport { withoutTrailingSlashes } from './url'\n\n/**\n * Where the probes go: the running application's origin\n * (`'http://localhost:3000'`), or a function that serves a request in\n * process (Hono's `app.fetch`, `checkFastifyMount` for Fastify).\n */\nexport type MountTarget = string | ((request: Request) => Response | Promise<Response>)\n\nexport async function checkMount(basePath: string, target: MountTarget): Promise<void> {\n  const origin = typeof target === 'string' ? withoutTrailingSlashes(target) : 'http://localhost'\n  if (!/^https?:\\/\\/[^/\\s]+$/.test(origin)) {\n    throw new CauthyConfigError(`checkMount needs the application's origin, e.g. http://localhost:3000, not ${JSON.stringify(target)}`)\n  }\n  const send = typeof target === 'string' ? (r: Request) => fetch(r, { redirect: 'manual' }) : target\n  const probes = [\n    new Request(`${origin}${basePath}/session`, { headers: { accept: 'application/json' } }),\n    new Request(`${origin}${basePath}/cauthy-mount-check`),\n    new Request(`${origin}${basePath}/sign-out`, { method: 'POST', headers: { origin, 'content-type': 'application/json', 'x-cauthy-request': '1' }, body: '{}' }),\n  ]\n  for (const probe of probes) {\n    const what = `${probe.method} ${new URL(probe.url).pathname}`\n    let res: Response\n    try {\n      res = await send(probe)\n    } catch (err) {\n      // In process, a throw is the handler's own; over HTTP, it is the connection.\n      throw new CauthyConfigError(typeof target === 'string'\n        ? `could not reach ${what} to check where the handler is mounted: ${(err as Error).message}`\n        : `the handler threw on ${what}: ${(err as Error).message}`)\n    }\n    await res.body?.cancel()\n    if (res.headers.get('cauthy-protocol') !== PROTOCOL_VERSION) {\n      // Nothing is followed: a redirect is the answer, and says where the mount goes.\n      if (res.status >= 300 && res.status < 400) {\n        throw new CauthyConfigError(`${what}: the mount redirects (${res.status} to ${res.headers.get('location') ?? 'nowhere'}): ` +\n          `a proxy rule, a trailing-slash or HTTPS redirect sits in front of ${basePath}. Cauthy is not what answers.`)\n      }\n      if (res.status >= 500) {\n        throw new CauthyConfigError(`${what} answered ${res.status} without Cauthy-Protocol: ${PROTOCOL_VERSION}: the application crashed before or instead of the handler. Look at its log.`)\n      }\n      throw new CauthyConfigError(`${what} answered ${res.status} without Cauthy-Protocol: ${PROTOCOL_VERSION}: something other than this handler answers under ${basePath}. ` +\n        'Move that route, mount Cauthy before it, or give Cauthy another basePath.')\n    }\n  }\n}\n","// Sign in with Cauthy, held by the application's own server.\n//\n// The application mounts one route (`handler`) and asks who is there\n// (`getSession`). Signing in, signing up, second factors, passkeys, recovering\n// a password and the account page are Cauthy's pages: this sends the browser\n// to them and keeps what comes back in an encrypted, httpOnly cookie. There is\n// no database and no screen to build.\n//\n// The session is Cauthy's short-lived access token plus the refresh token that\n// renews it. When the access token expires the session is renewed with Cauthy,\n// which is where an account disabled there, or signed out everywhere, stops\n// being signed in here — within minutes, with nothing to synchronise.\n\nimport { clearParts, readCookies, readParts, writeCookie, writeParts, type CookieAttributes } from './cookies'\nimport { keyOf, seal, unsealAny, unsealIndexed } from './seal'\nimport { failClosed, readContract, type PactStatus, type ResolvedContract } from './contract'\nimport { JWKS_MAX_AGE_S, pactKeys, type PactKeys } from './keys'\nimport { deriveKeys, type KeyRing } from './rootkey'\nimport { checkResultOf, checkWire, organizationIdOf } from './permissions'\nimport { CauthyApiError, createSystem, type CauthySystem } from './system'\nimport { checkCode, checkEmail, checkName, checkNewPassword, checkPassword, firstProblem, passwordPolicyOf, type FieldProblem, type PasswordPolicy, checkOrganization, checkOrganizationName } from './validate'\nimport { memoryReplayStore, verifyWebhook, type CauthyEvent, type VerifyWebhookOptions } from './webhook'\nimport {\n  CauthyConfigError,\n  type CauthyOptions,\n  type CheckQuestion,\n  type CheckResult,\n  type ConditionalPermission,\n  type JsonValue,\n  type OrganizationRef,\n  type PublicSession,\n  type Session,\n  type SessionOrganization,\n  type SessionStatus,\n  type SessionUser,\n} from './types'\nimport { withoutTrailingSlashes } from './url'\nimport { finish } from './protocol'\nimport { deadline } from './deadline'\nimport { createTokenVerifier, type TokenIdentity, type VerifyTokenOptions } from './verify'\nimport { deprecated } from './deprecate'\nimport { checkMount as probeMount, type MountTarget } from './mount'\nimport { parseKey, refuseBesideKey, type CauthyKey } from './cauthykey'\nimport { ASSERTION_TYPE, deriveFromKey, type KeyDerived } from './keyderive'\nimport { createIdentity, type Identity, type IdentityCache } from './identity'\nimport { CauthyKeyError } from './types'\n\n/** What the session cookie holds. Short names: it rides every request. */\ninterface Stored {\n  at: string // access token\n  rt: string // refresh token\n  exp: number // when the access token expires, epoch seconds\n  u: SessionUser\n  tid: string\n  roles: string[]\n  p?: 1 // the person asked to stay signed in, and Cauthy allowed it\n}\n\n/** What the sign-in in progress holds, between leaving for Cauthy and coming back. */\ninterface Flow {\n  state: string\n  verifier: string\n  returnTo: string\n}\n\n// A session that stays signed in keeps its cookie this long, renewed on each\n// use; a short one has a cookie that ends with the browser session. Cauthy\n// alone decides how long the session itself lives.\nconst PERSISTENT_SECONDS = 30 * 86_400\n// How long a sign-in may sit open at Cauthy and still be finished here. The\n// same hour Cauthy keeps its side of it.\nconst FLOW_SECONDS = 3600\n/** How long a sign-in that had to start again is remembered, so it starts again once and not forever. */\nconst AGAIN_SECONDS = 120\n/** Renew this long before the access token runs out, so a request never carries one about to. */\nconst SKEW_SECONDS = 30\nconst ORGANIZATIONS_TTL_MS = 60_000\n/** How long the workspace's look is kept before Cauthy is asked again. */\nconst LOOK_TTL_MS = 60_000\n/** A provider's id: `google`, `linkedin_oidc`, or one the workspace defined itself, `custom:<slug>`. */\nconst PROVIDER_ID = /^(custom:)?[a-z0-9_-]{1,40}$/\n\n/** The provider named in a route, as written or percent-encoded (`custom%3Aacme`). */\nfunction providerIn(segment: string): string {\n  try {\n    return decodeURIComponent(segment)\n  } catch {\n    return ''\n  }\n}\n\n/** What `resolve` answers: who is there, and the cookies that must go back. */\nexport interface Resolved {\n  session: Session | null\n  status: SessionStatus\n  /** `Set-Cookie` values to send with the response. Empty when nothing changed. */\n  cookies: string[]\n}\n\nexport interface Cauthy {\n  /** Serves the routes under `basePath`: login, callback, session, refresh, logout, account. */\n  handler(request: Request): Promise<Response>\n  /**\n   * Who the application is. On CAUTHY_KEY, Cauthy's answer to\n   * `GET /v1/connect/self`, waited for: it rejects with `CauthyApiError`\n   * `503 misconfigured` when Cauthy refuses the key. Otherwise what is\n   * configured, at once (`key: null`). Await it at startup to fail early.\n   */\n  ready(): Promise<Identity>\n  /**\n   * Checks that this handler is what answers under `basePath` in the running\n   * application, and throws `CauthyConfigError` naming the route when another\n   * one does. Call it once at startup: with the origin after the server\n   * listens (`'http://localhost:3000'`), or with a function that serves a\n   * request in process (Hono's `app.fetch`; `checkFastifyMount` for\n   * Fastify). Nothing it sends reaches Cauthy.\n   */\n  checkMount(target: MountTarget): Promise<void>\n  /**\n   * Who is signed in, or null.\n   *\n   * Give it the response's headers and a session that needs renewing is\n   * renewed on the spot, its new cookie added to them. Without them an\n   * expired session reads as null (see `status`): renewing changes the\n   * cookie, and a cookie nobody sends back is a session lost.\n   */\n  getSession(request: Request, responseHeaders?: Headers): Promise<Session | null>\n  /** Whether somebody is signed in, nobody is, or the session must be renewed first. */\n  status(request: Request): Promise<SessionStatus>\n  /**\n   * The session, renewed when it has to be, and the cookies to send back.\n   * The caller MUST send `cookies` with its response.\n   */\n  resolve(request: Request): Promise<Resolved>\n  /**\n   * For a route only a signed-in person may see: the session, or the response\n   * to give instead — a redirect to sign in (or to renew) for a page, a 401\n   * for anything else.\n   */\n  protect(request: Request): Promise<{ session: Session; response?: undefined } | { session?: undefined; response: Response }>\n  /** The organizations the person belongs to (of `system`, when set), with their role in each. */\n  organizations(session: Session): Promise<SessionOrganization[]>\n  /**\n   * Asks Cauthy whether the signed-in person may do an action on a resource\n   * in an organization, with what its conditions read (`attributes`, whose\n   * the record is). It is how a permission with a condition is decided —\n   * `can` never counts those — and it decides any other the same way.\n   *\n   *   const r = await auth.check(request, { organization, resource: 'invoices', action: 'approve', attributes: { amount: 500 } })\n   *   if (!r.allowed) return forbidden(r.reason)\n   *\n   * Nobody signed in, an organization the person is not in, or a disabled\n   * account answer `allowed: false`. A request whose session must be renewed\n   * first reads as nobody signed in: give it the `Session` from\n   * `getSession(request, responseHeaders)` instead. Throws `CauthyApiError`\n   * when Cauthy refuses the question itself (a malformed one) or cannot be reached.\n   */\n  check(who: Request | Session, question: CheckQuestion & { organization: OrganizationRef }): Promise<CheckResult>\n  /**\n   * Verifies a webhook delivery from Cauthy and answers the event it carries;\n   * throws `CauthyWebhookError` for anything else. No secret is involved: the\n   * delivery is signed with Cauthy's own key.\n   */\n  webhook(request: Request, options?: Pick<VerifyWebhookOptions, 'jwks' | 'now' | 'url'>): Promise<CauthyEvent>\n  /**\n   * Verifies a Cauthy access token (or a request's `Authorization: Bearer`) for\n   * an API of this application: `verifyToken` with this instance's issuer, its\n   * workspace (by contract, the link's `tenant_id`; otherwise `tenantId` or\n   * `CAUTHY_TENANT_ID`) and its audience (`audience` or `CAUTHY_AUDIENCE`).\n   * By contract it also refuses a person's token issued through another\n   * client than the link's (`wrong_client`).\n   */\n  verifyToken(from: string | Request | Headers, options?: Partial<VerifyTokenOptions>): Promise<TokenIdentity>\n  /** The same, built once: throws `CauthyConfigError` now if the audience or the workspace is missing. */\n  tokenVerifier(options?: Partial<VerifyTokenOptions>): (from: string | Request | Headers) => Promise<TokenIdentity>\n  /**\n   * The application acting on its own, with no person's token: its\n   * organizations, their members, invitations. Needs the client's secret, or\n   * `systemKey`.\n   */\n  system: CauthySystem\n  /**\n   * The application's contract, when it runs by one: what its link says,\n   * its own keys, and how it stands against its contract in Cauthy.\n   */\n  pact?: CauthyPact\n  /** What the browser may be told of a session. */\n  toPublic(session: Session): Promise<PublicSession>\n  /** Paths of this application that start a sign-in, a sign-out, or open the account page. */\n  urls: { signIn(returnTo?: string): string; signOut(): string; account(returnTo?: string): string; session: string }\n  options: Readonly<Required<Pick<CauthyOptions, 'issuer' | 'clientId' | 'basePath' | 'afterSignIn' | 'afterSignOut' | 'cookieName'>>>\n}\n\n/** A contracted application's view of its contract (`auth.pact`). */\nexport interface CauthyPact {\n  /** What its link in the graph says. */\n  contract: ResolvedContract\n  /** Its own keys: the one that signs, the ones published, rotating them. */\n  keys: PactKeys\n  /**\n   * The response for its jwks_url: the published keys. `handler` serves it\n   * at that path too, when the route reaches it.\n   */\n  jwks(): Promise<Response>\n  /** How it stands against its contract, as Cauthy checks it now. For a health endpoint. */\n  status(): Promise<PactStatus>\n}\n\nfunction env(name: string): string | undefined {\n  return typeof process !== 'undefined' ? process.env?.[name] : undefined\n}\n\nfunction hostOf(origin: string): string | undefined {\n  try { return new URL(origin).hostname } catch { return undefined }\n}\n\nfunction b64url(bytes: Uint8Array): string {\n  let s = ''\n  for (const b of bytes) s += String.fromCharCode(b)\n  return btoa(s).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')\n}\n\nfunction random(bytes = 32): string {\n  return b64url(crypto.getRandomValues(new Uint8Array(bytes)))\n}\n\n/**\n * A path of this application, and nothing else: never another site, never\n * `//host`. Browsers drop tabs and line breaks from a URL, so `/\\t/evil.test`\n * would become `//evil.test`: control characters are refused outright, and\n * what is left must resolve to this origin.\n */\nfunction localPath(candidate: string | null | undefined, fallback: string): string {\n  if (!candidate || !candidate.startsWith('/') || candidate.startsWith('//') || candidate.includes('\\\\')) return fallback\n  // eslint-disable-next-line no-control-regex\n  if (/[\\u0000-\\u001f\\u007f]/.test(candidate)) return fallback\n  try {\n    if (new URL(candidate, 'http://x').origin !== 'http://x') return fallback\n  } catch {\n    return fallback\n  }\n  return candidate\n}\n\nfunction json(body: unknown, status = 200, headers?: Headers): Response {\n  const h = headers ?? new Headers()\n  h.set('content-type', 'application/json; charset=utf-8')\n  h.set('cache-control', 'no-store')\n  return new Response(JSON.stringify(body), { status, headers: h })\n}\n\nfunction redirect(location: string, cookies: string[] = []): Response {\n  const h = new Headers({ location, 'cache-control': 'no-store' })\n  for (const c of cookies) h.append('set-cookie', c)\n  return new Response(null, { status: 302, headers: h })\n}\n\n/** A permission with a condition, as Cauthy lists it with an organization. */\nfunction conditionalOf(c: any): ConditionalPermission {\n  return { resource: String(c?.resource ?? ''), action: String(c?.action ?? ''), effect: c?.effect === 'deny' ? 'deny' : 'allow' }\n}\n\n/** What an application on CAUTHY_KEY reads: the key, and the one it replaces while rotating. */\ninterface Keyed {\n  key: CauthyKey\n  previous?: CauthyKey\n  /** While moving off the variables: old sessions are read with it, never written. */\n  legacySecret?: string\n  /** While moving off PACT_ROOT_KEY: old sessions are read with it, and its RS256 keys stay published. */\n  legacyRoot?: string\n  /** PACT_ROOT_KEY_PREVIOUS, when a root rotation was still open: its sessions are read too. */\n  legacyRootPrevious?: string\n}\n\nfunction byKey(given: CauthyOptions): Keyed | undefined {\n  const text = given.key ?? env('CAUTHY_KEY')\n  if (text === undefined || text === '') return undefined\n  refuseBesideKey(typeof process !== 'undefined' ? process.env : undefined)\n  for (const [name, value] of [['issuer', given.issuer], ['clientId', given.clientId], ['clientSecret', given.clientSecret],\n    ['secret', given.secret], ['system', given.system], ['tenant', given.tenant], ['audience', given.audience], ['tenantId', given.tenantId],\n    ['systemKey', given.systemKey], ['rootKey', given.rootKey]] as const) {\n    if (value !== undefined) throw new CauthyConfigError(`with CAUTHY_KEY, ${name} comes from CAUTHY_KEY: do not pass it`)\n  }\n  const key = parseKey(text)\n  const prevText = given.keyPrevious ?? env('CAUTHY_KEY_PREVIOUS')\n  let previous: CauthyKey | undefined\n  if (prevText) {\n    try {\n      previous = parseKey(prevText)\n    } catch (e) {\n      if (e instanceof CauthyKeyError) throw new CauthyKeyError(e.reason, `CAUTHY_KEY_PREVIOUS is refused: ${e.message.replace(/^@cauthyhq\\/node: CAUTHY_KEY: /, '').replace(/ \\(key_[a-z_]+\\)$/, '')}`)\n      throw e\n    }\n  }\n  if (previous && (previous.issuer !== key.issuer || previous.clientId !== key.clientId)) {\n    throw new CauthyKeyError('key_previous_mismatch', 'CAUTHY_KEY_PREVIOUS names another Cauthy or client than CAUTHY_KEY')\n  }\n  // The two secrets of before, accepted beside the key only to read what they sealed.\n  const legacySecret = env('CAUTHY_SECRET') || undefined\n  const legacyRoot = env('PACT_ROOT_KEY') || undefined\n  const legacyRootPrevious = legacyRoot ? env('PACT_ROOT_KEY_PREVIOUS') || undefined : undefined\n  if (legacySecret) deprecated('CAUTHY_SECRET beside CAUTHY_KEY', 'It is read only for sessions made before the move: remove it after the rotation window.')\n  if (legacyRoot) deprecated('PACT_ROOT_KEY beside CAUTHY_KEY', 'It is read only for sessions made before the move: remove it, the keys option and its table after the rotation window.')\n  if (given.keys && !(legacyRoot && given.contract)) {\n    throw new CauthyConfigError('with CAUTHY_KEY the application keeps no key store: remove keys (it is read only beside PACT_ROOT_KEY and a contract, while moving)')\n  }\n  return { key, previous, legacySecret, legacyRoot, legacyRootPrevious }\n}\n\n/** A request from an origin the application did not register in Cauthy (CAUTHY_KEY). */\nclass UnknownOriginError extends Error {\n  constructor(readonly origin: string, readonly registered: string[]) {\n    super(`${origin} is not one of the application's addresses in Cauthy (${registered.join(', ') || 'none'}): add it on the application's card, or set baseURL`)\n  }\n}\n\n/**\n * A contract on top of CAUTHY_KEY (key/cauthy-key.md §8): the graph says who\n * the application is, the key proves it. The key must name the graph's Cauthy.\n */\nfunction contractOnKey(given: CauthyOptions, keyed: Keyed): ResolvedContract {\n  const contract = readContract(given.contract as NonNullable<CauthyOptions['contract']>)\n  if (contract.issuer !== keyed.key.issuer) {\n    throw new CauthyKeyError('key_contract_issuer', `the key names ${keyed.key.issuer}, and the contract's Cauthy is ${contract.issuer}: make the key in that Cauthy's dashboard`)\n  }\n  return contract\n}\n\n/** What a contracted application reads of its contract, its keys and its root key. */\nfunction byContract(given: CauthyOptions): { contract: ResolvedContract; root: string; previous?: string } {\n  // Fail closed: one source. Every variable of the standard mode is a second.\n  failClosed(typeof process !== 'undefined' ? process.env : undefined)\n  for (const [name, value] of [['clientId', given.clientId], ['clientSecret', given.clientSecret], ['secret', given.secret],\n    ['system', given.system], ['tenant', given.tenant], ['systemKey', given.systemKey]] as const) {\n    if (value !== undefined) throw new CauthyConfigError(`with a contract, ${name} comes from the contract: do not pass it`)\n  }\n  const contract = readContract(given.contract as NonNullable<CauthyOptions['contract']>)\n  const root = given.rootKey ?? env('PACT_ROOT_KEY') ?? ''\n  if (root === '') throw new CauthyConfigError('rootKey (PACT_ROOT_KEY) is required with a contract: 32 random bytes, e.g. openssl rand -base64 32')\n  if (contract.serviceClientId && !given.keys) {\n    throw new CauthyConfigError(`the link ${contract.link} gives ${contract.system} its own identity: pass keys, where its key is kept (@cauthyhq/node/keys)`)\n  }\n  deprecated('PACT_ROOT_KEY', 'Make the application\\'s CAUTHY_KEY in Cauthy\\'s dashboard (the application\\'s card), then remove PACT_ROOT_KEY, the keys option and its table.')\n  return { contract, root, previous: given.rootKeyPrevious ?? env('PACT_ROOT_KEY_PREVIOUS') }\n}\n\n/** requestHeader: 'warn' says so once per process, whatever number of Cauthy instances run in it. */\nlet toldOfHeader = false\n\n/** A session cookie no key opens is said once per process: people are being signed out. */\nlet toldOfUnopened = false\nfunction toldUnopened(): void {\n  if (toldOfUnopened) return\n  toldOfUnopened = true\n  console.warn('@cauthyhq/node: a session cookie arrived that no key of this application opens; it was cleared and the person is signed out. ' +\n    'Moving to CAUTHY_KEY, keep the secret that sealed the old sessions (CAUTHY_SECRET, or PACT_ROOT_KEY and PACT_ROOT_KEY_PREVIOUS) beside it for the rotation window; ' +\n    'rotating the key, set CAUTHY_KEY_PREVIOUS.')\n}\n\nexport function createCauthy(given: CauthyOptions = {}): Cauthy {\n  // CAUTHY_KEY first: with it, nothing else names Cauthy or the client.\n  const keyed = byKey(given)\n  const pacted = given.contract && !keyed ? byContract(given) : undefined\n  const contract = keyed && given.contract ? contractOnKey(given, keyed) : pacted?.contract\n  // The client people sign in with: the contract's (public) or the key's.\n  const issuer = withoutTrailingSlashes(keyed?.key.issuer ?? given.issuer ?? contract?.issuer ?? env('CAUTHY_ISSUER') ?? '')\n  const clientId = contract?.clientId ?? keyed?.key.clientId ?? given.clientId ?? env('CAUTHY_CLIENT_ID') ?? ''\n  const clientSecret = contract || keyed ? undefined : given.clientSecret ?? env('CAUTHY_CLIENT_SECRET')\n  const secret = contract || keyed ? '' : given.secret ?? env('CAUTHY_SECRET') ?? ''\n  // On CAUTHY_KEY without a contract the workspace and the system are Cauthy's answer (identity below).\n  const askSelf = keyed !== undefined && contract === undefined\n  const system = askSelf ? '' : contract?.system ?? given.system ?? env('CAUTHY_SYSTEM') ?? ''\n  const tenant = askSelf ? '' : contract?.tenant ?? given.tenant ?? env('CAUTHY_TENANT') ?? ''\n  if (!/^https?:\\/\\//.test(issuer)) throw new CauthyConfigError('issuer (CAUTHY_ISSUER) must be Cauthy\\'s address, e.g. https://id.example.com')\n  if (clientId === '') throw new CauthyConfigError('clientId (CAUTHY_CLIENT_ID) is required')\n  if (!contract && !keyed && secret.length < 32) throw new CauthyConfigError('secret (CAUTHY_SECRET) must be at least 32 characters: it encrypts the session cookie')\n  // The keys the cookies are sealed with. On CAUTHY_KEY, and by contract, one\n  // per job, derived from the key's secret or the root key; otherwise the one\n  // CAUTHY_SECRET stands for.\n  const fromKey: KeyDerived | undefined = keyed ? deriveFromKey(keyed.key, keyed.previous) : undefined\n  let signingKid: string | undefined\n  fromKey?.signer.then(s => { signingKid = s.kid }, () => undefined)\n  const derived = pacted ? deriveKeys(pacted.root, pacted.previous) : undefined\n  const single: Promise<KeyRing> | undefined = derived || fromKey ? undefined : keyOf(secret).then(k => [k])\n  // Beside the key while moving: what CAUTHY_SECRET or PACT_ROOT_KEY (and\n  // PACT_ROOT_KEY_PREVIOUS, a root rotation still open) sealed is still read,\n  // after the key's own entries. Writing always uses entry 0, the key's.\n  const legacyRings = keyed?.legacyRoot ? deriveKeys(keyed.legacyRoot, keyed.legacyRootPrevious) : undefined\n  const legacySingle = keyed?.legacySecret ? keyOf(keyed.legacySecret) : undefined\n  const withLegacy = async (own: Promise<KeyRing>, purpose: 'cookie' | 'flow'): Promise<KeyRing> => [\n    ...(await own),\n    ...(legacyRings ? await legacyRings[purpose] : []),\n    ...(legacySingle ? [await legacySingle] : []),\n  ]\n  const cookieKeys = (fromKey ? withLegacy(fromKey.cookie, 'cookie') : derived?.cookie ?? single) as Promise<KeyRing>\n  const flowKeys = (fromKey ? withLegacy(fromKey.flow, 'flow') : derived?.flow ?? single) as Promise<KeyRing>\n  // Applications on the variables of 1.1 are told once where to go.\n  if (!keyed && !pacted) {\n    deprecated('Configuring with CAUTHY_ISSUER, CAUTHY_CLIENT_ID, CAUTHY_CLIENT_SECRET, CAUTHY_SECRET and the other CAUTHY_* variables (or their options)',\n      'Connect the application in Cauthy\\'s dashboard and use the one variable CAUTHY_KEY.')\n  }\n  // The RS256 keys of PACT_ROOT_KEY's store: by contract; on CAUTHY_KEY only while moving, published beside the key's.\n  const ownKeys = derived && given.keys ? pactKeys(given.keys, derived.seal)\n    : legacyRings && contract && given.keys ? pactKeys(given.keys, legacyRings.seal) : undefined\n  const baseURL = given.baseURL ?? (keyed ? undefined : env('CAUTHY_BASE_URL'))\n  if (baseURL !== undefined && baseURL !== '' && !/^https?:\\/\\/[^/]+\\/*$/.test(baseURL)) {\n    throw new CauthyConfigError('baseURL (CAUTHY_BASE_URL) must be the application\\'s public origin, e.g. https://app.example.com')\n  }\n\n  const basePath = '/' + (given.basePath ?? '/api/auth').replace(/^\\/+|\\/+$/g, '')\n  const requestHeader = given.requestHeader ?? 'required'\n  if (requestHeader !== 'required' && requestHeader !== 'warn') throw new CauthyConfigError(\"requestHeader must be 'required' or 'warn'\")\n  const afterSignIn = localPath(given.afterSignIn, '/')\n  const afterSignOut = localPath(given.afterSignOut, '/')\n  const cookieName = given.cookieName ?? 'cauthy_session'\n  const flowCookie = `${cookieName}_flow`\n  const againCookie = `${cookieName}_again`\n  const stepCookie = `${cookieName}_step`\n  const systemTimeout = given.timeouts?.system ?? 2000\n  const requestTimeout = given.timeouts?.request ?? 5000\n  for (const [name, ms] of [['system', systemTimeout], ['request', requestTimeout]] as const) {\n    if (!Number.isFinite(ms) || ms <= 0) throw new CauthyConfigError(`timeouts.${name} must be a positive number of milliseconds`)\n  }\n  // Every call to Cauthy has a deadline; for the event stream it covers the\n  // first response only, and the page that goes away ends the rest.\n  const doFetch = deadline(given.fetch, requestTimeout)\n  const iconOf = iconFor(issuer)\n  const pages = {\n    signIn: given.pages?.signIn ? localPath(given.pages.signIn, '/') : undefined,\n    resetPassword: given.pages?.resetPassword ? localPath(given.pages.resetPassword, '/') : undefined,\n    verifyEmail: given.pages?.verifyEmail ? localPath(given.pages.verifyEmail, '/') : undefined,\n    acceptInvite: given.pages?.acceptInvite ? localPath(given.pages.acceptInvite, '/') : undefined,\n  }\n  // The application acting on its own has no request to read its origin\n  // from: its invitations open the application's page only when it was told\n  // its public origin.\n  const acceptInviteUrl = baseURL && pages.acceptInvite ? `${withoutTrailingSlashes(baseURL)}${pages.acceptInvite}` : undefined\n  const ownSystem = createSystem({ issuer, clientId, clientSecret, key: given.systemKey, system: system || undefined, acceptInviteUrl, fetch: given.fetch, timeoutMs: systemTimeout,\n    ...(ownKeys ? { keys: ownKeys, keysClientId: contract?.serviceClientId } : {}),\n    // With a contract the key proves the link's service client; without, the key's own client.\n    ...(fromKey ? { signer: { clientId: contract ? contract.serviceClientId ?? keyed!.key.clientId : clientId, signer: fromKey.signer },\n      currentSystem: () => identity?.current()?.system ?? '' } : {}) })\n\n  // Who the application is, on CAUTHY_KEY: asked of Cauthy now, awaited by\n  // the first request (and by auth.ready()), revalidated every five minutes.\n  const selfOptions = () => ({ issuer, token: () => ownSystem.token(), fetch: deadline(given.fetch, requestTimeout), kid: () => signingKid,\n    log: (m: string) => console.error(`@cauthyhq/node: ${m}`) })\n  const identity: IdentityCache | undefined = askSelf\n    ? createIdentity({ issuer, token: () => ownSystem.token(), fetch: deadline(given.fetch, requestTimeout), kid: () => signingKid,\n      log: m => console.error(`@cauthyhq/node: ${m}`) })\n    : undefined\n  identity?.ready().catch(() => { /* answered per request: 503 unavailable or misconfigured */ })\n  const tenantNow = () => identity?.current()?.tenant.slug ?? tenant\n  const systemNow = () => identity?.current()?.system ?? system\n\n  // The application's public origin. Without baseURL it is the request's, with\n  // the scheme a TLS-terminating proxy (Railway, Fly, Render, a load balancer)\n  // says the browser used: the server itself only sees plain http.\n  const requestOrigin = (request: Request) => {\n    const url = new URL(request.url)\n    const proto = request.headers.get('x-forwarded-proto')?.split(',')[0]?.trim().toLowerCase()\n    return proto === 'https' || proto === 'http' ? `${proto}://${url.host}` : url.origin\n  }\n  // On CAUTHY_KEY the request's origin counts only when it is one the\n  // application registered in Cauthy (app_urls); else the only one there is;\n  // else the request is refused (400 unknown_origin).\n  const originOf = (request: Request) => {\n    if (baseURL) return withoutTrailingSlashes(baseURL)\n    const asked = requestOrigin(request)\n    if (!identity) return asked\n    const urls = identity.current()?.app_urls ?? []\n    if (urls.includes(asked)) return asked\n    if (urls.length === 1) return urls[0]\n    throw new UnknownOriginError(asked, urls)\n  }\n  const safeOrigin = (request: Request) => {\n    try { return originOf(request) } catch { return requestOrigin(request) }\n  }\n  const attrs = (request: Request, maxAge?: number): CookieAttributes => ({ secure: safeOrigin(request).startsWith('https://'), maxAge })\n\n  // How the application proves itself at the token and revoke endpoints: on\n  // CAUTHY_KEY a fresh Ed25519 assertion per call, never a secret.\n  // With a contract people sign in through the link's public client: nothing to prove there.\n  async function clientAuth(form: URLSearchParams): Promise<URLSearchParams> {\n    if (fromKey && !contract) {\n      const s = await fromKey.signer\n      form.set('client_assertion_type', ASSERTION_TYPE)\n      form.set('client_assertion', await s.assertion(clientId, `${issuer}/v1/oauth/token`))\n    } else if (clientSecret) {\n      form.set('client_secret', clientSecret)\n    }\n    return form\n  }\n\n  // ── Talking to Cauthy ────────────────────────────────────────────────────\n\n  // `proof`: the system's own headers (passedOn), sent on a code exchange — a\n  // contract may ask for them (require_system_proof), so a copied client id\n  // is no use on its own.\n  async function token(form: Record<string, string>, proof: Record<string, string> = {}): Promise<{ ok: true; body: any } | { ok: false; ended: boolean; code?: string }> {\n    const body = await clientAuth(new URLSearchParams({ client_id: clientId, ...form }))\n    try {\n      const res = await doFetch(`${issuer}/v1/oauth/token`, {\n        method: 'POST',\n        headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json', ...proof },\n        body,\n      })\n      if (res.ok) return { ok: true, body: await res.json() }\n      // 4xx is Cauthy's answer: the grant is no good. Anything else is a\n      // failure to ask, and says nothing about the session.\n      // Cauthy names why, as an OAuth error (RFC 6749 §5.2) with an extension code.\n      const why = (await res.json().catch(() => null)) as { error?: unknown } | null\n      return { ok: false, ended: res.status >= 400 && res.status < 500, ...(typeof why?.error === 'string' ? { code: why.error } : {}) }\n    } catch {\n      return { ok: false, ended: false }\n    }\n  }\n\n  async function userinfo(accessToken: string): Promise<{ u: SessionUser; tid: string; roles: string[] } | null> {\n    try {\n      const res = await doFetch(`${issuer}/v1/oauth/userinfo`, { headers: { authorization: `Bearer ${accessToken}` } })\n      if (!res.ok) return null\n      const b = (await res.json()) as Record<string, any>\n      return {\n        tid: String(b.tid ?? ''),\n        roles: Array.isArray(b.roles) ? b.roles.filter((r: unknown) => typeof r === 'string') : [],\n        u: {\n          id: String(b.sub ?? ''),\n          email: String(b.email ?? ''),\n          name: String(b.name ?? ''),\n          emailVerified: b.email_verified === true,\n          restricted: b.restricted === true,\n          ...(typeof b.email_verify_by === 'string' ? { emailVerifyBy: b.email_verify_by } : {}),\n          ...(typeof b.locale === 'string' && b.locale !== '' ? { locale: b.locale } : {}),\n          ...(b.anonymous === true ? { isAnonymous: true } : {}),\n        },\n      }\n    } catch {\n      return null\n    }\n  }\n\n  /** Whether the session stays signed in: as Cauthy says, or as it was when an older Cauthy says nothing. */\n  const kindOf = (body: any, was?: Stored): { p?: 1 } =>\n    (typeof body?.persistent === 'boolean' ? body.persistent : was?.p === 1) ? { p: 1 } : {}\n\n  /** Best effort: tells Cauthy a refresh token is no longer wanted. */\n  async function revoke(refreshToken: string): Promise<void> {\n    const form = await clientAuth(new URLSearchParams({ client_id: clientId, token: refreshToken }))\n    await doFetch(`${issuer}/v1/oauth/revoke`, { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: form }).catch(() => undefined)\n  }\n\n  /**\n   * A link that requires a verified address lets nobody in on a token whose\n   * person has not confirmed it, whatever Cauthy issued. The token itself\n   * does not say (verification/rules.md), so this reads the user it came with.\n   */\n  const unverified = (u: SessionUser) => contract?.requireVerifiedEmail === true && !u.emailVerified\n\n  /** What Cauthy's answer to a token request becomes in the cookie. */\n  async function stored(body: any, was?: Stored): Promise<Stored | null> {\n    if (typeof body?.access_token !== 'string' || typeof body?.refresh_token !== 'string') return null\n    const who = await userinfo(body.access_token)\n    if (who === null || who.u.id === '') return null\n    if (unverified(who.u)) {\n      // Cauthy just issued these tokens: the session they would have started never begins.\n      await revoke(body.refresh_token)\n      throw new CauthyApiError(403, 'email_not_confirmed', 'Confirm your email address first.')\n    }\n    const lifetime = typeof body.expires_in === 'number' && body.expires_in > 0 ? body.expires_in : 300\n    return { at: body.access_token, rt: body.refresh_token, exp: Math.floor(Date.now() / 1000) + lifetime, ...who, ...kindOf(body, was) }\n  }\n\n  function toSession(s: Stored): Session {\n    return { user: s.u, tenantId: s.tid, roles: s.roles, accessToken: s.at, expiresAt: new Date(s.exp * 1000).toISOString() }\n  }\n\n  // ── The cookie ───────────────────────────────────────────────────────────\n\n  // `stale`: opened by a key that only reads (CAUTHY_KEY_PREVIOUS, or the\n  // CAUTHY_SECRET / PACT_ROOT_KEY of before the move), so it is sealed again\n  // with the current key on the first answer that can carry a cookie.\n  async function read(request: Request): Promise<{ had: Map<string, string>; value: Stored | null; present: boolean; stale: boolean }> {\n    const had = readCookies(request.headers.get('cookie'))\n    const raw = readParts(had, cookieName)\n    if (raw === null) return { had, value: null, present: false, stale: false }\n    const opened = await unsealIndexed<Stored>(raw, await cookieKeys)\n    const value = opened?.value ?? null\n    const sound = value !== null && typeof value.at === 'string' && typeof value.rt === 'string' && typeof value.exp === 'number'\n    return { had, value: sound ? value : null, present: true, stale: sound && opened!.index > 0 }\n  }\n\n  async function write(request: Request, s: Stored, had: Map<string, string>): Promise<string[]> {\n    return writeParts(cookieName, await seal(s, (await cookieKeys)[0]), attrs(request, s.p === 1 ? PERSISTENT_SECONDS : undefined), had)\n  }\n\n  const fresh = (s: Stored) => s.exp - Date.now() / 1000 > SKEW_SECONDS\n\n  // One renewal per refresh token at a time in this process: requests that\n  // arrive together share it. (Across processes Cauthy gives a few seconds'\n  // grace to the same token, for the same reason.)\n  const renewing = new Map<string, Promise<Stored | 'ended' | 'unreachable'>>()\n\n  function renew(was: Stored): Promise<Stored | 'ended' | 'unreachable'> {\n    let running = renewing.get(was.rt)\n    if (running === undefined) {\n      const rt = was.rt\n      running = (async (): Promise<Stored | 'ended' | 'unreachable'> => {\n        const res = await token({ grant_type: 'refresh_token', refresh_token: rt })\n        if (!res.ok) return res.ended ? 'ended' : 'unreachable'\n        let next: Stored | null\n        try {\n          next = await stored(res.body, was)\n        } catch (err) {\n          if (err instanceof CauthyApiError && err.code === 'email_not_confirmed') return 'ended'\n          throw err\n        }\n        if (next !== null) return next\n        // Renewed, but who it is could not be read just now. The new tokens\n        // are kept all the same — the old refresh token is spent, and losing\n        // its successor would lose the session — with what was known before.\n        if (typeof res.body?.access_token !== 'string' || typeof res.body?.refresh_token !== 'string') return 'unreachable'\n        const lifetime = typeof res.body.expires_in === 'number' && res.body.expires_in > 0 ? res.body.expires_in : 300\n        const { p: _, ...rest } = was\n        return { ...rest, at: res.body.access_token, rt: res.body.refresh_token, exp: Math.floor(Date.now() / 1000) + lifetime, ...kindOf(res.body, was) }\n      })()\n      renewing.set(rt, running)\n      // A renewal that worked is remembered for a moment, for requests still\n      // arriving with the old cookie; one that could not ask is tried again\n      // by the next request.\n      void running.then((result) => {\n        if (result === 'unreachable') return renewing.delete(rt)\n        const timer = setTimeout(() => renewing.delete(rt), 5_000)\n        ;(timer as { unref?: () => void }).unref?.()\n      })\n    }\n    return running\n  }\n\n  async function resolve(request: Request): Promise<Resolved> {\n    const { had, value, present, stale } = await read(request)\n    if (value === null) {\n      // A cookie this key did not make (a rotated secret, a tampered value) is cleared.\n      if (present) toldUnopened()\n      return { session: null, status: 'unauthenticated', cookies: present ? clearParts(cookieName, attrs(request, 0), had) : [] }\n    }\n    // A session made before the link required a verified address does not outlive the requirement.\n    if (unverified(value.u)) return { session: null, status: 'unauthenticated', cookies: clearParts(cookieName, attrs(request, 0), had) }\n    // Sealed with a key that only reads: sealed again now with the current\n    // one, so the session outlives the removal of the old secret.\n    if (fresh(value)) return { session: toSession(value), status: 'authenticated', cookies: stale ? await write(request, value, had) : [] }\n\n    const renewed = await renew(value)\n    if (renewed === 'ended') {\n      return { session: null, status: 'unauthenticated', cookies: clearParts(cookieName, attrs(request, 0), had) }\n    }\n    // Cauthy could not be asked: the cookie stays as it is, and the next\n    // request tries again. Nobody is let in on an expired token meanwhile.\n    if (renewed === 'unreachable') return { session: null, status: 'expired', cookies: [] }\n    return { session: toSession(renewed), status: 'authenticated', cookies: await write(request, renewed, had) }\n  }\n\n  async function getSession(request: Request, responseHeaders?: Headers): Promise<Session | null> {\n    if (responseHeaders === undefined) {\n      const { value } = await read(request)\n      return value !== null && fresh(value) && !unverified(value.u) ? toSession(value) : null\n    }\n    const r = await resolve(request)\n    for (const c of r.cookies) responseHeaders.append('set-cookie', c)\n    return r.session\n  }\n\n  async function status(request: Request): Promise<SessionStatus> {\n    const { value } = await read(request)\n    if (value === null || unverified(value.u)) return 'unauthenticated'\n    return fresh(value) ? 'authenticated' : 'expired'\n  }\n\n  // ── Organizations ────────────────────────────────────────────────────────\n\n  const orgCache = new Map<string, { at: number; value: SessionOrganization[] }>()\n\n  async function organizations(session: Session): Promise<SessionOrganization[]> {\n    const hit = orgCache.get(session.accessToken)\n    if (hit && Date.now() - hit.at < ORGANIZATIONS_TTL_MS) return hit.value\n    const sys = systemNow()\n    const url = `${issuer}/v1/oauth/organizations${sys ? `?system=${encodeURIComponent(sys)}` : ''}`\n    const res = await doFetch(url, { headers: { authorization: `Bearer ${session.accessToken}` } })\n    if (!res.ok) throw new Error(`@cauthyhq/node: reading organizations: ${res.status}`)\n    const body = (await res.json()) as { data?: Record<string, any>[] }\n    const value = (body.data ?? []).map(\n      (o): SessionOrganization => ({\n        id: String(o.id),\n        system: String(o.system ?? ''),\n        name: String(o.name ?? ''),\n        kind: String(o.kind ?? ''),\n        role: String(o.role ?? ''),\n        metadata: (o.metadata as Record<string, JsonValue>) ?? {},\n        ...(o.external_id ? { externalId: String(o.external_id) } : {}),\n        ...(Array.isArray(o.permissions)\n          ? { permissions: o.permissions.map(String), denied: Array.isArray(o.denied) ? o.denied.map(String) : [], conditional: Array.isArray(o.conditional) ? o.conditional.map(conditionalOf) : [] }\n          : {}),\n      }),\n    )\n    if (orgCache.size > 5_000) orgCache.clear()\n    orgCache.set(session.accessToken, { at: Date.now(), value })\n    return value\n  }\n\n  // ── Asking Cauthy ────────────────────────────────────────────────────────\n\n  /** Cauthy's decision for the person whose token this is; refusals about the person are a no. */\n  async function decide(token: string, question: CheckQuestion & { organization: OrganizationRef }): Promise<CheckResult> {\n    const org = organizationIdOf(question.organization)\n    if (org === '') return { allowed: false, reason: 'no organization named' }\n    const res = await doFetch(`${issuer}/v1/oauth/organizations/${encodeURIComponent(org)}/check`, {\n      method: 'POST',\n      headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json', accept: 'application/json' },\n      body: JSON.stringify(checkWire(question)),\n    }).catch(() => null)\n    if (res === null) throw new CauthyApiError(503, 'unavailable', 'Cauthy could not be reached to check a permission')\n    const body = (await res.json().catch(() => null)) as { data?: unknown; errors?: { code?: string; message?: string }[] } | null\n    if (res.ok) return checkResultOf(body?.data)\n    const first = body?.errors?.[0]\n    // About the person, not the question: a token no longer good, an account\n    // disabled, an organization they are not in. Each is a plain no.\n    if (res.status === 401 || res.status === 403 || res.status === 404) {\n      return { allowed: false, reason: first?.message ?? (res.status === 401 ? 'not signed in' : res.status === 404 ? 'not a member of the organization' : 'refused') }\n    }\n    throw new CauthyApiError(res.status, first?.code ?? 'error', `Cauthy refused to check a permission (${res.status}): ${first?.message ?? res.statusText}`)\n  }\n\n  async function check(who: Request | Session, question: CheckQuestion & { organization: OrganizationRef }): Promise<CheckResult> {\n    // A Session carries its token; anything else is the request it rides on.\n    const session = 'accessToken' in who ? who : await getSession(who)\n    if (!session) return { allowed: false, reason: 'not signed in' }\n    return decide(session.accessToken, question)\n  }\n\n  // The application's own identity, as `auth.system`. A change it makes to who\n  // belongs where (a new member, a new role, an organization gone) empties the\n  // organizations read above: a person added a moment ago sees the\n  // organization on the next page, not a minute later.\n  const forgetting = <A extends unknown[], R>(fn: (...args: A) => Promise<R>) =>\n    async (...args: A): Promise<R> => {\n      const out = await fn(...args)\n      orgCache.clear()\n      return out\n    }\n  const systemThatRefreshes: CauthySystem = {\n    ...ownSystem,\n    organizations: {\n      ...ownSystem.organizations,\n      update: forgetting(ownSystem.organizations.update),\n      remove: forgetting(ownSystem.organizations.remove),\n    },\n    members: {\n      ...ownSystem.members,\n      add: forgetting(ownSystem.members.add),\n      setRole: forgetting(ownSystem.members.setRole),\n      remove: forgetting(ownSystem.members.remove),\n    },\n  }\n\n  async function toPublic(session: Session): Promise<PublicSession> {\n    let orgs: SessionOrganization[] = []\n    try {\n      orgs = await organizations(session)\n    } catch {\n      // The person is signed in all the same; their organizations come back on the next read.\n    }\n    return { user: session.user, tenantId: session.tenantId, roles: session.roles, organizations: orgs, expiresAt: session.expiresAt }\n  }\n\n  // ── Routes ───────────────────────────────────────────────────────────────\n\n  const urls = {\n    signIn: (returnTo?: string) => `${basePath}/login${returnTo ? `?return_to=${encodeURIComponent(returnTo)}` : ''}`,\n    signOut: () => `${basePath}/logout`,\n    account: (returnTo?: string) => `${basePath}/account${returnTo ? `?return_to=${encodeURIComponent(returnTo)}` : ''}`,\n    session: `${basePath}/session`,\n  }\n\n  async function login(request: Request, url: URL): Promise<Response> {\n    const flow: Flow = { state: random(), verifier: random(48), returnTo: localPath(url.searchParams.get('return_to'), afterSignIn) }\n    const challenge = b64url(new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(flow.verifier))))\n    const q = new URLSearchParams({\n      client_id: clientId,\n      redirect_uri: `${originOf(request)}${basePath}/callback`,\n      response_type: 'code',\n      state: flow.state,\n      code_challenge: challenge,\n      code_challenge_method: 'S256',\n    })\n    // What the application may ask of the sign-in page: to ask again, and a language.\n    const prompt = url.searchParams.get('prompt')\n    if (prompt === 'login' || prompt === 'none') q.set('prompt', prompt)\n    const locale = url.searchParams.get('locale') ?? url.searchParams.get('ui_locales')\n    if (locale && /^[a-zA-Z-]{2,10}$/.test(locale)) q.set('ui_locales', locale)\n    // An application whose own page cannot use the person's passkey sends\n    // them to Cauthy's for that step alone: a page that asks for the passkey\n    // and nothing else, and comes straight back.\n    let passkey = ''\n    if (url.searchParams.get('method') === 'passkey') {\n      q.set('method', 'passkey')\n      passkey = '#passkey' // what a Cauthy from before that page reads\n    }\n    return redirect(`${issuer}/v1/oauth/authorize?${q}${passkey}`, [\n      writeCookie(flowCookie, await seal(flow, (await flowKeys)[0]), attrs(request, FLOW_SECONDS)),\n    ])\n  }\n\n  function failed(request: Request, reason: string): Response {\n    const h = new Headers({ 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-store' })\n    h.append('set-cookie', writeCookie(flowCookie, '', attrs(request, 0)))\n    h.append('set-cookie', writeCookie(againCookie, '', attrs(request, 0)))\n    return new Response(`Sign-in could not be completed (${reason}). Go back and try again.`, { status: 400, headers: h })\n  }\n\n  async function callback(request: Request, url: URL): Promise<Response> {\n    const had = readCookies(request.headers.get('cookie'))\n    const sealed = had.get(flowCookie)\n    const flow = sealed ? await unsealAny<Flow>(sealed, await flowKeys) : null\n    // The answer must be to a question THIS browser asked: without that, a\n    // stranger's link could sign a person in to the stranger's account.\n    if (flow === null || url.searchParams.get('state') !== flow.state) {\n      // Not this browser's question — or its question was asked so long ago\n      // that it is forgotten: the page sat open, or the answer is to an older\n      // tab's. Nobody is signed in by it; the sign-in starts again, once. The\n      // person is still signed in at Cauthy, so they are not asked twice.\n      if (had.get(againCookie) === undefined) {\n        const back = flow?.returnTo ?? afterSignIn\n        return redirect(`${basePath}/login?return_to=${encodeURIComponent(back)}`, [writeCookie(againCookie, '1', attrs(request, AGAIN_SECONDS))])\n      }\n      return failed(request, 'state_mismatch')\n    }\n    const error = url.searchParams.get('error')\n    if (error !== null) {\n      // prompt=none and nobody signed in: not an error, just \"nobody\".\n      if (error === 'login_required') return redirect(flow.returnTo, [writeCookie(flowCookie, '', attrs(request, 0))])\n      // The person went back from Cauthy's page: to the sign-in they came from.\n      if (error === 'access_denied') {\n        const back = pages.signIn ?? flow.returnTo\n        return redirect(`${back}${back.includes('?') ? '&' : '?'}auth_error=cancelled`, [writeCookie(flowCookie, '', attrs(request, 0))])\n      }\n      return failed(request, error.slice(0, 60))\n    }\n    const code = url.searchParams.get('code')\n    if (!code) return failed(request, 'no_code')\n    const res = await token({\n      grant_type: 'authorization_code',\n      code,\n      redirect_uri: `${originOf(request)}${basePath}/callback`,\n      code_verifier: flow.verifier,\n    }, await passedOn(request))\n    // Back to the application's sign-in page with the reason, and the question forgotten.\n    const unconfirmed = () => {\n      const page = pages.signIn ?? '/'\n      return redirect(`${page}${page.includes('?') ? '&' : '?'}auth_error=email_not_confirmed`,\n        [writeCookie(flowCookie, '', attrs(request, 0)), writeCookie(againCookie, '', attrs(request, 0))])\n    }\n    // Cauthy refuses at the token endpoint when the client requires a confirmed address…\n    if (!res.ok && res.code === 'email_not_confirmed') return unconfirmed()\n    let s: Stored | null\n    try {\n      s = res.ok ? await stored(res.body) : null\n    } catch (err) {\n      // …and this side checks too, should an older Cauthy not.\n      if (!(err instanceof CauthyApiError && err.code === 'email_not_confirmed')) throw err\n      return unconfirmed()\n    }\n    if (s === null) return failed(request, 'exchange_failed')\n    return redirect(flow.returnTo, [...(await write(request, s, had)), writeCookie(flowCookie, '', attrs(request, 0)), writeCookie(againCookie, '', attrs(request, 0))])\n  }\n\n  async function logout(request: Request): Promise<Response> {\n    const { had, value } = await read(request)\n    if (value !== null) {\n      // Best effort: the session is over here whether or not Cauthy heard.\n      const body = await clientAuth(new URLSearchParams({ client_id: clientId, token: value.rt }))\n      await doFetch(`${issuer}/v1/oauth/revoke`, {\n        method: 'POST',\n        headers: { 'content-type': 'application/x-www-form-urlencoded' },\n        body,\n      }).catch(() => undefined)\n      orgCache.delete(value.at)\n    }\n    // Then through Cauthy, which ends its own session in this browser too:\n    // otherwise the next \"sign in\" would walk straight back in.\n    const q = new URLSearchParams({ client_id: clientId, post_logout_redirect_uri: `${originOf(request)}${afterSignOut}` })\n    return redirect(`${issuer}/v1/oauth/logout?${q}`, clearParts(cookieName, attrs(request, 0), had))\n  }\n\n  // ── The application's own screens ────────────────────────────────────────\n  //\n  // The application draws its sign-in, with its own components; these routes\n  // do the work behind it. The browser talks to the application's server and\n  // to nobody else: the password goes from the form to here and from here to\n  // Cauthy, the tokens Cauthy answers with go into the same encrypted cookie\n  // as ever, and nothing the browser could keep is sent back to it.\n\n  /** How long a sign-in waits for its second step, or for a provider to answer. */\n  const STEP_SECONDS = 600\n  /** How long a passkey ceremony waits for the person: Cauthy's own limit. */\n  const PASSKEY_SECONDS = 300\n\n  /** How an account takes its second step, as Cauthy says it. */\n  const factorsOf = (d: any) => ({\n    totp: d?.totp === true,\n    phone: d?.phone ? { number: String(d.phone.number ?? ''), channel: String(d.phone.channel ?? 'sms') } : null,\n    phoneChannels: Array.isArray(d?.phone_channels) ? d.phone_channels.map(String) : [],\n  })\n\n  /** What the browser answered a passkey ceremony with, as JSON. */\n  const isCredential = (v: unknown): v is Record<string, unknown> =>\n    typeof v === 'object' && v !== null && !Array.isArray(v) && typeof (v as { id?: unknown }).id === 'string' && typeof (v as { response?: unknown }).response === 'object'\n\n  const passkeyOf = (d: any) => ({\n    id: String(d?.id ?? ''), name: String(d?.nickname ?? ''),\n    kind: ['security_key', 'synced', 'device'].includes(d?.kind) ? d.kind : 'unknown', createdAt: String(d?.created_at ?? ''), lastUsedAt: d?.last_used_at ? String(d.last_used_at) : null,\n  })\n\n  const UUID = /^[0-9a-f-]{36}$/i\n\n  /** An organization the person belongs to, with what they may do with it and its people. */\n  const seatOf = (d: any) => ({\n    id: String(d?.id ?? ''), system: String(d?.system ?? ''), name: String(d?.name ?? ''), kind: String(d?.kind ?? ''), role: String(d?.role ?? ''),\n    // A Cauthy from before a power says nothing of it: then it is not given.\n    can: {\n      readMembers: d?.can?.read_members === true, manageMembers: d?.can?.manage_members === true, removeMembers: d?.can?.remove_members === true,\n      update: d?.can?.update === true, archive: d?.can?.archive === true, delete: d?.can?.delete === true,\n    },\n  })\n  /** A person of an organization, as a member who may see them reads it. */\n  const orgMemberOf = (d: any) => ({\n    userId: String(d?.user_id ?? ''), email: String(d?.email ?? ''), name: String(d?.name ?? ''), role: String(d?.role ?? ''),\n    status: String(d?.status ?? ''), invited: d?.invited === true, manager: d?.manager === true, you: d?.you === true, since: String(d?.since ?? ''),\n  })\n  /** A role of the organization's system that a member may give. */\n  const orgRoleOf = (d: any) => ({\n    role: String(d?.role ?? ''), name: String(d?.name ?? ''), description: String(d?.description ?? ''), manager: d?.manager === true,\n  })\n\n  /** An AI agent the person connected, as Cauthy says it. */\n  const agentOf = (d: any) => ({\n    id: String(d?.id ?? ''),\n    name: String(d?.agent?.name ?? ''),\n    redirectHost: String(d?.agent?.redirect_host ?? ''),\n    resource: { name: String(d?.resource?.name ?? ''), uri: String(d?.resource?.uri ?? '') },\n    scopes: Array.isArray(d?.scopes) ? d.scopes.map((s: any) => ({ name: String(s?.name ?? ''), description: String(s?.description ?? '') })) : [],\n    connectedAt: String(d?.created_at ?? ''),\n    lastUsedAt: String(d?.last_used_at ?? ''),\n  })\n\n  interface Step {\n    /** `mfa`: Cauthy asked for a code. `social`: a provider is answering. `link`: a provider is answering to be linked to the signed-in account. `passkey`/`enrol`: a passkey ceremony is under way on the page. `sso`: the person's company is answering; `token` is the PKCE verifier. */\n    kind: 'mfa' | 'social' | 'code' | 'link' | 'passkey' | 'enrol' | 'sso' | 'upgrade'\n    token: string\n    provider?: string\n    returnTo: string\n    /** The person asked to stay signed in: every call of the sign-in says so to Cauthy. */\n    remember?: boolean\n  }\n\n  /** A form's yes: true, \"1\" or \"on\". */\n  const wants = (v: unknown) => v === true || v === '1' || v === 'on' || v === 'true'\n\n  const problem = (status: number, code: string, message: string, field?: string, headers?: Headers, reasons?: string[]) =>\n    json({ error: { code, message, ...(field ? { field } : {}), ...(reasons && reasons.length > 0 ? { reasons } : {}) } }, status, headers)\n\n  const invalid = (p: FieldProblem) => problem(400, p.code, p.message, p.field)\n\n  let explained = false\n\n  /**\n   * A mutation carries X-Cauthy-Request: 1, which another site cannot add\n   * without CORS: the answer to send instead, or null when it may go on.\n   */\n  function withoutRequestHeader(request: Request, route: string): Response | null {\n    if (request.headers.get('x-cauthy-request') === '1') return null\n    if (requestHeader === 'warn') {\n      if (!toldOfHeader) {\n        toldOfHeader = true\n        console.warn(`@cauthyhq/node: POST ${basePath}${route} arrived without X-Cauthy-Request: 1 and was let through (requestHeader: 'warn'). ` +\n          'Update the browser to cauthy-auth 0.43 or @cauthyhq/js, then remove requestHeader.')\n      }\n      return null\n    }\n    return problem(403, 'csrf_required', 'This request did not come from this application\\'s own client.')\n  }\n\n  /** A request this application's own page made: never another site's form. */\n  function ownRequest(request: Request): boolean {\n    const origin = request.headers.get('origin')\n    if (origin !== null) {\n      const own = originOf(request)\n      if (origin === own || origin === new URL(request.url).origin) return true\n      // The same host on another scheme or port is this application seen\n      // through a proxy, not another site: say so once, where it can be fixed.\n      if (!explained && hostOf(origin) === new URL(own).hostname) {\n        explained = true\n        console.warn(`@cauthyhq/node: refused a request from ${origin} as cross_site: this application sees itself as ${own}. ` +\n          'Behind a proxy? Set CAUTHY_BASE_URL (or baseURL) to the public origin.')\n      }\n      return false\n    }\n    // No Origin: a browser sends one on every cross-site POST, so this is a\n    // same-origin form of an old browser, or not a browser at all.\n    return (request.headers.get('sec-fetch-site') ?? 'same-origin') === 'same-origin'\n  }\n\n  async function body(request: Request): Promise<Record<string, unknown> | null> {\n    if (!(request.headers.get('content-type') ?? '').includes('application/json')) return null\n    try {\n      const b = (await request.json()) as unknown\n      return typeof b === 'object' && b !== null && !Array.isArray(b) ? (b as Record<string, unknown>) : null\n    } catch {\n      return null\n    }\n  }\n\n  // Every person signing in here reaches Cauthy from this server's address.\n  // So the application says whose request it is passing on, and proves it is\n  // a system of the workspace with its own token: Cauthy believes the address\n  // from nobody else. The proof goes even when the address is unknown (no\n  // proxy in front, as in development): it also tells Cauthy which\n  // application signed the person in. An application that is no system\n  // passes nothing on.\n  // By default the address the last proxy wrote that is not the application's\n  // own network: a platform may put its own hop (127.0.0.1, 10.x) after it.\n  const clientIp = given.clientIp ?? ((request: Request) =>\n    request.headers.get('x-forwarded-for')?.split(',').map(a => a.trim()).reverse().find(a => a !== '' && !ownNetwork(a)))\n  let noProofUntil = 0\n  async function passedOn(request: Request): Promise<Record<string, string>> {\n    if (Date.now() < noProofUntil) return {}\n    const ip = clientIp(request)\n    try {\n      // The application's address too: a sign-in at a production one ticks\n      // its \"In production\" step in Cauthy's dashboard.\n      const proof = { 'x-cauthy-system-token': await ownSystem.token(), 'x-cauthy-app-origin': originOf(request) }\n      return ip ? { ...proof, 'x-cauthy-client-ip': ip } : proof\n    } catch {\n      // Not a system, or Cauthy is not answering: ask again shortly. Not\n      // long: a contract may ask for the proof on every sign-in.\n      noProofUntil = Date.now() + 30_000\n      return {}\n    }\n  }\n\n  /** Asks Cauthy's own API, as this workspace's application. */\n  async function ask(request: Request, method: string, path: string, payload?: unknown, page?: string, bearer?: string, remember = false): Promise<{ status: number; data: any; error?: { code: string; message: string; reasons?: string[] } }> {\n    try {\n      const res = await doFetch(`${issuer}${path}`, {\n        method,\n        headers: {\n          'x-tenant-key': tenantNow(),\n          accept: 'application/json',\n          // A link Cauthy mails opens the application's page for it when it\n          // has one; otherwise Cauthy's own. Either way in the reader's language.\n          ...(page ? { 'x-cauthy-link-to': `${originOf(request)}${page}` } : { 'x-cauthy-links': 'hosted' }),\n          // Whose request it is: what Cauthy mails goes in this application's\n          // name, under its logo.\n          ...(clientId ? { 'x-cauthy-client-id': clientId } : {}),\n          ...(await passedOn(request)),\n          ...(bearer ? { authorization: `Bearer ${bearer}` } : {}),\n          // The person asked to stay signed in: Cauthy keeps the session long if the client allows it.\n          ...(remember ? { 'x-cauthy-remember': '1' } : {}),\n          // The answer to the workspace's Turnstile challenge, from the\n          // person's browser: Cauthy checks it at the doors that ask for it.\n          ...(request.headers.get('x-cauthy-captcha') ? { 'x-captcha-token': request.headers.get('x-cauthy-captcha') as string } : {}),\n          ...(request.headers.get('accept-language') ? { 'accept-language': request.headers.get('accept-language') as string } : {}),\n          // The language the application says its person reads, over the browser's.\n          ...(request.headers.get('x-cauthy-locale') ? { 'x-cauthy-locale': request.headers.get('x-cauthy-locale') as string } : {}),\n          ...(request.headers.get('user-agent') ? { 'user-agent': request.headers.get('user-agent') as string } : {}),\n          ...(payload === undefined ? {} : { 'content-type': 'application/json' }),\n        },\n        body: payload === undefined ? undefined : JSON.stringify(payload),\n      })\n      const b = res.status === 204 || res.status === 202 ? null : ((await res.json().catch(() => null)) as any)\n      if (res.ok) return { status: res.status, data: b?.data ?? b }\n      const first = b?.errors?.[0]\n      // weak_password says which rules of the workspace's policy failed.\n      const reasons = Array.isArray(first?.meta?.reasons) ? (first.meta.reasons as unknown[]).map(String) : undefined\n      return { status: res.status, data: null, error: { code: String(first?.code ?? 'error'), message: String(first?.message ?? 'The request could not be completed.'), ...(reasons ? { reasons } : {}) } }\n    } catch {\n      return { status: 503, data: null, error: { code: 'unavailable', message: 'Sign-in is unavailable right now. Try again in a moment.' } }\n    }\n  }\n\n  const accountOf = (d: any) => ({\n    id: String(d?.id ?? ''), email: String(d?.email ?? ''), name: String(d?.name ?? ''),\n    emailVerified: d?.email_verified === true, hasPassword: d?.has_password === true, mfaEnabled: d?.mfa_enabled === true,\n  })\n\n  /**\n   * Who is signed in, for a route about their own account: their token, and\n   * the cookie to send back when the session had to be renewed. Nobody signed\n   * in gets the 401 to answer with.\n   */\n  async function signedInAs(request: Request): Promise<{ token: string; kept: Stored | null; headers: Headers } | { response: Response }> {\n    const r = await resolve(request)\n    const headers = new Headers()\n    for (const c of r.cookies) headers.append('set-cookie', c)\n    if (r.session === null) return { response: problem(401, 'unauthenticated', 'Sign in first.', undefined, headers) }\n    // `kept` is the session as the request's cookie holds it, or null when it\n    // was renewed just now: then the cookies above carry the new one.\n    return { token: r.session.accessToken, kept: r.cookies.length === 0 ? (await read(request)).value : null, headers }\n  }\n\n  /** Cauthy answered with tokens: the person is signed in here. */\n  async function signedIn(request: Request, tokens: any, extra: string[] = [], more: Record<string, unknown> = {}, was?: Stored): Promise<Response> {\n    const s = await stored(tokens, was)\n    if (s === null) return problem(502, 'unavailable', 'Sign-in is unavailable right now. Try again in a moment.')\n    const h = new Headers()\n    for (const c of [...(await write(request, s, readCookies(request.headers.get('cookie')))), ...extra]) h.append('set-cookie', c)\n    return json({ status: 'signed_in', session: await toPublic(toSession(s)), ...more }, 200, h)\n  }\n\n  /**\n   * Cauthy's answer to a sign-in with a password: the person is signed in, or\n   * the second step is asked for next. Then what proves the password was\n   * right stays here, sealed, and never reaches the page.\n   */\n  async function loggedIn(request: Request, data: any, remember = false): Promise<Response> {\n    if (data?.mfa_required === true) {\n      const step: Step = { kind: 'mfa', token: String(data.mfa_token ?? ''), returnTo: afterSignIn, ...(remember ? { remember } : {}) }\n      // By email: the account has no factor and a code was just mailed to it.\n      const how = data.mfa_method === 'email' ? { method: 'email' } : {}\n      return json({ status: 'mfa_required', ...how }, 200, new Headers({ 'set-cookie': writeCookie(stepCookie, await seal(step, (await flowKeys)[0]), attrs(request, STEP_SECONDS)) }))\n    }\n    return signedIn(request, data)\n  }\n\n  let lookCache: { until: number; look: Record<string, unknown> } | null = null\n\n  // The workspace's password policy, kept a minute like the look: what a new\n  // password is checked against here before it is sent. Cauthy checks it\n  // again, and alone knows whether a password was in a breach.\n  let policyCache: { until: number; policy: PasswordPolicy | null } | null = null\n  const keepPolicy = (settings: { data: any; error?: unknown }) => {\n    policyCache = { until: Date.now() + LOOK_TTL_MS, policy: settings.error || !settings.data?.password_policy ? null : passwordPolicyOf(settings.data.password_policy) }\n    return policyCache.policy\n  }\n  /** The workspace's password policy; null when Cauthy cannot say, and then only Cauthy checks. */\n  async function workspacePolicy(request: Request): Promise<PasswordPolicy | null> {\n    if (policyCache !== null && policyCache.until >= Date.now()) return policyCache.policy\n    return keepPolicy(await ask(request, 'GET', '/v1/auth/settings'))\n  }\n  /** A new password, checked here against the workspace's rule when it is known. */\n  async function newPasswordProblem(request: Request, value: unknown): Promise<FieldProblem | null> {\n    const policy = await workspacePolicy(request)\n    // Not known: only what no workspace accepts is refused here (8–128).\n    return checkNewPassword(value, policy ?? { min: 8, max: 128, requires: [], min_classes: 0, reject_breached: false })\n  }\n\n  async function ownRoute(request: Request, url: URL, route: string): Promise<Response | null> {\n    const post = request.method === 'POST'\n    const own = ['/sign-in/email', '/sign-in/mfa', '/sign-up/email', '/forgot-password', '/reset-password', '/verify-email', '/sign-in/magic-link', '/sign-in/magic-link/verify', '/sign-in/email-code', '/me', '/me/password', '/me/mfa/setup', '/me/mfa/verify', '/me/mfa/disable', '/me/mfa/recovery-codes', '/me/mfa/factors', '/me/mfa/phone', '/me/mfa/phone/verify', '/me/mfa/phone/remove', '/sign-in/mfa/methods', '/sign-in/mfa/send', '/sign-in/mfa/email', '/sign-in/mfa/push', '/sign-in/mfa/push/events', '/sign-in/mfa/push/finish', '/me/sessions', '/me/sessions/end', '/me/legal', '/me/legal/accept', '/me/email', '/me/identities', '/me/identities/unlink', '/sign-out', '/methods', '/look',\n      '/sign-in/passkey/begin', '/sign-in/passkey/finish', '/sign-in/google-one-tap/begin', '/sign-in/google-one-tap', '/me/passkeys', '/me/passkeys/add/begin', '/me/passkeys/add/finish', '/me/passkeys/remove', '/me/agents', '/me/agents/disconnect',\n      '/sign-in/anonymous', '/me/upgrade',\n      '/me/organizations', '/me/organizations/members', '/me/organizations/roles', '/me/organizations/members/add', '/me/organizations/members/role', '/me/organizations/members/remove', '/me/organizations/members/invite',\n      '/me/organizations/rename', '/me/organizations/archive', '/me/organizations/delete',\n      '/invitation', '/invitation/accept'].includes(route) ||\n      route.startsWith('/sign-in/social/') || route.startsWith('/callback/') || route.startsWith('/me/identities/link/') || route.startsWith('/me/upgrade/social/') ||\n      route === '/sign-in/sso' || route === '/sign-in/sso/discover' || route === '/sso/callback'\n    if (!own) return null\n    if (post) {\n      const refused = withoutRequestHeader(request, route)\n      if (refused) return refused\n    }\n    // Guest sessions and their upgrade leave the protocol in version 2.\n    if (route === '/sign-in/anonymous' || route === '/me/upgrade') deprecated(`POST ${route}`, 'Guest sessions leave the auth-bff protocol in version 2.')\n    if (route.startsWith('/me/upgrade/social/')) deprecated('GET /me/upgrade/social/{provider}', 'Guest sessions leave the auth-bff protocol in version 2.')\n    if (tenantNow() === '') {\n      return problem(500, 'not_configured', '@cauthyhq/node: tenant (CAUTHY_TENANT) is required for the application\\'s own sign-in screens')\n    }\n\n    // How the forms look, as a person set it in Cauthy's dashboard. Kept a\n    // minute: every form of every page reads it.\n    if (route === '/look' && !post) {\n      if (lookCache === null || lookCache.until < Date.now()) {\n        const res = await ask(request, 'GET', `/v1/auth/look/${encodeURIComponent(clientId)}`)\n        lookCache = { until: Date.now() + LOOK_TTL_MS, look: res.error ? {} : (res.data ?? {}) }\n      }\n      return json(lookCache.look)\n    }\n\n    // What the screen may offer: which providers, whether people may register.\n    if (route === '/methods' && !post) {\n      const [providers, settings, place, sso] = await Promise.all([\n        ask(request, 'GET', '/v1/auth/social/providers'),\n        ask(request, 'GET', '/v1/auth/settings'),\n        ask(request, 'GET', `/v1/auth/webauthn/place?origin=${encodeURIComponent(originOf(request))}`),\n        ask(request, 'GET', '/v1/auth/sso/connections'),\n      ])\n      const list = Array.isArray(providers.data) ? providers.data : []\n      const password = keepPolicy(settings)\n      // Passkeys the workspace turned off are offered nowhere: not the\n      // button, not the email field's autofill, not Cauthy's page.\n      const passkeys = settings.data?.allow_passkeys !== false\n      // Where the person uses a passkey: on this page, or on Cauthy's for that\n      // step alone. A Cauthy that cannot say yet has them on its page.\n      const here = passkeys && place.data?.here === true\n      return json({\n        providers: list.map((p: any) => ({ id: String(p.provider ?? p.id ?? ''), name: String(p.label ?? p.name ?? p.provider ?? ''), ...iconOf(p) })).filter((p: { id: string }) => p.id !== ''),\n        // Whether the workspace signs people in with a password at all. A\n        // Cauthy from before the setting says nothing of it: then it does.\n        passwordSignIn: settings.data?.allow_password !== false,\n        // The workspace's switch, and how the application's own system takes sign-ups.\n        signUp: settings.data?.allow_signup !== false && settings.data?.signup?.mode !== 'invite_only',\n        // The application's system makes an organization per sign-up: the form asks the company's name.\n        ...(settings.data?.signup?.organization?.ask === true\n          ? { organization: { ask: true, required: settings.data.signup.organization.required === true } }\n          : {}),\n        // Whether the person may ask to stay signed in: the client's choice in Cauthy.\n        ...(typeof settings.data?.persistent_sessions === 'boolean' ? { persistentSessions: settings.data.persistent_sessions } : {}),\n        // A sign-in link needs a page of the application to open.\n        magicLink: settings.data?.allow_magic_link === true && pages.signIn !== undefined,\n        passkey: passkeys && (place.error ? true : here || place.data?.on_cauthy === true),\n        passkeyHere: here,\n        passkeyOnCauthy: passkeys && (place.error ? true : place.data?.on_cauthy === true),\n        // A company's sign-in, found by the person's work address.\n        sso: Array.isArray(sso.data) && sso.data.some((c: any) => c?.discoverable === true),\n        // The terms a sign-up accepts and the consents it answers, when the workspace asks any.\n        ...(settings.data?.legal ? { legal: legalOf(settings.data.legal) } : {}),\n        ...(settings.data?.captcha_enabled === true && settings.data?.captcha_site_key ? { captchaSiteKey: String(settings.data.captcha_site_key) } : {}),\n        // What a new password must be: for the form to say it and check it.\n        ...(password ? { password } : {}),\n      })\n    }\n\n    // An invitation, read before the person chooses a password: who is invited\n    // to what. Reading it does not spend it.\n    if (route === '/invitation' && !post) {\n      const token = (url.searchParams.get('token') ?? '').trim()\n      if (token === '' || token.length > 512) return problem(422, 'invalid_token', 'This invitation is not valid, or it has expired.')\n      const res = await ask(request, 'GET', `/v1/auth/invitation?token=${encodeURIComponent(token)}`)\n      if (res.error) return problem(res.status, res.error.code, res.error.message)\n      const organization = typeof res.data?.organization === 'string' && res.data.organization !== '' ? { organization: res.data.organization } : {}\n      return json({ status: 'ok', invitation: { email: String(res.data?.email ?? ''), workspace: String(res.data?.workspace ?? ''), ...organization } })\n    }\n\n    // The person's company: to its IdP and back. Cauthy ends the flow on\n    // this site's page with a code, which only the browser holding the\n    // sealed PKCE verifier can trade for the session.\n    if (route === '/sign-in/sso' && !post) {\n      const returnTo = localPath(url.searchParams.get('return_to'), afterSignIn)\n      const failed = (code: string) => redirect(`${returnTo}${returnTo.includes('?') ? '&' : '?'}auth_error=${encodeURIComponent(code)}`)\n      const email = (url.searchParams.get('email') ?? '').trim()\n      const connection = (url.searchParams.get('connection') ?? '').trim()\n      if (email === '' && connection === '') return failed('sso_not_found')\n      const verifier = random(48)\n      const challenge = b64url(new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier))))\n      const callback = `${basePath}/sso/callback`\n      const remember = wants(url.searchParams.get('remember'))\n      const started = await ask(request, 'POST', '/v1/auth/sso/start', {\n        ...(connection ? { connection } : { email }),\n        redirect_uri: `${originOf(request)}${callback}`, code_challenge: challenge,\n      }, callback, undefined, remember)\n      if (started.error || typeof started.data?.redirect_url !== 'string') return failed(started.error?.code ?? 'sso_unavailable')\n      const step: Step = { kind: 'sso', token: verifier, returnTo, ...(remember ? { remember } : {}) }\n      return redirect(started.data.redirect_url, [writeCookie(stepCookie, await seal(step, (await flowKeys)[0]), attrs(request, STEP_SECONDS))])\n    }\n    if (route === '/sso/callback' && !post) {\n      const sealed = readCookies(request.headers.get('cookie')).get(stepCookie)\n      const step = sealed ? await unsealAny<Step>(sealed, await flowKeys) : null\n      const clear = writeCookie(stepCookie, '', attrs(request, 0))\n      const back = step?.returnTo ?? afterSignIn\n      const failedTo = (code: string) => redirect(`${back}${back.includes('?') ? '&' : '?'}auth_error=${encodeURIComponent(code)}`, [clear])\n      if (step === null || step.kind !== 'sso') return failedTo('state_mismatch')\n      const refused = url.searchParams.get('error')\n      if (refused) return failedTo(refused)\n      const code = url.searchParams.get('code')\n      if (!code) return failedTo('sso_failed')\n      const done = await ask(request, 'POST', '/v1/auth/sso/token', { code, redirect_uri: `${originOf(request)}${basePath}/sso/callback`, code_verifier: step.token }, undefined, undefined, step.remember === true)\n      if (done.error) return failedTo(done.error.code)\n      const s = await stored(done.data)\n      if (s === null) return failedTo('unavailable')\n      return redirect(back, [...(await write(request, s, readCookies(request.headers.get('cookie')))), clear])\n    }\n\n    // A provider: to it and back. The state is this browser's, kept sealed.\n    if (route.startsWith('/sign-in/social/') && !post) {\n      const provider = providerIn(route.slice('/sign-in/social/'.length))\n      if (!PROVIDER_ID.test(provider)) return new Response('Not found', { status: 404 })\n      const returnTo = localPath(url.searchParams.get('return_to'), afterSignIn)\n      const callback = `${basePath}/callback/${provider}`\n      // The callback is named as this client's page, so a provider that\n      // answers through Cauthy's relay (Apple) may return the browser to it.\n      const remember = wants(url.searchParams.get('remember'))\n      const started = await ask(request, 'GET', `/v1/auth/social/${provider}?redirect_uri=${encodeURIComponent(`${originOf(request)}${callback}`)}`, undefined, callback, undefined, remember)\n      if (started.error || typeof started.data?.redirect_url !== 'string') {\n        return redirect(`${returnTo}${returnTo.includes('?') ? '&' : '?'}auth_error=${encodeURIComponent(started.error?.code ?? 'provider_unavailable')}`)\n      }\n      const step: Step = { kind: 'social', token: String(started.data.state ?? ''), provider, returnTo, ...(remember ? { remember } : {}) }\n      return redirect(started.data.redirect_url, [writeCookie(stepCookie, await seal(step, (await flowKeys)[0]), attrs(request, STEP_SECONDS))])\n    }\n    if (route.startsWith('/callback/') && !post) {\n      const provider = providerIn(route.slice('/callback/'.length))\n      const sealed = readCookies(request.headers.get('cookie')).get(stepCookie)\n      const step = sealed ? await unsealAny<Step>(sealed, await flowKeys) : null\n      const clear = writeCookie(stepCookie, '', attrs(request, 0))\n      const back = step?.returnTo ?? afterSignIn\n      const failedTo = (code: string) => redirect(`${back}${back.includes('?') ? '&' : '?'}auth_error=${encodeURIComponent(code)}`, [clear])\n      // The answer must be to the question this browser asked of this provider.\n      if (step === null || (step.kind !== 'social' && step.kind !== 'link' && step.kind !== 'upgrade') || step.provider !== provider || url.searchParams.get('state') !== step.token) return failedTo('state_mismatch')\n      const code = url.searchParams.get('code')\n      if (!code) return failedTo(url.searchParams.get('error') === 'access_denied' ? 'cancelled' : 'provider_refused')\n      const q = new URLSearchParams({ code, state: step.token, redirect_uri: `${originOf(request)}${basePath}/callback/${provider}` })\n      if (step.kind === 'upgrade') {\n        // The guest is now the account of that address: its session from here on.\n        const mine = await signedInAs(request)\n        if ('response' in mine) return failedTo('unauthenticated')\n        const done = await ask(request, 'GET', `/v1/auth/anonymous/upgrade/${provider}/callback?${q}`, undefined, undefined, mine.token)\n        if (done.error) return failedTo(done.error.code)\n        const s = await stored(done.data, (await read(request)).value ?? undefined)\n        if (s === null) return failedTo('unavailable')\n        return redirect(back, [...(await write(request, s, readCookies(request.headers.get('cookie')))), clear])\n      }\n      if (step.kind === 'link') {\n        // Linked to the account signed in here, and back to where it was asked.\n        const mine = await signedInAs(request)\n        if ('response' in mine) return failedTo('unauthenticated')\n        const linked = await ask(request, 'GET', `/v1/auth/identities/${provider}/link/callback?${q}`, undefined, undefined, mine.token)\n        if (linked.error) return failedTo(linked.error.code)\n        const h = new Headers(mine.headers)\n        h.append('set-cookie', clear)\n        return redirect(`${back}${back.includes('?') ? '&' : '?'}linked=${encodeURIComponent(provider)}`, [...h.getSetCookie()])\n      }\n      const done = await ask(request, 'GET', `/v1/auth/social/${provider}/callback?${q}`, undefined, undefined, undefined, step.remember === true)\n      if (done.error) return failedTo(done.error.code)\n      const s = await stored(done.data)\n      if (s === null) return failedTo('unavailable')\n      return redirect(back, [...(await write(request, s, readCookies(request.headers.get('cookie')))), clear])\n    }\n\n    // A guest becoming the account of a provider's address: to it and back.\n    if (route.startsWith('/me/upgrade/social/') && !post) {\n      const provider = providerIn(route.slice('/me/upgrade/social/'.length))\n      if (!PROVIDER_ID.test(provider)) return new Response('Not found', { status: 404 })\n      const returnTo = localPath(url.searchParams.get('return_to'), afterSignIn)\n      const failed = (code: string) => redirect(`${returnTo}${returnTo.includes('?') ? '&' : '?'}auth_error=${encodeURIComponent(code)}`)\n      const mine = await signedInAs(request)\n      if ('response' in mine) return failed('unauthenticated')\n      const callback = `${basePath}/callback/${provider}`\n      const started = await ask(request, 'GET', `/v1/auth/anonymous/upgrade/${provider}?redirect_uri=${encodeURIComponent(`${originOf(request)}${callback}`)}`, undefined, callback, mine.token)\n      if (started.error || typeof started.data?.redirect_url !== 'string') return failed(started.error?.code ?? 'provider_unavailable')\n      const step: Step = { kind: 'upgrade', token: String(started.data.state ?? ''), provider, returnTo }\n      return redirect(started.data.redirect_url, [...mine.headers.getSetCookie(), writeCookie(stepCookie, await seal(step, (await flowKeys)[0]), attrs(request, STEP_SECONDS))])\n    }\n\n    // A provider linked to the signed-in account: to it and back, like a sign-in.\n    if (route.startsWith('/me/identities/link/') && !post) {\n      const provider = providerIn(route.slice('/me/identities/link/'.length))\n      if (!PROVIDER_ID.test(provider)) return new Response('Not found', { status: 404 })\n      const returnTo = localPath(url.searchParams.get('return_to'), afterSignIn)\n      const failed = (code: string) => redirect(`${returnTo}${returnTo.includes('?') ? '&' : '?'}auth_error=${encodeURIComponent(code)}`)\n      const mine = await signedInAs(request)\n      if ('response' in mine) return failed('unauthenticated')\n      const callback = `${basePath}/callback/${provider}`\n      const started = await ask(request, 'GET', `/v1/auth/identities/${provider}/link?redirect_uri=${encodeURIComponent(`${originOf(request)}${callback}`)}`, undefined, callback, mine.token)\n      if (started.error || typeof started.data?.redirect_url !== 'string') return failed(started.error?.code ?? 'provider_unavailable')\n      const step: Step = { kind: 'link', token: String(started.data.state ?? ''), provider, returnTo }\n      return redirect(started.data.redirect_url, [...mine.headers.getSetCookie(), writeCookie(stepCookie, await seal(step, (await flowKeys)[0]), attrs(request, STEP_SECONDS))])\n    }\n\n    // The person's own account: read here, changed below.\n    if (route === '/me/identities' && !post) {\n      const mine = await signedInAs(request)\n      if ('response' in mine) return mine.response\n      const res = await ask(request, 'GET', '/v1/auth/identities', undefined, undefined, mine.token)\n      if (res.error) return problem(res.status, res.error.code, res.error.message, undefined, mine.headers)\n      const list = Array.isArray(res.data) ? res.data : []\n      return json({ identities: list.map((x: any) => ({ provider: String(x.provider ?? ''), email: String(x.email ?? ''), name: String(x.name ?? ''), linkedAt: String(x.linked_at ?? '') })) }, 200, mine.headers)\n    }\n    if (route === '/me/passkeys' && !post) {\n      const mine = await signedInAs(request)\n      if ('response' in mine) return mine.response\n      const res = await ask(request, 'GET', '/v1/auth/webauthn/credentials', undefined, undefined, mine.token)\n      if (res.error) return problem(res.status, res.error.code, res.error.message, undefined, mine.headers)\n      const list = Array.isArray(res.data) ? res.data : []\n      return json({ passkeys: list.map(passkeyOf) }, 200, mine.headers)\n    }\n    // The AI agents the person connected.\n    if (route === '/me/agents' && !post) {\n      const mine = await signedInAs(request)\n      if ('response' in mine) return mine.response\n      const res = await ask(request, 'GET', '/v1/auth/me/agents', undefined, undefined, mine.token)\n      if (res.error) return problem(res.status, res.error.code, res.error.message, undefined, mine.headers)\n      const list = Array.isArray(res.data) ? res.data : []\n      return json({ agents: list.map(agentOf) }, 200, mine.headers)\n    }\n    // The person's organizations, and the people of one: as far as their\n    // role in the system's catalog lets them see (cauthy:members read).\n    if ((route === '/me/organizations' || route === '/me/organizations/members' || route === '/me/organizations/roles') && !post) {\n      const mine = await signedInAs(request)\n      if ('response' in mine) return mine.response\n      let path = '/v1/auth/me/organizations'\n      if (route !== '/me/organizations') {\n        const id = url.searchParams.get('id') ?? ''\n        if (!UUID.test(id)) return problem(400, 'invalid_organization', 'Say which organization.', undefined, mine.headers)\n        path += `/${id}/${route.endsWith('/roles') ? 'roles' : 'members'}`\n      } else if (url.searchParams.get('system')) {\n        path += `?system=${encodeURIComponent(url.searchParams.get('system')!)}`\n      }\n      const res = await ask(request, 'GET', path, undefined, undefined, mine.token)\n      if (res.error) return problem(res.status, res.error.code, res.error.message, undefined, mine.headers)\n      const list = Array.isArray(res.data) ? res.data : []\n      if (route === '/me/organizations') return json({ organizations: list.map(seatOf) }, 200, mine.headers)\n      if (route === '/me/organizations/roles') return json({ roles: list.map(orgRoleOf) }, 200, mine.headers)\n      return json({ members: list.map(orgMemberOf) }, 200, mine.headers)\n    }\n    // How the account takes its second step, and what the workspace offers.\n    if (route === '/me/mfa/factors' && !post) {\n      const mine = await signedInAs(request)\n      if ('response' in mine) return mine.response\n      const res = await ask(request, 'GET', '/v1/auth/mfa/factors', undefined, undefined, mine.token)\n      if (res.error) return problem(res.status, res.error.code, res.error.message, undefined, mine.headers)\n      return json(factorsOf(res.data), 200, mine.headers)\n    }\n    if ((route === '/me' || route === '/me/sessions' || route === '/me/legal') && !post) {\n      const mine = await signedInAs(request)\n      if ('response' in mine) return mine.response\n      const res = await ask(request, 'GET', route === '/me' ? '/v1/auth/me' : route === '/me/legal' ? '/v1/auth/me/legal' : '/v1/auth/me/sessions', undefined, undefined, mine.token)\n      if (res.error) return problem(res.status, res.error.code, res.error.message, undefined, mine.headers)\n      // The legal documents the person has not accepted in their current version.\n      if (route === '/me/legal') {\n        const list = Array.isArray(res.data?.pending) ? res.data.pending : []\n        return json({ pending: list.map((d: any) => ({ kind: String(d.kind ?? ''), version: String(d.version ?? ''), url: String(d.url ?? '') })) }, 200, mine.headers)\n      }\n      if (route === '/me/sessions') {\n        const list = Array.isArray(res.data) ? res.data : []\n        return json({ sessions: list.map((x: any) => ({ device: String(x.device ?? ''), ip: String(x.ip ?? ''), createdAt: String(x.created_at ?? ''), expiresAt: String(x.expires_at ?? '') })) }, 200, mine.headers)\n      }\n      return json({ account: accountOf(res.data) }, 200, mine.headers)\n    }\n\n    // The phone's answer to a push, as it comes: Cauthy's server-sent events,\n    // passed through to the page that waits on them.\n    if (route === '/sign-in/mfa/push/events' && !post) {\n      const sealed = readCookies(request.headers.get('cookie')).get(stepCookie)\n      const step = sealed ? await unsealAny<Step>(sealed, await flowKeys) : null\n      if (step === null || step.kind !== 'mfa') return problem(400, 'step_expired', 'Sign in again: the code was asked for too long ago.')\n      let upstream: Response\n      try {\n        upstream = await doFetch(`${issuer}/v1/auth/mfa/push/events`, {\n          headers: { 'x-tenant-key': tenantNow(), 'x-mfa-token': step.token, accept: 'text/event-stream' },\n          signal: request.signal,\n        })\n      } catch {\n        return problem(503, 'unavailable', 'Cauthy could not be reached.')\n      }\n      if (!upstream.ok || !upstream.body) {\n        const b = (await upstream.json().catch(() => null)) as any\n        return problem(upstream.status, String(b?.errors?.[0]?.code ?? 'error'), String(b?.errors?.[0]?.message ?? 'The request could not be completed.'))\n      }\n      return new Response(upstream.body, {\n        status: 200,\n        headers: { 'content-type': 'text/event-stream', 'cache-control': 'no-cache, no-store', 'x-accel-buffering': 'no' },\n      })\n    }\n\n    if (!post) return new Response('Method not allowed', { status: 405, headers: { allow: 'POST' } })\n    if (!ownRequest(request)) return problem(403, 'cross_site', 'This request did not come from this application.')\n\n    if (route === '/sign-out') {\n      const { had, value } = await read(request)\n      if (value !== null) {\n        const form = await clientAuth(new URLSearchParams({ client_id: clientId, token: value.rt }))\n        await doFetch(`${issuer}/v1/oauth/revoke`, { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: form }).catch(() => undefined)\n        orgCache.delete(value.at)\n      }\n      const h = new Headers()\n      for (const c of clearParts(cookieName, attrs(request, 0), had)) h.append('set-cookie', c)\n      return json({ status: 'signed_out' }, 200, h)\n    }\n\n    const b = await body(request)\n    if (b === null) return problem(400, 'bad_request', 'Send the form as JSON.')\n\n    // Which company's sign-in an address uses, if any: said of its domain,\n    // never of whether the address has an account.\n    if (route === '/sign-in/sso/discover') {\n      const bad = checkEmail(b.email)\n      if (bad) return invalid(bad)\n      const res = await ask(request, 'POST', '/v1/auth/sso/discover', { email: String(b.email).trim() })\n      if (res.error) return problem(res.status, res.error.code, res.error.message)\n      const c = res.data?.connection\n      return json(c ? { status: 'found', connection: { id: String(c.slug ?? ''), name: String(c.display_name ?? ''), enforced: c.enforced === true } } : { status: 'none' })\n    }\n\n    // A guest session, before the visitor signs up (the workspace's allow_anonymous).\n    if (route === '/sign-in/anonymous') {\n      if (!post) return new Response('Method not allowed', { status: 405, headers: { allow: 'POST' } })\n      const res = await ask(request, 'POST', '/v1/auth/anonymous', {})\n      if (res.error) return problem(res.status, res.error.code, res.error.message)\n      return signedIn(request, res.data)\n    }\n\n    if (route === '/sign-in/email') {\n      const bad = firstProblem(checkEmail(b.email), checkPassword(b.password))\n      if (bad) return invalid(bad)\n      const remember = wants(b.remember)\n      const res = await ask(request, 'POST', '/v1/auth/login', { email: String(b.email).trim(), password: b.password }, undefined, undefined, remember)\n      if (res.error) return problem(res.status, res.error.code, res.error.message)\n      return loggedIn(request, res.data, remember)\n    }\n\n    if (route === '/sign-in/mfa') {\n      const bad = checkCode(b.code)\n      if (bad) return invalid(bad)\n      const sealed = readCookies(request.headers.get('cookie')).get(stepCookie)\n      const step = sealed ? await unsealAny<Step>(sealed, await flowKeys) : null\n      if (step === null || step.kind !== 'mfa') return problem(400, 'step_expired', 'Sign in again: the code was asked for too long ago.')\n      const res = await ask(request, 'POST', '/v1/auth/mfa/challenge', { mfa_token: step.token, code: String(b.code).trim() }, undefined, undefined, step.remember === true)\n      if (res.error) return problem(res.status, res.error.code, res.error.message, 'code')\n      return signedIn(request, res.data, [writeCookie(stepCookie, '', attrs(request, 0))])\n    }\n\n    // The second step by phone, while signing in: which ways the account has,\n    // and a code sent to its phone. The challenge's token stays sealed here.\n    // The second step approved on the phone: a push, then the sign-in once the\n    // phone approved it (the answer itself streams from /sign-in/mfa/push/events).\n    if (route === '/sign-in/mfa/push' || route === '/sign-in/mfa/push/finish') {\n      const sealed = readCookies(request.headers.get('cookie')).get(stepCookie)\n      const step = sealed ? await unsealAny<Step>(sealed, await flowKeys) : null\n      if (step === null || step.kind !== 'mfa') return problem(400, 'step_expired', 'Sign in again: the code was asked for too long ago.')\n      if (route === '/sign-in/mfa/push') {\n        const res = await ask(request, 'POST', '/v1/auth/mfa/push', { mfa_token: step.token }, undefined, undefined, step.remember === true)\n        if (res.error) return problem(res.status, res.error.code, res.error.message)\n        return json({ status: 'sent', number: Number(res.data?.number ?? 0) })\n      }\n      const res = await ask(request, 'POST', '/v1/auth/mfa/challenge', { mfa_token: step.token, push: true }, undefined, undefined, step.remember === true)\n      if (res.error) return problem(res.status, res.error.code, res.error.message)\n      return signedIn(request, res.data, [writeCookie(stepCookie, '', attrs(request, 0))])\n    }\n\n    if (route === '/sign-in/mfa/methods' || route === '/sign-in/mfa/send' || route === '/sign-in/mfa/email') {\n      const sealed = readCookies(request.headers.get('cookie')).get(stepCookie)\n      const step = sealed ? await unsealAny<Step>(sealed, await flowKeys) : null\n      if (step === null || step.kind !== 'mfa') return problem(400, 'step_expired', 'Sign in again: the code was asked for too long ago.')\n      if (route === '/sign-in/mfa/methods') {\n        const res = await ask(request, 'POST', '/v1/auth/mfa/methods', { mfa_token: step.token }, undefined, undefined, step.remember === true)\n        if (res.error) return problem(res.status, res.error.code, res.error.message)\n        const p = res.data?.phone\n        const push = res.data?.push\n        const mail = res.data?.email\n        return json({ status: 'ok', totp: res.data?.totp === true, phone: p ? { number: String(p.number ?? ''), channel: String(p.channel ?? 'sms') } : null,\n          push: push ? { devices: Number(push.devices ?? 0) } : null, email: mail ? { to: String(mail.to ?? '') } : null })\n      }\n      if (route === '/sign-in/mfa/email') {\n        const res = await ask(request, 'POST', '/v1/auth/mfa/email', { mfa_token: step.token }, undefined, undefined, step.remember === true)\n        if (res.error) return problem(res.status, res.error.code, res.error.message)\n        return json({ status: 'sent', sentTo: String(res.data?.sent_to ?? '') })\n      }\n      const res = await ask(request, 'POST', '/v1/auth/mfa/send', { mfa_token: step.token }, undefined, undefined, step.remember === true)\n      if (res.error) return problem(res.status, res.error.code, res.error.message)\n      return json({ status: 'sent', sentTo: String(res.data?.sent_to ?? ''), channel: String(res.data?.channel ?? 'sms') })\n    }\n\n    if (route === '/sign-up/email') {\n      const bad = firstProblem(checkName(b.name), checkEmail(b.email), await newPasswordProblem(request, b.password), checkOrganization(b.organization))\n      if (bad) return invalid(bad)\n      const email = String(b.email).trim()\n      // The company's name, when the application's system makes an organization per sign-up.\n      const organization = typeof b.organization === 'string' && b.organization.trim() !== '' ? { organization: { name: b.organization.trim() } } : {}\n      // The terms accepted and the consents answered, when the workspace asks any (methods().legal).\n      const legal = { ...(b.acceptLegal === true ? { accept_legal: true } : {}), ...(b.consents && typeof b.consents === 'object' ? { consents: b.consents } : {}) }\n      const made = await ask(request, 'POST', '/v1/auth/register', { email, password: b.password, display_name: typeof b.name === 'string' ? b.name.trim() : '', ...organization, ...legal }, pages.verifyEmail)\n      if (made.error) return problem(made.status, made.error.code, made.error.message, made.error.code === 'weak_password' ? 'password' : undefined, undefined, made.error.reasons)\n      // An account that must confirm its address first cannot sign in yet.\n      if (made.data?.verification_required === true) return json({ status: 'verification_required', email })\n      const res = await ask(request, 'POST', '/v1/auth/login', { email, password: b.password })\n      if (res.error || res.data?.mfa_required === true) return json({ status: 'verification_required', email })\n      return signedIn(request, res.data)\n    }\n\n    if (route === '/forgot-password') {\n      const bad = checkEmail(b.email)\n      if (bad) return invalid(bad)\n      // The same answer whether or not the address has an account.\n      await ask(request, 'POST', '/v1/auth/password/reset', { email: String(b.email).trim() }, pages.resetPassword)\n      return json({ status: 'sent' })\n    }\n\n    if (route.startsWith('/me')) {\n      const mine = await signedInAs(request)\n      if ('response' in mine) return mine.response\n      const as = (path: string, payload?: unknown, method = 'POST') => ask(request, method, path, payload, undefined, mine.token)\n      const refused = (res: { status: number; error?: { code: string; message: string; reasons?: string[] } }, field?: string) =>\n        problem(res.status, res.error!.code, res.error!.message, field, mine.headers, res.error!.reasons)\n      // Asked again for what weakens the account; an account with no password sends none.\n      const password = typeof b.password === 'string' ? b.password : ''\n\n      if (route === '/me') {\n        const bad = checkName(b.name)\n        if (bad) return invalid(bad)\n        const res = await as('/v1/auth/me', { name: typeof b.name === 'string' ? b.name.trim() : '' }, 'PATCH')\n        if (res.error) return refused(res, 'name')\n        // The name is part of the session: the cookie says the new one at once.\n        const h = mine.headers\n        if (mine.kept !== null) {\n          const again = await stored({ access_token: mine.kept.at, refresh_token: mine.kept.rt, expires_in: Math.max(1, mine.kept.exp - Math.floor(Date.now() / 1000)) }, mine.kept)\n          if (again !== null) for (const c of await write(request, again, readCookies(request.headers.get('cookie')))) h.append('set-cookie', c)\n        }\n        return json({ status: 'saved', account: accountOf(res.data) }, 200, h)\n      }\n      if (route === '/me/legal/accept') {\n        const kinds = Array.isArray(b.kinds) ? b.kinds.filter((k: unknown) => typeof k === 'string') : []\n        const res = await as('/v1/auth/me/legal/accept', { kinds })\n        if (res.error) return refused(res)\n        return json({ status: 'accepted' }, 200, mine.headers)\n      }\n      if (route === '/me/password') {\n        const bad = await newPasswordProblem(request, b.newPassword)\n        if (bad) return problem(400, bad.code, bad.message, 'newPassword')\n        const res = await as('/v1/auth/me/password', { current_password: password, new_password: b.newPassword })\n        if (res.error) return refused(res, res.error.code === 'wrong_password' ? 'password' : res.error.code === 'weak_password' ? 'newPassword' : undefined)\n        // The change ended every session of the account. Cauthy answered with\n        // a new one for this browser, which just proved the password.\n        const next = await stored(res.data, (await read(request)).value ?? undefined)\n        const h = new Headers()\n        const had = readCookies(request.headers.get('cookie'))\n        for (const c of next !== null ? await write(request, next, had) : clearParts(cookieName, attrs(request, 0), had)) h.append('set-cookie', c)\n        return json({ status: 'changed', signedIn: next !== null }, 200, h)\n      }\n      if (route === '/me/mfa/setup') {\n        const res = await as('/v1/auth/mfa/setup', { password })\n        if (res.error) return refused(res, res.error.code === 'step_up_required' ? 'password' : undefined)\n        // The QR comes drawn by Cauthy; only a PNG data: URI goes on to the page.\n        const qr = String(res.data?.qr ?? '')\n        return json({ status: 'started', secret: String(res.data?.secret ?? ''), otpauthUri: String(res.data?.otpauth_uri ?? ''), qr: qr.startsWith('data:image/png;base64,') ? qr : '' }, 200, mine.headers)\n      }\n      if (route === '/me/mfa/verify') {\n        const bad = checkCode(b.code)\n        if (bad) return invalid(bad)\n        const res = await as('/v1/auth/mfa/verify', { code: String(b.code).trim() })\n        if (res.error) return refused(res, 'code')\n        return json({ status: 'enabled', recoveryCodes: Array.isArray(res.data?.recovery_codes) ? res.data.recovery_codes.map(String) : [] }, 200, mine.headers)\n      }\n      if (route === '/me/mfa/phone') {\n        const res = await as('/v1/auth/mfa/phone', { phone: typeof b.phone === 'string' ? b.phone : '', channel: typeof b.channel === 'string' ? b.channel : 'sms', password })\n        if (res.error) return refused(res, res.error.code === 'step_up_required' ? 'password' : res.error.code === 'validation_error' ? 'phone' : undefined)\n        return json({ status: 'sent', sentTo: String(res.data?.sent_to ?? ''), channel: String(res.data?.channel ?? '') }, 200, mine.headers)\n      }\n      if (route === '/me/mfa/phone/verify') {\n        const bad = checkCode(b.code)\n        if (bad) return invalid(bad)\n        const res = await as('/v1/auth/mfa/phone/verify', { code: String(b.code).trim() })\n        if (res.error) return refused(res, 'code')\n        return json({ status: 'enabled', recoveryCodes: Array.isArray(res.data?.recovery_codes) ? res.data.recovery_codes.map(String) : [] }, 200, mine.headers)\n      }\n      if (route === '/me/mfa/phone/remove') {\n        const res = await as('/v1/auth/mfa/phone/remove', { password })\n        if (res.error) return refused(res, res.error.code === 'step_up_required' ? 'password' : undefined)\n        return json({ status: 'removed' }, 200, mine.headers)\n      }\n      if (route === '/me/mfa/disable') {\n        const res = await as('/v1/auth/me/mfa/disable', { password })\n        if (res.error) return refused(res, res.error.code === 'step_up_required' ? 'password' : undefined)\n        return json({ status: 'disabled' }, 200, mine.headers)\n      }\n      if (route === '/me/mfa/recovery-codes') {\n        const res = await as('/v1/auth/me/mfa/recovery-codes', { password })\n        if (res.error) return refused(res, res.error.code === 'step_up_required' ? 'password' : undefined)\n        return json({ status: 'renewed', recoveryCodes: Array.isArray(res.data?.recovery_codes) ? res.data.recovery_codes.map(String) : [] }, 200, mine.headers)\n      }\n      if (route === '/me/email') {\n        const bad = checkEmail(b.email)\n        if (bad) return invalid(bad)\n        const email = String(b.email).trim()\n        const res = await as('/v1/auth/me/email', { email, password })\n        if (res.error) return refused(res, res.error.code === 'step_up_required' ? 'password' : ['invalid_email', 'email_unchanged', 'email_taken'].includes(res.error.code) ? 'email' : undefined)\n        // Nothing changed yet: the new address confirms it from the link it was sent.\n        return json({ status: 'sent', email }, 200, mine.headers)\n      }\n      if (route === '/me/identities/unlink') {\n        const provider = typeof b.provider === 'string' ? b.provider : ''\n        if (!PROVIDER_ID.test(provider)) return problem(400, 'invalid_provider', 'Say which provider to unlink.', 'provider', mine.headers)\n        const res = await as(`/v1/auth/identities/${provider}`, undefined, 'DELETE')\n        if (res.error) return refused(res)\n        return json({ status: 'unlinked', provider }, 200, mine.headers)\n      }\n      // A passkey made on this page, for the domain the workspace's passkeys\n      // belong to. The ceremony's id stays here, sealed, between its two calls.\n      if (route === '/me/passkeys/add/begin') {\n        const kind = b.kind === 'device' || b.kind === 'security_key' ? b.kind : ''\n        const res = await as('/v1/auth/webauthn/register/begin', { password, ...(kind ? { kind } : {}) })\n        if (res.error) return refused(res, res.error.code === 'step_up_required' ? 'password' : undefined)\n        const step: Step = { kind: 'enrol', token: String(res.data?.session_id ?? ''), returnTo: afterSignIn }\n        const h = new Headers(mine.headers)\n        h.append('set-cookie', writeCookie(stepCookie, await seal(step, (await flowKeys)[0]), attrs(request, PASSKEY_SECONDS)))\n        return json({ status: 'started', options: res.data?.options?.publicKey ?? res.data?.options ?? null }, 200, h)\n      }\n      if (route === '/me/passkeys/add/finish') {\n        const sealed = readCookies(request.headers.get('cookie')).get(stepCookie)\n        const step = sealed ? await unsealAny<Step>(sealed, await flowKeys) : null\n        if (step === null || step.kind !== 'enrol') return problem(400, 'step_expired', 'Start adding the passkey again: it was asked for too long ago.', undefined, mine.headers)\n        if (!isCredential(b.credential)) return problem(400, 'bad_request', 'Send the passkey the browser made.', undefined, mine.headers)\n        const name = typeof b.name === 'string' ? b.name.trim().slice(0, 60) : ''\n        const res = await as('/v1/auth/webauthn/register/finish', { session_id: step.token, nickname: name, credential: b.credential })\n        const h = new Headers(mine.headers)\n        h.append('set-cookie', writeCookie(stepCookie, '', attrs(request, 0)))\n        if (res.error) return problem(res.status, res.error.code === 'attestation_invalid' ? 'passkey_failed' : res.error.code, res.error.code === 'attestation_invalid' ? 'The passkey could not be added. Try again.' : res.error.message, undefined, h)\n        return json({ status: 'added', passkey: passkeyOf(res.data) }, 200, h)\n      }\n      if (route === '/me/passkeys/remove') {\n        const id = typeof b.id === 'string' ? b.id : ''\n        if (!/^[0-9a-f-]{36}$/i.test(id)) return problem(400, 'invalid_passkey', 'Say which passkey to remove.', undefined, mine.headers)\n        const res = await as(`/v1/auth/webauthn/credentials/${id}`, undefined, 'DELETE')\n        if (res.error) return refused(res)\n        return json({ status: 'removed', id }, 200, mine.headers)\n      }\n      // A guest becoming an account of their own, with an address and a password.\n      if (route === '/me/upgrade') {\n        const bad = firstProblem(checkName(b.name), checkEmail(b.email), await newPasswordProblem(request, b.password))\n        if (bad) return invalid(bad)\n        const res = await as('/v1/auth/anonymous/upgrade', { email: String(b.email).trim(), password: b.password, display_name: typeof b.name === 'string' ? b.name.trim() : '' })\n        if (res.error) return refused(res, res.error.code === 'weak_password' ? 'password' : 'email')\n        // The guest's session becomes the account's: of the same kind.\n        return signedIn(request, res.data, [], {}, (await read(request)).value ?? undefined)\n      }\n      // A member administering the organization itself (cauthy:organization\n      // update, archive, delete). Cauthy decides by the person's role.\n      if (route === '/me/organizations/rename' || route === '/me/organizations/archive' || route === '/me/organizations/delete') {\n        const org = typeof b.organizationId === 'string' ? b.organizationId : ''\n        if (!UUID.test(org)) return problem(400, 'invalid_organization', 'Say which organization.', undefined, mine.headers)\n        const path = `/v1/auth/me/organizations/${org}`\n        if (route === '/me/organizations/rename') {\n          const bad = checkOrganizationName(b.name)\n          if (bad) return invalid(bad)\n          const res = await as(path, { name: String(b.name).trim() }, 'PATCH')\n          if (res.error) return refused(res, res.error.code === 'validation_error' ? 'name' : undefined)\n          // The session's organizations carry the name: read them again.\n          orgCache.delete(mine.token)\n          return json({ status: 'renamed', organization: seatOf(res.data) }, 200, mine.headers)\n        }\n        const res = route === '/me/organizations/archive' ? await as(`${path}/archive`) : await as(path, undefined, 'DELETE')\n        if (res.error) return refused(res)\n        // Gone from the person's organizations either way.\n        orgCache.delete(mine.token)\n        return json({ status: route === '/me/organizations/archive' ? 'archived' : 'deleted', organizationId: org }, 200, mine.headers)\n      }\n      // A member administering their organization's people (cauthy:members\n      // manage; removing someone else, cauthy:members remove).\n      if (route.startsWith('/me/organizations/members/')) {\n        const org = typeof b.organizationId === 'string' ? b.organizationId : ''\n        if (!UUID.test(org)) return problem(400, 'invalid_organization', 'Say which organization.', undefined, mine.headers)\n        const base = `/v1/auth/me/organizations/${org}/members`\n        if (route === '/me/organizations/members/add') {\n          const bad = checkEmail(b.email)\n          if (bad) return invalid(bad)\n          const role = typeof b.role === 'string' ? b.role : ''\n          if (role === '') return problem(400, 'invalid_role', 'Choose a role.', 'role', mine.headers)\n          // A person new to the workspace is invited: the mail opens this\n          // application's page for it when it has one.\n          // Adding never changes the role of somebody already there: that is\n          // setRole's. The member's route only adds; it is asked so anyway.\n          const res = await ask(request, 'POST', base, { email: String(b.email).trim(), role, name: typeof b.name === 'string' ? b.name.trim() : '',\n            client_id: clientId, only_new: true, ...(typeof b.locale === 'string' && b.locale ? { locale: b.locale } : {}) }, pages.acceptInvite, mine.token)\n          // One code for \"already a member\", whichever route answered it.\n          if (res.error?.code === 'already_member') res.error.code = 'member_exists'\n          if (res.error) return refused(res, res.error.code === 'unknown_role' ? 'role' : 'email')\n          return json({ status: 'added', member: orgMemberOf(res.data) }, 200, mine.headers)\n        }\n        const user = typeof b.userId === 'string' ? b.userId : ''\n        if (!UUID.test(user)) return problem(400, 'invalid_member', 'Say which member.', undefined, mine.headers)\n        if (route === '/me/organizations/members/role') {\n          const role = typeof b.role === 'string' ? b.role : ''\n          if (role === '') return problem(400, 'invalid_role', 'Choose a role.', 'role', mine.headers)\n          const res = await as(`${base}/${user}`, { role }, 'PUT')\n          if (res.error) return refused(res, 'role')\n          return json({ status: 'changed', userId: user, role }, 200, mine.headers)\n        }\n        if (route === '/me/organizations/members/remove') {\n          const res = await as(`${base}/${user}`, undefined, 'DELETE')\n          if (res.error) return refused(res)\n          orgCache.delete(mine.token)\n          return json({ status: 'removed', userId: user }, 200, mine.headers)\n        }\n        if (route === '/me/organizations/members/invite') {\n          const res = await ask(request, 'POST', `${base}/${user}/invite`, { client_id: clientId, ...(typeof b.locale === 'string' && b.locale ? { locale: b.locale } : {}) }, pages.acceptInvite, mine.token)\n          if (res.error) return refused(res)\n          return json({ status: 'sent', userId: user }, 200, mine.headers)\n        }\n      }\n      if (route === '/me/agents/disconnect') {\n        const id = typeof b.id === 'string' ? b.id : ''\n        if (!/^[0-9a-f-]{36}$/i.test(id)) return problem(400, 'invalid_agent', 'Say which agent to disconnect.', undefined, mine.headers)\n        const res = await as(`/v1/auth/me/agents/${id}`, undefined, 'DELETE')\n        if (res.error) return refused(res)\n        return json({ status: 'disconnected', id }, 200, mine.headers)\n      }\n      if (route === '/me/sessions/end') {\n        const res = await as('/v1/auth/me/sessions', undefined, 'DELETE')\n        if (res.error) return refused(res)\n        // Everywhere is here too.\n        const h = new Headers()\n        for (const c of clearParts(cookieName, attrs(request, 0), readCookies(request.headers.get('cookie')))) h.append('set-cookie', c)\n        orgCache.delete(mine.token)\n        return json({ status: 'signed_out' }, 200, h)\n      }\n      return null\n    }\n\n    const isToken = (v: unknown): v is string => typeof v === 'string' && v !== '' && v.length <= 512\n    const badLink = () => problem(422, 'invalid_token', 'This link is not valid, or it has expired.')\n\n    // What a mailed link carries back: the token it was opened with.\n    if (route === '/reset-password') {\n      if (!isToken(b.token)) return badLink()\n      const bad = await newPasswordProblem(request, b.password)\n      if (bad) return invalid(bad)\n      const res = await ask(request, 'POST', '/v1/auth/password/change', { token: String(b.token), new_password: b.password })\n      if (res.error) return problem(res.status, res.error.code, res.error.message, res.error.code === 'weak_password' ? 'password' : undefined, undefined, res.error.reasons)\n      return json({ status: 'changed' })\n    }\n    if (route === '/verify-email') {\n      if (!isToken(b.token)) return badLink()\n      const res = await ask(request, 'POST', '/v1/auth/email/verify', { token: String(b.token) })\n      if (res.error) return problem(res.status, res.error.code, res.error.message)\n      // The link proved the address: Cauthy signs the person in from it, unless\n      // their account asks a second step — then they sign in the usual way.\n      if (res.data?.access_token) return signedIn(request, res.data)\n      return json({ status: 'verified' })\n    }\n    // An invitation accepted: the password the person chose, checked against\n    // the workspace's policy, and a sign-in like one with a password — the\n    // second step next, when the account owes one. A refused password does\n    // not spend the invitation.\n    if (route === '/invitation/accept') {\n      if (!isToken(b.token)) return problem(422, 'invalid_token', 'This invitation is not valid, or it has expired.')\n      const bad = await newPasswordProblem(request, b.password)\n      if (bad) return invalid(bad)\n      const res = await ask(request, 'POST', '/v1/auth/invitation/accept', { token: String(b.token), password: b.password })\n      if (res.error) return problem(res.status, res.error.code, res.error.message, res.error.code === 'weak_password' ? 'password' : undefined, undefined, res.error.reasons)\n      return loggedIn(request, res.data)\n    }\n\n    // A passkey, on this page: Cauthy says what to ask the browser for, the\n    // browser asks the person, and the answer goes back to Cauthy through here.\n    if (route === '/sign-in/passkey/begin') {\n      // With the person's address, the browser is told which passkeys are\n      // theirs; Cauthy answers the same for an address with none.\n      const email = typeof b.email === 'string' && checkEmail(b.email) === null ? b.email.trim() : ''\n      const remember = wants(b.remember)\n      const res = await ask(request, 'POST', '/v1/auth/webauthn/login/begin', email !== '' ? { email } : {}, undefined, undefined, remember)\n      if (res.error) return problem(res.status, res.error.code, res.error.message)\n      const step: Step = { kind: 'passkey', token: String(res.data?.session_id ?? ''), returnTo: afterSignIn, ...(remember ? { remember } : {}) }\n      return json({ status: 'started', options: res.data?.options?.publicKey ?? res.data?.options ?? null }, 200,\n        new Headers({ 'set-cookie': writeCookie(stepCookie, await seal(step, (await flowKeys)[0]), attrs(request, PASSKEY_SECONDS)) }))\n    }\n    if (route === '/sign-in/passkey/finish') {\n      const sealed = readCookies(request.headers.get('cookie')).get(stepCookie)\n      const step = sealed ? await unsealAny<Step>(sealed, await flowKeys) : null\n      if (step === null || step.kind !== 'passkey') return problem(400, 'step_expired', 'Try the passkey again: it was asked for too long ago.')\n      if (!isCredential(b.credential)) return problem(400, 'bad_request', 'Send the passkey the browser answered with.')\n      const res = await ask(request, 'POST', '/v1/auth/webauthn/login/finish', { session_id: step.token, credential: b.credential }, undefined, undefined, step.remember === true || wants(b.remember))\n      const clear = writeCookie(stepCookie, '', attrs(request, 0))\n      if (res.error) {\n        // Which check failed is Cauthy's to log; the page says only that it did.\n        const failed = ['assertion_invalid', 'session_expired', 'clone_detected', 'not_found'].includes(res.error.code)\n        return problem(res.status, failed ? 'passkey_failed' : res.error.code, failed ? 'The passkey sign-in could not be completed. Try again, or sign in another way.' : res.error.message, undefined, new Headers({ 'set-cookie': clear }))\n      }\n      return signedIn(request, res.data, [clear])\n    }\n\n    // Google One Tap: Cauthy gives the workspace's Google client and a nonce\n    // for one prompt; Google's prompt gives the page an ID token, which comes\n    // back here and is traded, once, for a session.\n    if (route === '/sign-in/google-one-tap/begin') {\n      const res = await ask(request, 'POST', '/v1/auth/google/one-tap/begin', {})\n      if (res.error) return problem(res.status, res.error.code, res.error.message)\n      return json({ status: 'started', clientId: String(res.data?.client_id ?? ''), nonce: String(res.data?.nonce ?? '') })\n    }\n    if (route === '/sign-in/google-one-tap') {\n      if (typeof b.credential !== 'string' || b.credential === '') return problem(400, 'bad_request', 'Send the credential Google gave the page.')\n      const res = await ask(request, 'POST', '/v1/auth/google/one-tap', { credential: b.credential }, undefined, undefined, wants(b.remember))\n      if (res.error) return problem(res.status, res.error.code, res.error.message)\n      return signedIn(request, res.data)\n    }\n\n    // A sign-in link: asked for here, mailed by Cauthy, opened on the\n    // application's sign-in page, which gives the token back.\n    if (route === '/sign-in/magic-link') {\n      const bad = checkEmail(b.email)\n      if (bad) return invalid(bad)\n      if (pages.signIn === undefined) return problem(500, 'not_configured', '@cauthyhq/node: pages.signIn is required for sign-in links: it is the page the link opens')\n      // The same answer whether or not the address has an account. With\n      // create, an address with none gets one when the link or code is used\n      // (if the workspace accepts new accounts): one screen for both.\n      const email = String(b.email).trim()\n      // Where the person goes once in travels in the link itself, as\n      // `return_to` on the page it opens: it may be opened in another browser.\n      const back = typeof b.returnTo === 'string' ? localPath(b.returnTo, afterSignIn) : afterSignIn\n      const remember = wants(b.remember)\n      // The choice to stay signed in travels in the link too: the mail may be opened anywhere.\n      const query = [...(back === afterSignIn ? [] : [`return_to=${encodeURIComponent(back)}`]), ...(remember ? ['remember=1'] : [])].join('&')\n      const page = query === '' ? pages.signIn : `${pages.signIn}${pages.signIn.includes('?') ? '&' : '?'}${query}`\n      await ask(request, 'POST', '/v1/auth/magic-link/request', { email, ...(b.create === true ? { create_account: true } : {}) }, page)\n      // The mail carries a code too. Whose it is stays here, sealed, so the\n      // page that asks for the code needs only the code.\n      const step: Step = { kind: 'code', token: email, returnTo: back, ...(remember ? { remember } : {}) }\n      return json({ status: 'sent' }, 200, new Headers({ 'set-cookie': writeCookie(stepCookie, await seal(step, (await flowKeys)[0]), attrs(request, STEP_SECONDS)) }))\n    }\n    if (route === '/sign-in/email-code') {\n      const bad = checkCode(b.code)\n      if (bad) return invalid(bad)\n      const sealed = readCookies(request.headers.get('cookie')).get(stepCookie)\n      const step = sealed ? await unsealAny<Step>(sealed, await flowKeys) : null\n      if (step === null || step.kind !== 'code') return problem(400, 'step_expired', 'Ask for a new link: this one was asked for too long ago.')\n      const res = await ask(request, 'POST', '/v1/auth/magic-link/verify-code', { email: step.token, code: String(b.code).trim() }, undefined, undefined, step.remember === true)\n      if (res.error) return problem(res.status, res.error.code, res.error.message, 'code')\n      return signedIn(request, res.data, [writeCookie(stepCookie, '', attrs(request, 0))], { returnTo: step.returnTo })\n    }\n    if (route === '/sign-in/magic-link/verify') {\n      if (!isToken(b.token)) return badLink()\n      const res = await ask(request, 'POST', '/v1/auth/magic-link/verify', { token: String(b.token) }, undefined, undefined, wants(b.remember))\n      if (res.error) return problem(res.status, res.error.code, res.error.message)\n      return signedIn(request, res.data)\n    }\n    return null\n  }\n\n  /** Every answer as protocol version 1 sends it (protocol.ts); the published keys keep their cache. */\n  async function handler(request: Request): Promise<Response> {\n    const url = new URL(request.url)\n    const inside = url.pathname === basePath || url.pathname.startsWith(`${basePath}/`)\n    const route = inside ? withoutTrailingSlashes(url.pathname.slice(basePath.length)) || '/' : null\n    const published = pact !== undefined && url.pathname === contract?.jwksPath && (request.method === 'GET' || request.method === 'HEAD')\n    if (identity && route !== null) {\n      const unready = await identityGate()\n      if (unready) return finish(unready, route)\n    }\n    try {\n      return finish(await serve(request), route, published)\n    } catch (err) {\n      if (err instanceof UnknownOriginError) return finish(problem(400, 'unknown_origin', err.message), route)\n      // A sign-in that Cauthy completed for an address not yet confirmed, on a link that requires it.\n      if (!(err instanceof CauthyApiError && err.code === 'email_not_confirmed')) throw err\n      const wantsPage = request.method === 'GET' && (request.headers.get('sec-fetch-mode') ?? 'navigate') === 'navigate'\n      return finish(wantsPage\n        ? new Response('Sign-in refused (email_not_confirmed). Confirm your email address first.', { status: 403, headers: { 'content-type': 'text/plain; charset=utf-8' } })\n        : problem(403, 'email_not_confirmed', 'Confirm your email address first.'), route)\n    }\n  }\n\n  /**\n   * On CAUTHY_KEY, before any auth route: the identity, or the answer to give\n   * instead. Never one yet and Cauthy failing: 503 unavailable at once (the\n   * retries go on); the first ask still out: waited for, up to the request\n   * deadline. Cauthy refusing the key: 503 misconfigured.\n   */\n  async function identityGate(): Promise<Response | null> {\n    if (!identity) return null\n    const unavailable = () => problem(503, 'unavailable', 'Cauthy cannot be reached yet. Try again in a moment.')\n    if (identity.failing()) return unavailable()\n    let timer: ReturnType<typeof setTimeout> | undefined\n    const waited = new Promise<'timeout'>((resolve) => { timer = setTimeout(() => resolve('timeout'), requestTimeout) })\n    try {\n      const ready = identity.ready()\n      const got = await Promise.race([ready.then(() => 'ok' as const), identity.attempt().then(ok => (ok ? 'ok' as const : 'failed' as const)), waited])\n      // A failed attempt that was Cauthy refusing the key has rejected ready() by now.\n      if (got === 'failed') await Promise.race([ready, Promise.resolve()])\n      return got === 'ok' ? null : unavailable()\n    } catch (e) {\n      return (e as { code?: string }).code === 'misconfigured'\n        ? problem(503, 'misconfigured', 'Cauthy refuses this application\\'s key: make a new one in Cauthy\\'s dashboard.')\n        : unavailable()\n    } finally {\n      clearTimeout(timer)\n    }\n  }\n\n  async function serve(request: Request): Promise<Response> {\n    const url = new URL(request.url)\n    if (pact && url.pathname === contract?.jwksPath && (request.method === 'GET' || request.method === 'HEAD')) return pact.jwks()\n    if (url.pathname !== basePath && !url.pathname.startsWith(`${basePath}/`)) return new Response('Not found', { status: 404 })\n    const route = withoutTrailingSlashes(url.pathname.slice(basePath.length)) || '/'\n    const get = request.method === 'GET' || request.method === 'HEAD'\n\n    const mine = await ownRoute(request, url, route)\n    if (mine !== null) return mine\n\n    // The browser asking about a permission (organizations.check). Outside the\n    // own screens: it needs no tenant, only the person's session.\n    if (route === '/me/organizations/check') return checkRoute(request)\n\n    if (route === '/login' && get) return login(request, url)\n    if (route === '/callback' && get) return callback(request, url)\n    if (route === '/logout' && (get || request.method === 'POST')) return logout(request)\n\n    if (route === '/session' && get) {\n      const r = await resolve(request)\n      const h = new Headers()\n      for (const c of r.cookies) h.append('set-cookie', c)\n      return json({ session: r.session ? await toPublic(r.session) : null, status: r.status }, 200, h)\n    }\n\n    // For a page that found its session expired: renew, and go back to it.\n    if (route === '/refresh' && get) {\n      const r = await resolve(request)\n      const back = localPath(url.searchParams.get('return_to'), afterSignIn)\n      if (r.status === 'unauthenticated') return redirect(urls.signIn(back), r.cookies)\n      if (r.status === 'expired') return new Response('Sign-in is unavailable right now. Try again in a moment.', { status: 503 })\n      return redirect(back, r.cookies)\n    }\n\n    if (route === '/account' && get) {\n      const q = new URLSearchParams({ client_id: clientId })\n      const back = localPath(url.searchParams.get('return_to'), '')\n      if (back !== '') q.set('return_to', `${originOf(request)}${back}`)\n      const locale = url.searchParams.get('locale')\n      if (locale && /^[a-zA-Z-]{2,10}$/.test(locale)) q.set('ui_locales', locale)\n      return redirect(`${issuer}/v1/oauth/account?${q}`)\n    }\n    return new Response('Not found', { status: 404 })\n  }\n\n  async function checkRoute(request: Request): Promise<Response> {\n    if (request.method !== 'POST') return new Response('Method not allowed', { status: 405, headers: { allow: 'POST' } })\n    const refused = withoutRequestHeader(request, '/me/organizations/check')\n    if (refused) return refused\n    if (!ownRequest(request)) return problem(403, 'cross_site', 'This request did not come from this application.')\n    const b = await body(request)\n    if (b === null) return problem(400, 'bad_request', 'Send the question as JSON.')\n    const asker = await signedInAs(request)\n    if ('response' in asker) return asker.response\n    const org = typeof b.organizationId === 'string' ? b.organizationId : ''\n    if (!UUID.test(org)) return problem(400, 'invalid_organization', 'Say which organization.', undefined, asker.headers)\n    const named = (v: unknown) => typeof v === 'string' && v !== '' && v.length <= 200\n    if (!named(b.resource) || !named(b.action)) return problem(400, 'bad_request', 'Say which resource and action.', undefined, asker.headers)\n    const attributes = b.attributes\n    if (attributes !== undefined && (typeof attributes !== 'object' || attributes === null || Array.isArray(attributes))) {\n      return problem(400, 'bad_request', 'The attributes are an object.', undefined, asker.headers)\n    }\n    try {\n      const r = await decide(asker.token, {\n        organization: org, resource: b.resource as string, action: b.action as string,\n        ...(attributes !== undefined ? { attributes: attributes as Record<string, unknown> } : {}),\n        ...(typeof b.resourceId === 'string' ? { resourceId: b.resourceId } : {}),\n        ...(typeof b.ownerId === 'string' ? { ownerId: b.ownerId } : {}),\n      })\n      return json({ status: 'decided', ...r }, 200, asker.headers)\n    } catch (e) {\n      const err = e instanceof CauthyApiError ? e : new CauthyApiError(503, 'unavailable', 'Cauthy could not be reached.')\n      return problem(err.status, err.code, err.message.replace(/^@cauthyhq\\/node: /, ''), undefined, asker.headers)\n    }\n  }\n\n  async function protect(request: Request) {\n    const read1 = await read(request)\n    // A session of a person the link does not let in (address not confirmed) is none.\n    const value = read1.value !== null && unverified(read1.value.u) ? null : read1.value\n    if (value !== null && fresh(value)) return { session: toSession(value) }\n    const url = new URL(request.url)\n    const state = value === null ? 'none' : 'expired'\n    // A page is sent to sign in, or to renew and come back. Anything else —\n    // a fetch, a form post — is told, and its caller decides.\n    const page = request.method === 'GET' && (request.headers.get('sec-fetch-mode') ?? 'navigate') === 'navigate' &&\n      (request.headers.get('accept') ?? 'text/html').includes('text/html')\n    if (!page) {\n      return { response: json({ error: 'unauthenticated', session: state }, 401, new Headers({ 'x-cauthy-session': state })) }\n    }\n    const back = url.pathname + url.search\n    const to = value === null ? urls.signIn(back) : `${basePath}/refresh?return_to=${encodeURIComponent(back)}`\n    return { response: redirect(to) }\n  }\n\n  // The endpoint's public address: the application's origin when it was\n  // given (a proxy may hide it from the request), with the request's path.\n  const replay = given.webhookReplay ?? memoryReplayStore()\n  let lateSelf: IdentityCache | undefined\n  const tokenVerifier: Cauthy['tokenVerifier'] = (o = {}) => {\n    // On CAUTHY_KEY the audience and the workspace are Cauthy's answer: the\n    // verifier is built once that answer is in.\n    if (keyed) {\n      if (contract && o.clientId !== undefined && o.clientId !== contract.clientId) {\n        throw new CauthyConfigError(`clientId is the contract's (${contract.clientId}): remove it from the call`)\n      }\n      let built: { from: Identity; verify: (from: string | Request | Headers) => Promise<TokenIdentity> } | undefined\n      return async (from) => {\n        // With a contract the audience is still Cauthy's to say: asked once, when first needed.\n        const id = await (identity ?? (lateSelf ??= createIdentity(selfOptions()))).ready()\n        if (built?.from !== id) {\n          built = { from: id, verify: createTokenVerifier({ issuer, tenantId: contract?.tenantId ?? id.tenant.id, audience: id.audience, fetch: given.fetch,\n            ...(contract ? { clientId: contract.clientId } : {}), ...o }) }\n        }\n        return built.verify(from)\n      }\n    }\n    // By contract the link owns the client: a person's token issued through\n    // another is refused (wrong_client), and a call cannot name another.\n    if (contract && o.clientId !== undefined && o.clientId !== contract.clientId) {\n      throw new CauthyConfigError(`clientId is the contract's (${contract.clientId}): remove it from the call`)\n    }\n    return createTokenVerifier({\n      issuer,\n      tenantId: contract?.tenantId ?? given.tenantId,\n      audience: given.audience,\n      fetch: given.fetch,\n      ...(contract ? { clientId: contract.clientId } : {}),\n      ...o,\n    })\n  }\n  const webhook: Cauthy['webhook'] = (request, o = {}) =>\n    verifyWebhook(request, { issuer, url: o.url ?? `${originOf(request)}${new URL(request.url).pathname}`, jwks: o.jwks, now: o.now, replay })\n\n  // On CAUTHY_KEY the published key is the key's public half (and the\n  // previous key's during a rotation): no key store, nothing sealed.\n  async function keyJwks(): Promise<Response> {\n    const s = await fromKey!.signer\n    const keys: object[] = [{ ...s.publicJwk, kid: s.kid, alg: 'EdDSA', use: 'sig' }]\n    if (fromKey!.previousJwk) keys.push({ ...(await fromKey!.previousJwk), alg: 'EdDSA', use: 'sig' })\n    if (ownKeys) keys.push(...(await ownKeys.published()).keys)\n    return new Response(JSON.stringify({ keys }), {\n      headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': `public, max-age=${JWKS_MAX_AGE_S}` },\n    })\n  }\n  const noStore = (): never => {\n    throw new CauthyConfigError('on CAUTHY_KEY the application keeps no key of its own: make a new key on the application\\'s card in Cauthy\\'s dashboard')\n  }\n  const keyOnly: PactKeys = {\n    current: async () => noStore(),\n    published: async () => ({ keys: [] }),\n    rotate: async () => noStore(),\n    reseal: async () => 0,\n  }\n  const pact: CauthyPact | undefined = contract && fromKey ? {\n    contract,\n    keys: ownKeys ?? keyOnly,\n    jwks: keyJwks,\n    status: () => ownSystem.request<PactStatus>('GET', `/v1/pact/status?system=${encodeURIComponent(contract.system)}`),\n  } : contract && ownKeys ? {\n    contract,\n    keys: ownKeys,\n    async jwks() {\n      // Cauthy reads it when it meets a key it does not know, and at most\n      // hourly otherwise. A new key signs only after it has been published\n      // longer than this cache lasts (SIGN_AFTER_MS): caching never hides it.\n      return new Response(JSON.stringify(await ownKeys.published()), {\n        headers: { 'content-type': 'application/json; charset=utf-8', 'cache-control': `public, max-age=${JWKS_MAX_AGE_S}` },\n      })\n    },\n    status: () => ownSystem.request<PactStatus>('GET', `/v1/pact/status?system=${encodeURIComponent(contract.system)}`),\n  } : undefined\n\n  // What the application is, as configured, for the modes that do not ask Cauthy.\n  const configured = (): Identity => ({\n    issuer, audience: given.audience ?? env('CAUTHY_AUDIENCE') ?? '', tenant: { id: contract?.tenantId ?? given.tenantId ?? env('CAUTHY_TENANT_ID') ?? '', slug: tenant },\n    system, client_id: clientId, sign_in_client_id: clientId, app_urls: baseURL ? [withoutTrailingSlashes(baseURL)] : [], callback_path: `${basePath}/callback`,\n    key: null,\n    contract: contract ? { link: contract.link, system_proof: contract.systemProof, require_verified_email: contract.requireVerifiedEmail } : null,\n  })\n\n  return {\n    handler,\n    ready: async () => {\n      if (identity) return identity.ready()\n      const id = configured()\n      return fromKey ? { ...id, key: { kid: (await fromKey.signer).kid, retires_at: null } } : id\n    },\n    checkMount: (target: MountTarget) => probeMount(basePath, target),\n    webhook,\n    tokenVerifier,\n    verifyToken: async (from, o) => tokenVerifier(o)(from),\n    system: systemThatRefreshes,\n    getSession,\n    status,\n    resolve,\n    protect,\n    organizations,\n    check,\n    toPublic,\n    urls,\n    ...(pact ? { pact } : {}),\n    options: { issuer, clientId, basePath, afterSignIn, afterSignOut, cookieName },\n  }\n}\n\n/**\n * A provider's logo, as Cauthy serves it. An address of Cauthy's own path (a\n * Cauthy with no public address of its own) is read against the issuer; only\n * an http(s) address is passed on.\n */\nfunction iconFor(issuer: string): (p: any) => { iconUrl?: string } {\n  return (p) => {\n    const raw = typeof p?.icon_url === 'string' ? p.icon_url.trim() : ''\n    if (raw === '') return {}\n    try {\n      const url = new URL(raw.startsWith('/') && !raw.startsWith('//') ? `${issuer}${raw}` : raw)\n      return url.protocol === 'https:' || url.protocol === 'http:' ? { iconUrl: url.href } : {}\n    } catch {\n      return {}\n    }\n  }\n}\n\n/** What a sign-up form shows for the law: the documents to accept and the consents to ask, as the API tells them. */\nfunction legalOf(raw: any): { documents: { kind: string; version: string; url: string }[]; consentPurposes: { key: string; label: string; required: boolean }[] } {\n  const documents = Array.isArray(raw?.documents) ? raw.documents : []\n  const purposes = Array.isArray(raw?.consent_purposes) ? raw.consent_purposes : []\n  return {\n    documents: documents.map((d: any) => ({ kind: String(d.kind ?? ''), version: String(d.version ?? ''), url: String(d.url ?? '') })),\n    consentPurposes: purposes.map((p: any) => ({ key: String(p.key ?? ''), label: String(p.label ?? ''), required: p.required === true })),\n  }\n}\n\n/** A loopback, private or link-local address: a network's own hop, never a person. */\nfunction ownNetwork(address: string): boolean {\n  const a = address.toLowerCase()\n  return /^(127\\.|10\\.|192\\.168\\.|169\\.254\\.|0\\.)/.test(a) || /^172\\.(1[6-9]|2\\d|3[01])\\./.test(a) ||\n    a === '::1' || /^f[cd]/.test(a) || /^fe[89ab]/.test(a) || a.startsWith('::ffff:127.') || a === 'localhost'\n}\n","// Connecting an application to Cauthy in one call: its client, where its\n// people come back to, where it hears events, and its own identity. It is what\n// `cauthy init` runs, and what Cauthy's dashboard does under \"Connect a\n// system\".\n\nimport { withoutTrailingSlashes } from './url'\nimport { deadline, DEFAULT_DEADLINE_MS } from './deadline'\nimport { deprecated } from './deprecate'\n\nexport interface ConnectOptions {\n  /** The system's name, as its organizations are filed under: lowercase, digits, - or _. */\n  system: string\n  /** The application's public address: `https://app.example.com`, or `http://localhost:3000` while developing. */\n  appUrl: string\n  /** Shown to people on Cauthy's pages. Default: the system's name. */\n  name?: string\n  /** Where the application serves the return from a sign-in. Default: `/api/auth/callback`. */\n  callbackPath?: string\n  /** An https address of the application that receives Cauthy's events. */\n  eventsUrl?: string\n  /** The events to receive. Default: all of them. */\n  events?: string[]\n  /** Where the application publishes its keys, to prove itself without a secret. */\n  jwksUri?: string\n  /** Cauthy's address. Default: `CAUTHY_ISSUER`. */\n  issuer?: string\n  /** The workspace's slug. Default: `CAUTHY_TENANT`. */\n  tenant?: string\n  /** A personal access token with `systems:connect`. Default: `CAUTHY_TOKEN`. */\n  token?: string\n  fetch?: typeof fetch\n  /** How long the call may take, in milliseconds, before it fails with a `TimeoutError`. Default: 5000. */\n  timeoutMs?: number\n}\n\nexport interface Connected {\n  system: string\n  clientId: string\n  /** Shown this once: Cauthy keeps only its hash. */\n  clientSecret: string\n  redirectUris: string[]\n  /**\n   * The subscription to events, when `eventsUrl` was given. Its `secret` signs\n   * the HMAC header (X-Cauthy-Signature) and is shown this once; `auth.webhook`\n   * does not need it, as it verifies by Cauthy's published keys.\n   */\n  webhook: { id: string; url: string; events: string[]; secret: string } | null\n  /**\n   * Everything the application sets: what Cauthy answered, plus CAUTHY_SECRET,\n   * the key of the session cookie, generated here and known to nobody else.\n   */\n  env: Record<string, string>\n}\n\nfunction sessionSecret(): string {\n  const bytes = crypto.getRandomValues(new Uint8Array(32))\n  let s = ''\n  for (const b of bytes) s += String.fromCharCode(b)\n  return btoa(s).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')\n}\n\n/** @deprecated Connect a system with the cauthy CLI (`npx cauthy init`); leaves in 2.0. */\nexport async function connectSystem(o: ConnectOptions): Promise<Connected> {\n  deprecated('connectSystem', 'Connect a system with the cauthy CLI: npx cauthy init.')\n  const env = (n: string) => (typeof process !== 'undefined' ? process.env?.[n] : undefined)\n  const issuer = withoutTrailingSlashes(o.issuer ?? env('CAUTHY_ISSUER') ?? '')\n  const tenant = o.tenant ?? env('CAUTHY_TENANT') ?? ''\n  const token = o.token ?? env('CAUTHY_TOKEN') ?? ''\n  for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {\n    if (v === '') throw new Error(`@cauthyhq/node: ${name} is required to connect a system`)\n  }\n  const res = await deadline(o.fetch, o.timeoutMs ?? DEFAULT_DEADLINE_MS)(`${issuer}/v1/connect`, {\n    method: 'POST',\n    headers: { authorization: `Bearer ${token}`, 'x-tenant-key': tenant, 'content-type': 'application/json' },\n    body: JSON.stringify({ system: o.system, app_url: o.appUrl, name: o.name, callback_path: o.callbackPath,\n      events_url: o.eventsUrl, events: o.events, jwks_uri: o.jwksUri }),\n  })\n  const body = (await res.json().catch(() => null)) as {\n    data?: { system: string; client_secret: string; client: { client_id: string; redirect_uris: string[] }\n      webhook: Connected['webhook']; env: Record<string, string> }\n    errors?: { field?: string; message?: string }[]\n  } | null\n  if (!res.ok || !body?.data) {\n    const why = (body?.errors ?? []).map((e) => e.message).filter(Boolean).join('; ') || res.statusText\n    throw new Error(`@cauthyhq/node: Cauthy did not connect the system (${res.status}): ${why}`)\n  }\n  const d = body.data\n  return { system: d.system, clientId: d.client.client_id, clientSecret: d.client_secret, redirectUris: d.client.redirect_uris,\n    webhook: d.webhook, env: { ...d.env, CAUTHY_SECRET: sessionSecret() } }\n}\n\n/** The variables as the lines of an env file. */\nexport function envFile(env: Record<string, string>): string {\n  return Object.entries(env).map(([k, v]) => `${k}=${v}`).join('\\n') + '\\n'\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACKA,IAAM,OAAO;AAEN,SAAS,YAAY,QAAwD;AAClF,QAAMA,OAAM,oBAAI,IAAoB;AACpC,aAAW,SAAS,UAAU,IAAI,MAAM,GAAG,GAAG;AAC5C,UAAM,IAAI,KAAK,QAAQ,GAAG;AAC1B,QAAI,IAAI,EAAG,CAAAA,KAAI,IAAI,KAAK,MAAM,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,MAAM,IAAI,CAAC,EAAE,KAAK,CAAC;AAAA,EACtE;AACA,SAAOA;AACT;AAGO,SAAS,UAAU,SAA8B,MAA6B;AACnF,MAAI,QAAQ;AACZ,WAAS,IAAI,GAAG,QAAQ,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,GAAG,IAAK,UAAS,QAAQ,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE;AACrF,SAAO,UAAU,KAAK,OAAO;AAC/B;AAQA,SAAS,WAAW,GAA6B;AAG/C,SAAO,QAAQ,EAAE,QAAQ,GAAG,2BAA2B,EAAE,WAAW,SAAY,KAAK,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,aAAa,EAAE;AAC3I;AAEO,SAAS,YAAY,MAAc,OAAe,GAA6B;AACpF,SAAO,GAAG,IAAI,IAAI,KAAK,KAAK,WAAW,CAAC,CAAC;AAC3C;AAMO,SAAS,WAAW,MAAc,OAAe,GAAqB,KAAoC;AAC/G,QAAMA,OAAgB,CAAC;AACvB,MAAI,IAAI;AACR,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,KAAM,CAAAA,KAAI,KAAK,YAAY,GAAG,IAAI,IAAI,GAAG,IAAI,MAAM,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC;AAChH,WAAS,IAAI,GAAG,IAAI,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,GAAG,IAAK,CAAAA,KAAI,KAAK,YAAY,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,GAAG,GAAG,QAAQ,EAAE,CAAC,CAAC;AAC3G,SAAOA;AACT;AAEO,SAAS,WAAW,MAAc,GAAqB,KAAoC;AAChG,QAAMA,OAAgB,CAAC;AACvB,WAAS,IAAI,GAAG,IAAI,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,KAAK,MAAM,GAAG,IAAK,CAAAA,KAAI,KAAK,YAAY,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,GAAG,GAAG,QAAQ,EAAE,CAAC,CAAC;AACtH,SAAOA;AACT;;;ACnDA,kBAA+C;AAE/C,IAAM,UAAU,IAAI,YAAY;AAChC,IAAM,UAAU,IAAI,YAAY;AAGhC,eAAsB,MAAM,QAAqC;AAC/D,SAAO,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,WAAW,QAAQ,OAAO,MAAM,CAAC,CAAC;AACrF;AAEA,eAAsB,KAAK,OAAgB,KAAkC;AAC3E,SAAO,IAAI,2BAAe,QAAQ,OAAO,KAAK,UAAU,KAAK,CAAC,CAAC,EAC5D,mBAAmB,EAAE,KAAK,OAAO,KAAK,UAAU,CAAC,EACjD,QAAQ,GAAG;AAChB;AAGA,eAAsB,OAAU,QAAgB,KAAoC;AAClF,MAAI;AACF,UAAM,EAAE,UAAU,IAAI,UAAM,4BAAe,QAAQ,KAAK;AAAA,MACtD,yBAAyB,CAAC,KAAK;AAAA,MAC/B,6BAA6B,CAAC,SAAS;AAAA,IACzC,CAAC;AACD,WAAO,KAAK,MAAM,QAAQ,OAAO,SAAS,CAAC;AAAA,EAC7C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAsB,UAAa,QAAgB,MAAuC;AACxF,UAAQ,MAAM,cAAiB,QAAQ,IAAI,IAAI,SAAS;AAC1D;AAGA,eAAsB,cAAiB,QAAgB,MAAiE;AACtH,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS;AAChD,UAAM,QAAQ,MAAM,OAAU,QAAQ,KAAK,KAAK,CAAC;AACjD,QAAI,UAAU,KAAM,QAAO,EAAE,OAAO,MAAM;AAAA,EAC5C;AACA,SAAO;AACT;;;ACwNO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAC3C,YAAY,SAAiB;AAC3B,UAAM,mBAAmB,OAAO,EAAE;AAClC,SAAK,OAAO;AAAA,EACd;AACF;AAOO,IAAM,iBAAN,cAA6B,kBAAkB;AAAA,EACpD,YAAqB,QAAyB,SAAiB;AAC7D,UAAM,eAAe,OAAO,KAAK,MAAM,GAAG;AADvB;AAEnB,SAAK,OAAO;AAAA,EACd;AAAA,EAHqB;AAIvB;;;ACjRO,SAAS,uBAAuB,GAAmB;AACxD,MAAI,MAAM,EAAE;AACZ,SAAO,MAAM,KAAK,EAAE,WAAW,MAAM,CAAC,MAAM,GAAI;AAChD,SAAO,EAAE,MAAM,GAAG,GAAG;AACvB;;;ACmDO,IAAM,qBAAqB;AAAA,EAChC;AAAA,EAAiB;AAAA,EAAoB;AAAA,EAAwB;AAAA,EAC7D;AAAA,EAAiB;AAAA,EAAiB;AAAA,EAAqB;AACzD;AAGO,SAAS,WAAW,aAAmE;AAC5F,QAAM,MAAM,mBAAmB,OAAO,WAAS,cAAc,IAAI,KAAK,QAAQ,EAAE;AAChF,MAAI,IAAI,SAAS,GAAG;AAClB,UAAM,IAAI,kBAAkB,yCAAyC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,WAAW,IAAI,OAAO,KAAK,wBACvG,IAAI,WAAW,IAAI,OAAO,UAAU,4DAA4D;AAAA,EACjH;AACF;AAEA,IAAM,OAAO;AACb,IAAM,OAAO;AACb,IAAM,WAAW;AAqBjB,IAAM,OAAO,CAAC,MAAgB,OAAO,MAAM,WAAW,IAAI;AAE1D,SAAS,aAAa,KAAa,MAAmB;AACpD,MAAI;AACJ,MAAI;AACF,QAAI,IAAI,IAAI,GAAG;AAAA,EACjB,QAAQ;AACN,UAAM,IAAI,kBAAkB,kBAAkB,IAAI,uBAAuB,KAAK,UAAU,GAAG,CAAC,EAAE;AAAA,EAChG;AACA,QAAM,QAAQ,EAAE,aAAa,eAAe,EAAE,aAAa;AAC3D,MAAI,EAAE,aAAa,YAAY,EAAE,EAAE,aAAa,WAAW,QAAQ;AACjE,UAAM,IAAI,kBAAkB,kBAAkB,IAAI,mBAAmB,GAAG,EAAE;AAAA,EAC5E;AACA,SAAO;AACT;AAGO,SAAS,aAAa,SAA4C;AACvE,QAAM,EAAE,OAAO,IAAI;AACnB,QAAM,WAAW,QAAQ,YAAY;AACrC,MAAI,CAAC,KAAK,KAAK,UAAU,EAAE,EAAG,OAAM,IAAI,kBAAkB,uEAAwE;AAClI,QAAM,QAAS,QAAQ,SAAS,OAAO,QAAQ,UAAU,YAAY,aAAa,QAAQ,SAAS,EAAE,WAAW,QAAQ,SACnH,QAAQ,MAA+B,UACxC,QAAQ;AACZ,MAAI,CAAC,SAAS,CAAC,MAAM,QAAQ,MAAM,KAAK,KAAK,CAAC,MAAM,QAAQ,MAAM,KAAK,GAAG;AACxE,UAAM,IAAI,kBAAkB,gGAAgG;AAAA,EAC9H;AACA,QAAM,OAAO,CAAC,OAAe,MAAM,OAAO,KAAK,OAAK,EAAE,SAAS,YAAY,EAAE,OAAO,EAAE;AACtF,QAAM,MAAM,KAAK,MAAM;AACvB,MAAI,CAAC,IAAK,OAAM,IAAI,kBAAkB,4BAA4B,MAAM,GAAG;AAC3E,QAAM,SAAS,KAAK,QAAQ;AAC5B,MAAI,CAAC,OAAQ,OAAM,IAAI,kBAAkB,4BAA4B,QAAQ,GAAG;AAEhF,QAAM,QAAQ,MAAM,MAAM,OAAO,CAAAC,OAAKA,GAAE,aAAa,WAAWA,GAAE,SAAS,UAAUA,GAAE,OAAO,YAAYA,GAAE,OAAO,EAChH,OAAO,CAAAA,OAAK,QAAQ,SAAS,UAAaA,GAAE,SAAS,QAAQ,IAAI;AACpE,MAAI,MAAM,WAAW,GAAG;AACtB,UAAM,IAAI,kBAAkB,QAAQ,OAChC,0BAA0B,QAAQ,IAAI,UAAU,MAAM,OAAO,QAAQ,kBACrE,8BAA8B,MAAM,qBAAqB,QAAQ,oEAAoE;AAAA,EAC3I;AACA,MAAI,MAAM,SAAS,GAAG;AACpB,UAAM,IAAI,kBAAkB,GAAG,MAAM,QAAQ,MAAM,MAAM,aAAa,QAAQ,2CAA2C,MAAM,IAAI,OAAK,KAAK,EAAE,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE;AAAA,EACpK;AACA,QAAM,IAAI,MAAM,CAAC;AACjB,QAAM,OAAO,KAAK,EAAE,IAAI;AAIxB,QAAM,QAAQ,KAAK,EAAE,UAAU,MAAM;AACrC,QAAM,SAAS,KAAK,EAAE,UAAU,SAAS;AACzC,MAAI,UAAU,YAAY,WAAW,SAAU,OAAM,IAAI,kBAAkB,YAAY,IAAI,sEAAsE;AACjK,MAAI;AACJ,MAAI;AACJ,MAAI,KAAK,KAAK,KAAK,GAAG;AACpB,QAAI,WAAW,MAAM,OAAO,YAAY,MAAM,MAAM,YAAY,GAAG;AACjE,YAAM,IAAI,kBAAkB,YAAY,IAAI,wBAAwB,KAAK,sBAAsB,MAAM,uCAAuC;AAAA,IAC9I;AACA,eAAW;AACX,aAAS,MAAM,OAAO,WAAW,CAAC,GAAG,KAAK,OAAK,EAAE,OAAO,KAAK,GAAG,IAAI;AACpE,QAAI,WAAW,GAAI,OAAM,IAAI,kBAAkB,qDAAqD,KAAK,kBAAkB,IAAI,OAAO;AAAA,EACxI,OAAO;AACL,QAAI,CAAC,KAAK,KAAK,KAAK,EAAG,OAAM,IAAI,kBAAkB,YAAY,IAAI,0DAA0D;AAC7H,QAAI,CAAC,KAAK,KAAK,MAAM,GAAG;AACtB,YAAM,IAAI,kBAAkB,EAAE,UAAU,kBAAkB,OACtD,YAAY,IAAI,qCAAqC,KAAK,+HAC1D,YAAY,IAAI,yBAAyB,KAAK,gFAAgF;AAAA,IACpI;AACA,eAAW;AACX,aAAS;AAAA,EACX;AACA,QAAM,SAAS,uBAAuB,aAAa,KAAK,OAAO,GAAG,GAAG,cAAc,QAAQ,EAAE,EAAE,IAAI;AACnG,QAAM,SAAS,EAAE,WAAW,CAAC;AAC7B,QAAM,WAAW,KAAK,OAAO,SAAS,KAAK,QAAQ,IAAI;AACvD,QAAM,eAAe,MAAM,QAAQ,OAAO,aAAa,IAAI,OAAO,cAAc,IAAI,IAAI,EAAE,OAAO,OAAO,IAAI,CAAC;AAC7G,MAAI,aAAa,WAAW,EAAG,OAAM,IAAI,kBAAkB,YAAY,IAAI,wBAAwB;AAGnG,QAAM,QAAQ,KAAK,OAAO,YAAY;AACtC,MAAI,OAAO,iBAAiB,UAAa,UAAU,SAAS,UAAU,UAAU,UAAU,YAAY;AACpG,UAAM,IAAI,kBAAkB,YAAY,IAAI,qBAAqB,KAAK,UAAU,OAAO,YAAY,CAAC,+EAA+E;AAAA,EACrL;AACA,QAAM,cAA+C,UAAU,SAAS,UAAU,UAAU,UAAU,aAClG,QACA,OAAO,yBAAyB,OAAO,aAAa;AACxD,MAAI,gBAAgB,SAAS,CAAC,EAAE,SAAS;AACvC,UAAM,IAAI,kBAAkB,YAAY,IAAI,iCAAiC,WAAW,eAAe,MAAM,wDAAwD;AAAA,EACvK;AAEA,QAAMC,OAAwB;AAAA,IAC5B;AAAA,IAAQ;AAAA,IAAM;AAAA,IAAQ;AAAA,IAAU;AAAA,IAAQ;AAAA,IAAU;AAAA,IAClD,oBAAoB,gBAAgB;AAAA,IACpC;AAAA,IACA,sBAAsB,OAAO,2BAA2B;AAAA,IACxD,oBAAoB,OAAO,wBAAwB;AAAA,EACrD;AACA,MAAI,EAAE,SAAS;AACb,IAAAA,KAAI,kBAAkB,KAAK,EAAE,QAAQ,SAAS,KAAK,QAAQ,IAAI;AAC/D,UAAM,OAAO,KAAK,EAAE,QAAQ,QAAQ,KAAK,KAAK,IAAI,QAAQ;AAC1D,QAAI,SAAS,GAAI,OAAM,IAAI,kBAAkB,YAAY,IAAI,UAAU,MAAM,0BAA0B,MAAM,oBAAoB;AACjI,IAAAA,KAAI,UAAU,aAAa,MAAM,UAAU,EAAE;AAC7C,IAAAA,KAAI,WAAW,IAAI,IAAIA,KAAI,OAAO,EAAE;AAAA,EACtC;AACA,MAAI,KAAK,IAAI,UAAU,MAAM,GAAI,CAAAA,KAAI,YAAY,aAAa,KAAK,IAAI,UAAU,GAAG,YAAY,EAAE;AAClG,SAAOA;AACT;;;ACnLA,IAAAC,eAAsG;AAgC/F,IAAM,kBAAkB,KAAK,KAAK,KAAK;AAE9C,IAAM,kBAAkB,IAAI,KAAK,KAAK,KAAK;AAE3C,IAAM,iBAAiB,IAAI,KAAK;AAEzB,IAAM,iBAAiB;AAEvB,IAAM,iBAAiB,iBAAiB,MAAM;AAErD,IAAM,kBAAkB,IAAI;AAc5B,IAAM,cAAc,CAACC,UAAsB,CAAC,GAAGA,KAAI,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,UAAU,cAAc,EAAE,SAAS,KAAK,EAAE,IAAI,cAAc,EAAE,GAAG,CAAC;AAExI,SAAS,UAAU,KAAqB;AACtC,QAAM,EAAE,KAAK,GAAG,EAAE,IAAI,IAAI;AAC1B,SAAO,EAAE,KAAK,GAAG,GAAG,KAAK,IAAI,KAAK,KAAK,SAAS,KAAK,MAAM;AAC7D;AAEO,SAAS,SAAS,OAAiB,UAA4B,MAAoB,KAAK,KAAe;AAC5G,MAAI;AACJ,MAAI;AAEJ,iBAAe,KAAK,OAAuC;AACzD,UAAM,EAAE,WAAW,WAAW,IAAI,UAAM,8BAAgB,SAAS,EAAE,eAAe,MAAM,aAAa,KAAK,CAAC;AAC3G,UAAM,YAAY,UAAM,wBAAU,SAAS;AAC3C,UAAM,MAAM,UAAM,qCAAuB,SAAS;AAElD,UAAM,KAAK,KAAK,IAAI,IAAI,GAAG,QAAQ,KAAK,MAAM,MAAM,SAAS,IAAI,IAAI,CAAC;AACtE,UAAM,MAAiB,EAAE,KAAK,WAAW,QAAQ,MAAM,KAAK,UAAM,wBAAU,UAAU,IAAI,MAAM,UAAU,CAAC,CAAC,GAAG,WAAW,IAAI,KAAK,EAAE,EAAE,YAAY,EAAE;AACrJ,QAAI,CAAC,SAAS,MAAM,SAAU,OAAM,MAAM,SAAS,GAAG;AAAA,QACjD,OAAM,MAAM,IAAI,GAAG;AACxB,WAAO;AAAA,EACT;AAEA,QAAM,MAAM,CAAC,QAAmB,IAAI,IAAI,KAAK,MAAM,IAAI,SAAS;AAKhE,WAAS,OAAO,MAAsD;AACpE,UAAM,OAAO,KAAK,KAAK,OAAK,IAAI,CAAC,KAAK,aAAa;AACnD,QAAI,CAAC,KAAM,QAAO,EAAE,KAAK,KAAK,KAAK,SAAS,CAAC,GAAG,OAAO,IAAI,IAAI,gBAAgB;AAE/E,UAAM,QAAQ,SAAS,KAAK,CAAC,IAAI,IAAI,IAAI,iBAAiB,KAAK,IAAI,IAAI,IAAI,gBAAgB,KAAK,MAAM,KAAK,CAAC,EAAE,SAAS,IAAI,aAAa;AACxI,WAAO,EAAE,KAAK,MAAM,MAAM;AAAA,EAC5B;AAEA,iBAAe,KAAK,KAA8D;AAChF,UAAM,OAAO,MAAM;AACnB,aAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,YAAM,MAAM,MAAM,OAAY,IAAI,QAAQ,KAAK,CAAC,CAAC;AACjD,UAAI,QAAQ,KAAM,QAAO,EAAE,KAAK,OAAO,MAAM,EAAE;AAAA,IACjD;AACA,WAAO;AAAA,EACT;AAGA,iBAAe,WAAiC;AAC9C,UAAM,OAAO,YAAY,MAAM,MAAM,KAAK,CAAC;AAC3C,QAAI,KAAK,SAAS,EAAG,QAAO;AAG5B,eAAW,KAAK,EAAE,QAAQ,MAAM;AAAE,eAAS;AAAA,IAAU,CAAC;AACtD,UAAM;AACN,UAAM,QAAQ,YAAY,MAAM,MAAM,KAAK,CAAC;AAC5C,QAAI,MAAM,WAAW,EAAG,OAAM,IAAI,kBAAkB,iDAAiD;AACrG,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL,MAAM,UAAU;AACd,UAAI,cAAc,WAAW,QAAQ,IAAI,EAAG,QAAO;AACnD,YAAM,EAAE,KAAK,MAAM,IAAI,OAAO,MAAM,SAAS,CAAC;AAC9C,UAAI,YAAY,QAAQ,IAAI,KAAK;AAC/B,mBAAW,QAAQ;AACnB,eAAO;AAAA,MACT;AACA,YAAM,SAAS,MAAM,KAAK,GAAG;AAC7B,UAAI,WAAW,MAAM;AACnB,cAAM,IAAI,kBAAkB,WAAW,IAAI,GAAG,kIACiC;AAAA,MACjF;AACA,mBAAa,EAAE,KAAK,IAAI,KAAK,YAAY,UAAM,wBAAU,OAAO,KAAK,OAAO,GAAG,MAAM;AACrF,aAAO;AAAA,IACT;AAAA,IACA,MAAM,YAAY;AAGhB,YAAM,OAAO,MAAM,SAAS;AAC5B,YAAMC,OAAa,CAAC;AACpB,eAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AAEpC,YAAI,MAAM,KAAK,IAAI,IAAI,KAAK,MAAM,KAAK,IAAI,CAAC,EAAE,SAAS,IAAI,gBAAiB,CAAAA,KAAI,KAAK,UAAU,KAAK,CAAC,CAAC,CAAC;AAAA,iBAC9F,IAAI,IAAI,KAAK,MAAM,KAAK,IAAI,CAAC,EAAE,SAAS,IAAI,gBAAiB,OAAM,MAAM,OAAO,KAAK,CAAC,EAAE,GAAG;AAAA,MACtG;AACA,aAAO,EAAE,MAAMA,KAAI;AAAA,IACrB;AAAA,IACA,MAAM,SAAS;AACb,YAAM,MAAM,MAAM,KAAK,YAAY,MAAM,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;AACzD,mBAAa;AACb,aAAO,IAAI;AAAA,IACb;AAAA,IACA,MAAM,SAAS;AACb,UAAI,UAAU;AACd,YAAM,OAAO,MAAM;AACnB,iBAAW,OAAO,MAAM,MAAM,KAAK,GAAG;AACpC,cAAM,SAAS,MAAM,KAAK,GAAG;AAC7B,YAAI,WAAW,QAAQ,OAAO,MAAO;AACrC,cAAM,MAAM,OAAO,EAAE,GAAG,KAAK,QAAQ,MAAM,KAAK,OAAO,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;AACtE;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA,EACF;AACF;;;AChKA,IAAMC,WAAU,IAAI,YAAY;AAGzB,IAAM,eAAe;AAK5B,eAAe,OAAO,MAAc,SAA0C;AAC5E,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAOA,SAAQ,OAAO,IAAI,GAAG,QAAQ,OAAO,CAAC,YAAY,CAAC;AACpG,QAAM,OAAO,MAAM,OAAO,OAAO;AAAA,IAC/B,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,IAAI,WAAW,CAAC,GAAG,MAAMA,SAAQ,OAAO,QAAQ,OAAO,KAAK,EAAE;AAAA,IAAG;AAAA,IAAK;AAAA,EAAG;AAClH,SAAO,IAAI,WAAW,IAAI;AAC5B;AASO,SAAS,WAAW,MAAc,UAAgC;AACvE,MAAI,KAAK,SAAS,cAAc;AAC9B,UAAM,IAAI,kBAAkB,4CAA4C,YAAY,4DAA4D;AAAA,EAClJ;AACA,MAAI,aAAa,UAAa,aAAa,MAAM,SAAS,SAAS,cAAc;AAC/E,UAAM,IAAI,kBAAkB,mEAAmE,YAAY,aAAa;AAAA,EAC1H;AACA,QAAM,QAAQ,YAAY,aAAa,OAAO,CAAC,MAAM,QAAQ,IAAI,CAAC,IAAI;AACtE,QAAM,OAAO,CAAC,YAAwB,QAAQ,IAAI,MAAM,IAAI,OAAK,OAAO,GAAG,OAAO,CAAC,CAAC;AACpF,SAAO,EAAE,MAAM,KAAK,MAAM,GAAG,QAAQ,KAAK,QAAQ,GAAG,MAAM,KAAK,MAAM,EAAE;AAC1E;;;AC/CO,IAAM,sBAAsB;AAG5B,IAAM,YAAY,CAAC,QAA2B,KAAmC,SAAS;AAE1F,SAAS,SAAS,MAAgC,IAA0B;AACjF,SAAO,OAAO,OAAO,OAAO,CAAC,MAAM;AACjC,UAAM,OAAO,QAAQ;AACrB,UAAM,SAAS,IAAI,QAAQ,KAAK,OAAO,EAAE,IAAI,QAAQ,GAAG,SAAS,mBAAmB,MAAM;AAC1F,QAAI,CAAC,QAAQ;AAEX,YAAM,QAAQ,YAAY,QAAQ,EAAE;AACpC,aAAO,KAAK,OAAO,EAAE,GAAG,MAAM,QAAQ,KAAK,SAAS,UAAU,CAAC,KAAK,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC;AAAA,IAC/F;AACA,UAAM,MAAM,IAAI,gBAAgB;AAChC,UAAM,QAAQ,WAAW,MAAM,IAAI,MAAM,IAAI,aAAa,gCAAgC,EAAE,OAAO,cAAc,CAAC,GAAG,EAAE;AACvH,QAAI;AACF,aAAO,MAAM,KAAK,OAAO,EAAE,GAAG,MAAM,QAAQ,KAAK,SAAS,UAAU,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC;AAAA,IAC/G,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF;AACF;AAEA,SAAS,UAAU,SAAqC;AACtD,MAAI,OAAO,YAAY,QAAQ,WAAY,QAAO,YAAY,IAAI,OAAO;AAEzE,QAAM,aAAa,IAAI,gBAAgB;AACvC,aAAW,UAAU,SAAS;AAC5B,QAAI,OAAO,SAAS;AAClB,iBAAW,MAAM,OAAO,MAAM;AAC9B;AAAA,IACF;AACA,WAAO,iBAAiB,SAAS,MAAM,WAAW,MAAM,OAAO,MAAM,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,EACxF;AACA,SAAO,WAAW;AACpB;;;ACrBA,SAAS,QAAQ,OAAe,UAAkB,QAAyB;AAEzE,QAAM,IAAI,MAAM,YAAY,GAAG;AAC/B,MAAI,IAAI,EAAG,QAAO;AAClB,QAAM,IAAI,MAAM,MAAM,GAAG,CAAC;AAC1B,QAAM,IAAI,MAAM,MAAM,IAAI,CAAC;AAC3B,UAAQ,MAAM,OAAO,MAAM,cAAc,MAAM,OAAO,MAAM;AAC9D;AAgBO,SAAS,IAAI,cAA4C,UAAkB,QAAyB;AACzG,MAAI,CAAC,cAAc,YAAa,QAAO;AACvC,OAAK,aAAa,UAAU,CAAC,GAAG,KAAK,CAAC,MAAM,QAAQ,GAAG,UAAU,MAAM,CAAC,EAAG,QAAO;AAClF,SAAO,aAAa,YAAY,KAAK,CAAC,MAAM,QAAQ,GAAG,UAAU,MAAM,CAAC;AAC1E;AA4KO,SAAS,aAAa,OAAwG;AACnI,QAAM,QAA8B,MAAM,QAAQ,KAAK,IAAI,QAAS,MAA2E;AAC/I,QAAM,YAAsC,MAAM,QAAQ,KAAK,IAAI,CAAC,IAAK,MAA2E,WAAW,CAAC;AAChK,QAAM,QAAQ,CAAC,MAA4C,GAAG,EAAE,QAAQ,IAAI,EAAE,MAAM;AACpF,QAAM,SAAS,IAAI,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACpD,QAAM,QAAQ,CAAC,eAAyC;AACtD,UAAM,IAAI,WAAW,YAAY,GAAG;AACpC,WAAO,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,MAAM,GAAG,CAAC,GAAG,WAAW,MAAM,IAAI,CAAC,CAAC;AAAA,EACpF;AACA,SAAO;AAAA,IACL,OAAO,MAAM,IAAI,CAAC,OAAO;AAAA,MACvB,MAAM,EAAE;AAAA,MACR,GAAI,EAAE,SAAS,SAAY,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;AAAA,MAC/C,GAAI,EAAE,gBAAgB,SAAY,EAAE,aAAa,EAAE,YAAY,IAAI,CAAC;AAAA,MACpE,GAAI,EAAE,WAAW,EAAE,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC;AAAA,MAClD,GAAI,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC;AAAA,IAC/E,EAAE;AAAA,IACF,SAAS,UAAU,IAAI,CAAC,OAAO;AAAA,MAC7B,UAAU,EAAE;AAAA,MACZ,GAAI,EAAE,gBAAgB,SAAY,EAAE,aAAa,EAAE,YAAY,IAAI,CAAC;AAAA,MACpE,SAAS,CAAC,GAAG,EAAE,OAAO;AAAA,MACtB,GAAI,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC;AAAA,IAC5D,EAAE;AAAA,IACF,WAAW,MAAM,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,IAClC,aAAa,CAAC,GAAG,IAAI,IAAI,MAAM,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC;AAAA,IAChF,IAAI,cAAc,YAAY;AAC5B,YAAM,CAAC,UAAU,MAAM,IAAI,MAAM,UAAU;AAC3C,aAAO,IAAI,cAAc,UAAU,MAAM;AAAA,IAC3C;AAAA,IACA,QAAQ,iBAAiB,QAAQ;AAC/B,aAAO,gBAAgB,QAAQ,OAAO,SAAS,aAAa,IAAI;AAAA,IAClE;AAAA,IACA,cAAc,MAAM;AAClB,YAAM,OAAO,oBAAI,IAAY;AAC7B,YAAMC,OAAM,oBAAI,IAAY;AAC5B,YAAM,OAAO,CAAC,SAAiB;AAC7B,YAAI,KAAK,IAAI,IAAI,EAAG;AACpB,aAAK,IAAI,IAAI;AACb,cAAM,IAAI,OAAO,IAAI,IAAI;AACzB,mBAAW,KAAK,GAAG,eAAe,CAAC,EAAG,CAAAA,KAAI,IAAI,MAAM,CAAC,CAAC;AACtD,mBAAW,UAAU,GAAG,YAAY,CAAC,EAAG,MAAK,MAAM;AAAA,MACrD;AACA,WAAK,IAAI;AACT,aAAO,CAAC,GAAGA,IAAG;AAAA,IAChB;AAAA;AAAA;AAAA,IAGA,MAAM,UAA+D,MAAiB;AACpF,aAAO,MAAM,MAAM,GAAG,IAAI;AAAA,IAC5B;AAAA,EACF;AACF;AAEA,IAAM,QAAQ;AAcP,SAAS,aAAa,QAAgB,MAAmF;AAC9H,QAAM,QAAQ,MAAM,QAAQ,IAAI,IAAI,OAAO,KAAK;AAChD,QAAM,UAAU,MAAM,QAAQ,IAAI,IAAI,CAAC,IAAK,KAAK,WAAW,CAAC;AAC7D,QAAMC,QAAO,CAAC,MAAc,KAAK,UAAU,CAAC;AAC5C,QAAM,MAAM,CAAC,MAAe,MAAM,KAAK,CAAC,IAAI,IAAIA,MAAK,CAAC;AACtD,QAAM,MAAM,CAAC,GAAe,QAAgB;AAC1C,UAAM,QAAQ,CAAC,SAASA,MAAK,EAAE,IAAI,CAAC,EAAE;AACtC,QAAI,EAAE,KAAM,OAAM,KAAK,SAASA,MAAK,EAAE,IAAI,CAAC,EAAE;AAC9C,QAAI,EAAE,YAAa,OAAM,KAAK,gBAAgBA,MAAK,EAAE,WAAW,CAAC,EAAE;AACnE,QAAI,EAAE,UAAU,OAAQ,OAAM,KAAK,cAAc,EAAE,SAAS,IAAIA,KAAI,EAAE,KAAK,IAAI,CAAC,GAAG;AACnF,QAAI,EAAE,aAAa,QAAQ;AACzB,YAAM,OAAO,EAAE,YAAY,IAAI,CAAC,MAAM,GAAG,GAAG,WAAW;AAAA,QACrD,GAAI,EAAE,QAAQ,EAAE,SAAS,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,KAAKA,MAAK,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;AAAA,QACtE,aAAaA,MAAK,EAAE,QAAQ,CAAC;AAAA,QAC7B,WAAWA,MAAK,EAAE,MAAM,CAAC;AAAA,QACzB,GAAI,EAAE,YAAY,CAAC,cAAcA,MAAK,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC;AAAA,MAC3D,EAAE,KAAK,IAAI,CAAC,KAAK;AACjB,YAAM,KAAK;AAAA,EAAmB,KAAK,KAAK,IAAI,CAAC;AAAA,EAAK,GAAG,OAAO;AAAA,IAC9D;AACA,WAAO,GAAG,GAAG;AAAA,EAAQ,GAAG,OAAO,MAAM,KAAK;AAAA,EAAM,GAAG,MAAM,CAAC;AAAA,EAAM,GAAG;AAAA,EACrE;AACA,QAAM,WAAW,CAAC,MAAuB;AACvC,UAAM,QAAQ,CAAC,aAAaA,MAAK,EAAE,QAAQ,CAAC,EAAE;AAC9C,QAAI,EAAE,YAAa,OAAM,KAAK,gBAAgBA,MAAK,EAAE,WAAW,CAAC,EAAE;AACnE,UAAM,KAAK,aAAa,EAAE,QAAQ,IAAIA,KAAI,EAAE,KAAK,IAAI,CAAC,GAAG;AACzD,UAAM,QAAQ,OAAO,QAAQ,EAAE,cAAc,CAAC,CAAC;AAC/C,QAAI,MAAM,OAAQ,OAAM,KAAK,iBAAiB,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,KAAKA,MAAK,CAAC,CAAC,EAAE,EAAE,KAAK,IAAI,CAAC,IAAI;AAC3G,WAAO,SAAS,MAAM,KAAK,IAAI,CAAC;AAAA,EAClC;AACA,QAAM,OAAO,8BAA8BA,MAAK,MAAM,CAAC;AAAA;AAAA;AAAA;AAIvD,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO,GAAG,IAAI;AAAA;AAAA;AAAA;AAAA,EAIhB,MAAM,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOvC;AACA,SAAO,GAAG,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,EAKd,QAAQ,IAAI,QAAQ,EAAE,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA,EAGhC,MAAM,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAU3C;AAWA,SAAS,MAAM,GAAqC,OAAsB;AACxE,QAAMC,OAAM,CAAC,MAAe,OAAO,YAAY,cAAc,QAAQ,MAAM,CAAC,IAAI;AAChF,QAAM,IAAI;AAAA,IACR,QAAQ,uBAAuB,EAAE,UAAUA,KAAI,eAAe,KAAK,EAAE;AAAA,IACrE,QAAQ,EAAE,UAAUA,KAAI,eAAe,KAAK;AAAA,IAC5C,QAAQ,EAAE,UAAUA,KAAI,eAAe,KAAK;AAAA,IAC5C,OAAO,EAAE,SAASA,KAAI,cAAc,KAAK;AAAA,EAC3C;AACA,aAAW,CAAC,MAAM,CAAC,KAAK,OAAO,QAAQ,EAAE,eAAe,EAAE,QAAQ,eAAe,EAAE,QAAQ,eAAe,EAAE,QAAQ,cAAc,EAAE,MAAM,CAAC,GAAG;AAC5I,QAAI,MAAM,GAAI,OAAM,IAAI,MAAM,mBAAmB,IAAI,mBAAmB,KAAK,EAAE;AAAA,EACjF;AACA,SAAO,EAAE,GAAG,GAAG,OAAO,SAAS,EAAE,OAAO,EAAE,aAAa,mBAAmB,EAAE;AAC9E;AAEA,eAAe,WAAW,GAAU,QAAuB,MAA4B,MAA8B;AACnH,QAAM,MAAM,MAAM,EAAE,MAAM,GAAG,EAAE,MAAM,eAAe,mBAAmB,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI;AAAA,IAC1F,GAAI,WAAW,QAAQ,EAAE,OAAO,IAAI,CAAC;AAAA,IACrC,SAAS;AAAA,MACP,eAAe,UAAU,EAAE,KAAK;AAAA,MAAI,gBAAgB,EAAE;AAAA,MACtD,GAAI,SAAS,SAAY,EAAE,QAAQ,mBAAmB,IAAI,EAAE,gBAAgB,mBAAmB;AAAA,IACjG;AAAA,IACA,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,IAAI,EAAE;AAAA,EAC7D,CAAC;AACD,QAAM,SAAU,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AACjD,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,OAAO,WAAW,QAAQ,uBAAuB,IAAI,KAAK,eAAe,IAAI;AACnF,UAAM,IAAI,MAAM,0BAA0B,IAAI,KAAK,IAAI,MAAM,MAAM,QAAQ,SAAS,CAAC,GAAG,WAAW,IAAI,UAAU,EAAE;AAAA,EACrH;AACA,SAAO,QAAQ;AACjB;AAGA,eAAsB,WAAW,IAAsC,CAAC,GAA0B;AAChG,QAAM,OAAO,MAAM,WAAW,MAAM,GAAG,eAAe,GAAG,OAAO,QAAQ;AACxE,SAAQ,MAAM,SAAsC,CAAC;AACvD;AAGA,eAAsB,YAAY,IAAsC,CAAC,GAA+B;AACtG,QAAM,OAAO,MAAM,WAAW,MAAM,GAAG,gBAAgB,GAAG,OAAO,SAAS;AAC1E,SAAQ,MAAM,aAA+C,CAAC;AAChE;AAiCA,eAAsB,WAAW,GAAqC;AACpE,QAAM,IAAI,MAAM,GAAG,eAAe;AAClC,MAAI,EAAE,YAAY,OAAW,OAAM,WAAW,GAAG,OAAO,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC;AAC3F,QAAM,WAAW,GAAG,OAAO,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC;AACzD;AAOA,eAAsB,YAAY,GAAgH;AAChJ,QAAM,OAAO,MAAM,WAAW,MAAM,GAAG,gBAAgB,GAAG,OAAO,WAAW,EAAE,WAAW,EAAE,UAAU,CAAC;AACtG,SAAQ,MAAM,aAA+C,CAAC;AAChE;AAcO,SAAS,UAAU,GAA2C;AACnE,SAAO;AAAA,IACL,UAAU,EAAE;AAAA,IACZ,QAAQ,EAAE;AAAA,IACV,GAAI,EAAE,eAAe,SAAY,EAAE,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,IAClE,GAAI,EAAE,YAAY,SAAY,EAAE,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,IACzD,GAAI,EAAE,eAAe,SAAY,EAAE,YAAY,EAAE,WAAW,IAAI,CAAC;AAAA,EACnE;AACF;AAGO,SAAS,cAAc,GAAqB;AACjD,QAAM,IAAI,GAAG;AACb,QAAM,OAA8B,KAAK,OAAO,MAAM,WAClD;AAAA,IACE,QAAQ,EAAE,WAAW,cAAc,cAAc;AAAA,IACjD,GAAI,EAAE,OAAO,EAAE,MAAM,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA,IACzC,MAAM,OAAO,EAAE,QAAQ,GAAG;AAAA,IAC1B,UAAU,OAAO,EAAE,YAAY,EAAE;AAAA,IACjC,QAAQ,OAAO,EAAE,UAAU,EAAE;AAAA,IAC7B,QAAQ,EAAE,WAAW,UAAU,UAAU;AAAA,IACzC,GAAI,EAAE,YAAY,EAAE,WAAW,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC;AAAA,EAC1D,IACA;AACJ,SAAO,EAAE,SAAS,GAAG,YAAY,MAAM,QAAQ,OAAO,GAAG,UAAU,EAAE,GAAG,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC,EAAG;AACpG;AAGO,SAAS,iBAAiB,GAA+C;AAC9E,SAAO,OAAO,MAAM,WAAW,IAAI,OAAO,GAAG,OAAO,WAAW,EAAE,KAAK;AACxE;;;ACreA,IAAAC,eAAmF;;;ACmGnF,IAAM,aAAa;AAanB,SAAS,gBAAgB,KAAqB;AAC5C,MAAIC,OAAM;AACV,MAAI,IAAI;AACR,aAAS;AACP,UAAM,OAAO,IAAI,QAAQ,MAAM,CAAC;AAChC,QAAI,OAAO,EAAG,QAAOA,OAAM,IAAI,MAAM,CAAC;AACtC,IAAAA,QAAO,IAAI,MAAM,GAAG,IAAI;AACxB,UAAM,QAAQ,IAAI,QAAQ,MAAM,OAAO,CAAC;AACxC,QAAI,QAAQ,EAAG,QAAOA;AACtB,QAAI,QAAQ;AAAA,EACd;AACF;AAEA,SAAS,aAAa,KAA4B;AAChD,QAAMC,QAAO,gBAAgB,GAAG;AAChC,QAAMD,OAAqB,CAAC;AAC5B,QAAM,SAAmB,CAAC;AAC1B,MAAI,QAAQ;AACZ,MAAI,QAAQ;AACZ,MAAI,QAAQ;AACZ,QAAM,QAAQ,MAAM;AAClB,UAAM,IAAI,sCAAsC,KAAK,KAAK;AAC1D,QAAI,EAAG,CAAAA,KAAI,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,QAAQ,QAAQ,GAAG,EAAE,QAAQ,kBAAkB,EAAE,GAAG,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC;AACnH,YAAQ;AAAA,EACV;AACA,aAAW,MAAMC,OAAM;AACrB,QAAI,OAAO;AACT,eAAS;AACT,UAAI,OAAO,MAAO,SAAQ;AAC1B;AAAA,IACF;AACA,QAAI,OAAO,OAAO,OAAO,KAAK;AAC5B,cAAQ;AACR,eAAS;AAAA,IACX,WAAW,OAAO,KAAK;AACrB;AACA,eAAS;AAAA,IACX,WAAW,OAAO,KAAK;AACrB,cAAQ,KAAK,IAAI,GAAG,QAAQ,CAAC;AAC7B,eAAS;AAAA,IACX,WAAW,OAAO,OAAO,UAAU,GAAG;AACpC,aAAO,KAAK,MAAM,KAAK,EAAE,QAAQ,QAAQ,GAAG,CAAC;AAC7C,cAAQ;AAAA,IACV,WAAW,OAAO,OAAO,UAAU,GAAG;AACpC,YAAM;AACN,aAAO,IAAI;AAAA,IACb,WAAW,OAAO,OAAO,UAAU,GAAG;AACpC,YAAM;AAAA,IACR,OAAO;AACL,eAAS;AAAA,IACX;AAAA,EACF;AACA,SAAOD;AACT;AAEA,IAAM,OAAO;AACb,IAAM,QAAQ;AACd,IAAM,QAAQ;AAGd,SAAS,QAAQ,GAAgB,GAAgF;AAC/G,aAAW,SAAS,EAAE,QAAQ;AAC5B,QAAI,EAAE,SAAS,WAAW,KAAK,KAAK,KAAK,EAAG,QAAO;AACnD,QAAI,EAAE,SAAS,UAAU,MAAM,KAAK,KAAK,EAAG,QAAO;AACnD,UAAM,QAAQ,MAAM,KAAK,KAAK;AAC9B,QAAI,SAAS,CAAC,kBAAkB,KAAK,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAO,QAAO;AAG/E,QAAI,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC,6DAA6D,KAAK,KAAK,EAAG,QAAO;AAAA,EAClH;AACA,SAAO;AACT;AAKA,IAAM,cAAc;AACpB,IAAM,cAAc,oBAAI,IAAI;AAAA,EAAC;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAO;AAAA,EAAS;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAO;AAAA,EAAO;AAAA,EAAS;AAAA,EAAS;AAAA,EACtI;AAAA,EAAa;AAAA,EAAc;AAAA,EAAgB;AAAA,EAAS;AAAA,EAAU;AAAA,EAAmB;AAAA,EAAmB;AAAA,EACpG;AAAA,EAA6B;AAAA,EAA6B;AAAA,EAAe;AAAA,EAAQ;AAAA,EAAa;AAAA,EAAc;AAAA,EAAc;AAAA,EAAS;AAAQ,CAAC;AAE9I,SAAS,WAAW,OAA8B;AAChD,QAAM,IAAI,MAAM,QAAQ,QAAQ,GAAG,EAAE,KAAK;AAC1C,MAAI,MAAM,MAAM,EAAE,SAAS,OAAO,CAAC,YAAY,KAAK,CAAC,EAAG,QAAO;AAC/D,aAAW,KAAK,EAAE,SAAS,iBAAiB,EAAG,KAAI,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,YAAY,CAAC,EAAG,QAAO;AAChG,MAAI,cAAc,KAAK,CAAC,EAAG,QAAO;AAClC,SAAO;AACT;AAGA,IAAM,iBAAiB;AAGvB,IAAM,eAAe,CAAC,cAAsB;AAC1C,QAAM,QAAQ,UAAU,MAAM,QAAQ,EAAE,OAAO,OAAO;AACtD,SAAO,MAAM,SAAS,KAAK,MAAM,MAAM,CAAC,QAAQ,eAAe,KAAK,GAAG,CAAC;AAC1E;AAkBO,SAAS,oBAAoB,KAAwB,UAAiC,CAAC,GAAoB;AAChH,QAAM,OAAO,QAAQ,QAAQ;AAC7B,QAAM,OAAO,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,QAAQ,YAAY;AACnE,QAAM,QAAQ,QAAQ,SAAS,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,kBAAkB,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO;AAChJ,QAAM,OAAO,oBAAI,IAAoB;AACrC,aAAW,KAAK,KAAK;AACnB,QAAI,CAAC,QAAQ,GAAG,EAAE,MAAM,OAAO,MAAM,CAAC,EAAG;AACzC,QAAI,CAAC,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,KAAK,aAAa,CAAC,CAAC,EAAG;AAClE,SAAK,IAAI,EAAE,MAAM,EAAE,KAAK;AAAA,EAC1B;AAEA,QAAM,SAAS,CAAC,OAAe,QAAQ,MAAqB;AAC1D,QAAI,QAAQ,GAAI,QAAO;AACvB,QAAI,SAAS;AACb,QAAIA,OAAM;AACV,aAAS,QAAQ,GAAG,QAAQ,IAAI,SAAS;AACvC,YAAM,OAAOA,KAAI,QAAQ,wEAAwE,CAAC,IAAI,MAAc,aAAsB;AACxI,cAAM,QAAQ,KAAK,IAAI,IAAI;AAC3B,cAAM,MAAM,UAAU,SAAY,OAAO,OAAO,QAAQ,CAAC,IAAI,aAAa,SAAY,OAAO,SAAS,KAAK,GAAG,QAAQ,CAAC,IAAI;AAC3H,YAAI,QAAQ,KAAM,UAAS;AAC3B,eAAO,OAAO;AAAA,MAChB,CAAC;AACD,UAAI,OAAQ,QAAO;AACnB,UAAI,SAASA,KAAK;AAClB,MAAAA,OAAM;AAAA,IACR;AACA,WAAOA;AAAA,EACT;AACA,QAAM,SAAiC,CAAC;AACxC,QAAM,WAAqB,CAAC;AAC5B,aAAW,CAAC,MAAM,GAAG,KAAK,MAAM;AAC9B,QAAI,CAAC,kCAAkC,KAAK,IAAI,EAAG;AACnD,UAAM,UAAU,OAAO,GAAG;AAC1B,UAAM,QAAQ,YAAY,OAAO,OAAO,WAAW,OAAO;AAC1D,QAAI,UAAU,KAAM,UAAS,KAAK,GAAG,IAAI,MAAM,IAAI,SAAS,KAAK,IAAI,MAAM,GAAG,EAAE,IAAI,WAAM,GAAG,+BAA+B;AAAA,QACvH,QAAO,IAAI,IAAI;AAAA,EACtB;AACA,MAAI,OAAO,KAAK,MAAM,EAAE,WAAW,EAAG,UAAS,KAAK,gDAAgD;AACpG,SAAO,EAAE,QAAQ,SAAS;AAC5B;AAIA,SAAS,QAAQ,OAAe,MAA2B,OAAO,GAAkB;AAClF,MAAI,OAAO,GAAI,QAAO;AACtB,MAAI,aAAa;AAEjB,MAAIA,OAAM;AACV,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,KAAKA,IAAG,GAAG,SAAS;AAC5D,IAAAA,OAAMA,KAAI,QAAQ,iEAAiE,CAAC,IAAI,MAAc,aAAsB;AAC1H,YAAM,QAAQ,KAAK,IAAI,IAAI;AAC3B,YAAM,OAAO,UAAU,SAAY,QAAQ,OAAO,MAAM,OAAO,CAAC,IAAI,aAAa,SAAY,QAAQ,SAAS,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI;AACxI,UAAI,SAAS,KAAM,cAAa;AAChC,aAAO,QAAQ;AAAA,IACjB,CAAC;AACD,QAAI,WAAY,QAAO;AAAA,EACzB;AACA,SAAO,QAAQ,KAAKA,IAAG,IAAI,OAAOA,KAAI,KAAK;AAC7C;AAEA,IAAM,UAAU,CAAC,MAAc,KAAK,IAAI,GAAG,KAAK,IAAI,GAAG,CAAC,CAAC;AACzD,IAAM,OAAO,CAAC,MAAc,KAAK,MAAM,QAAQ,CAAC,IAAI,GAAG,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AACrF,IAAM,QAAQ,CAAC,MAAe,KAAK,WAAY,QAAQ,IAAI,QAAQ,KAAK,IAAI,GAAG,IAAI,GAAG,IAAI;AAE1F,SAAS,IAAI,GAAW,GAAW,GAAW,IAAI,GAAW;AAC3D,MAAI,KAAK,EAAG,QAAO,IAAI,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;AAClD,SAAO,QAAQ,KAAK,MAAM,QAAQ,CAAC,IAAI,GAAG,CAAC,KAAK,KAAK,MAAM,QAAQ,CAAC,IAAI,GAAG,CAAC,KAAK,KAAK,MAAM,QAAQ,CAAC,IAAI,GAAG,CAAC,KAAK,KAAK,MAAM,QAAQ,CAAC,IAAI,GAAI,IAAI,GAAI;AACxJ;AAEA,IAAM,QAAQ,CAAC,MAA2B,MAAM,SAAY,IAAI,EAAE,SAAS,GAAG,IAAI,WAAW,CAAC,IAAI,MAAM,WAAW,CAAC;AAEpH,IAAM,WAAmC,EAAE,OAAO,WAAW,OAAO,UAAU;AAGvE,SAAS,QAAQ,OAA8B;AACpD,QAAM,IAAI,MAAM,KAAK,EAAE,YAAY;AACnC,MAAI,SAAS,CAAC,EAAG,QAAO,SAAS,CAAC;AAClC,MAAI,6CAA6C,KAAK,CAAC,EAAG,QAAO;AACjE,MAAI,IAAI,uFAAuF,KAAK,CAAC;AACrG,MAAI,GAAG;AACL,UAAM,KAAK,CAAC,MAAe,EAAE,SAAS,GAAG,IAAI,WAAW,CAAC,IAAI,MAAM,WAAW,CAAC,IAAI;AACnF,WAAO,IAAI,GAAG,EAAE,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;AAAA,EACtD;AACA,MAAI,2FAA2F,KAAK,CAAC;AACrG,MAAI,GAAG;AACL,UAAM,KAAM,WAAW,EAAE,CAAC,CAAC,IAAI,MAAO,OAAO;AAC7C,UAAM,IAAI,WAAW,EAAE,CAAC,CAAC,IAAI;AAC7B,UAAM,IAAI,WAAW,EAAE,CAAC,CAAC,IAAI;AAC7B,UAAM,IAAI,CAAC,MAAc;AACvB,YAAM,KAAK,IAAI,IAAI,MAAM;AACzB,aAAO,IAAI,IAAI,KAAK,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC;AAAA,IAC5E;AACA,WAAO,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;AAAA,EAC1C;AACA,MAAI,qFAAqF,KAAK,CAAC;AAC/F,MAAI,GAAG;AACL,UAAM,IAAI,EAAE,CAAC,EAAE,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,CAAC,IAAI,MAAM,WAAW,EAAE,CAAC,CAAC;AACvE,UAAM,IAAI,EAAE,CAAC,EAAE,SAAS,GAAG,IAAK,WAAW,EAAE,CAAC,CAAC,IAAI,MAAO,MAAM,WAAW,EAAE,CAAC,CAAC;AAC/E,UAAM,IAAK,WAAW,EAAE,CAAC,CAAC,IAAI,KAAK,KAAM;AACzC,UAAM,IAAI,IAAI,KAAK,IAAI,CAAC;AACxB,UAAM,IAAI,IAAI,KAAK,IAAI,CAAC;AACxB,UAAM,IAAI,KAAK,IAAI,IAAI,eAAe,IAAI,eAAe,GAAG,CAAC;AAC7D,UAAM,KAAK,KAAK,IAAI,IAAI,eAAe,IAAI,eAAe,GAAG,CAAC;AAC9D,UAAM,IAAI,KAAK,IAAI,IAAI,eAAe,IAAI,cAAc,GAAG,CAAC;AAC5D,WAAO;AAAA,MACL,MAAM,eAAe,IAAI,eAAe,KAAK,eAAe,CAAC;AAAA,MAC7D,MAAM,gBAAgB,IAAI,eAAe,KAAK,eAAe,CAAC;AAAA,MAC9D,MAAM,gBAAgB,IAAI,eAAe,KAAK,cAAc,CAAC;AAAA,MAC7D,MAAM,EAAE,CAAC,CAAC;AAAA,IACZ;AAAA,EACF;AACA,SAAO;AACT;AAGA,SAAS,SAAS,OAA8B;AAC9C,QAAM,IAAI,yBAAyB,KAAK,MAAM,KAAK,CAAC;AACpD,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,KAAK,WAAW,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,MAAM,SAAS,EAAE,CAAC,MAAM,OAAO,KAAK;AACtE,SAAO,OAAO,SAAS,EAAE,IAAI,KAAK,IAAI,YAAY,KAAK,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC,CAAC,IAAI;AACnF;AAGA,SAAS,OAAO,OAA8B;AAC5C,QAAM,IAAI,MAAM,KAAK;AACrB,SAAO,6BAA6B,KAAK,CAAC,MAAM,EAAE,MAAM,IAAI,GAAG,UAAU,KAAK,MAAM,MAAM,EAAE,MAAM,IAAI,GAAG,UAAU,KAAK,MAAM,IAAI,IAAI;AACxI;AAKA,IAAM,SAA0C;AAAA,EAC9C,CAAC,cAAc,CAAC,mBAAmB,cAAc,CAAC;AAAA,EAClD,CAAC,WAAW,CAAC,0BAA0B,qBAAqB,CAAC;AAAA,EAC7D,CAAC,QAAQ,CAAC,qBAAqB,mBAAmB,CAAC;AAAA,EACnD,CAAC,aAAa,CAAC,qBAAqB,CAAC;AAAA,EACrC,CAAC,UAAU,CAAC,uBAAuB,qBAAqB,CAAC;AAAA,EACzD,CAAC,WAAW,CAAC,gBAAgB,qBAAqB,CAAC;AAAA,EACnD,CAAC,eAAe,CAAC,qBAAqB,mBAAmB,CAAC;AAAA,EAC1D,CAAC,UAAU,CAAC,mBAAmB,qBAAqB,aAAa,CAAC;AAAA,EAClE,CAAC,SAAS,CAAC,wBAAwB,YAAY,CAAC;AAAA,EAChD,CAAC,mBAAmB,CAAC,iBAAiB,CAAC;AAAA,EACvC,CAAC,WAAW,CAAC,0BAA0B,cAAc,CAAC;AAAA,EACtD,CAAC,qBAAqB,CAAC,mBAAmB,CAAC;AAC7C;AAWO,SAAS,mBAAmB,KAAwB,UAAiC,CAAC,GAAkB;AAC7G,QAAM,IAAI,EAAE,MAAM,QAAQ,QAAQ,SAAS,OAAO,QAAQ,MAAM;AAChE,QAAM,OAAO,oBAAI,IAAoB;AACrC,aAAW,SAAS,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG;AACpD,eAAW,KAAK,aAAa,KAAK,EAAG,KAAI,QAAQ,GAAG,CAAC,EAAG,MAAK,IAAI,EAAE,MAAM,EAAE,KAAK;AAAA,EAClF;AACA,QAAM,QAAqB,CAAC;AAC5B,QAAM,WAAqB,CAAC;AAE5B,QAAM,OAAO,CAAI,QAAkB,IAA6B,SAAgC;AAC9F,eAAW,SAAS,QAAQ;AAC1B,YAAM,MAAM,KAAK,IAAI,KAAK;AAC1B,UAAI,QAAQ,OAAW;AACvB,YAAM,QAAQ,QAAQ,KAAK,IAAI;AAC/B,YAAM,MAAM,UAAU,OAAO,OAAO,GAAG,KAAK;AAC5C,UAAI,QAAQ,KAAM,QAAO;AACzB,eAAS,KAAK,GAAG,KAAK,MAAM,GAAG,YAAY,IAAI,kBAAkB;AAAA,IACnE;AACA,WAAO;AAAA,EACT;AAEA,aAAW,CAAC,OAAO,MAAM,KAAK,QAAQ;AACpC,UAAM,IAAI,KAAK,QAAQ,SAAS,UAAU;AAC1C,QAAI,MAAM,OAAW,CAAC,MAAkC,KAAK,IAAI;AAAA,EACnE;AACA,QAAM,SAAS,KAAK,CAAC,yBAAyB,gBAAgB,GAAG,UAAU,UAAU;AACrF,MAAI,WAAW,OAAW,OAAM,SAAS;AACzC,QAAM,SAAS,KAAK,CAAC,2BAA2B,gBAAgB,GAAG,UAAU,UAAU;AACvF,MAAI,WAAW,OAAW,OAAM,eAAe;AAC/C,QAAM,OAAO,KAAK,CAAC,kBAAkB,GAAG,QAAQ,aAAa;AAC7D,MAAI,SAAS,OAAW,OAAM,aAAa;AAC3C,MAAI,QAAQ,QAAS,OAAM,UAAU,QAAQ;AAE7C,MAAI,KAAK,SAAS,EAAG,UAAS,KAAK,0FAA0F;AAAA,WACpH,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,OAAO,CAAC,EAAG,UAAS,KAAK,gDAAgD;AAC7H,SAAO,EAAE,OAAO,SAAS;AAC3B;AAmJO,SAAS,OAAO,OAA6C;AAClE,QAAM,QAA2C;AAAA,IAC/C,YAAY;AAAA,IAAc,SAAS;AAAA,IAAW,MAAM;AAAA,IAAQ,WAAW;AAAA,IAAc,QAAQ;AAAA,IAC7F,SAAS;AAAA,IAAW,aAAa;AAAA,IAAgB,QAAQ;AAAA,IAAU,OAAO;AAAA,IAAS,iBAAiB;AAAA,IACpG,SAAS;AAAA,IAAW,mBAAmB;AAAA,IAAsB,QAAQ;AAAA,IAAU,cAAc;AAAA,IAC7F,YAAY;AAAA,IAAe,SAAS;AAAA,IAAY,OAAO;AAAA,IAAS,QAAQ;AAAA,IAAU,aAAa;AAAA,IAC/F,WAAW;AAAA,IAAc,cAAc;AAAA,IAAkB,OAAO;AAAA,IAAS,iBAAiB;AAAA,IAAoB,aAAa;AAAA,IAAgB,QAAQ;AAAA,EACrJ;AACA,QAAM,OAAgC,CAAC;AACvC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC1C,QAAI,MAAM,UAAa,MAAM,MAAO,MAAM,QAAQ,CAAC,KAAK,EAAE,WAAW,EAAI;AACzE,SAAK,MAAM,CAAsB,CAAC,IAAI;AAAA,EACxC;AACA,SAAO;AACT;AAGO,SAAS,SAAS,MAA4C;AACnE,QAAM,QAA2C;AAAA,IAC/C,YAAY;AAAA,IAAc,SAAS;AAAA,IAAW,MAAM;AAAA,IAAQ,YAAY;AAAA,IAAa,QAAQ;AAAA,IAC7F,SAAS;AAAA,IAAW,cAAc;AAAA,IAAe,QAAQ;AAAA,IAAU,OAAO;AAAA,IAAS,kBAAkB;AAAA,IACrG,SAAS;AAAA,IAAW,oBAAoB;AAAA,IAAqB,QAAQ;AAAA,IAAU,eAAe;AAAA,IAC9F,aAAa;AAAA,IAAc,UAAU;AAAA,IAAW,OAAO;AAAA,IAAS,QAAQ;AAAA,IAAU,cAAc;AAAA,IAChG,YAAY;AAAA,IAAa,gBAAgB;AAAA,IAAgB,OAAO;AAAA,IAAS,kBAAkB;AAAA,IAAmB,cAAc;AAAA,IAAe,QAAQ;AAAA,EACrJ;AACA,QAAM,QAAiC,CAAC;AACxC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,QAAQ,CAAC,CAAC,EAAG,KAAI,MAAM,CAAC,KAAK,MAAM,UAAa,MAAM,QAAQ,MAAM,GAAI,OAAM,MAAM,CAAC,CAAC,IAAI;AAC9H,SAAO;AACT;AAyBA,eAAsB,UAAU,GAAoC;AAClE,QAAME,OAAM,CAAC,MAAe,OAAO,YAAY,cAAc,QAAQ,MAAM,CAAC,IAAI;AAChF,QAAM,SAAS,uBAAuB,EAAE,UAAUA,KAAI,eAAe,KAAK,EAAE;AAC5E,QAAM,WAAW,EAAE,YAAYA,KAAI,kBAAkB,KAAK;AAC1D,QAAM,SAAS,EAAE,UAAUA,KAAI,eAAe,KAAK;AACnD,QAAM,QAAQ,EAAE,SAASA,KAAI,cAAc,KAAK;AAChD,aAAW,CAAC,MAAM,CAAC,KAAK,OAAO,QAAQ,EAAE,eAAe,QAAQ,kBAAkB,UAAU,eAAe,QAAQ,cAAc,MAAM,CAAC,GAAG;AACzI,QAAI,MAAM,GAAI,OAAM,IAAI,MAAM,mBAAmB,IAAI,8BAA8B;AAAA,EACrF;AACA,QAAM,MAAM,MAAM,SAAS,EAAE,OAAO,EAAE,aAAa,mBAAmB,EAAE,GAAG,MAAM,qBAAqB,mBAAmB,QAAQ,CAAC,UAAU;AAAA,IAC1I,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,KAAK,IAAI,gBAAgB,QAAQ,gBAAgB,mBAAmB;AAAA,IACxG,MAAM,KAAK,UAAU,OAAO,EAAE,KAAK,CAAC;AAAA,EACtC,CAAC;AACD,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC/C,UAAM,IAAI,MAAM,6CAA6C,IAAI,MAAM,MAAM,MAAM,SAAS,CAAC,GAAG,WAAW,IAAI,UAAU,EAAE;AAAA,EAC7H;AACF;;;ADnnBA,IAAM,iBAAiB;AAEvB,IAAM,UAAU;AA2DT,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,YACW,QAEA,MACT,SACA;AACA,UAAM,mBAAmB,OAAO,EAAE;AALzB;AAEA;AAIT,SAAK,OAAO;AAAA,EACd;AAAA,EAPW;AAAA,EAEA;AAMb;AA8FA,SAAS,IAAI,MAAkC;AAC7C,SAAO,OAAO,YAAY,cAAc,QAAQ,MAAM,IAAI,IAAI;AAChE;AAOA,SAAS,eAAe,GAA0B;AAChD,SAAO;AAAA,IAAE,IAAI,EAAE;AAAA,IAAI,QAAQ,EAAE;AAAA,IAAQ,MAAM,EAAE;AAAA,IAAM,MAAM,EAAE;AAAA,IAAM,YAAY,EAAE;AAAA,IAAa,QAAQ,EAAE;AAAA,IACpG,UAAU,EAAE,YAAY,CAAC;AAAA,IAAG,SAAS,EAAE;AAAA,IAAS,WAAW,EAAE;AAAA,IAAY,WAAW,EAAE;AAAA,EAAW;AACrG;AAIA,SAAS,SAAS,GAAmC;AACnD,SAAO,EAAE,QAAQ,EAAE,SAAS,OAAO,EAAE,OAAO,MAAM,EAAE,MAAM,QAAQ,EAAE,QAAQ,MAAM,EAAE,MAAM,GAAI,EAAE,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAG;AACvJ;AAEA,SAAS,MAAM,GAA+B;AAC5C,MAAI,OAAO,EAAE,eAAe,SAAU,QAAO,EAAE;AAC/C,SAAO,EAAE,WAAW,SAAS,OAAO,IAAI,SAAa,KAAK,MAAM,EAAE,UAAU;AAC9E;AAEA,eAAe,QAAQ,GAA6C;AAClE,QAAM,MAAM,MAAM,CAAC;AAEnB,SAAO,UAAM,wBAAU,KAAK,OAAO,QAAI,0BAAY,EAAE,YAAsB,SAAS,EAAE,aAAa,KAAK,CAAC;AAC3G;AAEO,SAAS,aAAa,QAAuB,CAAC,GAAiB;AACpE,QAAM,SAAS,uBAAuB,MAAM,UAAU,IAAI,eAAe,KAAK,EAAE;AAChF,QAAM,WAAW,MAAM,YAAY,IAAI,kBAAkB,KAAK;AAC9D,QAAM,eAAe,MAAM,gBAAgB,IAAI,sBAAsB,KAAK;AAC1E,QAAM,SAAS,IAAI,mBAAmB;AACtC,QAAM,MAAM,MAAM,QAAQ,SAAS,EAAE,YAAY,QAAQ,OAAO,IAAI,sBAAsB,KAAK,GAAG,IAAI;AACtG,QAAM,YAAY,MAAM,UAAU,IAAI,eAAe,KAAK;AAC1D,QAAM,kBAAkB,MAAM,mBAAmB,IAAI,0BAA0B,KAAK;AAGpF,QAAM,gBAAwC,eAAe,KAAK,eAAe,IAC7E,EAAE,sBAAsB,UAAU,oBAAoB,gBAAgB,IACtE,CAAC;AACL,QAAM,YAAY,MAAM,aAAa;AACrC,MAAI,CAAC,OAAO,SAAS,SAAS,KAAK,aAAa,EAAG,OAAM,IAAI,kBAAkB,qDAAqD;AAGpI,QAAM,UAAU,SAAS,MAAM,OAAO,SAAS;AAC/C,QAAM,UAAwB,OAAO,OAAO,SAAS;AACnD,QAAI;AACF,aAAO,MAAM,QAAQ,OAAO,IAAI;AAAA,IAClC,SAAS,KAAK;AAEZ,UAAI,UAAU,GAAG,EAAG,OAAM,IAAI,eAAe,KAAK,eAAe,gCAAgC,SAAS,KAAK;AAC/G,YAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,gBAAgB,GAAG,MAAM;AAI/B,WAAS,aAAmB;AAC1B,QAAI,MAAM,OAAQ;AAClB,QAAI,CAAC,eAAe,KAAK,MAAM,EAAG,OAAM,IAAI,kBAAkB,iDAAkD;AAChH,QAAI,aAAa,GAAI,OAAM,IAAI,kBAAkB,yCAAyC;AAC1F,QAAI,MAAM,MAAM;AACd,UAAI,CAAC,MAAM,aAAc,OAAM,IAAI,kBAAkB,sFAAsF;AAC3I;AAAA,IACF;AACA,QAAI,MAAM,IAAI,UAAU,KAAK,iBAAiB,IAAI;AAChD,YAAM,IAAI,kBAAkB,MAAM,gDAC9B,wGAAwG;AAAA,IAC9G;AAAA,EACF;AAEA,MAAI;AACJ,QAAM,aAAa,MAAO,aAAa,QAAQ,GAAgB;AAI/D,iBAAeC,MAAK,KAAe,MAA8B;AAC/D,UAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAE/C,UAAM,QAAQ,MAAM,SAAS,CAAC;AAC9B,UAAM,OAAO,OAAO,MAAM,UAAU,WAAW,KAAK,QAAQ,OAAO;AACnE,UAAM,UAAU,OAAO,MAAM,UAAU,WAAW,KAAK,oBAAoB,OAAO;AAClF,UAAM,IAAI,eAAe,IAAI,QAAQ,QAAQ,SAAS,kBAAkB,IAAI,KAAK,IAAI,MAAM,MAAM,WAAW,IAAI,UAAU,EAAE;AAAA,EAC9H;AAEA,MAAI;AACJ,MAAI;AAEJ,iBAAe,MAAuB;AACpC,eAAW;AACX,UAAM,OAAO,MAAM,SAAS,MAAM,OAAO,WAAW,MAAM,OAAQ,MAAM,eAA0B,KAAK,YAAY;AACnH,UAAM,OAAO,IAAI,gBAAgB,EAAE,YAAY,sBAAsB,WAAW,KAAK,CAAC;AACtF,QAAI,MAAM,QAAQ;AAChB,YAAM,IAAI,MAAM,MAAM,OAAO;AAC7B,WAAK,IAAI,yBAAyB,cAAc;AAChD,WAAK,IAAI,oBAAoB,MAAM,EAAE,UAAU,MAAM,aAAa,CAAC;AAAA,IACrE,WAAW,MAAM,QAAQ,KAAK;AAC5B,YAAM,SAAS,MAAM,OAAO,MAAM,MAAM,KAAK,QAAQ,IAAI,EAAE,KAAM,IAAkB,OAAO,YAAY,MAAM,WAAW,EAAE;AACzH,YAAM,YAAY,MAAM,IAAI,qBAAQ,CAAC,CAAC,EACnC,mBAAmB,EAAE,KAAK,SAAS,KAAK,OAAO,IAAI,CAAC,EACpD,UAAU,IAAI,EAAE,WAAW,IAAI,EAAE,YAAY,aAAa,EAC1D,OAAO,OAAO,WAAW,CAAC,EAAE,YAAY,EAAE,kBAAkB,IAAI,EAChE,KAAK,OAAO,UAAU;AACzB,WAAK,IAAI,yBAAyB,cAAc;AAChD,WAAK,IAAI,oBAAoB,SAAS;AAAA,IACxC,OAAO;AACL,WAAK,IAAI,iBAAiB,YAAY;AAAA,IACxC;AACA,UAAM,MAAM,MAAM,QAAQ,eAAe,EAAE,QAAQ,QAAQ,SAAS,EAAE,gBAAgB,oCAAoC,GAAG,MAAM,KAAK,CAAC;AACzI,QAAI,CAAC,IAAI,GAAI,OAAMA,MAAK,KAAK,6BAA8B;AAC3D,UAAM,IAAK,MAAM,IAAI,KAAK;AAC1B,WAAO,EAAE,OAAO,EAAE,cAAc,OAAO,KAAK,IAAI,IAAI,EAAE,aAAa,MAAO,QAAQ;AAClF,WAAO,EAAE;AAAA,EACX;AAEA,WAAS,QAAyB;AAChC,QAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,MAAO,QAAO,QAAQ,QAAQ,KAAK,KAAK;AAEtE,WAAQ,WAAW,IAAI,EAAE,QAAQ,MAAM;AAAE,eAAS;AAAA,IAAU,CAAC;AAAA,EAC/D;AAEA,iBAAe,KAAK,QAAgB,MAAc,MAAgB,QAAgC,CAAC,GAAqB;AACtH,UAAM,OAAO,YAAY,QAAQ,GAAG,MAAM,GAAG,IAAI,IAAI;AAAA,MACnD;AAAA,MACA,SAAS,EAAE,eAAe,UAAU,MAAM,MAAM,CAAC,IAAI,GAAG,OAAO,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB,EAAG;AAAA,MACrI,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,IAAI;AAAA,IAC5D,CAAC;AACD,QAAI,MAAM,MAAM,KAAK;AACrB,QAAI,IAAI,WAAW,OAAO,MAAM;AAE9B,aAAO;AACP,YAAM,MAAM,KAAK;AAAA,IACnB;AACA,QAAI,CAAC,IAAI,GAAI,OAAMA,MAAK,KAAK,GAAG,MAAM,IAAI,IAAI,EAAE;AAChD,WAAO,IAAI,WAAW,MAAM,SAAY,IAAI,KAAK;AAAA,EACnD;AAEA,QAAM,OAAO,OAAU,QAAgB,MAAc,MAAgB,WAAqC,MAAM,KAAK,QAAQ,MAAM,MAAM,KAAK,IAAgC;AAC9K,QAAM,KAAK;AAEX,SAAO;AAAA,IACL;AAAA,IACA,SAAS;AAAA,IACT,eAAe;AAAA,MACb,MAAM,KAAK,QAAQ,CAAC,GAAG;AACrB,cAAM,IAAI,IAAI,gBAAgB;AAC9B,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,EAAG,KAAI,MAAM,OAAW,GAAE,IAAI,GAAG,OAAO,CAAC,CAAC;AACnF,cAAMC,OAAO,MAAM,KAAK,OAAO,oBAAoB,EAAE,OAAO,IAAI,CAAC,KAAK,EAAE,EAAE;AAC1E,eAAO,EAAE,OAAOA,KAAI,KAAK,IAAI,cAAc,GAAG,OAAOA,KAAI,YAAY;AAAA,MACvE;AAAA,MACA,MAAM,OAAO,OAAO;AAClB,eAAO,eAAe,MAAM;AAAA,UAAc;AAAA,UAAQ;AAAA,UAChD,EAAE,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,aAAa,MAAM,YAAY,UAAU,MAAM,SAAS;AAAA,QAAC,CAAC;AAAA,MACpG;AAAA,MACA,MAAM,IAAI,OAAO;AACf,eAAO,eAAe,MAAM,KAAc,OAAO,qBAAqB,GAAG,KAAK,CAAC,EAAE,CAAC;AAAA,MACpF;AAAA,MACA,MAAM,OAAO,OAAO,OAAO;AACzB,eAAO,eAAe,MAAM,KAAc,SAAS,qBAAqB,GAAG,KAAK,CAAC,IAAI,KAAK,CAAC;AAAA,MAC7F;AAAA,MACA,MAAM,OAAO,OAAO;AAClB,cAAM,KAAK,UAAU,qBAAqB,GAAG,KAAK,CAAC,EAAE;AAAA,MACvD;AAAA,IACF;AAAA,IACA,SAAS;AAAA,MACP,MAAM,KAAK,OAAO;AAChB,gBAAQ,MAAM,KAAmB,OAAO,qBAAqB,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,QAAQ;AAAA,MACjG;AAAA,MACA,MAAM,IAAI,OAAO,GAAG;AAClB,eAAO,SAAS,MAAM;AAAA,UAAiB;AAAA,UAAQ,qBAAqB,GAAG,KAAK,CAAC;AAAA,UAC3E,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,QAAQ,OAAO,EAAE,OAAO,MAAM,EAAE,MAAM,QAAQ,EAAE,QAAQ,WAAW,UAAU,UAAU,EAAE,YAAY,MAAM;AAAA,UAAG;AAAA,QAAa,CAAC;AAAA,MAC3J;AAAA,MACA,MAAM,QAAQ,OAAO,QAAQ,MAAM;AACjC,eAAO,SAAS,MAAM,KAAiB,OAAO,qBAAqB,GAAG,KAAK,CAAC,YAAY,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAAA,MACjH;AAAA,MACA,MAAM,OAAO,OAAO,QAAQ;AAC1B,cAAM,KAAK,UAAU,qBAAqB,GAAG,KAAK,CAAC,YAAY,GAAG,MAAM,CAAC,EAAE;AAAA,MAC7E;AAAA,IACF;AAAA,IACA,MAAM,OAAO,QAAQ;AAEnB,YAAM,IAAI,MAAM,KAAoC,QAAQ,aAAa,EAAE,GAAG,QAAQ,WAAW,SAAS,GAAG,aAAa;AAC1H,aAAO,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,MAAM;AAAA,IACpC;AAAA,IACA,OAAO;AAAA,MACL,MAAM,IAAI,KAAK,UAAU;AACvB,eAAO,SAAS,MAAM,KAA8B,OAAO,qBAAqB,GAAG,EAAE,CAAC,QAAQ,CAAC;AAAA,MACjG;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,MAAM,IAAI,QAAQ;AAChB,gBAAQ,MAAM,KAA+B,OAAO,eAAe,GAAG,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;AAAA,MACrG;AAAA,IACF;AAAA,IACA,SAAS;AAAA,MACP,MAAM,IAAI,QAAQ;AAChB,gBAAQ,MAAM,KAAwC,OAAO,eAAe,GAAG,MAAM,CAAC,UAAU,GAAG,aAAa,CAAC;AAAA,MACnH;AAAA,MACA,MAAM,IAAI,QAAQ,WAAW;AAC3B,gBAAQ,MAAM,KAAwC,OAAO,eAAe,GAAG,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,GAAG,aAAa,CAAC;AAAA,MAClI;AAAA,IACF;AAAA,IACA,MAAM,MAAM,GAAG;AACb,YAAM,SAAS,EAAE,WAAW,aAAa,MAAM,gBAAgB,KAAK;AACpE,UAAI,WAAW,GAAI,OAAM,IAAI,kBAAkB,wDAAwD;AACvG,aAAO,cAAc,MAAM,KAAK,QAAQ,eAAe,GAAG,MAAM,CAAC,UAAU,EAAE,iBAAiB,EAAE,gBAAgB,SAAS,EAAE,QAAQ,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;AAAA,IACvJ;AAAA,IACA,MAAM,aAAa;AACjB,UAAI,MAAM,KAAM,QAAO,MAAM,KAAK,UAAU;AAC5C,UAAI,CAAC,IAAK,QAAO,EAAE,MAAM,CAAC,EAAE;AAC5B,YAAM,EAAE,KAAK,GAAG,EAAE,IAAI,MAAM,GAAG,KAAM,UAAM,wBAAU,MAAM,WAAW,CAAC;AACvE,aAAO,EAAE,MAAM,CAAC,EAAE,KAAK,GAAG,GAAG,KAAK,IAAI,OAAO,KAAK,SAAS,KAAK,MAAM,CAAC,EAAE;AAAA,IAC3E;AAAA,EACF;AACF;;;AE7XO,IAAM,eAAe;AAE5B,IAAM,eAAe;AAErB,IAAM,iBAAiB;AACvB,IAAM,WAAW;AAwBjB,IAAM,UAA2B,CAAC,aAAa,aAAa,SAAS,QAAQ;AAGtE,IAAM,0BAA0C,OAAO,OAAO,EAAE,KAAK,cAAc,KAAK,cAAc,UAAU,CAAC,GAAG,aAAa,GAAG,iBAAiB,MAAM,CAAC;AAEnK,IAAM,MAAM,CAAC,GAAY,aAAsB,OAAO,MAAM,YAAY,OAAO,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;AAOtG,SAAS,iBAAiB,KAA8B;AAC7D,QAAM,IAAK,OAAO,OAAO,QAAQ,WAAW,MAAM,CAAC;AACnD,QAAM,MAAM,KAAK,IAAI,KAAK,IAAI,IAAI,EAAE,OAAO,EAAE,YAAY,YAAY,KAAK,cAAc,cAAc,GAAG,YAAY;AACrH,QAAM,MAAM,KAAK,IAAI,KAAK,IAAI,IAAI,EAAE,OAAO,EAAE,YAAY,YAAY,KAAK,cAAc,YAAY,GAAG,GAAG;AAC1G,QAAM,QAAQ,MAAM,QAAQ,EAAE,QAAQ,IAAI,EAAE,WAAW,CAAC;AACxD,SAAO;AAAA,IACL;AAAA,IAAK;AAAA,IACL,UAAU,QAAQ,OAAO,CAAC,MAAM,MAAM,SAAS,CAAC,CAAC;AAAA,IACjD,aAAa,KAAK,IAAI,KAAK,IAAI,IAAI,EAAE,eAAe,EAAE,YAAY,CAAC,GAAG,CAAC,GAAG,QAAQ,MAAM;AAAA,IACxF,kBAAkB,EAAE,mBAAmB,EAAE,oBAAoB;AAAA,EAC/D;AACF;AAGA,SAAS,WAAW,GAAmB;AACrC,MAAI,IAAI;AACR,aAAW,MAAM,GAAG;AAClB,UAAM,IAAI,GAAG,YAAY,CAAC;AAC1B,SAAK,IAAI,MAAO,IAAI,IAAI,OAAQ,IAAI,IAAI,QAAU,IAAI;AAAA,EACxD;AACA,SAAO;AACT;AAGA,SAAS,UAAU,GAA+B;AAChD,QAAM,MAAM,oBAAI,IAAmB;AACnC,aAAW,MAAM,GAAG;AAClB,QAAI,WAAC,WAAO,GAAC,EAAC,KAAK,EAAE,EAAG,KAAI,IAAI,WAAW;AAAA,aAClC,WAAC,WAAO,GAAC,EAAC,KAAK,EAAE,EAAG,KAAI,IAAI,WAAW;AAAA,aACvC,WAAC,WAAO,GAAC,EAAC,KAAK,EAAE,EAAG,KAAI,IAAI,OAAO;AAAA,aACnC,CAAC,WAAC,UAAM,GAAC,EAAC,KAAK,EAAE,EAAG,KAAI,IAAI,QAAQ;AAAA,EAC/C;AACA,SAAO;AACT;AAMO,SAAS,iBAAiB,OAAe,SAAyB,yBAA2C;AAClH,QAAM,IAAI,iBAAiB,MAAM;AACjC,QAAMC,OAAwB,CAAC;AAC/B,QAAM,SAAS,WAAW,KAAK;AAC/B,MAAI,SAAS,EAAE,IAAK,CAAAA,KAAI,KAAK,WAAW;AACxC,MAAI,SAAS,EAAE,IAAK,CAAAA,KAAI,KAAK,UAAU;AACvC,QAAM,MAAM,UAAU,KAAK;AAC3B,aAAW,KAAK,EAAE,SAAU,KAAI,CAAC,IAAI,IAAI,CAAC,EAAG,CAAAA,KAAI,KAAK,SAAS,CAAC,EAAoB;AACpF,MAAI,EAAE,cAAc,KAAK,QAAQ,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,YAAa,CAAAA,KAAI,KAAK,eAAe;AAC3G,SAAOA;AACT;AAKA,IAAM,QAGD;AAAA,EACH,IAAI;AAAA,IACF,SAAS;AAAA,IAAuC,UAAU;AAAA,IAAoB,KAAK;AAAA,IACnF,SAAS;AAAA,IACT,UAAU;AAAA,IACV,OAAO,EAAE,WAAW,sBAAsB,WAAW,uBAAuB,OAAO,WAAW,QAAQ,WAAW;AAAA,IACjH,SAAS;AAAA,MACP,WAAW;AAAA,MAAkC,UAAU;AAAA,MACvD,iBAAiB;AAAA,MAA+B,iBAAiB;AAAA,MAAgC,aAAa;AAAA,MAAoB,cAAc;AAAA,MAChJ,eAAe;AAAA,MACf,UAAU;AAAA,IACZ;AAAA,EACF;AAAA,EACA,IAAI;AAAA,IACF,SAAS;AAAA,IAAmC,UAAU;AAAA,IAAoB,KAAK;AAAA,IAC/E,SAAS;AAAA,IACT,UAAU;AAAA,IACV,OAAO,EAAE,WAAW,oBAAiB,WAAW,oBAAiB,OAAO,gBAAa,QAAQ,gBAAa;AAAA,IAC1G,SAAS;AAAA,MACP,WAAW;AAAA,MAAkC,UAAU;AAAA,MACvD,iBAAiB;AAAA,MAA0B,iBAAiB;AAAA,MAA0B,aAAa;AAAA,MAAsB,cAAc;AAAA,MACvI,eAAe;AAAA,MACf,UAAU;AAAA,IACZ;AAAA,EACF;AACF;AAEA,IAAM,OAAO,CAAC,GAAW,MAAsB,EAAE,QAAQ,SAAS,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,SAAS,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,OAAO,OAAO,EAAE,WAAW,CAAC;AAG9I,SAAS,uBAAuB,SAAyB,yBAAyB,SAAyB,MAAc;AAC9H,QAAM,IAAI,iBAAiB,MAAM;AACjC,QAAM,IAAI,MAAM,MAAM,KAAK,MAAM;AACjC,QAAM,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;AACjC,MAAI,EAAE,SAAS,SAAS,GAAG;AACzB,UAAM,QAAQ,EAAE,SAAS,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC9C,UAAM,SAAS,MAAM,WAAW,IAAI,MAAM,CAAC,IAAI,GAAG,MAAM,MAAM,GAAG,EAAE,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,MAAM,MAAM,SAAS,CAAC,CAAC;AACnH,UAAM,KAAK,EAAE,SAAS,QAAQ,WAAW,MAAM,CAAC;AAAA,EAClD;AACA,MAAI,EAAE,cAAc,EAAG,OAAM,KAAK,KAAK,EAAE,SAAS,CAAC,CAAC;AACpD,MAAI,EAAE,gBAAiB,OAAM,KAAK,EAAE,QAAQ;AAC5C,SAAO,MAAM,KAAK,GAAG;AACvB;AAGO,SAAS,wBAAwB,SAA4B,SAAyB,yBAAyB,SAAyB,MAAc;AAC3J,QAAM,IAAI,iBAAiB,MAAM;AACjC,QAAM,IAAI,MAAM,MAAM,KAAK,MAAM;AACjC,QAAM,OAAO,QAAQ,OAAO,CAAC,MAA2B,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;AACxG,SAAO,KAAK,SAAS,IAAI,KAAK,KAAK,GAAG,IAAI,uBAAuB,GAAG,MAAM;AAC5E;AAIA,IAAM,QAAQ;AAEP,SAAS,WAAW,OAAqC;AAC9D,QAAM,IAAI,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AACrD,MAAI,MAAM,GAAI,QAAO,EAAE,OAAO,SAAS,MAAM,YAAY,SAAS,4BAA4B;AAC9F,MAAI,EAAE,SAAS,OAAO,CAAC,MAAM,KAAK,CAAC,EAAG,QAAO,EAAE,OAAO,SAAS,MAAM,iBAAiB,SAAS,4CAA4C;AAC3I,SAAO;AACT;AAGO,SAAS,cAAc,OAAqC;AACjE,MAAI,OAAO,UAAU,YAAY,UAAU,GAAI,QAAO,EAAE,OAAO,YAAY,MAAM,YAAY,SAAS,uBAAuB;AAC7H,MAAI,MAAM,SAAS,aAAc,QAAO,EAAE,OAAO,YAAY,MAAM,YAAY,SAAS,6BAA6B;AACrH,SAAO;AACT;AAOO,SAAS,iBAAiB,OAAgB,QAAqD;AACpG,MAAI,OAAO,UAAU,YAAY,UAAU,GAAI,QAAO,EAAE,OAAO,YAAY,MAAM,YAAY,SAAS,uBAAuB;AAC7H,QAAM,IAAI,SAAS,iBAAiB,MAAM,IAAI;AAC9C,QAAM,UAAU,iBAAiB,OAAO,CAAC;AACzC,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,SAAO,EAAE,OAAO,YAAY,MAAM,QAAQ,CAAC,GAAG,SAAS,wBAAwB,SAAS,CAAC,EAAE;AAC7F;AAEO,SAAS,UAAU,OAAqC;AAC7D,MAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,GAAI,QAAO;AAClE,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,SAAU,QAAO,EAAE,OAAO,QAAQ,MAAM,YAAY,SAAS,eAAe,QAAQ,eAAe;AAC1J,SAAO;AACT;AAGO,IAAM,mBAAmB;AAEzB,SAAS,kBAAkB,OAAgB,WAAW,OAA4B;AACvF,QAAM,IAAI,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AACrD,MAAI,MAAM,GAAI,QAAO,WAAW,EAAE,OAAO,gBAAgB,MAAM,YAAY,SAAS,6BAA6B,IAAI;AACrH,MAAI,EAAE,SAAS,iBAAkB,QAAO,EAAE,OAAO,gBAAgB,MAAM,YAAY,SAAS,eAAe,gBAAgB,eAAe;AAC1I,SAAO;AACT;AAGO,SAAS,sBAAsB,OAAqC;AACzE,QAAM,IAAI,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AACrD,MAAI,MAAM,GAAI,QAAO,EAAE,OAAO,QAAQ,MAAM,YAAY,SAAS,iCAAiC;AAClG,MAAI,EAAE,SAAS,iBAAkB,QAAO,EAAE,OAAO,QAAQ,MAAM,YAAY,SAAS,eAAe,gBAAgB,eAAe;AAClI,SAAO;AACT;AAEO,SAAS,UAAU,OAAqC;AAC7D,QAAM,IAAI,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AACrD,MAAI,MAAM,GAAI,QAAO,EAAE,OAAO,QAAQ,MAAM,YAAY,SAAS,kBAAkB;AACnF,MAAI,EAAE,SAAS,GAAI,QAAO,EAAE,OAAO,QAAQ,MAAM,YAAY,SAAS,sBAAsB;AAC5F,SAAO;AACT;AAGO,SAAS,gBAAgB,QAAsD;AACpF,SAAO,OAAO,KAAK,CAAC,MAAM,MAAM,IAAI,KAAK;AAC3C;;;AC9NA,IAAAC,eAAoE;;;ACVpE,IAAM,IAAI,IAAI,YAAY;AAAA,EACxB;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AACtF,CAAC;AAEM,SAAS,OAAO,MAA8B;AACnD,QAAM,IAAI,IAAI,YAAY,CAAC,YAAY,YAAY,YAAY,YAAY,YAAY,YAAY,WAAY,UAAU,CAAC;AAC1H,QAAM,MAAM,KAAK;AACjB,QAAM,SAAS,IAAI,WAAa,MAAM,IAAI,MAAO,KAAM,CAAC;AACxD,SAAO,IAAI,IAAI;AACf,SAAO,GAAG,IAAI;AACd,QAAM,OAAO,IAAI,SAAS,OAAO,MAAM;AACvC,OAAK,UAAU,OAAO,SAAS,GAAG,KAAK,MAAM,MAAM,SAAU,CAAC;AAC9D,OAAK,UAAU,OAAO,SAAS,GAAI,OAAO,MAAO,CAAC;AAClD,QAAM,IAAI,IAAI,YAAY,EAAE;AAC5B,QAAM,OAAO,CAAC,GAAW,MAAe,MAAM,IAAM,KAAM,KAAK;AAC/D,WAAS,MAAM,GAAG,MAAM,OAAO,QAAQ,OAAO,IAAI;AAChD,aAAS,IAAI,GAAG,IAAI,IAAI,IAAK,GAAE,CAAC,IAAI,KAAK,UAAU,MAAM,IAAI,CAAC;AAC9D,aAAS,IAAI,IAAI,IAAI,IAAI,KAAK;AAC5B,YAAM,KAAK,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAK,EAAE,IAAI,EAAE,MAAM;AACrE,YAAM,KAAK,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,IAAK,EAAE,IAAI,CAAC,MAAM;AACnE,QAAE,CAAC,IAAK,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,OAAQ;AAAA,IAC9C;AACA,QAAI,CAAC,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,IAAI;AAChC,aAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAC3B,YAAM,KAAM,MAAM,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,GAAG,EAAE,MAAO,IAAI,IAAM,CAAC,IAAI,KAAM,EAAE,CAAC,IAAI,EAAE,CAAC,MAAO;AACpG,YAAM,MAAO,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,GAAG,EAAE,MAAO,IAAI,IAAM,IAAI,IAAM,IAAI,OAAS;AAC1F,WAAK;AAAG,UAAI;AAAG,UAAI;AAAG,UAAK,IAAI,OAAQ;AAAG,UAAI;AAAG,UAAI;AAAG,UAAI;AAAG,UAAK,KAAK,OAAQ;AAAA,IACnF;AACA,MAAE,CAAC,KAAK;AAAG,MAAE,CAAC,KAAK;AAAG,MAAE,CAAC,KAAK;AAAG,MAAE,CAAC,KAAK;AAAG,MAAE,CAAC,KAAK;AAAG,MAAE,CAAC,KAAK;AAAG,MAAE,CAAC,KAAK;AAAG,MAAE,CAAC,KAAK;AAAA,EACvF;AACA,QAAMC,OAAM,IAAI,WAAW,EAAE;AAC7B,QAAM,KAAK,IAAI,SAASA,KAAI,MAAM;AAClC,WAAS,IAAI,GAAG,IAAI,GAAG,IAAK,IAAG,UAAU,IAAI,GAAG,EAAE,CAAC,CAAC;AACpD,SAAOA;AACT;;;ACvCO,IAAM,aAAa;AAMnB,IAAM,eAAe;AAAA,EAAC;AAAA,EAAiB;AAAA,EAAoB;AAAA,EAAwB;AAAA,EAAiB;AAAA,EACzG;AAAA,EAAqB;AAAA,EAAwB;AAAA,EAAmB;AAAA,EAAmB;AAAkB;AAGhG,SAAS,gBAAgB,aAAmE;AACjG,QAAM,MAAM,aAAa,OAAO,QAAM,cAAc,CAAC,KAAK,QAAQ,EAAE;AACpE,MAAI,IAAI,SAAS,GAAG;AAClB,UAAM,IAAI,kBAAkB,2CAA2C,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,WAAW,IAAI,OAAO,KAAK,qBAC5G,IAAI,WAAW,IAAI,OAAO,MAAM,uDAAuD;AAAA,EACrG;AACF;AACA,IAAM,UAAU;AAChB,IAAM,MAAM,IAAI,YAAY;AAC5B,IAAM,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAW7C,SAAS,WAAW,GAAuB;AAChD,MAAI,MAAM;AACV,aAAW,KAAK,EAAG,QAAO,OAAO,aAAa,CAAC;AAC/C,SAAO,KAAK,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC5E;AAGO,SAAS,WAAW,GAA8B;AACvD,MAAI,CAAC,mBAAmB,KAAK,CAAC,KAAK,EAAE,SAAS,MAAM,EAAG,QAAO;AAC9D,QAAM,MAAM,KAAK,EAAE,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,IAAI,IAAI,QAAQ,IAAK,EAAE,SAAS,KAAM,CAAC,CAAC;AAC/F,QAAMC,OAAM,WAAW,KAAK,KAAK,OAAK,EAAE,WAAW,CAAC,CAAC;AACrD,SAAO,WAAWA,IAAG,MAAM,IAAIA,OAAM;AACvC;AAEA,SAAS,SAAS,MAAsB;AACtC,SAAO,WAAW,OAAO,IAAI,OAAO,IAAI,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC;AACxD;AAEA,SAAS,eAAe,GAAoB;AAC1C,SAAO,iBAAiB,KAAK,CAAC;AAChC;AAOO,SAAS,YAAY,GAAoB;AAC9C,MAAI,MAAM,MAAM,CAAC,eAAe,CAAC,EAAG,QAAO;AAC3C,MAAI;AACJ,MAAI;AAAE,QAAI,IAAI,IAAI,CAAC;AAAA,EAAE,QAAQ;AAAE,WAAO;AAAA,EAAM;AAC5C,MAAI,EAAE,WAAW,EAAG,QAAO;AAC3B,MAAI,cAAc,KAAK,EAAE,IAAI,EAAG,QAAO;AACvC,MAAI,EAAE,aAAa,SAAU,QAAO;AACpC,SAAO,EAAE,aAAa,WAAW,CAAC,aAAa,aAAa,OAAO,EAAE,SAAS,EAAE,QAAQ;AAC1F;AAEA,IAAM,OAAO,CAAC,QAAyB,YAA2B;AAChE,QAAM,IAAI,eAAe,QAAQ,OAAO;AAC1C;AAEA,IAAM,YAAY;AAGX,SAAS,SAASC,OAAyB;AAChD,QAAM,IAAIA,MAAK,QAAQ,4BAA4B,EAAE;AACrD,MAAI,MAAM,MAAM,EAAE,SAAS,WAAW,CAAC,eAAe,CAAC,EAAG,MAAK,cAAc,SAAS;AACtF,QAAM,OAAO,EAAE,MAAM,KAAK,CAAC,EAAE,CAAC;AAC9B,MAAI,SAAS,YAAY;AACvB,QAAI,iBAAiB,KAAK,IAAI,EAAG,MAAK,eAAe,gCAAgC,IAAI,0BAA0B;AACnH,SAAK,cAAc,SAAS;AAAA,EAC9B;AACA,QAAM,QAAQ,EAAE,MAAM,GAAG;AACzB,MAAI,MAAM,WAAW,KAAK,MAAM,KAAK,OAAK,MAAM,EAAE,EAAG,MAAK,cAAc,SAAS;AACjF,MAAI,CAAC,kBAAkB,SAAS,MAAM,MAAM,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG;AACvE,SAAK,gBAAgB,yFAAyF;AAAA,EAChH;AACA,QAAM,cAAc,WAAW,MAAM,CAAC,CAAC;AACvC,MAAI,SAAS;AACb,MAAI;AAAE,aAAS,cAAc,IAAI,OAAO,WAAW,IAAI;AAAA,EAAG,QAAQ;AAAE,aAAS;AAAA,EAAG;AAChF,MAAI,CAAC,YAAY,MAAM,EAAG,MAAK,cAAc,uCAAuC;AACpF,QAAM,cAAc,WAAW,MAAM,CAAC,CAAC;AACvC,QAAM,WAAW,cAAc,OAAO,aAAa,GAAG,WAAW,IAAI;AACrE,MAAI,CAAC,0BAA0B,KAAK,QAAQ,EAAG,MAAK,cAAc,+BAA+B;AACjG,QAAM,SAAS,WAAW,MAAM,CAAC,CAAC;AAClC,MAAI,MAAM,CAAC,EAAE,WAAW,MAAM,CAAC,UAAU,OAAO,WAAW,GAAI,MAAK,cAAc,kCAAmC;AACrH,SAAO,EAAE,QAAQ,UAAU,QAAQ,MAAM,CAAC,EAAE;AAC9C;AAGO,SAAS,WAAW,QAAgB,UAAkB,QAAwB;AACnF,QAAM,OAAO,GAAG,UAAU,IAAI,WAAW,IAAI,OAAO,MAAM,CAAC,CAAC,IAAI,WAAW,IAAI,OAAO,QAAQ,CAAC,CAAC,IAAI,MAAM;AAC1G,QAAM,MAAM,GAAG,IAAI,IAAI,SAAS,IAAI,CAAC;AACrC,WAAS,GAAG;AACZ,SAAO;AACT;AAEA,SAAS,kBAAkB,GAAW,GAAoB;AACxD,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAI,IAAI;AACR,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,MAAK,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC;AACxE,SAAO,MAAM;AACf;;;AFnFO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAC5C,YAAqB,QAAgB;AACnC,UAAM,oCAAoC,MAAM,EAAE;AAD/B;AAEnB,SAAK,OAAO;AAAA,EACd;AAAA,EAHqB;AAIvB;AAmCO,SAAS,kBAAkB,MAAoB,KAAK,KAAkB;AAC3E,QAAM,OAAO,oBAAI,IAAoB;AACrC,SAAO;AAAA,IACL,MAAM,MAAM,KAAK,OAAO;AACtB,YAAM,IAAI,IAAI;AACd,UAAI,KAAK,OAAO;AAAQ,mBAAW,CAAC,GAAG,CAAC,KAAK,KAAM,KAAI,KAAK,EAAG,MAAK,OAAO,CAAC;AAAA;AAC5E,YAAM,OAAO,KAAK,IAAI,GAAG;AACzB,UAAI,SAAS,UAAa,OAAO,EAAG,QAAO;AAC3C,WAAK,IAAI,KAAK,MAAM,QAAQ,CAAC;AAC7B,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,IAAM,OAAO,oBAAI,IAA6B;AAE9C,SAAS,OAAO,QAAiC;AAC/C,MAAI,MAAM,KAAK,IAAI,MAAM;AACzB,MAAI,QAAQ,QAAW;AACrB,cAAM,iCAAmB,IAAI,IAAI,GAAG,MAAM,wBAAwB,GAAG,EAAE,kBAAkB,IAAO,CAAC;AACjG,SAAK,IAAI,QAAQ,GAAG;AAAA,EACtB;AACA,SAAO;AACT;AAEA,IAAM,MAAM,CAAC,MAAgB,OAAO,MAAM,YAAY,MAAM,KAAK,IAAI;AAOrE,eAAsB,cAAc,SAAkB,UAAgC,CAAC,GAAyB;AAE9G,QAAM,MAAM,OAAO,YAAY,cAAc,QAAQ,KAAK,aAAa;AACvE,QAAMC,OAAM,MAAM,SAAS,GAAG,EAAE,SAAS,OAAO,YAAY,cAAc,QAAQ,KAAK,gBAAgB;AACvG,QAAM,SAAS,uBAAuB,QAAQ,UAAUA,QAAO,EAAE;AACjE,MAAI,WAAW,GAAI,OAAM,IAAI,mBAAmB,mCAAmC;AACnF,QAAM,YAAY,QAAQ,QAAQ,IAAI,wBAAwB;AAC9D,MAAI,CAAC,UAAW,OAAM,IAAI,mBAAmB,cAAc;AAG3D,QAAM,MAAM,IAAI,WAAW,MAAM,QAAQ,YAAY,CAAC;AACtD,QAAM,WAAW,QAAQ,OAAO,QAAQ,IAAI,MAAM,GAAG,EAAE,CAAC;AAExD,MAAI;AACJ,MAAI;AACF,UAAM,WAAW,UAAM,wBAAU,WAAW,QAAQ,QAAQ,OAAO,MAAM,GAAG;AAAA,MAC1E,YAAY,CAAC,OAAO;AAAA,MACpB;AAAA,MACA,KAAK;AAAA,MACL,gBAAgB,CAAC,OAAO,OAAO,OAAO,aAAa;AAAA,MACnD,aAAa,QAAQ;AAAA,MACrB,gBAAgB;AAAA,IAClB,CAAC;AACD,aAAS,SAAS;AAAA,EACpB,SAAS,KAAK;AACZ,UAAM,IAAI,mBAAmB,eAAe,QAAQ,IAAI,UAAU,eAAe;AAAA,EACnF;AAGA,MAAI,OAAO,QAAQ,UAAU,OAAO,eAAe,QAAQ;AACzD,UAAM,IAAI,mBAAmB,8BAA8B;AAAA,EAC7D;AAGA,QAAM,MAAM,KAAK,OAAO,QAAQ,OAAO,oBAAI,KAAK,GAAG,QAAQ,IAAI,GAAI;AACnE,MAAI,OAAO,OAAO,QAAQ,YAAY,OAAO,MAAM,MAAM,GAAI,OAAM,IAAI,mBAAmB,sBAAsB;AAEhH,QAAM,SAAS,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,WAAW,GAAG,CAAC;AACxE,MAAI,MAAM;AACV,aAAW,KAAK,OAAQ,QAAO,OAAO,aAAa,CAAC;AACpD,QAAM,OAAO,KAAK,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAChF,MAAI,SAAS,OAAO,YAAa,OAAM,IAAI,mBAAmB,yCAAyC;AAEvG,MAAI;AACJ,MAAI;AACF,WAAO,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,GAAG,CAAC;AAAA,EACjD,QAAQ;AACN,UAAM,IAAI,mBAAmB,sBAAsB;AAAA,EACrD;AAEA,MAAI,KAAK,OAAO,OAAO,OAAO,KAAK,UAAU,OAAO,OAAO,KAAK,cAAc,OAAO,KAAK;AACxF,UAAM,IAAI,mBAAmB,qCAAqC;AAAA,EACpE;AACA,MAAI,QAAQ,QAAQ;AAElB,UAAM,MAAM,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM,MAAM;AAChE,QAAI,CAAE,MAAM,QAAQ,OAAO,MAAM,GAAG,OAAO,OAAO,GAAG,CAAC,IAAI,OAAO,OAAO,GAAG,CAAC,IAAI,IAAI,KAAK,MAAM,GAAI,CAAC,GAAI;AACtG,YAAM,IAAI,mBAAmB,iCAAiC;AAAA,IAChE;AAAA,EACF;AACA,QAAM,QAAS,KAAK,QAAQ,CAAC;AAC7B,SAAO;AAAA,IACL,IAAI,OAAO,KAAK,EAAE;AAAA,IAClB,MAAM,OAAO,KAAK,KAAK;AAAA,IACvB,UAAU,OAAO,KAAK,SAAS;AAAA,IAC/B,WAAW,OAAO,MAAM,cAAc,KAAK,cAAc,EAAE;AAAA,IAC3D,GAAI,IAAI,MAAM,OAAO,IAAI,EAAE,QAAQ,MAAM,QAAQ,IAAI,CAAC;AAAA,IACtD,GAAI,IAAI,MAAM,QAAQ,IAAI,EAAE,SAAS,MAAM,SAAS,IAAI,CAAC;AAAA,IACzD,MAAO,MAAM,QAAQ,CAAC;AAAA,EACxB;AACF;;;AG5KO,IAAM,mBAAmB;AAkBzB,IAAM,iBAAsC,oBAAI,IAAI;AAAA,EACzD;AAAA,EAAkB;AAAA,EAAgB;AAAA,EAAqB;AAAA,EAAsB;AAAA,EAAqB;AAAA,EAClG;AAAA,EAAkB;AAAA,EAAsB;AAAA,EAAuB;AAAA,EAAuB;AAAA,EACtF;AAAA,EAA0B;AAAA,EAA2B;AAAA,EAAiC;AAAA,EACtF;AAAA,EAAsB;AACxB,CAAC;AAGM,SAAS,OAAO,OAAe,QAAuC;AAC3E,UAAQ,QAAQ;AAAA,IACd,KAAK;AAAa,aAAO;AAAA,IACzB,KAAK;AAAgB,aAAO;AAAA,IAC5B,KAAK;AAAyB,aAAO;AAAA;AAAA,IAErC,KAAK;AAAQ,aAAO,MAAM,WAAW,cAAc,IAAI,QAAQ;AAAA;AAAA,IAE/D,KAAK;AAAW,aAAO,UAAU,kCAAkC,YAAY;AAAA,IAC/E;AAAS,aAAO;AAAA,EAClB;AACF;AAQA,eAAsB,OAAO,KAAe,OAAsB,YAAY,OAA0B;AACtG,QAAM,UAAU,IAAI,QAAQ;AAC5B,MAAI,QAAQ,QAAQ,CAAC,OAAO,SAAS;AACnC,QAAI,SAAS,aAAc,SAAQ,IAAI,MAAM,KAAK;AAAA,EACpD,CAAC;AACD,aAAW,UAAU,IAAI,QAAQ,aAAa,EAAG,SAAQ,OAAO,cAAc,MAAM;AACpF,UAAQ,IAAI,mBAAmB,gBAAgB;AAC/C,MAAI,CAAC,aAAa,EAAE,QAAQ,IAAI,eAAe,KAAK,IAAI,SAAS,UAAU,EAAG,SAAQ,IAAI,iBAAiB,UAAU;AAErH,MAAI,OAAwB,IAAI;AAChC,MAAI,UAAU,QAAQ,eAAe,IAAI,KAAK,KAAK,IAAI,OAAO,QAAQ,IAAI,cAAc,KAAK,IAAI,WAAW,kBAAkB,GAAG;AAC/H,UAAMC,QAAO,MAAM,IAAI,KAAK;AAC5B,WAAOA;AACP,QAAI;AACF,YAAM,SAAS,KAAK,MAAMA,KAAI;AAC9B,YAAM,OAAO,OAAO,OAAO,QAAQ,MAAM;AACzC,UAAI,WAAW,QAAQ,SAAS,OAAW,QAAO,KAAK,UAAU,EAAE,GAAG,QAAQ,KAAK,CAAC;AAAA,IACtF,QAAQ;AAAA,IAER;AACA,YAAQ,OAAO,gBAAgB;AAAA,EACjC;AACA,SAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,QAAQ,YAAY,IAAI,YAAY,QAAQ,CAAC;AACvF;;;AC7DA,IAAAC,eAAqH;;;ACLrH,IAAM,QAAQ,oBAAI,IAAI,CAAC,KAAK,KAAM,MAAM,IAAI,CAAC;AAC7C,IAAM,QAAQ,MAAM;AAEb,SAAS,YAAYC,OAAc,iBAAoC,CAAC,GAAY;AACzF,MAAI,IAAI;AACR,MAAI,QAAQ;AACZ,QAAMC,QAAO,CAAC,SAAwB;AACpC,UAAM,IAAI,YAAY,GAAG,IAAI,OAAO,CAAC,EAAE;AAAA,EACzC;AACA,QAAM,OAAO,MAAM;AACjB,WAAO,IAAID,MAAK,UAAU,MAAM,IAAIA,MAAK,CAAC,CAAC,EAAG;AAAA,EAChD;AACA,QAAM,QAAQ,CAAC,UAAU,UAAmB;AAC1C,SAAK;AACL,UAAM,IAAIA,MAAK,CAAC;AAChB,QAAI,MAAM,IAAK,QAAO,OAAO;AAC7B,QAAI,MAAM,IAAK,QAAO,MAAM;AAC5B,QAAI,MAAM,IAAK,QAAO,OAAO;AAC7B,QAAI,MAAM,OAAQ,KAAK,OAAO,KAAK,IAAM,QAAO,OAAO,OAAO;AAC9D,eAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAY;AACnF,UAAIA,MAAK,WAAW,MAAM,CAAC,GAAG;AAC5B,aAAK,KAAK;AACV,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAOC,MAAK,sBAAsB;AAAA,EACpC;AACA,QAAM,SAAS,MAAc;AAC3B,UAAM,QAAQ;AACd;AACA,WAAO,IAAID,MAAK,UAAUA,MAAK,CAAC,MAAM,IAAK,MAAKA,MAAK,CAAC,MAAM,OAAO,IAAI;AACvE,QAAIA,MAAK,CAAC,MAAM,IAAK,CAAAC,MAAK,qBAAqB;AAC/C;AACA,WAAO,KAAK,MAAMD,MAAK,MAAM,OAAO,CAAC,CAAC;AAAA,EACxC;AACA,QAAM,SAAS,CAAC,YAA6B;AAC3C,UAAM,IAAI,yCAAyC,KAAKA,MAAK,MAAM,CAAC,CAAC;AACrE,QAAI,CAAC,EAAG,QAAOC,MAAK,YAAY;AAChC,SAAK,EAAE,CAAC,EAAE;AAEV,QAAI,YAAY,EAAE,CAAC,MAAM,UAAa,EAAE,CAAC,MAAM,QAAY,QAAO,OAAO;AACzE,QAAI,EAAE,CAAC,MAAM,UAAa,EAAE,CAAC,MAAM,QAAW;AAC5C,YAAM,MAAM,OAAO,EAAE,CAAC,CAAC;AACvB,UAAI,MAAM,SAAS,MAAM,CAAC,MAAO,QAAO,OAAO;AAAA,IACjD;AACA,WAAO,OAAO,EAAE,CAAC,CAAC;AAAA,EACpB;AACA,QAAM,QAAQ,MAAiB;AAC7B;AACA;AACA,UAAMC,OAAiB,CAAC;AACxB,SAAK;AACL,QAAIF,MAAK,CAAC,MAAM,KAAK;AACnB;AACA;AACA,aAAOE;AAAA,IACT;AACA,eAAS;AACP,MAAAA,KAAI,KAAK,MAAM,CAAC;AAChB,WAAK;AACL,UAAIF,MAAK,CAAC,MAAM,IAAK;AAAA,eACZA,MAAK,CAAC,MAAM,KAAK;AACxB;AACA;AACA,eAAOE;AAAA,MACT,MAAO,CAAAD,MAAK,iBAAiB;AAAA,IAC/B;AAAA,EACF;AACA,QAAM,SAAS,MAA+B;AAC5C;AACA;AACA,UAAMC,OAA+B,CAAC;AACtC,UAAM,OAAO,oBAAI,IAAY;AAC7B,SAAK;AACL,QAAIF,MAAK,CAAC,MAAM,KAAK;AACnB;AACA;AACA,aAAOE;AAAA,IACT;AACA,eAAS;AACP,WAAK;AACL,UAAIF,MAAK,CAAC,MAAM,IAAK,CAAAC,MAAK,iBAAiB;AAC3C,YAAM,OAAO,OAAO;AACpB,UAAI,KAAK,IAAI,IAAI,EAAG,CAAAA,MAAK,iBAAiB,KAAK,UAAU,IAAI,CAAC,EAAE;AAChE,WAAK,IAAI,IAAI;AACb,WAAK;AACL,UAAID,MAAK,CAAC,MAAM,IAAK,CAAAC,MAAK,YAAY;AACtC;AACA,aAAO,eAAeC,MAAK,MAAM,EAAE,OAAO,MAAM,UAAU,KAAK,eAAe,SAAS,IAAI,CAAC,GAAG,YAAY,MAAM,UAAU,MAAM,cAAc,KAAK,CAAC;AACrJ,WAAK;AACL,UAAIF,MAAK,CAAC,MAAM,IAAK;AAAA,eACZA,MAAK,CAAC,MAAM,KAAK;AACxB;AACA;AACA,eAAOE;AAAA,MACT,MAAO,CAAAD,MAAK,iBAAiB;AAAA,IAC/B;AAAA,EACF;AACA,QAAM,SAAS,MAAM;AACrB,OAAK;AACL,MAAI,IAAID,MAAK,OAAQ,CAAAC,MAAK,qBAAqB;AAC/C,SAAO;AACT;;;AC1GA,IAAM,OAAO,oBAAI,IAAY;AAGtB,SAAS,WAAW,MAAc,SAAuB;AAC9D,MAAI,KAAK,IAAI,IAAI,EAAG;AACpB,OAAK,IAAI,IAAI;AACb,QAAM,UAAU,mBAAmB,IAAI,qCAAqC,OAAO;AAEnF,MAAI,OAAO,YAAY,eAAe,OAAO,QAAQ,gBAAgB,YAAY;AAC/E,YAAQ,YAAY,SAAS,EAAE,MAAM,sBAAsB,MAAM,oBAAoB,CAAC;AAAA,EACxF,OAAO;AACL,YAAQ,KAAK,OAAO;AAAA,EACtB;AACF;;;ACNA,IAAME,OAAM,IAAI,YAAY;AAC5B,IAAM,gBAAgB,WAAW,KAAK,CAAC,IAAM,IAAM,GAAM,GAAM,GAAM,IAAM,GAAM,GAAM,GAAM,IAAM,KAAM,KAAM,GAAM,IAAM,GAAM,EAAI,CAAC;AAE/H,IAAMC,kBAAiB;AAmB9B,eAAe,OAAO,QAAqC;AACzD,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAOD,KAAI,OAAO,MAAM,GAAG,QAAQ,OAAO,CAAC,YAAY,CAAC;AAClG,SAAO,IAAI,WAAW,MAAM,OAAO,OAAO;AAAA,IACxC,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,IAAI,WAAW,CAAC,GAAG,MAAMA,KAAI,OAAO,gBAAgB,EAAE;AAAA,IAAG;AAAA,IAAK;AAAA,EAAG,CAAC;AAC7G;AAGA,eAAsB,WAAW,GAA4B;AAC3D,SAAO,WAAW,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,WAAWA,KAAI,OAAO,qCAAqC,CAAC,IAAI,CAAC,CAAC,CAAC;AACjI;AAEA,eAAe,SAAS,QAAiC;AACvD,QAAM,OAAO,MAAM,OAAO,MAAM;AAChC,QAAM,MAAM,IAAI,WAAW,cAAc,SAAS,EAAE;AACpD,MAAI,IAAI,aAAa;AACrB,MAAI,IAAI,MAAM,cAAc,MAAM;AAElC,QAAM,WAAW,MAAM,OAAO,OAAO,UAAU,SAAS,KAAK,EAAE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;AAChG,QAAM,EAAE,EAAE,IAAI,MAAM,OAAO,OAAO,UAAU,OAAO,QAAQ;AAC3D,QAAM,UAAU,MAAM,OAAO,OAAO,UAAU,SAAS,KAAK,EAAE,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;AAChG,MAAI,KAAK,CAAC;AACV,OAAK,KAAK,CAAC;AACX,QAAM,YAAuB,EAAE,KAAK,OAAO,KAAK,WAAW,EAAe;AAC1E,QAAM,MAAM,MAAM,WAAW,UAAU,CAAC;AACxC,QAAM,SAAS,WAAWA,KAAI,OAAO,KAAK,UAAU,EAAE,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC;AAC3E,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,MAAM,UAAU,UAAU,eAAe,MAAM,OAAO,WAAW,GAAG,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAAG;AACvG,YAAM,SAAS,EAAE,KAAK,UAAU,KAAK,UAAU,KAAK,eAAe,KAAK,KAAK,KAAK,MAAM,IAAI;AAC5F,YAAM,QAAQ,GAAG,MAAM,IAAI,WAAWA,KAAI,OAAO,KAAK,UAAU,MAAM,CAAC,CAAC,CAAC;AACzE,YAAM,MAAM,IAAI,WAAW,MAAM,OAAO,OAAO,KAAK,EAAE,MAAM,UAAU,GAAG,SAASA,KAAI,OAAO,KAAK,CAAC,CAAC;AACpG,aAAO,GAAG,KAAK,IAAI,WAAW,GAAG,CAAC;AAAA,IACpC;AAAA,EACF;AACF;AAGO,SAAS,cAAc,KAAgB,UAAkC;AAC9E,QAAM,QAAQ,YAAY,SAAS,WAAW,IAAI,SAAS,WAAW;AACtE,QAAM,QAAQ,WAAW,IAAI,QAAQ,OAAO,MAAM;AAClD,SAAO;AAAA,IACL,QAAQ,MAAM;AAAA,IACd,MAAM,MAAM;AAAA,IACZ,QAAQ,SAAS,IAAI,MAAM;AAAA,IAC3B,GAAI,QAAQ,EAAE,aAAa,SAAS,MAAM,MAAM,EAAE,KAAK,QAAM,EAAE,GAAG,EAAE,WAAW,KAAK,EAAE,IAAI,EAAE,EAAE,IAAI,CAAC;AAAA,EACrG;AACF;;;AC/BO,IAAM,gBAAgB;AAE7B,IAAM,QAAQ,CAAC,OAAe,IAAI,QAAc,CAACE,aAAY;AAC3D,QAAM,IAAI,WAAWA,UAAS,EAAE;AAC/B,EAAC,EAA6B,QAAQ;AACzC,CAAC;AAEM,SAAS,eAAe,GAAmC;AAChE,QAAM,UAAU,EAAE,SAAS,WAAW;AACtC,QAAM,MAAM,EAAE,OAAO,KAAK;AAC1B,QAAM,QAAQ,EAAE,WAAW,CAAC,KAAM,KAAM,KAAM,KAAQ,GAAM;AAC5D,MAAI;AACJ,MAAI;AACJ,MAAI,YAAY;AAChB,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI,SAAS;AACb,MAAI;AACJ,MAAI;AACJ,QAAM,MAAM,OAAO,OAAO,EAAE,QAAQ,aAAa,EAAE,IAAI,IAAI,EAAE,QAAQ;AAErE,iBAAe,MAAkC;AAC/C,UAAM,UAAkC,EAAE,eAAe,UAAU,MAAM,EAAE,MAAM,CAAC,IAAI,QAAQ,mBAAmB;AACjH,QAAI,QAAQ,KAAM,SAAQ,eAAe,IAAI;AAC7C,UAAM,MAAM,MAAM,QAAQ,GAAG,EAAE,MAAM,oBAAoB,EAAE,QAAQ,CAAC;AACpE,QAAI,IAAI,WAAW,OAAO,KAAM,QAAO;AACvC,QAAI,IAAI,WAAW,IAAK,OAAM,OAAO,OAAO,IAAI,MAAM,iBAAiB,GAAG,EAAE,MAAM,kBAAkB,CAAC;AACrG,QAAI,CAAC,IAAI,GAAI,OAAM,IAAI,eAAe,KAAK,eAAe,mBAAmB,IAAI,MAAM,sBAAsB;AAC7G,UAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAI,CAAC,MAAM,QAAQ,OAAO,KAAK,KAAK,cAAc,SAAU,OAAM,IAAI,eAAe,KAAK,eAAe,qDAAsD;AAC/J,WAAO,IAAI,QAAQ,IAAI,MAAM,KAAK;AAClC,WAAO,KAAK;AAAA,EACd;AAGA,WAAS,UAAU,GAAwC;AACzD,UAAM,OAAQ,GAAgC;AAC9C,QAAI,SAAS,oBAAoB,SAAS,kBAAmB,QAAO;AACpE,UAAM,UAAU,SAAS,oBACrB,kEAAkE,IAAI,CAAC,+CACvE,8CAA8C,IAAI,CAAC;AACvD,WAAO,IAAI,eAAe,KAAK,iBAAiB,OAAO;AAAA,EACzD;AAEA,WAAS,OAAO,KAAqC;AACnD,QAAI,YAAY,OAAW,GAAE,MAAM,IAAI,QAAQ,QAAQ,sBAAsB,EAAE,CAAC;AAChF,cAAU;AAEV,gBAAY,IAAI;AAChB,WAAO;AAAA,EACT;AAEA,iBAAe,cAAiC;AAC9C,aAAS,UAAU,KAAK,WAAW;AACjC,mBAAa,IAAI,QAAiB,CAAAA,aAAW;AAAE,uBAAeA;AAAA,MAAQ,CAAC;AACvE,UAAI;AACF,cAAM,MAAM,MAAM,IAAI;AACtB,YAAI,QAAQ,OAAQ,QAAO;AAC3B,oBAAY,IAAI;AAChB,iBAAS;AACT,uBAAe,IAAI;AACnB,eAAO;AAAA,MACT,SAAS,GAAG;AACV,cAAM,IAAI,UAAU,CAAC;AACrB,iBAAS;AACT,uBAAe,KAAK;AACpB,YAAI,EAAG,OAAM,OAAO,CAAC;AACrB,cAAM,MAAM,MAAM,KAAK,IAAI,SAAS,MAAM,SAAS,CAAC,CAAC,CAAC;AAAA,MACxD;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,UAAyB;AACtC,gBAAY,IAAI;AAChB,QAAI;AACF,YAAM,MAAM,MAAM,IAAI;AACtB,UAAI,QAAQ,OAAQ,QAAO;AAC3B,gBAAU;AAAA,IACZ,SAAS,GAAG;AACV,YAAM,IAAI,UAAU,CAAC;AACrB,UAAI,EAAG,QAAO,CAAC;AAAA,IAEjB;AAAA,EACF;AAEA,SAAO;AAAA,IACL,QAA2B;AACzB,WAAK,QAAQ,YAAY,IAAI,IAAI,aAAa,eAAe;AAC3D,uBAAe,QAAQ,EAAE,QAAQ,MAAM;AAAE,uBAAa;AAAA,QAAU,CAAC;AAAA,MACnE;AACA,UAAI,QAAS,QAAO,QAAQ,OAAO,OAAO;AAC1C,UAAI,KAAM,QAAO,QAAQ,QAAQ,IAAI;AACrC,gBAAU,YAAY;AACtB,aAAO;AAAA,IACT;AAAA,IACA,SAAS,MAAM;AAAA,IACf,SAAS,MAAO,eAAe,QAAQ,EAAE,QAAQ,MAAM;AAAE,mBAAa;AAAA,IAAU,CAAC;AAAA,IACjF,SAAS,MAAM,SAAS,UAAa,UAAU,YAAY;AAAA,IAC3D,SAAS,MAAO,SAAS,SAAY,QAAQ,QAAQ,IAAI,IAAI,cAAc,QAAQ,QAAQ,KAAK;AAAA,EAClG;AACF;;;AJzFO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,YAAY,QAAgB;AAC1B,UAAM,kDAAkD,MAAM,EAAE;AAChE,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAC1C,YAAqB,QAA+B,QAAiB;AACnE,UAAM,kCAAkC,MAAM,GAAG,SAAS,KAAK,MAAM,MAAM,EAAE,EAAE;AAD5D;AAA+B;AAElD,SAAK,OAAO;AAAA,EACd;AAAA,EAHqB;AAAA,EAA+B;AAItD;AA8CA,IAAM,kBAAkB;AACxB,IAAMC,QAAO;AACb,IAAMC,YAAW;AACjB,IAAM,UAAU;AAEhB,IAAM,iBAAiB,KAAK;AAC5B,IAAM,kBAAkB;AACxB,IAAM,mBAAmB;AACzB,IAAM,qBAAqB;AAC3B,IAAM,iBAAiB;AACvB,IAAM,iBAAiB;AAWhB,SAAS,WAAW,QAAgB,YAA0B,OAAwB;AAC3F,MAAI;AACJ,MAAI,YAAY;AAChB,MAAI,YAAY;AAChB,MAAI;AAEJ,QAAM,OAAO,YAA2B;AACtC,gBAAY,KAAK,IAAI;AACrB,QAAI;AACF,YAAM,MAAM,MAAM,UAAU,GAAG,MAAM,0BAA0B,EAAE,UAAU,UAAU,QAAQ,YAAY,QAAQ,eAAe,GAAG,SAAS,EAAE,QAAQ,mBAAmB,EAAE,CAAC;AAC5K,UAAI,IAAI,WAAW,IAAK,OAAM,IAAI,MAAM,YAAY,IAAI,MAAM,EAAE;AAChE,YAAM,QAAQ,MAAM,WAAW,KAAK,cAAc;AAClD,YAAM,SAAS,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AACzD,UAAI,CAAC,UAAU,CAAC,MAAM,QAAQ,OAAO,IAAI,EAAG,OAAM,IAAI,MAAM,eAAe;AAE3E,YAAM,OAAO,oBAAI,IAAY;AAC7B,iBAAW,KAAK,OAAO,MAAM;AAC3B,cAAM,SAAS,GAAG,QAAQ,UAAU,EAAE,QAAQ,UAAa,EAAE,QAAQ,WAAW,EAAE,QAAQ,UAAa,EAAE,QAAQ;AACjH,YAAI,CAAC,UAAU,OAAO,EAAE,QAAQ,SAAU;AAC1C,YAAI,KAAK,IAAI,EAAE,GAAG,EAAG,OAAM,IAAI,MAAM,iCAAiC,KAAK,UAAU,EAAE,GAAG,CAAC,EAAE;AAC7F,aAAK,IAAI,EAAE,GAAG;AAAA,MAChB;AACA,gBAAM,gCAAkB,MAAM;AAC9B,YAAM,SAAS,gBAAgB,KAAK,IAAI,QAAQ,IAAI,eAAe,KAAK,EAAE;AAE1E,YAAM,MAAM,KAAK,IAAI,gBAAgB,KAAK,IAAI,SAAS,OAAO,OAAO,CAAC,CAAC,IAAI,oBAAoB,cAAc,CAAC;AAC9G,kBAAY,KAAK,IAAI,IAAI,MAAM;AAAA,IACjC,SAAS,KAAK;AAIZ,UAAI,QAAQ,OAAW,OAAM,IAAI,uBAAuB,eAAe,QAAQ,IAAI,UAAU,aAAa;AAC1G,kBAAY,KAAK,IAAI,WAAW,KAAK,IAAI,IAAI,gBAAgB;AAAA,IAC/D;AAAA,EACF;AACA,QAAM,UAAU,MAAqB;AACnC,iBAAa,KAAK,EAAE,QAAQ,MAAM;AAChC,iBAAW;AAAA,IACb,CAAC;AACD,WAAO;AAAA,EACT;AAEA,SAAO,OAAO,QAAQ,UAAU;AAC9B,QAAI,QAAQ,UAAa,KAAK,IAAI,KAAK,UAAW,OAAM,QAAQ;AAChE,QAAI;AACF,aAAO,MAAM,IAAK,QAAQ,KAAK;AAAA,IACjC,SAAS,KAAK;AACZ,YAAM,UAAW,KAAmC,SAAS;AAC7D,UAAI,WAAW,KAAK,IAAI,IAAI,aAAa,kBAAkB;AACzD,cAAM,QAAQ;AACd,eAAO,IAAK,QAAQ,KAAK;AAAA,MAC3B;AACA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,eAAe,WAAW,KAAe,KAAkC;AACzE,QAAM,SAAS,IAAI,MAAM,UAAU;AACnC,MAAI,CAAC,OAAQ,QAAO,IAAI,WAAW;AACnC,QAAM,SAAuB,CAAC;AAC9B,MAAI,OAAO;AACX,aAAS;AACP,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,QAAI,KAAM;AACV,YAAQ,MAAM;AACd,QAAI,OAAO,KAAK;AACd,YAAM,OAAO,OAAO;AACpB,YAAM,IAAI,MAAM,QAAQ,GAAG,QAAQ;AAAA,IACrC;AACA,WAAO,KAAK,KAAK;AAAA,EACnB;AACA,QAAMC,OAAM,IAAI,WAAW,IAAI;AAC/B,MAAI,KAAK;AACT,aAAW,KAAK,QAAQ;AACtB,IAAAA,KAAI,IAAI,GAAG,EAAE;AACb,UAAM,EAAE;AAAA,EACV;AACA,SAAOA;AACT;AAEA,IAAMC,aAAY,oBAAI,IAA6B;AACnD,IAAM,YAAY,oBAAI,QAAoD;AAE1E,SAAS,cAAc,QAAgB,WAA0C;AAC/E,MAAI,WAAW,UAAU,IAAI,SAAS;AACtC,MAAI,CAAC,SAAU,WAAU,IAAI,WAAY,WAAW,oBAAI,IAAI,CAAE;AAC9D,MAAI,MAAM,SAAS,IAAI,MAAM;AAC7B,MAAI,CAAC,IAAK,UAAS,IAAI,QAAS,MAAM,WAAW,QAAQ,SAAS,CAAE;AACpE,SAAO;AACT;AAGO,SAASC,QAAO,QAAiC;AACtD,MAAI,MAAMD,WAAU,IAAI,MAAM;AAC9B,MAAI,QAAQ,QAAW;AACrB,UAAM,WAAW,MAAM;AACvB,IAAAA,WAAU,IAAI,QAAQ,GAAG;AAAA,EAC3B;AACA,SAAO;AACT;AAEA,SAASE,KAAI,MAAkC;AAC7C,SAAO,OAAO,YAAY,cAAc,QAAQ,MAAM,IAAI,IAAI;AAChE;AAEA,SAAS,OAAO,MAA0C;AAExD,MAAI,OAAO,SAAS,SAAU,QAAO,KAAK,QAAQ,eAAe,EAAE;AACnE,QAAM,UAAU,gBAAgB,UAAU,OAAO,KAAK,SAAS,IAAI,eAAe,KAAK;AACvF,SAAO,cAAc,KAAK,MAAM,IAAI,OAAO,QAAQ,eAAe,EAAE,EAAE,KAAK,IAAI;AACjF;AAEA,SAAS,cAAc,OAAe,MAAsB;AAC1D,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,KAAK;AAAA,EACrB,QAAQ;AACN,UAAM,IAAI,kBAAkB,GAAG,IAAI,wDAAwD;AAAA,EAC7F;AAEA,QAAM,QAAQ,IAAI,aAAa,eAAe,IAAI,aAAa,eAAe,IAAI,SAAS,SAAS,YAAY,KAAK,IAAI,SAAS,SAAS,OAAO;AAClJ,MAAI,IAAI,aAAa,YAAY,EAAE,IAAI,aAAa,WAAW,OAAQ,OAAM,IAAI,kBAAkB,GAAG,IAAI,kEAAkE;AAC5K,MAAI,IAAI,WAAW,MAAM,IAAI,SAAS,GAAI,OAAM,IAAI,kBAAkB,GAAG,IAAI,iCAAiC;AAC9G,SAAO,uBAAuB,KAAK;AACrC;AAEA,IAAM,WAAW,CAAC,MAA6C,OAAO,MAAM,YAAY,MAAM,QAAQ,CAAC,MAAM,QAAQ,CAAC;AAEtH,SAAS,WAAW,SAA0B;AAC5C,QAAM,SAAS,QAAQ,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAC3D,SAAO,YAAY,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,MAAM,CAAC;AACnE;AAOO,SAAS,oBAAoB,UAA8B,CAAC,GAAiE;AAElI,QAAM,UAAW,CAAC,iBAAiB,mBAAmB,kBAAkB,EACrE,OAAO,CAAC,MAAM,MAAM,CAAC,QAAQ,QAAQ,QAAQ,UAAU,QAAQ,QAAQ,EAAE,CAAC,MAAM,WAAcA,KAAI,IAAI,KAAK,QAAQ,EAAE;AACxH,MAAI,QAAQ,SAAS,GAAG;AACtB,eAAW,gFAAgF,iDAAiD;AAAA,EAC9I;AACA,QAAM,cAAc,QAAQ,UAAUA,KAAI,eAAe,KAAK;AAC9D,MAAI,gBAAgB,GAAI,OAAM,IAAI,kBAAkB,mCAAmC;AACvF,QAAM,SAAS,cAAc,aAAa,QAAQ;AAClD,QAAM,UAAU,CAAC,QAAQ,IAAI,QAAQ,WAAW,CAAC,GAAG,IAAI,CAAC,MAAM,cAAc,GAAG,SAAS,CAAC,CAAC;AAC3F,QAAM,WAAW,QAAQ,YAAYA,KAAI,iBAAiB,KAAK;AAC/D,MAAI,aAAa,GAAI,OAAM,IAAI,kBAAkB,4GAA4G;AAC7J,QAAM,SAAS,QAAQ,YAAYA,KAAI,kBAAkB,KAAK;AAC9D,MAAI,WAAW,GAAI,OAAM,IAAI,kBAAkB,mGAAmG;AAClJ,MAAI,CAACL,MAAK,KAAK,MAAM,KAAK,WAAWC,UAAU,OAAM,IAAI,kBAAkB,gFAAiF;AAC5J,QAAM,SAAS,QAAQ,UAAU;AACjC,MAAI,CAAC,OAAO,SAAS,MAAM,KAAK,SAAS,KAAK,SAAS,GAAI,OAAM,IAAI,kBAAkB,gCAAgC;AAEvH,SAAO,OAAO,SAAS;AACrB,UAAM,QAAQ,OAAO,IAAI;AACzB,QAAI,UAAU,GAAI,OAAM,IAAI,iBAAiB,UAAU;AAEvD,QAAI,OAAO,WAAW,KAAK,IAAI,gBAAiB,OAAM,IAAI,iBAAiB,WAAW;AAEtF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,KAAK,CAAC,MAAM,MAAM,CAAC,MAAM,QAAQ,KAAK,CAAC,KAAK,MAAM,EAAE,EAAG,OAAM,IAAI,iBAAiB,aAAa,8BAA8B;AAClJ,QAAI;AACJ,QAAI;AACF,eAAS,WAAW,MAAM,CAAC,CAAC;AAAA,IAC9B,QAAQ;AACN,YAAM,IAAI,iBAAiB,aAAa,wBAAwB;AAAA,IAClE;AACA,QAAI,CAAC,SAAS,MAAM,EAAG,OAAM,IAAI,iBAAiB,aAAa,6BAA6B;AAE5F,QAAI,OAAO,QAAQ,QAAS,OAAM,IAAI,iBAAiB,iBAAiB;AACxE,QAAI,UAAU,OAAQ,OAAM,IAAI,iBAAiB,oBAAoB;AAErE,QAAI,SAAS,UAAU,EAAE,OAAO,OAAO,QAAQ,YAAY,CAAC,OAAO,QAAQ,EAAE,SAAS,OAAO,IAAI,YAAY,CAAC,IAAI;AAChH,YAAM,IAAI,iBAAiB,sBAAsB,KAAK;AAAA,IACxD;AACA,QAAI,OAAO,OAAO,QAAQ,YAAY,OAAO,QAAQ,GAAI,OAAM,IAAI,iBAAiB,aAAa;AAGjG,QAAI;AACJ,QAAI;AACF,YAAM,WAAW,UAAM,4BAAc,OAAQ,QAAQ,SAAS,QAAQ,QAAQ,cAAc,QAAQ,QAAQ,KAAK,IAAIG,QAAO,MAAM,IAA4B,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC;AACvL,qBAAe,SAAS;AAAA,IAC1B,SAAS,KAAK;AAEZ,YAAM,OAAQ,KAAmC;AACjD,UAAI,SAAS,2BAA4B,OAAM,IAAI,iBAAiB,aAAa;AACjF,UAAI,SAAS,wCAAyC,OAAM,IAAI,iBAAiB,eAAe;AAChG,UAAI,eAAe,aAAa,OAAO,KAAK,IAAI,OAAO,EAAG,OAAM,IAAI,iBAAiB,UAAU;AAC/F,UAAI,SAAS,kBAAmB,OAAM,IAAI,iBAAiB,aAAa,eAAe,QAAQ,IAAI,UAAU,MAAS;AACtH,UAAI,eAAe,uBAAwB,OAAM;AACjD,YAAM,IAAI,iBAAiB,iBAAiB,eAAe,QAAQ,IAAI,UAAU,MAAS;AAAA,IAC5F;AAGA,QAAI;AACJ,QAAI;AACF,eAAS,YAAY,IAAI,YAAY,EAAE,OAAO,YAAY,GAAG,CAAC,OAAO,OAAO,KAAK,CAAC;AAAA,IACpF,QAAQ;AACN,YAAM,IAAI,iBAAiB,aAAa,yBAAyB;AAAA,IACnE;AACA,QAAI,CAAC,SAAS,MAAM,EAAG,OAAM,IAAI,iBAAiB,aAAa,8BAA8B;AAC7F,eAAW,QAAQ,CAAC,OAAO,OAAO,OAAO,OAAO,OAAO,KAAK,GAAG;AAC7D,UAAI,OAAO,IAAI,MAAM,OAAW,OAAM,IAAI,iBAAiB,iBAAiB,IAAI;AAAA,IAClF;AAEA,UAAM,MAAM,CAAC,SAAwB;AACnC,YAAM,IAAI,iBAAiB,iBAAiB,IAAI;AAAA,IAClD;AACA,QAAI,OAAO,OAAO,QAAQ,SAAU,KAAI,KAAK;AAC7C,QAAI,OAAO,OAAO,QAAQ,YAAY,CAACJ,MAAK,KAAK,OAAO,GAAG,EAAG,KAAI,KAAK;AACvE,QAAI,OAAO,OAAO,QAAQ,YAAY,CAACA,MAAK,KAAK,OAAO,GAAG,EAAG,KAAI,KAAK;AACvE,UAAM,MAAM,OAAO;AACnB,QAAI,EAAE,OAAO,QAAQ,YAAa,MAAM,QAAQ,GAAG,KAAK,IAAI,SAAS,KAAK,IAAI,MAAM,CAAC,MAAM,OAAO,MAAM,QAAQ,GAAK,KAAI,KAAK;AAC9H,eAAW,QAAQ,CAAC,OAAO,OAAO,KAAK,EAAG,KAAI,OAAO,IAAI,MAAM,UAAa,CAAC,OAAO,UAAU,OAAO,IAAI,CAAC,EAAG,KAAI,IAAI;AACrH,QAAI,OAAO,UAAU,UAAa,OAAO,UAAU,QAAQ,EAAE,MAAM,QAAQ,OAAO,KAAK,KAAK,OAAO,MAAM,MAAM,CAAC,MAAM,OAAO,MAAM,QAAQ,GAAI,KAAI,OAAO;AAC1J,QAAI,OAAO,UAAU,UAAa,OAAO,OAAO,UAAU,SAAU,KAAI,OAAO;AAC/E,eAAW,QAAQ,CAAC,kBAAkB,MAAM,EAAG,KAAI,OAAO,IAAI,MAAM,UAAa,OAAO,OAAO,IAAI,MAAM,UAAW,KAAI,IAAI;AAC5H,eAAW,QAAQ,CAAC,aAAa,KAAK,EAAG,KAAI,OAAO,IAAI,MAAM,UAAa,OAAO,OAAO,IAAI,MAAM,SAAU,KAAI,IAAI;AAGrH,QAAI,CAAC,QAAQ,SAAS,OAAO,GAAa,EAAG,OAAM,IAAI,iBAAiB,cAAc;AACtF,QAAI,EAAE,MAAM,QAAQ,GAAG,IAAI,IAAI,SAAS,QAAQ,IAAI,QAAQ,UAAW,OAAM,IAAI,iBAAiB,gBAAgB;AAElH,UAAM,OAAO,QAAQ,OAAO,oBAAI,KAAK,GAAG,QAAQ,IAAI;AACpD,QAAI,OAAQ,OAAO,MAAiB,OAAQ,OAAM,IAAI,iBAAiB,SAAS;AAChF,QAAI,OAAO,QAAQ,UAAa,MAAO,OAAO,MAAiB,OAAQ,OAAM,IAAI,iBAAiB,eAAe;AACjH,QAAI,MAAO,OAAO,MAAiB,OAAQ,OAAM,IAAI,iBAAiB,kBAAkB;AAExF,QAAI,OAAO,QAAQ,OAAQ,OAAM,IAAI,iBAAiB,cAAc;AAGpE,QAAI,SAAS,UAAU,CAAC,QAAQ,YAAa,OAAM,IAAI,iBAAiB,cAAc;AAEtF,QAAI,eAAe,UAAU,CAAC,QAAQ,kBAAmB,OAAM,IAAI,iBAAiB,cAAc;AAClG,QAAI,OAAO,SAAS,QAAQ,CAAC,QAAQ,eAAgB,OAAM,IAAI,iBAAiB,iBAAiB;AAEjG,QAAI,QAAQ,YAAY,OAAO,OAAO,QAAQ,YAAY,OAAO,QAAQ,MAAM,OAAO,QAAQ,QAAQ,SAAU,OAAM,IAAI,iBAAiB,cAAc;AAEzJ,WAAO;AAAA,MACL,QAAQ,OAAO;AAAA,MACf,UAAU,OAAO;AAAA,MACjB,GAAI,OAAO,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,MACzF,GAAI,OAAO,OAAO,mBAAmB,YAAY,EAAE,eAAe,OAAO,eAAe,IAAI,CAAC;AAAA,MAC7F,OAAO,MAAM,QAAQ,OAAO,KAAK,IAAK,OAAO,QAAqB,CAAC;AAAA,MACnE,GAAI,OAAO,OAAO,QAAQ,YAAY,OAAO,QAAQ,KAAK,EAAE,QAAQ,OAAO,IAAI,IAAI,CAAC;AAAA,MACpF,GAAI,OAAO,SAAS,OAAO,EAAE,WAAW,KAAc,IAAI,CAAC;AAAA,MAC3D,GAAI,OAAO,OAAO,QAAQ,YAAY,OAAO,QAAQ,KAAK,EAAE,iBAAiB,OAAO,IAAI,IAAI,CAAC;AAAA,MAC7F,GAAI,OAAO,OAAO,cAAc,YAAY,OAAO,cAAc,KAAK,EAAE,UAAU,OAAO,UAAU,IAAI,CAAC;AAAA,MACxG,WAAW,IAAI,KAAM,OAAO,MAAiB,GAAI,EAAE,YAAY;AAAA,MAC/D;AAAA,IACF;AAAA,EACF;AACF;AAQA,eAAsB,YAAY,MAAkC,UAA8B,CAAC,GAA2B;AAC5H,SAAO,oBAAoB,OAAO,EAAE,IAAI;AAC1C;AAYA,eAAsB,sBACpB,UAAkE,CAAC,GACI;AACvE,QAAMM,QAAO,QAAQ,OAAOD,KAAI,YAAY;AAC5C,MAAIC,UAAS,UAAaA,UAAS,GAAI,QAAO,oBAAoB,OAAO;AACzE,kBAAgB,OAAO,YAAY,cAAc,QAAQ,MAAM,MAAS;AACxE,aAAW,QAAQ,CAAC,UAAU,YAAY,UAAU,GAAY;AAC9D,QAAI,QAAQ,IAAI,MAAM,OAAW,OAAM,IAAI,kBAAkB,oBAAoB,IAAI,wCAAwC;AAAA,EAC/H;AACA,QAAM,MAAM,SAASA,KAAI;AACzB,QAAM,SAAS,aAAa,EAAE,QAAQ,IAAI,QAAQ,UAAU,IAAI,UAAU,QAAQ,EAAE,UAAU,IAAI,UAAU,QAAQ,cAAc,GAAG,EAAE,OAAO,GAAG,OAAO,QAAQ,MAAM,CAAC;AACvK,QAAM,KAAK,MAAM,eAAe,EAAE,QAAQ,IAAI,QAAQ,OAAO,MAAM,OAAO,MAAM,GAAG,OAAO,SAAS,QAAQ,OAAO,eAAe,EAAE,CAAC,EAAE,MAAM;AAC5I,QAAM,EAAE,KAAK,GAAG,GAAG,KAAK,IAAI;AAC5B,SAAO,oBAAoB,EAAE,GAAG,MAAM,QAAQ,GAAG,QAAQ,UAAU,GAAG,UAAU,UAAU,GAAG,OAAO,GAAG,CAAC;AAC1G;;;AK9ZA,eAAsB,WAAW,UAAkB,QAAoC;AACrF,QAAM,SAAS,OAAO,WAAW,WAAW,uBAAuB,MAAM,IAAI;AAC7E,MAAI,CAAC,uBAAuB,KAAK,MAAM,GAAG;AACxC,UAAM,IAAI,kBAAkB,8EAA8E,KAAK,UAAU,MAAM,CAAC,EAAE;AAAA,EACpI;AACA,QAAM,OAAO,OAAO,WAAW,WAAW,CAAC,MAAe,MAAM,GAAG,EAAE,UAAU,SAAS,CAAC,IAAI;AAC7F,QAAM,SAAS;AAAA,IACb,IAAI,QAAQ,GAAG,MAAM,GAAG,QAAQ,YAAY,EAAE,SAAS,EAAE,QAAQ,mBAAmB,EAAE,CAAC;AAAA,IACvF,IAAI,QAAQ,GAAG,MAAM,GAAG,QAAQ,qBAAqB;AAAA,IACrD,IAAI,QAAQ,GAAG,MAAM,GAAG,QAAQ,aAAa,EAAE,QAAQ,QAAQ,SAAS,EAAE,QAAQ,gBAAgB,oBAAoB,oBAAoB,IAAI,GAAG,MAAM,KAAK,CAAC;AAAA,EAC/J;AACA,aAAW,SAAS,QAAQ;AAC1B,UAAM,OAAO,GAAG,MAAM,MAAM,IAAI,IAAI,IAAI,MAAM,GAAG,EAAE,QAAQ;AAC3D,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,KAAK,KAAK;AAAA,IACxB,SAAS,KAAK;AAEZ,YAAM,IAAI,kBAAkB,OAAO,WAAW,WAC1C,mBAAmB,IAAI,2CAA4C,IAAc,OAAO,KACxF,wBAAwB,IAAI,KAAM,IAAc,OAAO,EAAE;AAAA,IAC/D;AACA,UAAM,IAAI,MAAM,OAAO;AACvB,QAAI,IAAI,QAAQ,IAAI,iBAAiB,MAAM,kBAAkB;AAE3D,UAAI,IAAI,UAAU,OAAO,IAAI,SAAS,KAAK;AACzC,cAAM,IAAI,kBAAkB,GAAG,IAAI,0BAA0B,IAAI,MAAM,OAAO,IAAI,QAAQ,IAAI,UAAU,KAAK,SAAS,wEAC/C,QAAQ,+BAA+B;AAAA,MAChH;AACA,UAAI,IAAI,UAAU,KAAK;AACrB,cAAM,IAAI,kBAAkB,GAAG,IAAI,aAAa,IAAI,MAAM,6BAA6B,gBAAgB,8EAA8E;AAAA,MACvL;AACA,YAAM,IAAI,kBAAkB,GAAG,IAAI,aAAa,IAAI,MAAM,6BAA6B,gBAAgB,qDAAqD,QAAQ,6EACvF;AAAA,IAC/E;AAAA,EACF;AACF;;;ACeA,IAAM,qBAAqB,KAAK;AAGhC,IAAM,eAAe;AAErB,IAAM,gBAAgB;AAEtB,IAAM,eAAe;AACrB,IAAM,uBAAuB;AAE7B,IAAM,cAAc;AAEpB,IAAM,cAAc;AAGpB,SAAS,WAAW,SAAyB;AAC3C,MAAI;AACF,WAAO,mBAAmB,OAAO;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAuHA,SAASC,KAAI,MAAkC;AAC7C,SAAO,OAAO,YAAY,cAAc,QAAQ,MAAM,IAAI,IAAI;AAChE;AAEA,SAAS,OAAO,QAAoC;AAClD,MAAI;AAAE,WAAO,IAAI,IAAI,MAAM,EAAE;AAAA,EAAS,QAAQ;AAAE,WAAO;AAAA,EAAU;AACnE;AAEA,SAAS,OAAO,OAA2B;AACzC,MAAI,IAAI;AACR,aAAW,KAAK,MAAO,MAAK,OAAO,aAAa,CAAC;AACjD,SAAO,KAAK,CAAC,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC1E;AAEA,SAAS,OAAO,QAAQ,IAAY;AAClC,SAAO,OAAO,OAAO,gBAAgB,IAAI,WAAW,KAAK,CAAC,CAAC;AAC7D;AAQA,SAAS,UAAU,WAAsC,UAA0B;AACjF,MAAI,CAAC,aAAa,CAAC,UAAU,WAAW,GAAG,KAAK,UAAU,WAAW,IAAI,KAAK,UAAU,SAAS,IAAI,EAAG,QAAO;AAE/G,MAAI,wBAAwB,KAAK,SAAS,EAAG,QAAO;AACpD,MAAI;AACF,QAAI,IAAI,IAAI,WAAW,UAAU,EAAE,WAAW,WAAY,QAAO;AAAA,EACnE,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,KAAK,MAAe,SAAS,KAAK,SAA6B;AACtE,QAAM,IAAI,WAAW,IAAI,QAAQ;AACjC,IAAE,IAAI,gBAAgB,iCAAiC;AACvD,IAAE,IAAI,iBAAiB,UAAU;AACjC,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG,EAAE,QAAQ,SAAS,EAAE,CAAC;AAClE;AAEA,SAAS,SAAS,UAAkB,UAAoB,CAAC,GAAa;AACpE,QAAM,IAAI,IAAI,QAAQ,EAAE,UAAU,iBAAiB,WAAW,CAAC;AAC/D,aAAW,KAAK,QAAS,GAAE,OAAO,cAAc,CAAC;AACjD,SAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;AACvD;AAGA,SAAS,cAAc,GAA+B;AACpD,SAAO,EAAE,UAAU,OAAO,GAAG,YAAY,EAAE,GAAG,QAAQ,OAAO,GAAG,UAAU,EAAE,GAAG,QAAQ,GAAG,WAAW,SAAS,SAAS,QAAQ;AACjI;AAcA,SAAS,MAAM,OAAyC;AACtD,QAAMC,QAAO,MAAM,OAAOD,KAAI,YAAY;AAC1C,MAAIC,UAAS,UAAaA,UAAS,GAAI,QAAO;AAC9C,kBAAgB,OAAO,YAAY,cAAc,QAAQ,MAAM,MAAS;AACxE,aAAW,CAAC,MAAM,KAAK,KAAK;AAAA,IAAC,CAAC,UAAU,MAAM,MAAM;AAAA,IAAG,CAAC,YAAY,MAAM,QAAQ;AAAA,IAAG,CAAC,gBAAgB,MAAM,YAAY;AAAA,IACtH,CAAC,UAAU,MAAM,MAAM;AAAA,IAAG,CAAC,UAAU,MAAM,MAAM;AAAA,IAAG,CAAC,UAAU,MAAM,MAAM;AAAA,IAAG,CAAC,YAAY,MAAM,QAAQ;AAAA,IAAG,CAAC,YAAY,MAAM,QAAQ;AAAA,IACvI,CAAC,aAAa,MAAM,SAAS;AAAA,IAAG,CAAC,WAAW,MAAM,OAAO;AAAA,EAAC,GAAY;AACtE,QAAI,UAAU,OAAW,OAAM,IAAI,kBAAkB,oBAAoB,IAAI,wCAAwC;AAAA,EACvH;AACA,QAAM,MAAM,SAASA,KAAI;AACzB,QAAM,WAAW,MAAM,eAAeD,KAAI,qBAAqB;AAC/D,MAAI;AACJ,MAAI,UAAU;AACZ,QAAI;AACF,iBAAW,SAAS,QAAQ;AAAA,IAC9B,SAAS,GAAG;AACV,UAAI,aAAa,eAAgB,OAAM,IAAI,eAAe,EAAE,QAAQ,mCAAmC,EAAE,QAAQ,QAAQ,kCAAkC,EAAE,EAAE,QAAQ,qBAAqB,EAAE,CAAC,EAAE;AACjM,YAAM;AAAA,IACR;AAAA,EACF;AACA,MAAI,aAAa,SAAS,WAAW,IAAI,UAAU,SAAS,aAAa,IAAI,WAAW;AACtF,UAAM,IAAI,eAAe,yBAAyB,oEAAoE;AAAA,EACxH;AAEA,QAAM,eAAeA,KAAI,eAAe,KAAK;AAC7C,QAAM,aAAaA,KAAI,eAAe,KAAK;AAC3C,QAAM,qBAAqB,aAAaA,KAAI,wBAAwB,KAAK,SAAY;AACrF,MAAI,aAAc,YAAW,mCAAmC,yFAAyF;AACzJ,MAAI,WAAY,YAAW,mCAAmC,wHAAwH;AACtL,MAAI,MAAM,QAAQ,EAAE,cAAc,MAAM,WAAW;AACjD,UAAM,IAAI,kBAAkB,qIAAqI;AAAA,EACnK;AACA,SAAO,EAAE,KAAK,UAAU,cAAc,YAAY,mBAAmB;AACvE;AAGA,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACrC,YAAqB,QAAyB,YAAsB;AAClE,UAAM,GAAG,MAAM,yDAAyD,WAAW,KAAK,IAAI,KAAK,MAAM,qDAAqD;AADzI;AAAyB;AAAA,EAE9C;AAAA,EAFqB;AAAA,EAAyB;AAGhD;AAMA,SAAS,cAAc,OAAsB,OAAgC;AAC3E,QAAM,WAAW,aAAa,MAAM,QAAkD;AACtF,MAAI,SAAS,WAAW,MAAM,IAAI,QAAQ;AACxC,UAAM,IAAI,eAAe,uBAAuB,iBAAiB,MAAM,IAAI,MAAM,kCAAkC,SAAS,MAAM,2CAA2C;AAAA,EAC/K;AACA,SAAO;AACT;AAGA,SAAS,WAAW,OAAuF;AAEzG,aAAW,OAAO,YAAY,cAAc,QAAQ,MAAM,MAAS;AACnE,aAAW,CAAC,MAAM,KAAK,KAAK;AAAA,IAAC,CAAC,YAAY,MAAM,QAAQ;AAAA,IAAG,CAAC,gBAAgB,MAAM,YAAY;AAAA,IAAG,CAAC,UAAU,MAAM,MAAM;AAAA,IACtH,CAAC,UAAU,MAAM,MAAM;AAAA,IAAG,CAAC,UAAU,MAAM,MAAM;AAAA,IAAG,CAAC,aAAa,MAAM,SAAS;AAAA,EAAC,GAAY;AAC9F,QAAI,UAAU,OAAW,OAAM,IAAI,kBAAkB,oBAAoB,IAAI,0CAA0C;AAAA,EACzH;AACA,QAAM,WAAW,aAAa,MAAM,QAAkD;AACtF,QAAM,OAAO,MAAM,WAAWA,KAAI,eAAe,KAAK;AACtD,MAAI,SAAS,GAAI,OAAM,IAAI,kBAAkB,oGAAoG;AACjJ,MAAI,SAAS,mBAAmB,CAAC,MAAM,MAAM;AAC3C,UAAM,IAAI,kBAAkB,YAAY,SAAS,IAAI,UAAU,SAAS,MAAM,2EAA2E;AAAA,EAC3J;AACA,aAAW,iBAAiB,6IAAgJ;AAC5K,SAAO,EAAE,UAAU,MAAM,UAAU,MAAM,mBAAmBA,KAAI,wBAAwB,EAAE;AAC5F;AAGA,IAAI,eAAe;AAGnB,IAAI,iBAAiB;AACrB,SAAS,eAAqB;AAC5B,MAAI,eAAgB;AACpB,mBAAiB;AACjB,UAAQ,KAAK,4UAEiC;AAChD;AAEO,SAAS,aAAa,QAAuB,CAAC,GAAW;AAE9D,QAAM,QAAQ,MAAM,KAAK;AACzB,QAAM,SAAS,MAAM,YAAY,CAAC,QAAQ,WAAW,KAAK,IAAI;AAC9D,QAAM,WAAW,SAAS,MAAM,WAAW,cAAc,OAAO,KAAK,IAAI,QAAQ;AAEjF,QAAM,SAAS,uBAAuB,OAAO,IAAI,UAAU,MAAM,UAAU,UAAU,UAAUA,KAAI,eAAe,KAAK,EAAE;AACzH,QAAM,WAAW,UAAU,YAAY,OAAO,IAAI,YAAY,MAAM,YAAYA,KAAI,kBAAkB,KAAK;AAC3G,QAAM,eAAe,YAAY,QAAQ,SAAY,MAAM,gBAAgBA,KAAI,sBAAsB;AACrG,QAAM,SAAS,YAAY,QAAQ,KAAK,MAAM,UAAUA,KAAI,eAAe,KAAK;AAEhF,QAAM,UAAU,UAAU,UAAa,aAAa;AACpD,QAAM,SAAS,UAAU,KAAK,UAAU,UAAU,MAAM,UAAUA,KAAI,eAAe,KAAK;AAC1F,QAAM,SAAS,UAAU,KAAK,UAAU,UAAU,MAAM,UAAUA,KAAI,eAAe,KAAK;AAC1F,MAAI,CAAC,eAAe,KAAK,MAAM,EAAG,OAAM,IAAI,kBAAkB,8EAA+E;AAC7I,MAAI,aAAa,GAAI,OAAM,IAAI,kBAAkB,yCAAyC;AAC1F,MAAI,CAAC,YAAY,CAAC,SAAS,OAAO,SAAS,GAAI,OAAM,IAAI,kBAAkB,uFAAuF;AAIlK,QAAM,UAAkC,QAAQ,cAAc,MAAM,KAAK,MAAM,QAAQ,IAAI;AAC3F,MAAI;AACJ,WAAS,OAAO,KAAK,OAAK;AAAE,iBAAa,EAAE;AAAA,EAAI,GAAG,MAAM,MAAS;AACjE,QAAM,UAAU,SAAS,WAAW,OAAO,MAAM,OAAO,QAAQ,IAAI;AACpE,QAAM,SAAuC,WAAW,UAAU,SAAY,MAAM,MAAM,EAAE,KAAK,OAAK,CAAC,CAAC,CAAC;AAIzG,QAAM,cAAc,OAAO,aAAa,WAAW,MAAM,YAAY,MAAM,kBAAkB,IAAI;AACjG,QAAM,eAAe,OAAO,eAAe,MAAM,MAAM,YAAY,IAAI;AACvE,QAAM,aAAa,OAAO,KAAuB,YAAiD;AAAA,IAChG,GAAI,MAAM;AAAA,IACV,GAAI,cAAc,MAAM,YAAY,OAAO,IAAI,CAAC;AAAA,IAChD,GAAI,eAAe,CAAC,MAAM,YAAY,IAAI,CAAC;AAAA,EAC7C;AACA,QAAM,aAAc,UAAU,WAAW,QAAQ,QAAQ,QAAQ,IAAI,SAAS,UAAU;AACxF,QAAM,WAAY,UAAU,WAAW,QAAQ,MAAM,MAAM,IAAI,SAAS,QAAQ;AAEhF,MAAI,CAAC,SAAS,CAAC,QAAQ;AACrB;AAAA,MAAW;AAAA,MACT;AAAA,IAAqF;AAAA,EACzF;AAEA,QAAM,UAAU,WAAW,MAAM,OAAO,SAAS,MAAM,MAAM,QAAQ,IAAI,IACrE,eAAe,YAAY,MAAM,OAAO,SAAS,MAAM,MAAM,YAAY,IAAI,IAAI;AACrF,QAAM,UAAU,MAAM,YAAY,QAAQ,SAAYA,KAAI,iBAAiB;AAC3E,MAAI,YAAY,UAAa,YAAY,MAAM,CAAC,wBAAwB,KAAK,OAAO,GAAG;AACrF,UAAM,IAAI,kBAAkB,iGAAkG;AAAA,EAChI;AAEA,QAAM,WAAW,OAAO,MAAM,YAAY,aAAa,QAAQ,cAAc,EAAE;AAC/E,QAAM,gBAAgB,MAAM,iBAAiB;AAC7C,MAAI,kBAAkB,cAAc,kBAAkB,OAAQ,OAAM,IAAI,kBAAkB,4CAA4C;AACtI,QAAM,cAAc,UAAU,MAAM,aAAa,GAAG;AACpD,QAAM,eAAe,UAAU,MAAM,cAAc,GAAG;AACtD,QAAM,aAAa,MAAM,cAAc;AACvC,QAAM,aAAa,GAAG,UAAU;AAChC,QAAM,cAAc,GAAG,UAAU;AACjC,QAAM,aAAa,GAAG,UAAU;AAChC,QAAM,gBAAgB,MAAM,UAAU,UAAU;AAChD,QAAM,iBAAiB,MAAM,UAAU,WAAW;AAClD,aAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,UAAU,aAAa,GAAG,CAAC,WAAW,cAAc,CAAC,GAAY;AAC1F,QAAI,CAAC,OAAO,SAAS,EAAE,KAAK,MAAM,EAAG,OAAM,IAAI,kBAAkB,YAAY,IAAI,4CAA4C;AAAA,EAC/H;AAGA,QAAM,UAAU,SAAS,MAAM,OAAO,cAAc;AACpD,QAAM,SAAS,QAAQ,MAAM;AAC7B,QAAM,QAAQ;AAAA,IACZ,QAAQ,MAAM,OAAO,SAAS,UAAU,MAAM,MAAM,QAAQ,GAAG,IAAI;AAAA,IACnE,eAAe,MAAM,OAAO,gBAAgB,UAAU,MAAM,MAAM,eAAe,GAAG,IAAI;AAAA,IACxF,aAAa,MAAM,OAAO,cAAc,UAAU,MAAM,MAAM,aAAa,GAAG,IAAI;AAAA,IAClF,cAAc,MAAM,OAAO,eAAe,UAAU,MAAM,MAAM,cAAc,GAAG,IAAI;AAAA,EACvF;AAIA,QAAM,kBAAkB,WAAW,MAAM,eAAe,GAAG,uBAAuB,OAAO,CAAC,GAAG,MAAM,YAAY,KAAK;AACpH,QAAM,YAAY,aAAa;AAAA,IAAE;AAAA,IAAQ;AAAA,IAAU;AAAA,IAAc,KAAK,MAAM;AAAA,IAAW,QAAQ,UAAU;AAAA,IAAW;AAAA,IAAiB,OAAO,MAAM;AAAA,IAAO,WAAW;AAAA,IAClK,GAAI,UAAU,EAAE,MAAM,SAAS,cAAc,UAAU,gBAAgB,IAAI,CAAC;AAAA;AAAA,IAE5E,GAAI,UAAU;AAAA,MAAE,QAAQ,EAAE,UAAU,WAAW,SAAS,mBAAmB,MAAO,IAAI,WAAW,UAAU,QAAQ,QAAQ,OAAO;AAAA,MAChI,eAAe,MAAM,UAAU,QAAQ,GAAG,UAAU;AAAA,IAAG,IAAI,CAAC;AAAA,EAAG,CAAC;AAIpE,QAAM,cAAc,OAAO;AAAA,IAAE;AAAA,IAAQ,OAAO,MAAM,UAAU,MAAM;AAAA,IAAG,OAAO,SAAS,MAAM,OAAO,cAAc;AAAA,IAAG,KAAK,MAAM;AAAA,IAC5H,KAAK,CAAC,MAAc,QAAQ,MAAM,mBAAmB,CAAC,EAAE;AAAA,EAAE;AAC5D,QAAM,WAAsC,UACxC,eAAe;AAAA,IAAE;AAAA,IAAQ,OAAO,MAAM,UAAU,MAAM;AAAA,IAAG,OAAO,SAAS,MAAM,OAAO,cAAc;AAAA,IAAG,KAAK,MAAM;AAAA,IAClH,KAAK,OAAK,QAAQ,MAAM,mBAAmB,CAAC,EAAE;AAAA,EAAE,CAAC,IACjD;AACJ,YAAU,MAAM,EAAE,MAAM,MAAM;AAAA,EAA+D,CAAC;AAC9F,QAAM,YAAY,MAAM,UAAU,QAAQ,GAAG,OAAO,QAAQ;AAC5D,QAAM,YAAY,MAAM,UAAU,QAAQ,GAAG,UAAU;AAKvD,QAAM,gBAAgB,CAAC,YAAqB;AAC1C,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,QAAQ,QAAQ,IAAI,mBAAmB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,EAAE,YAAY;AAC1F,WAAO,UAAU,WAAW,UAAU,SAAS,GAAG,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI;AAAA,EAChF;AAIA,QAAM,WAAW,CAAC,YAAqB;AACrC,QAAI,QAAS,QAAO,uBAAuB,OAAO;AAClD,UAAM,QAAQ,cAAc,OAAO;AACnC,QAAI,CAAC,SAAU,QAAO;AACtB,UAAME,QAAO,SAAS,QAAQ,GAAG,YAAY,CAAC;AAC9C,QAAIA,MAAK,SAAS,KAAK,EAAG,QAAO;AACjC,QAAIA,MAAK,WAAW,EAAG,QAAOA,MAAK,CAAC;AACpC,UAAM,IAAI,mBAAmB,OAAOA,KAAI;AAAA,EAC1C;AACA,QAAM,aAAa,CAAC,YAAqB;AACvC,QAAI;AAAE,aAAO,SAAS,OAAO;AAAA,IAAE,QAAQ;AAAE,aAAO,cAAc,OAAO;AAAA,IAAE;AAAA,EACzE;AACA,QAAM,QAAQ,CAAC,SAAkB,YAAuC,EAAE,QAAQ,WAAW,OAAO,EAAE,WAAW,UAAU,GAAG,OAAO;AAKrI,iBAAe,WAAW,MAAiD;AACzE,QAAI,WAAW,CAAC,UAAU;AACxB,YAAM,IAAI,MAAM,QAAQ;AACxB,WAAK,IAAI,yBAAyBC,eAAc;AAChD,WAAK,IAAI,oBAAoB,MAAM,EAAE,UAAU,UAAU,GAAG,MAAM,iBAAiB,CAAC;AAAA,IACtF,WAAW,cAAc;AACvB,WAAK,IAAI,iBAAiB,YAAY;AAAA,IACxC;AACA,WAAO;AAAA,EACT;AAOA,iBAAe,MAAM,MAA8B,QAAgC,CAAC,GAAoF;AACtK,UAAMC,QAAO,MAAM,WAAW,IAAI,gBAAgB,EAAE,WAAW,UAAU,GAAG,KAAK,CAAC,CAAC;AACnF,QAAI;AACF,YAAM,MAAM,MAAM,QAAQ,GAAG,MAAM,mBAAmB;AAAA,QACpD,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,qCAAqC,QAAQ,oBAAoB,GAAG,MAAM;AAAA,QACrG,MAAAA;AAAA,MACF,CAAC;AACD,UAAI,IAAI,GAAI,QAAO,EAAE,IAAI,MAAM,MAAM,MAAM,IAAI,KAAK,EAAE;AAItD,YAAM,MAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC9C,aAAO,EAAE,IAAI,OAAO,OAAO,IAAI,UAAU,OAAO,IAAI,SAAS,KAAK,GAAI,OAAO,KAAK,UAAU,WAAW,EAAE,MAAM,IAAI,MAAM,IAAI,CAAC,EAAG;AAAA,IACnI,QAAQ;AACN,aAAO,EAAE,IAAI,OAAO,OAAO,MAAM;AAAA,IACnC;AAAA,EACF;AAEA,iBAAe,SAAS,aAAuF;AAC7G,QAAI;AACF,YAAM,MAAM,MAAM,QAAQ,GAAG,MAAM,sBAAsB,EAAE,SAAS,EAAE,eAAe,UAAU,WAAW,GAAG,EAAE,CAAC;AAChH,UAAI,CAAC,IAAI,GAAI,QAAO;AACpB,YAAM,IAAK,MAAM,IAAI,KAAK;AAC1B,aAAO;AAAA,QACL,KAAK,OAAO,EAAE,OAAO,EAAE;AAAA,QACvB,OAAO,MAAM,QAAQ,EAAE,KAAK,IAAI,EAAE,MAAM,OAAO,CAAC,MAAe,OAAO,MAAM,QAAQ,IAAI,CAAC;AAAA,QACzF,GAAG;AAAA,UACD,IAAI,OAAO,EAAE,OAAO,EAAE;AAAA,UACtB,OAAO,OAAO,EAAE,SAAS,EAAE;AAAA,UAC3B,MAAM,OAAO,EAAE,QAAQ,EAAE;AAAA,UACzB,eAAe,EAAE,mBAAmB;AAAA,UACpC,YAAY,EAAE,eAAe;AAAA,UAC7B,GAAI,OAAO,EAAE,oBAAoB,WAAW,EAAE,eAAe,EAAE,gBAAgB,IAAI,CAAC;AAAA,UACpF,GAAI,OAAO,EAAE,WAAW,YAAY,EAAE,WAAW,KAAK,EAAE,QAAQ,EAAE,OAAO,IAAI,CAAC;AAAA,UAC9E,GAAI,EAAE,cAAc,OAAO,EAAE,aAAa,KAAK,IAAI,CAAC;AAAA,QACtD;AAAA,MACF;AAAA,IACF,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAGA,QAAM,SAAS,CAACA,OAAW,SACxB,OAAOA,OAAM,eAAe,YAAYA,MAAK,aAAa,KAAK,MAAM,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC;AAGzF,iBAAe,OAAO,cAAqC;AACzD,UAAM,OAAO,MAAM,WAAW,IAAI,gBAAgB,EAAE,WAAW,UAAU,OAAO,aAAa,CAAC,CAAC;AAC/F,UAAM,QAAQ,GAAG,MAAM,oBAAoB,EAAE,QAAQ,QAAQ,SAAS,EAAE,gBAAgB,oCAAoC,GAAG,MAAM,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EACpK;AAOA,QAAM,aAAa,CAAC,MAAmB,UAAU,yBAAyB,QAAQ,CAAC,EAAE;AAGrF,iBAAe,OAAOA,OAAW,KAAsC;AACrE,QAAI,OAAOA,OAAM,iBAAiB,YAAY,OAAOA,OAAM,kBAAkB,SAAU,QAAO;AAC9F,UAAM,MAAM,MAAM,SAASA,MAAK,YAAY;AAC5C,QAAI,QAAQ,QAAQ,IAAI,EAAE,OAAO,GAAI,QAAO;AAC5C,QAAI,WAAW,IAAI,CAAC,GAAG;AAErB,YAAM,OAAOA,MAAK,aAAa;AAC/B,YAAM,IAAI,eAAe,KAAK,uBAAuB,mCAAmC;AAAA,IAC1F;AACA,UAAM,WAAW,OAAOA,MAAK,eAAe,YAAYA,MAAK,aAAa,IAAIA,MAAK,aAAa;AAChG,WAAO,EAAE,IAAIA,MAAK,cAAc,IAAIA,MAAK,eAAe,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,UAAU,GAAG,KAAK,GAAG,OAAOA,OAAM,GAAG,EAAE;AAAA,EACtI;AAEA,WAAS,UAAU,GAAoB;AACrC,WAAO,EAAE,MAAM,EAAE,GAAG,UAAU,EAAE,KAAK,OAAO,EAAE,OAAO,aAAa,EAAE,IAAI,WAAW,IAAI,KAAK,EAAE,MAAM,GAAI,EAAE,YAAY,EAAE;AAAA,EAC1H;AAOA,iBAAe,KAAK,SAAiH;AACnI,UAAM,MAAM,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AACrD,UAAM,MAAM,UAAU,KAAK,UAAU;AACrC,QAAI,QAAQ,KAAM,QAAO,EAAE,KAAK,OAAO,MAAM,SAAS,OAAO,OAAO,MAAM;AAC1E,UAAM,SAAS,MAAM,cAAsB,KAAK,MAAM,UAAU;AAChE,UAAM,QAAQ,QAAQ,SAAS;AAC/B,UAAM,QAAQ,UAAU,QAAQ,OAAO,MAAM,OAAO,YAAY,OAAO,MAAM,OAAO,YAAY,OAAO,MAAM,QAAQ;AACrH,WAAO,EAAE,KAAK,OAAO,QAAQ,QAAQ,MAAM,SAAS,MAAM,OAAO,SAAS,OAAQ,QAAQ,EAAE;AAAA,EAC9F;AAEA,iBAAe,MAAM,SAAkB,GAAW,KAA6C;AAC7F,WAAO,WAAW,YAAY,MAAM,KAAK,IAAI,MAAM,YAAY,CAAC,CAAC,GAAG,MAAM,SAAS,EAAE,MAAM,IAAI,qBAAqB,MAAS,GAAG,GAAG;AAAA,EACrI;AAEA,QAAM,QAAQ,CAAC,MAAc,EAAE,MAAM,KAAK,IAAI,IAAI,MAAO;AAKzD,QAAM,WAAW,oBAAI,IAAuD;AAE5E,WAAS,MAAM,KAAwD;AACrE,QAAI,UAAU,SAAS,IAAI,IAAI,EAAE;AACjC,QAAI,YAAY,QAAW;AACzB,YAAM,KAAK,IAAI;AACf,iBAAW,YAAuD;AAChE,cAAM,MAAM,MAAM,MAAM,EAAE,YAAY,iBAAiB,eAAe,GAAG,CAAC;AAC1E,YAAI,CAAC,IAAI,GAAI,QAAO,IAAI,QAAQ,UAAU;AAC1C,YAAI;AACJ,YAAI;AACF,iBAAO,MAAM,OAAO,IAAI,MAAM,GAAG;AAAA,QACnC,SAAS,KAAK;AACZ,cAAI,eAAe,kBAAkB,IAAI,SAAS,sBAAuB,QAAO;AAChF,gBAAM;AAAA,QACR;AACA,YAAI,SAAS,KAAM,QAAO;AAI1B,YAAI,OAAO,IAAI,MAAM,iBAAiB,YAAY,OAAO,IAAI,MAAM,kBAAkB,SAAU,QAAO;AACtG,cAAM,WAAW,OAAO,IAAI,KAAK,eAAe,YAAY,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,aAAa;AAC5G,cAAM,EAAE,GAAG,GAAG,GAAG,KAAK,IAAI;AAC1B,eAAO,EAAE,GAAG,MAAM,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,eAAe,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,UAAU,GAAG,OAAO,IAAI,MAAM,GAAG,EAAE;AAAA,MACnJ,GAAG;AACH,eAAS,IAAI,IAAI,OAAO;AAIxB,WAAK,QAAQ,KAAK,CAAC,WAAW;AAC5B,YAAI,WAAW,cAAe,QAAO,SAAS,OAAO,EAAE;AACvD,cAAM,QAAQ,WAAW,MAAM,SAAS,OAAO,EAAE,GAAG,GAAK;AACxD,QAAC,MAAiC,QAAQ;AAAA,MAC7C,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,iBAAeC,SAAQ,SAAqC;AAC1D,UAAM,EAAE,KAAK,OAAO,SAAS,MAAM,IAAI,MAAM,KAAK,OAAO;AACzD,QAAI,UAAU,MAAM;AAElB,UAAI,QAAS,cAAa;AAC1B,aAAO,EAAE,SAAS,MAAM,QAAQ,mBAAmB,SAAS,UAAU,WAAW,YAAY,MAAM,SAAS,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE;AAAA,IAC5H;AAEA,QAAI,WAAW,MAAM,CAAC,EAAG,QAAO,EAAE,SAAS,MAAM,QAAQ,mBAAmB,SAAS,WAAW,YAAY,MAAM,SAAS,CAAC,GAAG,GAAG,EAAE;AAGpI,QAAI,MAAM,KAAK,EAAG,QAAO,EAAE,SAAS,UAAU,KAAK,GAAG,QAAQ,iBAAiB,SAAS,QAAQ,MAAM,MAAM,SAAS,OAAO,GAAG,IAAI,CAAC,EAAE;AAEtI,UAAM,UAAU,MAAM,MAAM,KAAK;AACjC,QAAI,YAAY,SAAS;AACvB,aAAO,EAAE,SAAS,MAAM,QAAQ,mBAAmB,SAAS,WAAW,YAAY,MAAM,SAAS,CAAC,GAAG,GAAG,EAAE;AAAA,IAC7G;AAGA,QAAI,YAAY,cAAe,QAAO,EAAE,SAAS,MAAM,QAAQ,WAAW,SAAS,CAAC,EAAE;AACtF,WAAO,EAAE,SAAS,UAAU,OAAO,GAAG,QAAQ,iBAAiB,SAAS,MAAM,MAAM,SAAS,SAAS,GAAG,EAAE;AAAA,EAC7G;AAEA,iBAAe,WAAW,SAAkB,iBAAoD;AAC9F,QAAI,oBAAoB,QAAW;AACjC,YAAM,EAAE,MAAM,IAAI,MAAM,KAAK,OAAO;AACpC,aAAO,UAAU,QAAQ,MAAM,KAAK,KAAK,CAAC,WAAW,MAAM,CAAC,IAAI,UAAU,KAAK,IAAI;AAAA,IACrF;AACA,UAAM,IAAI,MAAMA,SAAQ,OAAO;AAC/B,eAAW,KAAK,EAAE,QAAS,iBAAgB,OAAO,cAAc,CAAC;AACjE,WAAO,EAAE;AAAA,EACX;AAEA,iBAAe,OAAO,SAA0C;AAC9D,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,OAAO;AACpC,QAAI,UAAU,QAAQ,WAAW,MAAM,CAAC,EAAG,QAAO;AAClD,WAAO,MAAM,KAAK,IAAI,kBAAkB;AAAA,EAC1C;AAIA,QAAM,WAAW,oBAAI,IAA0D;AAE/E,iBAAe,cAAc,SAAkD;AAC7E,UAAM,MAAM,SAAS,IAAI,QAAQ,WAAW;AAC5C,QAAI,OAAO,KAAK,IAAI,IAAI,IAAI,KAAK,qBAAsB,QAAO,IAAI;AAClE,UAAM,MAAM,UAAU;AACtB,UAAM,MAAM,GAAG,MAAM,0BAA0B,MAAM,WAAW,mBAAmB,GAAG,CAAC,KAAK,EAAE;AAC9F,UAAM,MAAM,MAAM,QAAQ,KAAK,EAAE,SAAS,EAAE,eAAe,UAAU,QAAQ,WAAW,GAAG,EAAE,CAAC;AAC9F,QAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,0CAA0C,IAAI,MAAM,EAAE;AACnF,UAAMD,QAAQ,MAAM,IAAI,KAAK;AAC7B,UAAM,SAASA,MAAK,QAAQ,CAAC,GAAG;AAAA,MAC9B,CAAC,OAA4B;AAAA,QAC3B,IAAI,OAAO,EAAE,EAAE;AAAA,QACf,QAAQ,OAAO,EAAE,UAAU,EAAE;AAAA,QAC7B,MAAM,OAAO,EAAE,QAAQ,EAAE;AAAA,QACzB,MAAM,OAAO,EAAE,QAAQ,EAAE;AAAA,QACzB,MAAM,OAAO,EAAE,QAAQ,EAAE;AAAA,QACzB,UAAW,EAAE,YAA0C,CAAC;AAAA,QACxD,GAAI,EAAE,cAAc,EAAE,YAAY,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC;AAAA,QAC7D,GAAI,MAAM,QAAQ,EAAE,WAAW,IAC3B,EAAE,aAAa,EAAE,YAAY,IAAI,MAAM,GAAG,QAAQ,MAAM,QAAQ,EAAE,MAAM,IAAI,EAAE,OAAO,IAAI,MAAM,IAAI,CAAC,GAAG,aAAa,MAAM,QAAQ,EAAE,WAAW,IAAI,EAAE,YAAY,IAAI,aAAa,IAAI,CAAC,EAAE,IACzL,CAAC;AAAA,MACP;AAAA,IACF;AACA,QAAI,SAAS,OAAO,IAAO,UAAS,MAAM;AAC1C,aAAS,IAAI,QAAQ,aAAa,EAAE,IAAI,KAAK,IAAI,GAAG,MAAM,CAAC;AAC3D,WAAO;AAAA,EACT;AAKA,iBAAe,OAAOE,QAAe,UAAmF;AACtH,UAAM,MAAM,iBAAiB,SAAS,YAAY;AAClD,QAAI,QAAQ,GAAI,QAAO,EAAE,SAAS,OAAO,QAAQ,wBAAwB;AACzE,UAAM,MAAM,MAAM,QAAQ,GAAG,MAAM,2BAA2B,mBAAmB,GAAG,CAAC,UAAU;AAAA,MAC7F,QAAQ;AAAA,MACR,SAAS,EAAE,eAAe,UAAUA,MAAK,IAAI,gBAAgB,oBAAoB,QAAQ,mBAAmB;AAAA,MAC5G,MAAM,KAAK,UAAU,UAAU,QAAQ,CAAC;AAAA,IAC1C,CAAC,EAAE,MAAM,MAAM,IAAI;AACnB,QAAI,QAAQ,KAAM,OAAM,IAAI,eAAe,KAAK,eAAe,mDAAmD;AAClH,UAAMF,QAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC/C,QAAI,IAAI,GAAI,QAAO,cAAcA,OAAM,IAAI;AAC3C,UAAM,QAAQA,OAAM,SAAS,CAAC;AAG9B,QAAI,IAAI,WAAW,OAAO,IAAI,WAAW,OAAO,IAAI,WAAW,KAAK;AAClE,aAAO,EAAE,SAAS,OAAO,QAAQ,OAAO,YAAY,IAAI,WAAW,MAAM,kBAAkB,IAAI,WAAW,MAAM,qCAAqC,WAAW;AAAA,IAClK;AACA,UAAM,IAAI,eAAe,IAAI,QAAQ,OAAO,QAAQ,SAAS,yCAAyC,IAAI,MAAM,MAAM,OAAO,WAAW,IAAI,UAAU,EAAE;AAAA,EAC1J;AAEA,iBAAe,MAAM,KAAwB,UAAmF;AAE9H,UAAM,UAAU,iBAAiB,MAAM,MAAM,MAAM,WAAW,GAAG;AACjE,QAAI,CAAC,QAAS,QAAO,EAAE,SAAS,OAAO,QAAQ,gBAAgB;AAC/D,WAAO,OAAO,QAAQ,aAAa,QAAQ;AAAA,EAC7C;AAMA,QAAM,aAAa,CAAyB,OAC1C,UAAU,SAAwB;AAChC,UAAMG,OAAM,MAAM,GAAG,GAAG,IAAI;AAC5B,aAAS,MAAM;AACf,WAAOA;AAAA,EACT;AACF,QAAM,sBAAoC;AAAA,IACxC,GAAG;AAAA,IACH,eAAe;AAAA,MACb,GAAG,UAAU;AAAA,MACb,QAAQ,WAAW,UAAU,cAAc,MAAM;AAAA,MACjD,QAAQ,WAAW,UAAU,cAAc,MAAM;AAAA,IACnD;AAAA,IACA,SAAS;AAAA,MACP,GAAG,UAAU;AAAA,MACb,KAAK,WAAW,UAAU,QAAQ,GAAG;AAAA,MACrC,SAAS,WAAW,UAAU,QAAQ,OAAO;AAAA,MAC7C,QAAQ,WAAW,UAAU,QAAQ,MAAM;AAAA,IAC7C;AAAA,EACF;AAEA,iBAAe,SAAS,SAA0C;AAChE,QAAI,OAA8B,CAAC;AACnC,QAAI;AACF,aAAO,MAAM,cAAc,OAAO;AAAA,IACpC,QAAQ;AAAA,IAER;AACA,WAAO,EAAE,MAAM,QAAQ,MAAM,UAAU,QAAQ,UAAU,OAAO,QAAQ,OAAO,eAAe,MAAM,WAAW,QAAQ,UAAU;AAAA,EACnI;AAIA,QAAM,OAAO;AAAA,IACX,QAAQ,CAAC,aAAsB,GAAG,QAAQ,SAAS,WAAW,cAAc,mBAAmB,QAAQ,CAAC,KAAK,EAAE;AAAA,IAC/G,SAAS,MAAM,GAAG,QAAQ;AAAA,IAC1B,SAAS,CAAC,aAAsB,GAAG,QAAQ,WAAW,WAAW,cAAc,mBAAmB,QAAQ,CAAC,KAAK,EAAE;AAAA,IAClH,SAAS,GAAG,QAAQ;AAAA,EACtB;AAEA,iBAAe,MAAM,SAAkB,KAA6B;AAClE,UAAM,OAAa,EAAE,OAAO,OAAO,GAAG,UAAU,OAAO,EAAE,GAAG,UAAU,UAAU,IAAI,aAAa,IAAI,WAAW,GAAG,WAAW,EAAE;AAChI,UAAM,YAAY,OAAO,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC;AACvH,UAAM,IAAI,IAAI,gBAAgB;AAAA,MAC5B,WAAW;AAAA,MACX,cAAc,GAAG,SAAS,OAAO,CAAC,GAAG,QAAQ;AAAA,MAC7C,eAAe;AAAA,MACf,OAAO,KAAK;AAAA,MACZ,gBAAgB;AAAA,MAChB,uBAAuB;AAAA,IACzB,CAAC;AAED,UAAM,SAAS,IAAI,aAAa,IAAI,QAAQ;AAC5C,QAAI,WAAW,WAAW,WAAW,OAAQ,GAAE,IAAI,UAAU,MAAM;AACnE,UAAM,SAAS,IAAI,aAAa,IAAI,QAAQ,KAAK,IAAI,aAAa,IAAI,YAAY;AAClF,QAAI,UAAU,oBAAoB,KAAK,MAAM,EAAG,GAAE,IAAI,cAAc,MAAM;AAI1E,QAAI,UAAU;AACd,QAAI,IAAI,aAAa,IAAI,QAAQ,MAAM,WAAW;AAChD,QAAE,IAAI,UAAU,SAAS;AACzB,gBAAU;AAAA,IACZ;AACA,WAAO,SAAS,GAAG,MAAM,uBAAuB,CAAC,GAAG,OAAO,IAAI;AAAA,MAC7D,YAAY,YAAY,MAAM,KAAK,OAAO,MAAM,UAAU,CAAC,CAAC,GAAG,MAAM,SAAS,YAAY,CAAC;AAAA,IAC7F,CAAC;AAAA,EACH;AAEA,WAAS,OAAO,SAAkB,QAA0B;AAC1D,UAAM,IAAI,IAAI,QAAQ,EAAE,gBAAgB,6BAA6B,iBAAiB,WAAW,CAAC;AAClG,MAAE,OAAO,cAAc,YAAY,YAAY,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC;AACrE,MAAE,OAAO,cAAc,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC;AACtE,WAAO,IAAI,SAAS,mCAAmC,MAAM,6BAA6B,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;AAAA,EACvH;AAEA,iBAAe,SAAS,SAAkB,KAA6B;AACrE,UAAM,MAAM,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AACrD,UAAM,SAAS,IAAI,IAAI,UAAU;AACjC,UAAM,OAAO,SAAS,MAAM,UAAgB,QAAQ,MAAM,QAAQ,IAAI;AAGtE,QAAI,SAAS,QAAQ,IAAI,aAAa,IAAI,OAAO,MAAM,KAAK,OAAO;AAKjE,UAAI,IAAI,IAAI,WAAW,MAAM,QAAW;AACtC,cAAM,OAAO,MAAM,YAAY;AAC/B,eAAO,SAAS,GAAG,QAAQ,oBAAoB,mBAAmB,IAAI,CAAC,IAAI,CAAC,YAAY,aAAa,KAAK,MAAM,SAAS,aAAa,CAAC,CAAC,CAAC;AAAA,MAC3I;AACA,aAAO,OAAO,SAAS,gBAAgB;AAAA,IACzC;AACA,UAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;AAC1C,QAAI,UAAU,MAAM;AAElB,UAAI,UAAU,iBAAkB,QAAO,SAAS,KAAK,UAAU,CAAC,YAAY,YAAY,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;AAE/G,UAAI,UAAU,iBAAiB;AAC7B,cAAM,OAAO,MAAM,UAAU,KAAK;AAClC,eAAO,SAAS,GAAG,IAAI,GAAG,KAAK,SAAS,GAAG,IAAI,MAAM,GAAG,wBAAwB,CAAC,YAAY,YAAY,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;AAAA,MAClI;AACA,aAAO,OAAO,SAAS,MAAM,MAAM,GAAG,EAAE,CAAC;AAAA,IAC3C;AACA,UAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,QAAI,CAAC,KAAM,QAAO,OAAO,SAAS,SAAS;AAC3C,UAAM,MAAM,MAAM,MAAM;AAAA,MACtB,YAAY;AAAA,MACZ;AAAA,MACA,cAAc,GAAG,SAAS,OAAO,CAAC,GAAG,QAAQ;AAAA,MAC7C,eAAe,KAAK;AAAA,IACtB,GAAG,MAAM,SAAS,OAAO,CAAC;AAE1B,UAAM,cAAc,MAAM;AACxB,YAAM,OAAO,MAAM,UAAU;AAC7B,aAAO;AAAA,QAAS,GAAG,IAAI,GAAG,KAAK,SAAS,GAAG,IAAI,MAAM,GAAG;AAAA,QACtD,CAAC,YAAY,YAAY,IAAI,MAAM,SAAS,CAAC,CAAC,GAAG,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC;AAAA,MAAC;AAAA,IACrG;AAEA,QAAI,CAAC,IAAI,MAAM,IAAI,SAAS,sBAAuB,QAAO,YAAY;AACtE,QAAI;AACJ,QAAI;AACF,UAAI,IAAI,KAAK,MAAM,OAAO,IAAI,IAAI,IAAI;AAAA,IACxC,SAAS,KAAK;AAEZ,UAAI,EAAE,eAAe,kBAAkB,IAAI,SAAS,uBAAwB,OAAM;AAClF,aAAO,YAAY;AAAA,IACrB;AACA,QAAI,MAAM,KAAM,QAAO,OAAO,SAAS,iBAAiB;AACxD,WAAO,SAAS,KAAK,UAAU,CAAC,GAAI,MAAM,MAAM,SAAS,GAAG,GAAG,GAAI,YAAY,YAAY,IAAI,MAAM,SAAS,CAAC,CAAC,GAAG,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;AAAA,EACrK;AAEA,iBAAe,OAAO,SAAqC;AACzD,UAAM,EAAE,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO;AACzC,QAAI,UAAU,MAAM;AAElB,YAAMH,QAAO,MAAM,WAAW,IAAI,gBAAgB,EAAE,WAAW,UAAU,OAAO,MAAM,GAAG,CAAC,CAAC;AAC3F,YAAM,QAAQ,GAAG,MAAM,oBAAoB;AAAA,QACzC,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,QAC/D,MAAAA;AAAA,MACF,CAAC,EAAE,MAAM,MAAM,MAAS;AACxB,eAAS,OAAO,MAAM,EAAE;AAAA,IAC1B;AAGA,UAAM,IAAI,IAAI,gBAAgB,EAAE,WAAW,UAAU,0BAA0B,GAAG,SAAS,OAAO,CAAC,GAAG,YAAY,GAAG,CAAC;AACtH,WAAO,SAAS,GAAG,MAAM,oBAAoB,CAAC,IAAI,WAAW,YAAY,MAAM,SAAS,CAAC,GAAG,GAAG,CAAC;AAAA,EAClG;AAWA,QAAM,eAAe;AAErB,QAAM,kBAAkB;AAGxB,QAAM,YAAY,CAAC,OAAY;AAAA,IAC7B,MAAM,GAAG,SAAS;AAAA,IAClB,OAAO,GAAG,QAAQ,EAAE,QAAQ,OAAO,EAAE,MAAM,UAAU,EAAE,GAAG,SAAS,OAAO,EAAE,MAAM,WAAW,KAAK,EAAE,IAAI;AAAA,IACxG,eAAe,MAAM,QAAQ,GAAG,cAAc,IAAI,EAAE,eAAe,IAAI,MAAM,IAAI,CAAC;AAAA,EACpF;AAGA,QAAM,eAAe,CAAC,MACpB,OAAO,MAAM,YAAY,MAAM,QAAQ,CAAC,MAAM,QAAQ,CAAC,KAAK,OAAQ,EAAuB,OAAO,YAAY,OAAQ,EAA6B,aAAa;AAElK,QAAM,YAAY,CAAC,OAAY;AAAA,IAC7B,IAAI,OAAO,GAAG,MAAM,EAAE;AAAA,IAAG,MAAM,OAAO,GAAG,YAAY,EAAE;AAAA,IACvD,MAAM,CAAC,gBAAgB,UAAU,QAAQ,EAAE,SAAS,GAAG,IAAI,IAAI,EAAE,OAAO;AAAA,IAAW,WAAW,OAAO,GAAG,cAAc,EAAE;AAAA,IAAG,YAAY,GAAG,eAAe,OAAO,EAAE,YAAY,IAAI;AAAA,EACpL;AAEA,QAAMI,QAAO;AAGb,QAAM,SAAS,CAAC,OAAY;AAAA,IAC1B,IAAI,OAAO,GAAG,MAAM,EAAE;AAAA,IAAG,QAAQ,OAAO,GAAG,UAAU,EAAE;AAAA,IAAG,MAAM,OAAO,GAAG,QAAQ,EAAE;AAAA,IAAG,MAAM,OAAO,GAAG,QAAQ,EAAE;AAAA,IAAG,MAAM,OAAO,GAAG,QAAQ,EAAE;AAAA;AAAA,IAE9I,KAAK;AAAA,MACH,aAAa,GAAG,KAAK,iBAAiB;AAAA,MAAM,eAAe,GAAG,KAAK,mBAAmB;AAAA,MAAM,eAAe,GAAG,KAAK,mBAAmB;AAAA,MACtI,QAAQ,GAAG,KAAK,WAAW;AAAA,MAAM,SAAS,GAAG,KAAK,YAAY;AAAA,MAAM,QAAQ,GAAG,KAAK,WAAW;AAAA,IACjG;AAAA,EACF;AAEA,QAAM,cAAc,CAAC,OAAY;AAAA,IAC/B,QAAQ,OAAO,GAAG,WAAW,EAAE;AAAA,IAAG,OAAO,OAAO,GAAG,SAAS,EAAE;AAAA,IAAG,MAAM,OAAO,GAAG,QAAQ,EAAE;AAAA,IAAG,MAAM,OAAO,GAAG,QAAQ,EAAE;AAAA,IACxH,QAAQ,OAAO,GAAG,UAAU,EAAE;AAAA,IAAG,SAAS,GAAG,YAAY;AAAA,IAAM,SAAS,GAAG,YAAY;AAAA,IAAM,KAAK,GAAG,QAAQ;AAAA,IAAM,OAAO,OAAO,GAAG,SAAS,EAAE;AAAA,EACjJ;AAEA,QAAM,YAAY,CAAC,OAAY;AAAA,IAC7B,MAAM,OAAO,GAAG,QAAQ,EAAE;AAAA,IAAG,MAAM,OAAO,GAAG,QAAQ,EAAE;AAAA,IAAG,aAAa,OAAO,GAAG,eAAe,EAAE;AAAA,IAAG,SAAS,GAAG,YAAY;AAAA,EAC/H;AAGA,QAAM,UAAU,CAAC,OAAY;AAAA,IAC3B,IAAI,OAAO,GAAG,MAAM,EAAE;AAAA,IACtB,MAAM,OAAO,GAAG,OAAO,QAAQ,EAAE;AAAA,IACjC,cAAc,OAAO,GAAG,OAAO,iBAAiB,EAAE;AAAA,IAClD,UAAU,EAAE,MAAM,OAAO,GAAG,UAAU,QAAQ,EAAE,GAAG,KAAK,OAAO,GAAG,UAAU,OAAO,EAAE,EAAE;AAAA,IACvF,QAAQ,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,OAAO,IAAI,CAAC,OAAY,EAAE,MAAM,OAAO,GAAG,QAAQ,EAAE,GAAG,aAAa,OAAO,GAAG,eAAe,EAAE,EAAE,EAAE,IAAI,CAAC;AAAA,IAC7I,aAAa,OAAO,GAAG,cAAc,EAAE;AAAA,IACvC,YAAY,OAAO,GAAG,gBAAgB,EAAE;AAAA,EAC1C;AAaA,QAAM,QAAQ,CAAC,MAAe,MAAM,QAAQ,MAAM,OAAO,MAAM,QAAQ,MAAM;AAE7E,QAAM,UAAU,CAACC,SAAgB,MAAc,SAAiB,OAAgB,SAAmB,YACjG,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC,GAAI,GAAI,WAAW,QAAQ,SAAS,IAAI,EAAE,QAAQ,IAAI,CAAC,EAAG,EAAE,GAAGA,SAAQ,OAAO;AAExI,QAAM,UAAU,CAAC,MAAoB,QAAQ,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK;AAE5E,MAAI,YAAY;AAMhB,WAAS,qBAAqB,SAAkB,OAAgC;AAC9E,QAAI,QAAQ,QAAQ,IAAI,kBAAkB,MAAM,IAAK,QAAO;AAC5D,QAAI,kBAAkB,QAAQ;AAC5B,UAAI,CAAC,cAAc;AACjB,uBAAe;AACf,gBAAQ,KAAK,wBAAwB,QAAQ,GAAG,KAAK,sKACiC;AAAA,MACxF;AACA,aAAO;AAAA,IACT;AACA,WAAO,QAAQ,KAAK,iBAAiB,+DAAgE;AAAA,EACvG;AAGA,WAAS,WAAW,SAA2B;AAC7C,UAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAC3C,QAAI,WAAW,MAAM;AACnB,YAAM,MAAM,SAAS,OAAO;AAC5B,UAAI,WAAW,OAAO,WAAW,IAAI,IAAI,QAAQ,GAAG,EAAE,OAAQ,QAAO;AAGrE,UAAI,CAAC,aAAa,OAAO,MAAM,MAAM,IAAI,IAAI,GAAG,EAAE,UAAU;AAC1D,oBAAY;AACZ,gBAAQ,KAAK,0CAA0C,MAAM,mDAAmD,GAAG,0EACzC;AAAA,MAC5E;AACA,aAAO;AAAA,IACT;AAGA,YAAQ,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,mBAAmB;AAAA,EACtE;AAEA,iBAAe,KAAK,SAA2D;AAC7E,QAAI,EAAE,QAAQ,QAAQ,IAAI,cAAc,KAAK,IAAI,SAAS,kBAAkB,EAAG,QAAO;AACtF,QAAI;AACF,YAAM,IAAK,MAAM,QAAQ,KAAK;AAC9B,aAAO,OAAO,MAAM,YAAY,MAAM,QAAQ,CAAC,MAAM,QAAQ,CAAC,IAAK,IAAgC;AAAA,IACrG,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAWA,QAAM,WAAW,MAAM,aAAa,CAAC,YACnC,QAAQ,QAAQ,IAAI,iBAAiB,GAAG,MAAM,GAAG,EAAE,IAAI,OAAK,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,KAAK,OAAK,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;AACtH,MAAI,eAAe;AACnB,iBAAe,SAAS,SAAmD;AACzE,QAAI,KAAK,IAAI,IAAI,aAAc,QAAO,CAAC;AACvC,UAAM,KAAK,SAAS,OAAO;AAC3B,QAAI;AAGF,YAAM,QAAQ,EAAE,yBAAyB,MAAM,UAAU,MAAM,GAAG,uBAAuB,SAAS,OAAO,EAAE;AAC3G,aAAO,KAAK,EAAE,GAAG,OAAO,sBAAsB,GAAG,IAAI;AAAA,IACvD,QAAQ;AAGN,qBAAe,KAAK,IAAI,IAAI;AAC5B,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AAGA,iBAAe,IAAI,SAAkB,QAAgB,MAAc,SAAmB,MAAeC,SAAiB,WAAW,OAA8G;AAC7O,QAAI;AACF,YAAM,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,IAAI,IAAI;AAAA,QAC5C;AAAA,QACA,SAAS;AAAA,UACP,gBAAgB,UAAU;AAAA,UAC1B,QAAQ;AAAA;AAAA;AAAA,UAGR,GAAI,OAAO,EAAE,oBAAoB,GAAG,SAAS,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,kBAAkB,SAAS;AAAA;AAAA;AAAA,UAGhG,GAAI,WAAW,EAAE,sBAAsB,SAAS,IAAI,CAAC;AAAA,UACrD,GAAI,MAAM,SAAS,OAAO;AAAA,UAC1B,GAAIA,UAAS,EAAE,eAAe,UAAUA,OAAM,GAAG,IAAI,CAAC;AAAA;AAAA,UAEtD,GAAI,WAAW,EAAE,qBAAqB,IAAI,IAAI,CAAC;AAAA;AAAA;AAAA,UAG/C,GAAI,QAAQ,QAAQ,IAAI,kBAAkB,IAAI,EAAE,mBAAmB,QAAQ,QAAQ,IAAI,kBAAkB,EAAY,IAAI,CAAC;AAAA,UAC1H,GAAI,QAAQ,QAAQ,IAAI,iBAAiB,IAAI,EAAE,mBAAmB,QAAQ,QAAQ,IAAI,iBAAiB,EAAY,IAAI,CAAC;AAAA;AAAA,UAExH,GAAI,QAAQ,QAAQ,IAAI,iBAAiB,IAAI,EAAE,mBAAmB,QAAQ,QAAQ,IAAI,iBAAiB,EAAY,IAAI,CAAC;AAAA,UACxH,GAAI,QAAQ,QAAQ,IAAI,YAAY,IAAI,EAAE,cAAc,QAAQ,QAAQ,IAAI,YAAY,EAAY,IAAI,CAAC;AAAA,UACzG,GAAI,YAAY,SAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;AAAA,QACxE;AAAA,QACA,MAAM,YAAY,SAAY,SAAY,KAAK,UAAU,OAAO;AAAA,MAClE,CAAC;AACD,YAAM,IAAI,IAAI,WAAW,OAAO,IAAI,WAAW,MAAM,OAAS,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC/F,UAAI,IAAI,GAAI,QAAO,EAAE,QAAQ,IAAI,QAAQ,MAAM,GAAG,QAAQ,EAAE;AAC5D,YAAM,QAAQ,GAAG,SAAS,CAAC;AAE3B,YAAM,UAAU,MAAM,QAAQ,OAAO,MAAM,OAAO,IAAK,MAAM,KAAK,QAAsB,IAAI,MAAM,IAAI;AACtG,aAAO,EAAE,QAAQ,IAAI,QAAQ,MAAM,MAAM,OAAO,EAAE,MAAM,OAAO,OAAO,QAAQ,OAAO,GAAG,SAAS,OAAO,OAAO,WAAW,qCAAqC,GAAG,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC,EAAG,EAAE;AAAA,IACtM,QAAQ;AACN,aAAO,EAAE,QAAQ,KAAK,MAAM,MAAM,OAAO,EAAE,MAAM,eAAe,SAAS,2DAA2D,EAAE;AAAA,IACxI;AAAA,EACF;AAEA,QAAM,YAAY,CAAC,OAAY;AAAA,IAC7B,IAAI,OAAO,GAAG,MAAM,EAAE;AAAA,IAAG,OAAO,OAAO,GAAG,SAAS,EAAE;AAAA,IAAG,MAAM,OAAO,GAAG,QAAQ,EAAE;AAAA,IAClF,eAAe,GAAG,mBAAmB;AAAA,IAAM,aAAa,GAAG,iBAAiB;AAAA,IAAM,YAAY,GAAG,gBAAgB;AAAA,EACnH;AAOA,iBAAe,WAAW,SAA8G;AACtI,UAAM,IAAI,MAAML,SAAQ,OAAO;AAC/B,UAAM,UAAU,IAAI,QAAQ;AAC5B,eAAW,KAAK,EAAE,QAAS,SAAQ,OAAO,cAAc,CAAC;AACzD,QAAI,EAAE,YAAY,KAAM,QAAO,EAAE,UAAU,QAAQ,KAAK,mBAAmB,kBAAkB,QAAW,OAAO,EAAE;AAGjH,WAAO,EAAE,OAAO,EAAE,QAAQ,aAAa,MAAM,EAAE,QAAQ,WAAW,KAAK,MAAM,KAAK,OAAO,GAAG,QAAQ,MAAM,QAAQ;AAAA,EACpH;AAGA,iBAAe,SAAS,SAAkB,QAAa,QAAkB,CAAC,GAAG,OAAgC,CAAC,GAAG,KAAiC;AAChJ,UAAM,IAAI,MAAM,OAAO,QAAQ,GAAG;AAClC,QAAI,MAAM,KAAM,QAAO,QAAQ,KAAK,eAAe,0DAA0D;AAC7G,UAAM,IAAI,IAAI,QAAQ;AACtB,eAAW,KAAK,CAAC,GAAI,MAAM,MAAM,SAAS,GAAG,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,CAAC,GAAI,GAAG,KAAK,EAAG,GAAE,OAAO,cAAc,CAAC;AAC9H,WAAO,KAAK,EAAE,QAAQ,aAAa,SAAS,MAAM,SAAS,UAAU,CAAC,CAAC,GAAG,GAAG,KAAK,GAAG,KAAK,CAAC;AAAA,EAC7F;AAOA,iBAAe,SAAS,SAAkB,MAAW,WAAW,OAA0B;AACxF,QAAI,MAAM,iBAAiB,MAAM;AAC/B,YAAM,OAAa,EAAE,MAAM,OAAO,OAAO,OAAO,KAAK,aAAa,EAAE,GAAG,UAAU,aAAa,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC,EAAG;AAEhI,YAAM,MAAM,KAAK,eAAe,UAAU,EAAE,QAAQ,QAAQ,IAAI,CAAC;AACjE,aAAO,KAAK,EAAE,QAAQ,gBAAgB,GAAG,IAAI,GAAG,KAAK,IAAI,QAAQ,EAAE,cAAc,YAAY,YAAY,MAAM,KAAK,OAAO,MAAM,UAAU,CAAC,CAAC,GAAG,MAAM,SAAS,YAAY,CAAC,EAAE,CAAC,CAAC;AAAA,IAClL;AACA,WAAO,SAAS,SAAS,IAAI;AAAA,EAC/B;AAEA,MAAI,YAAqE;AAKzE,MAAI,cAAuE;AAC3E,QAAM,aAAa,CAAC,aAA6C;AAC/D,kBAAc,EAAE,OAAO,KAAK,IAAI,IAAI,aAAa,QAAQ,SAAS,SAAS,CAAC,SAAS,MAAM,kBAAkB,OAAO,iBAAiB,SAAS,KAAK,eAAe,EAAE;AACpK,WAAO,YAAY;AAAA,EACrB;AAEA,iBAAe,gBAAgB,SAAkD;AAC/E,QAAI,gBAAgB,QAAQ,YAAY,SAAS,KAAK,IAAI,EAAG,QAAO,YAAY;AAChF,WAAO,WAAW,MAAM,IAAI,SAAS,OAAO,mBAAmB,CAAC;AAAA,EAClE;AAEA,iBAAe,mBAAmB,SAAkB,OAA8C;AAChG,UAAM,SAAS,MAAM,gBAAgB,OAAO;AAE5C,WAAO,iBAAiB,OAAO,UAAU,EAAE,KAAK,GAAG,KAAK,KAAK,UAAU,CAAC,GAAG,aAAa,GAAG,iBAAiB,MAAM,CAAC;AAAA,EACrH;AAEA,iBAAe,SAAS,SAAkB,KAAU,OAAyC;AAC3F,UAAM,OAAO,QAAQ,WAAW;AAChC,UAAM,MAAM;AAAA,MAAC;AAAA,MAAkB;AAAA,MAAgB;AAAA,MAAkB;AAAA,MAAoB;AAAA,MAAmB;AAAA,MAAiB;AAAA,MAAuB;AAAA,MAA8B;AAAA,MAAuB;AAAA,MAAO;AAAA,MAAgB;AAAA,MAAiB;AAAA,MAAkB;AAAA,MAAmB;AAAA,MAA0B;AAAA,MAAmB;AAAA,MAAiB;AAAA,MAAwB;AAAA,MAAwB;AAAA,MAAwB;AAAA,MAAqB;AAAA,MAAsB;AAAA,MAAqB;AAAA,MAA4B;AAAA,MAA4B;AAAA,MAAgB;AAAA,MAAoB;AAAA,MAAa;AAAA,MAAoB;AAAA,MAAa;AAAA,MAAkB;AAAA,MAAyB;AAAA,MAAa;AAAA,MAAY;AAAA,MACpqB;AAAA,MAA0B;AAAA,MAA2B;AAAA,MAAiC;AAAA,MAA2B;AAAA,MAAgB;AAAA,MAA0B;AAAA,MAA2B;AAAA,MAAuB;AAAA,MAAc;AAAA,MAC3N;AAAA,MAAsB;AAAA,MACtB;AAAA,MAAqB;AAAA,MAA6B;AAAA,MAA2B;AAAA,MAAiC;AAAA,MAAkC;AAAA,MAAoC;AAAA,MACpL;AAAA,MAA4B;AAAA,MAA6B;AAAA,MACzD;AAAA,MAAe;AAAA,IAAoB,EAAE,SAAS,KAAK,KACnD,MAAM,WAAW,kBAAkB,KAAK,MAAM,WAAW,YAAY,KAAK,MAAM,WAAW,sBAAsB,KAAK,MAAM,WAAW,qBAAqB,KAC5J,UAAU,kBAAkB,UAAU,2BAA2B,UAAU;AAC7E,QAAI,CAAC,IAAK,QAAO;AACjB,QAAI,MAAM;AACR,YAAM,UAAU,qBAAqB,SAAS,KAAK;AACnD,UAAI,QAAS,QAAO;AAAA,IACtB;AAEA,QAAI,UAAU,wBAAwB,UAAU,cAAe,YAAW,QAAQ,KAAK,IAAI,0DAA0D;AACrJ,QAAI,MAAM,WAAW,qBAAqB,EAAG,YAAW,qCAAqC,0DAA0D;AACvJ,QAAI,UAAU,MAAM,IAAI;AACtB,aAAO,QAAQ,KAAK,kBAAkB,8FAA+F;AAAA,IACvI;AAIA,QAAI,UAAU,WAAW,CAAC,MAAM;AAC9B,UAAI,cAAc,QAAQ,UAAU,QAAQ,KAAK,IAAI,GAAG;AACtD,cAAM,MAAM,MAAM,IAAI,SAAS,OAAO,iBAAiB,mBAAmB,QAAQ,CAAC,EAAE;AACrF,oBAAY,EAAE,OAAO,KAAK,IAAI,IAAI,aAAa,MAAM,IAAI,QAAQ,CAAC,IAAK,IAAI,QAAQ,CAAC,EAAG;AAAA,MACzF;AACA,aAAO,KAAK,UAAU,IAAI;AAAA,IAC5B;AAGA,QAAI,UAAU,cAAc,CAAC,MAAM;AACjC,YAAM,CAAC,WAAW,UAAU,OAAO,GAAG,IAAI,MAAM,QAAQ,IAAI;AAAA,QAC1D,IAAI,SAAS,OAAO,2BAA2B;AAAA,QAC/C,IAAI,SAAS,OAAO,mBAAmB;AAAA,QACvC,IAAI,SAAS,OAAO,kCAAkC,mBAAmB,SAAS,OAAO,CAAC,CAAC,EAAE;AAAA,QAC7F,IAAI,SAAS,OAAO,0BAA0B;AAAA,MAChD,CAAC;AACD,YAAM,OAAO,MAAM,QAAQ,UAAU,IAAI,IAAI,UAAU,OAAO,CAAC;AAC/D,YAAM,WAAW,WAAW,QAAQ;AAGpC,YAAM,WAAW,SAAS,MAAM,mBAAmB;AAGnD,YAAM,OAAO,YAAY,MAAM,MAAM,SAAS;AAC9C,aAAO,KAAK;AAAA,QACV,WAAW,KAAK,IAAI,CAAC,OAAY,EAAE,IAAI,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,GAAG,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,MAAsB,EAAE,OAAO,EAAE;AAAA;AAAA;AAAA,QAGxL,gBAAgB,SAAS,MAAM,mBAAmB;AAAA;AAAA,QAElD,QAAQ,SAAS,MAAM,iBAAiB,SAAS,SAAS,MAAM,QAAQ,SAAS;AAAA;AAAA,QAEjF,GAAI,SAAS,MAAM,QAAQ,cAAc,QAAQ,OAC7C,EAAE,cAAc,EAAE,KAAK,MAAM,UAAU,SAAS,KAAK,OAAO,aAAa,aAAa,KAAK,EAAE,IAC7F,CAAC;AAAA;AAAA,QAEL,GAAI,OAAO,SAAS,MAAM,wBAAwB,YAAY,EAAE,oBAAoB,SAAS,KAAK,oBAAoB,IAAI,CAAC;AAAA;AAAA,QAE3H,WAAW,SAAS,MAAM,qBAAqB,QAAQ,MAAM,WAAW;AAAA,QACxE,SAAS,aAAa,MAAM,QAAQ,OAAO,QAAQ,MAAM,MAAM,cAAc;AAAA,QAC7E,aAAa;AAAA,QACb,iBAAiB,aAAa,MAAM,QAAQ,OAAO,MAAM,MAAM,cAAc;AAAA;AAAA,QAE7E,KAAK,MAAM,QAAQ,IAAI,IAAI,KAAK,IAAI,KAAK,KAAK,CAAC,MAAW,GAAG,iBAAiB,IAAI;AAAA;AAAA,QAElF,GAAI,SAAS,MAAM,QAAQ,EAAE,OAAO,QAAQ,SAAS,KAAK,KAAK,EAAE,IAAI,CAAC;AAAA,QACtE,GAAI,SAAS,MAAM,oBAAoB,QAAQ,SAAS,MAAM,mBAAmB,EAAE,gBAAgB,OAAO,SAAS,KAAK,gBAAgB,EAAE,IAAI,CAAC;AAAA;AAAA,QAE/I,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,MACjC,CAAC;AAAA,IACH;AAIA,QAAI,UAAU,iBAAiB,CAAC,MAAM;AACpC,YAAMC,UAAS,IAAI,aAAa,IAAI,OAAO,KAAK,IAAI,KAAK;AACzD,UAAIA,WAAU,MAAMA,OAAM,SAAS,IAAK,QAAO,QAAQ,KAAK,iBAAiB,kDAAkD;AAC/H,YAAM,MAAM,MAAM,IAAI,SAAS,OAAO,6BAA6B,mBAAmBA,MAAK,CAAC,EAAE;AAC9F,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,OAAO;AAC3E,YAAM,eAAe,OAAO,IAAI,MAAM,iBAAiB,YAAY,IAAI,KAAK,iBAAiB,KAAK,EAAE,cAAc,IAAI,KAAK,aAAa,IAAI,CAAC;AAC7I,aAAO,KAAK,EAAE,QAAQ,MAAM,YAAY,EAAE,OAAO,OAAO,IAAI,MAAM,SAAS,EAAE,GAAG,WAAW,OAAO,IAAI,MAAM,aAAa,EAAE,GAAG,GAAG,aAAa,EAAE,CAAC;AAAA,IACnJ;AAKA,QAAI,UAAU,kBAAkB,CAAC,MAAM;AACrC,YAAM,WAAW,UAAU,IAAI,aAAa,IAAI,WAAW,GAAG,WAAW;AACzE,YAAMK,UAAS,CAAC,SAAiB,SAAS,GAAG,QAAQ,GAAG,SAAS,SAAS,GAAG,IAAI,MAAM,GAAG,cAAc,mBAAmB,IAAI,CAAC,EAAE;AAClI,YAAM,SAAS,IAAI,aAAa,IAAI,OAAO,KAAK,IAAI,KAAK;AACzD,YAAM,cAAc,IAAI,aAAa,IAAI,YAAY,KAAK,IAAI,KAAK;AACnE,UAAI,UAAU,MAAM,eAAe,GAAI,QAAOA,QAAO,eAAe;AACpE,YAAM,WAAW,OAAO,EAAE;AAC1B,YAAM,YAAY,OAAO,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,QAAQ,CAAC,CAAC,CAAC;AAClH,YAAMC,YAAW,GAAG,QAAQ;AAC5B,YAAM,WAAW,MAAM,IAAI,aAAa,IAAI,UAAU,CAAC;AACvD,YAAM,UAAU,MAAM,IAAI,SAAS,QAAQ,sBAAsB;AAAA,QAC/D,GAAI,aAAa,EAAE,WAAW,IAAI,EAAE,MAAM;AAAA,QAC1C,cAAc,GAAG,SAAS,OAAO,CAAC,GAAGA,SAAQ;AAAA,QAAI,gBAAgB;AAAA,MACnE,GAAGA,WAAU,QAAW,QAAQ;AAChC,UAAI,QAAQ,SAAS,OAAO,QAAQ,MAAM,iBAAiB,SAAU,QAAOD,QAAO,QAAQ,OAAO,QAAQ,iBAAiB;AAC3H,YAAM,OAAa,EAAE,MAAM,OAAO,OAAO,UAAU,UAAU,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC,EAAG;AAC/F,aAAO,SAAS,QAAQ,KAAK,cAAc,CAAC,YAAY,YAAY,MAAM,KAAK,OAAO,MAAM,UAAU,CAAC,CAAC,GAAG,MAAM,SAAS,YAAY,CAAC,CAAC,CAAC;AAAA,IAC3I;AACA,QAAI,UAAU,mBAAmB,CAAC,MAAM;AACtC,YAAM,SAAS,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,EAAE,IAAI,UAAU;AACxE,YAAM,OAAO,SAAS,MAAM,UAAgB,QAAQ,MAAM,QAAQ,IAAI;AACtE,YAAM,QAAQ,YAAY,YAAY,IAAI,MAAM,SAAS,CAAC,CAAC;AAC3D,YAAM,OAAO,MAAM,YAAY;AAC/B,YAAM,WAAW,CAACE,UAAiB,SAAS,GAAG,IAAI,GAAG,KAAK,SAAS,GAAG,IAAI,MAAM,GAAG,cAAc,mBAAmBA,KAAI,CAAC,IAAI,CAAC,KAAK,CAAC;AACrI,UAAI,SAAS,QAAQ,KAAK,SAAS,MAAO,QAAO,SAAS,gBAAgB;AAC1E,YAAM,UAAU,IAAI,aAAa,IAAI,OAAO;AAC5C,UAAI,QAAS,QAAO,SAAS,OAAO;AACpC,YAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,UAAI,CAAC,KAAM,QAAO,SAAS,YAAY;AACvC,YAAM,OAAO,MAAM,IAAI,SAAS,QAAQ,sBAAsB,EAAE,MAAM,cAAc,GAAG,SAAS,OAAO,CAAC,GAAG,QAAQ,iBAAiB,eAAe,KAAK,MAAM,GAAG,QAAW,QAAW,KAAK,aAAa,IAAI;AAC7M,UAAI,KAAK,MAAO,QAAO,SAAS,KAAK,MAAM,IAAI;AAC/C,YAAM,IAAI,MAAM,OAAO,KAAK,IAAI;AAChC,UAAI,MAAM,KAAM,QAAO,SAAS,aAAa;AAC7C,aAAO,SAAS,MAAM,CAAC,GAAI,MAAM,MAAM,SAAS,GAAG,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,CAAC,GAAI,KAAK,CAAC;AAAA,IACzG;AAGA,QAAI,MAAM,WAAW,kBAAkB,KAAK,CAAC,MAAM;AACjD,YAAM,WAAW,WAAW,MAAM,MAAM,mBAAmB,MAAM,CAAC;AAClE,UAAI,CAAC,YAAY,KAAK,QAAQ,EAAG,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AACjF,YAAM,WAAW,UAAU,IAAI,aAAa,IAAI,WAAW,GAAG,WAAW;AACzE,YAAMD,YAAW,GAAG,QAAQ,aAAa,QAAQ;AAGjD,YAAM,WAAW,MAAM,IAAI,aAAa,IAAI,UAAU,CAAC;AACvD,YAAM,UAAU,MAAM,IAAI,SAAS,OAAO,mBAAmB,QAAQ,iBAAiB,mBAAmB,GAAG,SAAS,OAAO,CAAC,GAAGA,SAAQ,EAAE,CAAC,IAAI,QAAWA,WAAU,QAAW,QAAQ;AACvL,UAAI,QAAQ,SAAS,OAAO,QAAQ,MAAM,iBAAiB,UAAU;AACnE,eAAO,SAAS,GAAG,QAAQ,GAAG,SAAS,SAAS,GAAG,IAAI,MAAM,GAAG,cAAc,mBAAmB,QAAQ,OAAO,QAAQ,sBAAsB,CAAC,EAAE;AAAA,MACnJ;AACA,YAAM,OAAa,EAAE,MAAM,UAAU,OAAO,OAAO,QAAQ,KAAK,SAAS,EAAE,GAAG,UAAU,UAAU,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC,EAAG;AACpI,aAAO,SAAS,QAAQ,KAAK,cAAc,CAAC,YAAY,YAAY,MAAM,KAAK,OAAO,MAAM,UAAU,CAAC,CAAC,GAAG,MAAM,SAAS,YAAY,CAAC,CAAC,CAAC;AAAA,IAC3I;AACA,QAAI,MAAM,WAAW,YAAY,KAAK,CAAC,MAAM;AAC3C,YAAM,WAAW,WAAW,MAAM,MAAM,aAAa,MAAM,CAAC;AAC5D,YAAM,SAAS,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,EAAE,IAAI,UAAU;AACxE,YAAM,OAAO,SAAS,MAAM,UAAgB,QAAQ,MAAM,QAAQ,IAAI;AACtE,YAAM,QAAQ,YAAY,YAAY,IAAI,MAAM,SAAS,CAAC,CAAC;AAC3D,YAAM,OAAO,MAAM,YAAY;AAC/B,YAAM,WAAW,CAACC,UAAiB,SAAS,GAAG,IAAI,GAAG,KAAK,SAAS,GAAG,IAAI,MAAM,GAAG,cAAc,mBAAmBA,KAAI,CAAC,IAAI,CAAC,KAAK,CAAC;AAErI,UAAI,SAAS,QAAS,KAAK,SAAS,YAAY,KAAK,SAAS,UAAU,KAAK,SAAS,aAAc,KAAK,aAAa,YAAY,IAAI,aAAa,IAAI,OAAO,MAAM,KAAK,MAAO,QAAO,SAAS,gBAAgB;AAChN,YAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,UAAI,CAAC,KAAM,QAAO,SAAS,IAAI,aAAa,IAAI,OAAO,MAAM,kBAAkB,cAAc,kBAAkB;AAC/G,YAAM,IAAI,IAAI,gBAAgB,EAAE,MAAM,OAAO,KAAK,OAAO,cAAc,GAAG,SAAS,OAAO,CAAC,GAAG,QAAQ,aAAa,QAAQ,GAAG,CAAC;AAC/H,UAAI,KAAK,SAAS,WAAW;AAE3B,cAAM,OAAO,MAAM,WAAW,OAAO;AACrC,YAAI,cAAc,KAAM,QAAO,SAAS,iBAAiB;AACzD,cAAMC,QAAO,MAAM,IAAI,SAAS,OAAO,8BAA8B,QAAQ,aAAa,CAAC,IAAI,QAAW,QAAW,KAAK,KAAK;AAC/H,YAAIA,MAAK,MAAO,QAAO,SAASA,MAAK,MAAM,IAAI;AAC/C,cAAMC,KAAI,MAAM,OAAOD,MAAK,OAAO,MAAM,KAAK,OAAO,GAAG,SAAS,MAAS;AAC1E,YAAIC,OAAM,KAAM,QAAO,SAAS,aAAa;AAC7C,eAAO,SAAS,MAAM,CAAC,GAAI,MAAM,MAAM,SAASA,IAAG,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,CAAC,GAAI,KAAK,CAAC;AAAA,MACzG;AACA,UAAI,KAAK,SAAS,QAAQ;AAExB,cAAM,OAAO,MAAM,WAAW,OAAO;AACrC,YAAI,cAAc,KAAM,QAAO,SAAS,iBAAiB;AACzD,cAAM,SAAS,MAAM,IAAI,SAAS,OAAO,uBAAuB,QAAQ,kBAAkB,CAAC,IAAI,QAAW,QAAW,KAAK,KAAK;AAC/H,YAAI,OAAO,MAAO,QAAO,SAAS,OAAO,MAAM,IAAI;AACnD,cAAM,IAAI,IAAI,QAAQ,KAAK,OAAO;AAClC,UAAE,OAAO,cAAc,KAAK;AAC5B,eAAO,SAAS,GAAG,IAAI,GAAG,KAAK,SAAS,GAAG,IAAI,MAAM,GAAG,UAAU,mBAAmB,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;AAAA,MACzH;AACA,YAAM,OAAO,MAAM,IAAI,SAAS,OAAO,mBAAmB,QAAQ,aAAa,CAAC,IAAI,QAAW,QAAW,QAAW,KAAK,aAAa,IAAI;AAC3I,UAAI,KAAK,MAAO,QAAO,SAAS,KAAK,MAAM,IAAI;AAC/C,YAAM,IAAI,MAAM,OAAO,KAAK,IAAI;AAChC,UAAI,MAAM,KAAM,QAAO,SAAS,aAAa;AAC7C,aAAO,SAAS,MAAM,CAAC,GAAI,MAAM,MAAM,SAAS,GAAG,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,CAAC,GAAI,KAAK,CAAC;AAAA,IACzG;AAGA,QAAI,MAAM,WAAW,qBAAqB,KAAK,CAAC,MAAM;AACpD,YAAM,WAAW,WAAW,MAAM,MAAM,sBAAsB,MAAM,CAAC;AACrE,UAAI,CAAC,YAAY,KAAK,QAAQ,EAAG,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AACjF,YAAM,WAAW,UAAU,IAAI,aAAa,IAAI,WAAW,GAAG,WAAW;AACzE,YAAMJ,UAAS,CAAC,SAAiB,SAAS,GAAG,QAAQ,GAAG,SAAS,SAAS,GAAG,IAAI,MAAM,GAAG,cAAc,mBAAmB,IAAI,CAAC,EAAE;AAClI,YAAM,OAAO,MAAM,WAAW,OAAO;AACrC,UAAI,cAAc,KAAM,QAAOA,QAAO,iBAAiB;AACvD,YAAMC,YAAW,GAAG,QAAQ,aAAa,QAAQ;AACjD,YAAM,UAAU,MAAM,IAAI,SAAS,OAAO,8BAA8B,QAAQ,iBAAiB,mBAAmB,GAAG,SAAS,OAAO,CAAC,GAAGA,SAAQ,EAAE,CAAC,IAAI,QAAWA,WAAU,KAAK,KAAK;AACzL,UAAI,QAAQ,SAAS,OAAO,QAAQ,MAAM,iBAAiB,SAAU,QAAOD,QAAO,QAAQ,OAAO,QAAQ,sBAAsB;AAChI,YAAM,OAAa,EAAE,MAAM,WAAW,OAAO,OAAO,QAAQ,KAAK,SAAS,EAAE,GAAG,UAAU,SAAS;AAClG,aAAO,SAAS,QAAQ,KAAK,cAAc,CAAC,GAAG,KAAK,QAAQ,aAAa,GAAG,YAAY,YAAY,MAAM,KAAK,OAAO,MAAM,UAAU,CAAC,CAAC,GAAG,MAAM,SAAS,YAAY,CAAC,CAAC,CAAC;AAAA,IAC3K;AAGA,QAAI,MAAM,WAAW,sBAAsB,KAAK,CAAC,MAAM;AACrD,YAAM,WAAW,WAAW,MAAM,MAAM,uBAAuB,MAAM,CAAC;AACtE,UAAI,CAAC,YAAY,KAAK,QAAQ,EAAG,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AACjF,YAAM,WAAW,UAAU,IAAI,aAAa,IAAI,WAAW,GAAG,WAAW;AACzE,YAAMA,UAAS,CAAC,SAAiB,SAAS,GAAG,QAAQ,GAAG,SAAS,SAAS,GAAG,IAAI,MAAM,GAAG,cAAc,mBAAmB,IAAI,CAAC,EAAE;AAClI,YAAM,OAAO,MAAM,WAAW,OAAO;AACrC,UAAI,cAAc,KAAM,QAAOA,QAAO,iBAAiB;AACvD,YAAMC,YAAW,GAAG,QAAQ,aAAa,QAAQ;AACjD,YAAM,UAAU,MAAM,IAAI,SAAS,OAAO,uBAAuB,QAAQ,sBAAsB,mBAAmB,GAAG,SAAS,OAAO,CAAC,GAAGA,SAAQ,EAAE,CAAC,IAAI,QAAWA,WAAU,KAAK,KAAK;AACvL,UAAI,QAAQ,SAAS,OAAO,QAAQ,MAAM,iBAAiB,SAAU,QAAOD,QAAO,QAAQ,OAAO,QAAQ,sBAAsB;AAChI,YAAM,OAAa,EAAE,MAAM,QAAQ,OAAO,OAAO,QAAQ,KAAK,SAAS,EAAE,GAAG,UAAU,SAAS;AAC/F,aAAO,SAAS,QAAQ,KAAK,cAAc,CAAC,GAAG,KAAK,QAAQ,aAAa,GAAG,YAAY,YAAY,MAAM,KAAK,OAAO,MAAM,UAAU,CAAC,CAAC,GAAG,MAAM,SAAS,YAAY,CAAC,CAAC,CAAC;AAAA,IAC3K;AAGA,QAAI,UAAU,oBAAoB,CAAC,MAAM;AACvC,YAAM,OAAO,MAAM,WAAW,OAAO;AACrC,UAAI,cAAc,KAAM,QAAO,KAAK;AACpC,YAAM,MAAM,MAAM,IAAI,SAAS,OAAO,uBAAuB,QAAW,QAAW,KAAK,KAAK;AAC7F,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,SAAS,QAAW,KAAK,OAAO;AACpG,YAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,IAAI,IAAI,OAAO,CAAC;AACnD,aAAO,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC,OAAY,EAAE,UAAU,OAAO,EAAE,YAAY,EAAE,GAAG,OAAO,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,OAAO,EAAE,QAAQ,EAAE,GAAG,UAAU,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,KAAK,OAAO;AAAA,IAC9M;AACA,QAAI,UAAU,kBAAkB,CAAC,MAAM;AACrC,YAAM,OAAO,MAAM,WAAW,OAAO;AACrC,UAAI,cAAc,KAAM,QAAO,KAAK;AACpC,YAAM,MAAM,MAAM,IAAI,SAAS,OAAO,iCAAiC,QAAW,QAAW,KAAK,KAAK;AACvG,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,SAAS,QAAW,KAAK,OAAO;AACpG,YAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,IAAI,IAAI,OAAO,CAAC;AACnD,aAAO,KAAK,EAAE,UAAU,KAAK,IAAI,SAAS,EAAE,GAAG,KAAK,KAAK,OAAO;AAAA,IAClE;AAEA,QAAI,UAAU,gBAAgB,CAAC,MAAM;AACnC,YAAM,OAAO,MAAM,WAAW,OAAO;AACrC,UAAI,cAAc,KAAM,QAAO,KAAK;AACpC,YAAM,MAAM,MAAM,IAAI,SAAS,OAAO,sBAAsB,QAAW,QAAW,KAAK,KAAK;AAC5F,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,SAAS,QAAW,KAAK,OAAO;AACpG,YAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,IAAI,IAAI,OAAO,CAAC;AACnD,aAAO,KAAK,EAAE,QAAQ,KAAK,IAAI,OAAO,EAAE,GAAG,KAAK,KAAK,OAAO;AAAA,IAC9D;AAGA,SAAK,UAAU,uBAAuB,UAAU,+BAA+B,UAAU,8BAA8B,CAAC,MAAM;AAC5H,YAAM,OAAO,MAAM,WAAW,OAAO;AACrC,UAAI,cAAc,KAAM,QAAO,KAAK;AACpC,UAAI,OAAO;AACX,UAAI,UAAU,qBAAqB;AACjC,cAAM,KAAK,IAAI,aAAa,IAAI,IAAI,KAAK;AACzC,YAAI,CAACH,MAAK,KAAK,EAAE,EAAG,QAAO,QAAQ,KAAK,wBAAwB,2BAA2B,QAAW,KAAK,OAAO;AAClH,gBAAQ,IAAI,EAAE,IAAI,MAAM,SAAS,QAAQ,IAAI,UAAU,SAAS;AAAA,MAClE,WAAW,IAAI,aAAa,IAAI,QAAQ,GAAG;AACzC,gBAAQ,WAAW,mBAAmB,IAAI,aAAa,IAAI,QAAQ,CAAE,CAAC;AAAA,MACxE;AACA,YAAM,MAAM,MAAM,IAAI,SAAS,OAAO,MAAM,QAAW,QAAW,KAAK,KAAK;AAC5E,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,SAAS,QAAW,KAAK,OAAO;AACpG,YAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,IAAI,IAAI,OAAO,CAAC;AACnD,UAAI,UAAU,oBAAqB,QAAO,KAAK,EAAE,eAAe,KAAK,IAAI,MAAM,EAAE,GAAG,KAAK,KAAK,OAAO;AACrG,UAAI,UAAU,0BAA2B,QAAO,KAAK,EAAE,OAAO,KAAK,IAAI,SAAS,EAAE,GAAG,KAAK,KAAK,OAAO;AACtG,aAAO,KAAK,EAAE,SAAS,KAAK,IAAI,WAAW,EAAE,GAAG,KAAK,KAAK,OAAO;AAAA,IACnE;AAEA,QAAI,UAAU,qBAAqB,CAAC,MAAM;AACxC,YAAM,OAAO,MAAM,WAAW,OAAO;AACrC,UAAI,cAAc,KAAM,QAAO,KAAK;AACpC,YAAM,MAAM,MAAM,IAAI,SAAS,OAAO,wBAAwB,QAAW,QAAW,KAAK,KAAK;AAC9F,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,SAAS,QAAW,KAAK,OAAO;AACpG,aAAO,KAAK,UAAU,IAAI,IAAI,GAAG,KAAK,KAAK,OAAO;AAAA,IACpD;AACA,SAAK,UAAU,SAAS,UAAU,kBAAkB,UAAU,gBAAgB,CAAC,MAAM;AACnF,YAAM,OAAO,MAAM,WAAW,OAAO;AACrC,UAAI,cAAc,KAAM,QAAO,KAAK;AACpC,YAAM,MAAM,MAAM,IAAI,SAAS,OAAO,UAAU,QAAQ,gBAAgB,UAAU,cAAc,sBAAsB,wBAAwB,QAAW,QAAW,KAAK,KAAK;AAC9K,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,SAAS,QAAW,KAAK,OAAO;AAEpG,UAAI,UAAU,aAAa;AACzB,cAAM,OAAO,MAAM,QAAQ,IAAI,MAAM,OAAO,IAAI,IAAI,KAAK,UAAU,CAAC;AACpE,eAAO,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC,OAAY,EAAE,MAAM,OAAO,EAAE,QAAQ,EAAE,GAAG,SAAS,OAAO,EAAE,WAAW,EAAE,GAAG,KAAK,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,KAAK,OAAO;AAAA,MAChK;AACA,UAAI,UAAU,gBAAgB;AAC5B,cAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,IAAI,IAAI,OAAO,CAAC;AACnD,eAAO,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC,OAAY,EAAE,QAAQ,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,OAAO,EAAE,MAAM,EAAE,GAAG,WAAW,OAAO,EAAE,cAAc,EAAE,GAAG,WAAW,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,KAAK,OAAO;AAAA,MAC/M;AACA,aAAO,KAAK,EAAE,SAAS,UAAU,IAAI,IAAI,EAAE,GAAG,KAAK,KAAK,OAAO;AAAA,IACjE;AAIA,QAAI,UAAU,8BAA8B,CAAC,MAAM;AACjD,YAAM,SAAS,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,EAAE,IAAI,UAAU;AACxE,YAAM,OAAO,SAAS,MAAM,UAAgB,QAAQ,MAAM,QAAQ,IAAI;AACtE,UAAI,SAAS,QAAQ,KAAK,SAAS,MAAO,QAAO,QAAQ,KAAK,gBAAgB,qDAAqD;AACnI,UAAI;AACJ,UAAI;AACF,mBAAW,MAAM,QAAQ,GAAG,MAAM,4BAA4B;AAAA,UAC5D,SAAS,EAAE,gBAAgB,UAAU,GAAG,eAAe,KAAK,OAAO,QAAQ,oBAAoB;AAAA,UAC/F,QAAQ,QAAQ;AAAA,QAClB,CAAC;AAAA,MACH,QAAQ;AACN,eAAO,QAAQ,KAAK,eAAe,8BAA8B;AAAA,MACnE;AACA,UAAI,CAAC,SAAS,MAAM,CAAC,SAAS,MAAM;AAClC,cAAMQ,KAAK,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AACjD,eAAO,QAAQ,SAAS,QAAQ,OAAOA,IAAG,SAAS,CAAC,GAAG,QAAQ,OAAO,GAAG,OAAOA,IAAG,SAAS,CAAC,GAAG,WAAW,qCAAqC,CAAC;AAAA,MACnJ;AACA,aAAO,IAAI,SAAS,SAAS,MAAM;AAAA,QACjC,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,qBAAqB,iBAAiB,sBAAsB,qBAAqB,KAAK;AAAA,MACnH,CAAC;AAAA,IACH;AAEA,QAAI,CAAC,KAAM,QAAO,IAAI,SAAS,sBAAsB,EAAE,QAAQ,KAAK,SAAS,EAAE,OAAO,OAAO,EAAE,CAAC;AAChG,QAAI,CAAC,WAAW,OAAO,EAAG,QAAO,QAAQ,KAAK,cAAc,kDAAkD;AAE9G,QAAI,UAAU,aAAa;AACzB,YAAM,EAAE,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO;AACzC,UAAI,UAAU,MAAM;AAClB,cAAM,OAAO,MAAM,WAAW,IAAI,gBAAgB,EAAE,WAAW,UAAU,OAAO,MAAM,GAAG,CAAC,CAAC;AAC3F,cAAM,QAAQ,GAAG,MAAM,oBAAoB,EAAE,QAAQ,QAAQ,SAAS,EAAE,gBAAgB,oCAAoC,GAAG,MAAM,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAClK,iBAAS,OAAO,MAAM,EAAE;AAAA,MAC1B;AACA,YAAM,IAAI,IAAI,QAAQ;AACtB,iBAAW,KAAK,WAAW,YAAY,MAAM,SAAS,CAAC,GAAG,GAAG,EAAG,GAAE,OAAO,cAAc,CAAC;AACxF,aAAO,KAAK,EAAE,QAAQ,aAAa,GAAG,KAAK,CAAC;AAAA,IAC9C;AAEA,UAAM,IAAI,MAAM,KAAK,OAAO;AAC5B,QAAI,MAAM,KAAM,QAAO,QAAQ,KAAK,eAAe,wBAAwB;AAI3E,QAAI,UAAU,yBAAyB;AACrC,YAAM,MAAM,WAAW,EAAE,KAAK;AAC9B,UAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,yBAAyB,EAAE,OAAO,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACjG,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,OAAO;AAC3E,YAAM,IAAI,IAAI,MAAM;AACpB,aAAO,KAAK,IAAI,EAAE,QAAQ,SAAS,YAAY,EAAE,IAAI,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,EAAE,gBAAgB,EAAE,GAAG,UAAU,EAAE,aAAa,KAAK,EAAE,IAAI,EAAE,QAAQ,OAAO,CAAC;AAAA,IACvK;AAGA,QAAI,UAAU,sBAAsB;AAClC,UAAI,CAAC,KAAM,QAAO,IAAI,SAAS,sBAAsB,EAAE,QAAQ,KAAK,SAAS,EAAE,OAAO,OAAO,EAAE,CAAC;AAChG,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,sBAAsB,CAAC,CAAC;AAC/D,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,OAAO;AAC3E,aAAO,SAAS,SAAS,IAAI,IAAI;AAAA,IACnC;AAEA,QAAI,UAAU,kBAAkB;AAC9B,YAAM,MAAM,aAAa,WAAW,EAAE,KAAK,GAAG,cAAc,EAAE,QAAQ,CAAC;AACvE,UAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,YAAM,WAAW,MAAM,EAAE,QAAQ;AACjC,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,kBAAkB,EAAE,OAAO,OAAO,EAAE,KAAK,EAAE,KAAK,GAAG,UAAU,EAAE,SAAS,GAAG,QAAW,QAAW,QAAQ;AAChJ,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,OAAO;AAC3E,aAAO,SAAS,SAAS,IAAI,MAAM,QAAQ;AAAA,IAC7C;AAEA,QAAI,UAAU,gBAAgB;AAC5B,YAAM,MAAM,UAAU,EAAE,IAAI;AAC5B,UAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,YAAM,SAAS,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,EAAE,IAAI,UAAU;AACxE,YAAM,OAAO,SAAS,MAAM,UAAgB,QAAQ,MAAM,QAAQ,IAAI;AACtE,UAAI,SAAS,QAAQ,KAAK,SAAS,MAAO,QAAO,QAAQ,KAAK,gBAAgB,qDAAqD;AACnI,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,0BAA0B,EAAE,WAAW,KAAK,OAAO,MAAM,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAW,QAAW,KAAK,aAAa,IAAI;AACrK,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,SAAS,MAAM;AACnF,aAAO,SAAS,SAAS,IAAI,MAAM,CAAC,YAAY,YAAY,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;AAAA,IACrF;AAMA,QAAI,UAAU,uBAAuB,UAAU,4BAA4B;AACzE,YAAM,SAAS,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,EAAE,IAAI,UAAU;AACxE,YAAM,OAAO,SAAS,MAAM,UAAgB,QAAQ,MAAM,QAAQ,IAAI;AACtE,UAAI,SAAS,QAAQ,KAAK,SAAS,MAAO,QAAO,QAAQ,KAAK,gBAAgB,qDAAqD;AACnI,UAAI,UAAU,qBAAqB;AACjC,cAAMC,OAAM,MAAM,IAAI,SAAS,QAAQ,qBAAqB,EAAE,WAAW,KAAK,MAAM,GAAG,QAAW,QAAW,KAAK,aAAa,IAAI;AACnI,YAAIA,KAAI,MAAO,QAAO,QAAQA,KAAI,QAAQA,KAAI,MAAM,MAAMA,KAAI,MAAM,OAAO;AAC3E,eAAO,KAAK,EAAE,QAAQ,QAAQ,QAAQ,OAAOA,KAAI,MAAM,UAAU,CAAC,EAAE,CAAC;AAAA,MACvE;AACA,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,0BAA0B,EAAE,WAAW,KAAK,OAAO,MAAM,KAAK,GAAG,QAAW,QAAW,KAAK,aAAa,IAAI;AACpJ,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,OAAO;AAC3E,aAAO,SAAS,SAAS,IAAI,MAAM,CAAC,YAAY,YAAY,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;AAAA,IACrF;AAEA,QAAI,UAAU,0BAA0B,UAAU,uBAAuB,UAAU,sBAAsB;AACvG,YAAM,SAAS,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,EAAE,IAAI,UAAU;AACxE,YAAM,OAAO,SAAS,MAAM,UAAgB,QAAQ,MAAM,QAAQ,IAAI;AACtE,UAAI,SAAS,QAAQ,KAAK,SAAS,MAAO,QAAO,QAAQ,KAAK,gBAAgB,qDAAqD;AACnI,UAAI,UAAU,wBAAwB;AACpC,cAAMA,OAAM,MAAM,IAAI,SAAS,QAAQ,wBAAwB,EAAE,WAAW,KAAK,MAAM,GAAG,QAAW,QAAW,KAAK,aAAa,IAAI;AACtI,YAAIA,KAAI,MAAO,QAAO,QAAQA,KAAI,QAAQA,KAAI,MAAM,MAAMA,KAAI,MAAM,OAAO;AAC3E,cAAM,IAAIA,KAAI,MAAM;AACpB,cAAM,OAAOA,KAAI,MAAM;AACvB,cAAM,OAAOA,KAAI,MAAM;AACvB,eAAO,KAAK;AAAA,UAAE,QAAQ;AAAA,UAAM,MAAMA,KAAI,MAAM,SAAS;AAAA,UAAM,OAAO,IAAI,EAAE,QAAQ,OAAO,EAAE,UAAU,EAAE,GAAG,SAAS,OAAO,EAAE,WAAW,KAAK,EAAE,IAAI;AAAA,UAC9I,MAAM,OAAO,EAAE,SAAS,OAAO,KAAK,WAAW,CAAC,EAAE,IAAI;AAAA,UAAM,OAAO,OAAO,EAAE,IAAI,OAAO,KAAK,MAAM,EAAE,EAAE,IAAI;AAAA,QAAK,CAAC;AAAA,MACpH;AACA,UAAI,UAAU,sBAAsB;AAClC,cAAMA,OAAM,MAAM,IAAI,SAAS,QAAQ,sBAAsB,EAAE,WAAW,KAAK,MAAM,GAAG,QAAW,QAAW,KAAK,aAAa,IAAI;AACpI,YAAIA,KAAI,MAAO,QAAO,QAAQA,KAAI,QAAQA,KAAI,MAAM,MAAMA,KAAI,MAAM,OAAO;AAC3E,eAAO,KAAK,EAAE,QAAQ,QAAQ,QAAQ,OAAOA,KAAI,MAAM,WAAW,EAAE,EAAE,CAAC;AAAA,MACzE;AACA,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,qBAAqB,EAAE,WAAW,KAAK,MAAM,GAAG,QAAW,QAAW,KAAK,aAAa,IAAI;AACnI,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,OAAO;AAC3E,aAAO,KAAK,EAAE,QAAQ,QAAQ,QAAQ,OAAO,IAAI,MAAM,WAAW,EAAE,GAAG,SAAS,OAAO,IAAI,MAAM,WAAW,KAAK,EAAE,CAAC;AAAA,IACtH;AAEA,QAAI,UAAU,kBAAkB;AAC9B,YAAM,MAAM,aAAa,UAAU,EAAE,IAAI,GAAG,WAAW,EAAE,KAAK,GAAG,MAAM,mBAAmB,SAAS,EAAE,QAAQ,GAAG,kBAAkB,EAAE,YAAY,CAAC;AACjJ,UAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,YAAM,QAAQ,OAAO,EAAE,KAAK,EAAE,KAAK;AAEnC,YAAM,eAAe,OAAO,EAAE,iBAAiB,YAAY,EAAE,aAAa,KAAK,MAAM,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,aAAa,KAAK,EAAE,EAAE,IAAI,CAAC;AAE/I,YAAM,QAAQ,EAAE,GAAI,EAAE,gBAAgB,OAAO,EAAE,cAAc,KAAK,IAAI,CAAC,GAAI,GAAI,EAAE,YAAY,OAAO,EAAE,aAAa,WAAW,EAAE,UAAU,EAAE,SAAS,IAAI,CAAC,EAAG;AAC7J,YAAM,OAAO,MAAM,IAAI,SAAS,QAAQ,qBAAqB,EAAE,OAAO,UAAU,EAAE,UAAU,cAAc,OAAO,EAAE,SAAS,WAAW,EAAE,KAAK,KAAK,IAAI,IAAI,GAAG,cAAc,GAAG,MAAM,GAAG,MAAM,WAAW;AACzM,UAAI,KAAK,MAAO,QAAO,QAAQ,KAAK,QAAQ,KAAK,MAAM,MAAM,KAAK,MAAM,SAAS,KAAK,MAAM,SAAS,kBAAkB,aAAa,QAAW,QAAW,KAAK,MAAM,OAAO;AAE5K,UAAI,KAAK,MAAM,0BAA0B,KAAM,QAAO,KAAK,EAAE,QAAQ,yBAAyB,MAAM,CAAC;AACrG,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,kBAAkB,EAAE,OAAO,UAAU,EAAE,SAAS,CAAC;AACxF,UAAI,IAAI,SAAS,IAAI,MAAM,iBAAiB,KAAM,QAAO,KAAK,EAAE,QAAQ,yBAAyB,MAAM,CAAC;AACxG,aAAO,SAAS,SAAS,IAAI,IAAI;AAAA,IACnC;AAEA,QAAI,UAAU,oBAAoB;AAChC,YAAM,MAAM,WAAW,EAAE,KAAK;AAC9B,UAAI,IAAK,QAAO,QAAQ,GAAG;AAE3B,YAAM,IAAI,SAAS,QAAQ,2BAA2B,EAAE,OAAO,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa;AAC5G,aAAO,KAAK,EAAE,QAAQ,OAAO,CAAC;AAAA,IAChC;AAEA,QAAI,MAAM,WAAW,KAAK,GAAG;AAC3B,YAAM,OAAO,MAAM,WAAW,OAAO;AACrC,UAAI,cAAc,KAAM,QAAO,KAAK;AACpC,YAAM,KAAK,CAAC,MAAc,SAAmB,SAAS,WAAW,IAAI,SAAS,QAAQ,MAAM,SAAS,QAAW,KAAK,KAAK;AAC1H,YAAM,UAAU,CAAC,KAAwF,UACvG,QAAQ,IAAI,QAAQ,IAAI,MAAO,MAAM,IAAI,MAAO,SAAS,OAAO,KAAK,SAAS,IAAI,MAAO,OAAO;AAElG,YAAM,WAAW,OAAO,EAAE,aAAa,WAAW,EAAE,WAAW;AAE/D,UAAI,UAAU,OAAO;AACnB,cAAM,MAAM,UAAU,EAAE,IAAI;AAC5B,YAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,cAAM,MAAM,MAAM,GAAG,eAAe,EAAE,MAAM,OAAO,EAAE,SAAS,WAAW,EAAE,KAAK,KAAK,IAAI,GAAG,GAAG,OAAO;AACtG,YAAI,IAAI,MAAO,QAAO,QAAQ,KAAK,MAAM;AAEzC,cAAM,IAAI,KAAK;AACf,YAAI,KAAK,SAAS,MAAM;AACtB,gBAAM,QAAQ,MAAM,OAAO,EAAE,cAAc,KAAK,KAAK,IAAI,eAAe,KAAK,KAAK,IAAI,YAAY,KAAK,IAAI,GAAG,KAAK,KAAK,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,CAAC,EAAE,GAAG,KAAK,IAAI;AACzK,cAAI,UAAU,KAAM,YAAW,KAAK,MAAM,MAAM,SAAS,OAAO,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,CAAC,EAAG,GAAE,OAAO,cAAc,CAAC;AAAA,QACvI;AACA,eAAO,KAAK,EAAE,QAAQ,SAAS,SAAS,UAAU,IAAI,IAAI,EAAE,GAAG,KAAK,CAAC;AAAA,MACvE;AACA,UAAI,UAAU,oBAAoB;AAChC,cAAM,QAAQ,MAAM,QAAQ,EAAE,KAAK,IAAI,EAAE,MAAM,OAAO,CAAC,MAAe,OAAO,MAAM,QAAQ,IAAI,CAAC;AAChG,cAAM,MAAM,MAAM,GAAG,4BAA4B,EAAE,MAAM,CAAC;AAC1D,YAAI,IAAI,MAAO,QAAO,QAAQ,GAAG;AACjC,eAAO,KAAK,EAAE,QAAQ,WAAW,GAAG,KAAK,KAAK,OAAO;AAAA,MACvD;AACA,UAAI,UAAU,gBAAgB;AAC5B,cAAM,MAAM,MAAM,mBAAmB,SAAS,EAAE,WAAW;AAC3D,YAAI,IAAK,QAAO,QAAQ,KAAK,IAAI,MAAM,IAAI,SAAS,aAAa;AACjE,cAAM,MAAM,MAAM,GAAG,wBAAwB,EAAE,kBAAkB,UAAU,cAAc,EAAE,YAAY,CAAC;AACxG,YAAI,IAAI,MAAO,QAAO,QAAQ,KAAK,IAAI,MAAM,SAAS,mBAAmB,aAAa,IAAI,MAAM,SAAS,kBAAkB,gBAAgB,MAAS;AAGpJ,cAAM,OAAO,MAAM,OAAO,IAAI,OAAO,MAAM,KAAK,OAAO,GAAG,SAAS,MAAS;AAC5E,cAAM,IAAI,IAAI,QAAQ;AACtB,cAAM,MAAM,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AACrD,mBAAW,KAAK,SAAS,OAAO,MAAM,MAAM,SAAS,MAAM,GAAG,IAAI,WAAW,YAAY,MAAM,SAAS,CAAC,GAAG,GAAG,EAAG,GAAE,OAAO,cAAc,CAAC;AAC1I,eAAO,KAAK,EAAE,QAAQ,WAAW,UAAU,SAAS,KAAK,GAAG,KAAK,CAAC;AAAA,MACpE;AACA,UAAI,UAAU,iBAAiB;AAC7B,cAAM,MAAM,MAAM,GAAG,sBAAsB,EAAE,SAAS,CAAC;AACvD,YAAI,IAAI,MAAO,QAAO,QAAQ,KAAK,IAAI,MAAM,SAAS,qBAAqB,aAAa,MAAS;AAEjG,cAAM,KAAK,OAAO,IAAI,MAAM,MAAM,EAAE;AACpC,eAAO,KAAK,EAAE,QAAQ,WAAW,QAAQ,OAAO,IAAI,MAAM,UAAU,EAAE,GAAG,YAAY,OAAO,IAAI,MAAM,eAAe,EAAE,GAAG,IAAI,GAAG,WAAW,wBAAwB,IAAI,KAAK,GAAG,GAAG,KAAK,KAAK,OAAO;AAAA,MACtM;AACA,UAAI,UAAU,kBAAkB;AAC9B,cAAM,MAAM,UAAU,EAAE,IAAI;AAC5B,YAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,cAAM,MAAM,MAAM,GAAG,uBAAuB,EAAE,MAAM,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC3E,YAAI,IAAI,MAAO,QAAO,QAAQ,KAAK,MAAM;AACzC,eAAO,KAAK,EAAE,QAAQ,WAAW,eAAe,MAAM,QAAQ,IAAI,MAAM,cAAc,IAAI,IAAI,KAAK,eAAe,IAAI,MAAM,IAAI,CAAC,EAAE,GAAG,KAAK,KAAK,OAAO;AAAA,MACzJ;AACA,UAAI,UAAU,iBAAiB;AAC7B,cAAM,MAAM,MAAM,GAAG,sBAAsB,EAAE,OAAO,OAAO,EAAE,UAAU,WAAW,EAAE,QAAQ,IAAI,SAAS,OAAO,EAAE,YAAY,WAAW,EAAE,UAAU,OAAO,SAAS,CAAC;AACtK,YAAI,IAAI,MAAO,QAAO,QAAQ,KAAK,IAAI,MAAM,SAAS,qBAAqB,aAAa,IAAI,MAAM,SAAS,qBAAqB,UAAU,MAAS;AACnJ,eAAO,KAAK,EAAE,QAAQ,QAAQ,QAAQ,OAAO,IAAI,MAAM,WAAW,EAAE,GAAG,SAAS,OAAO,IAAI,MAAM,WAAW,EAAE,EAAE,GAAG,KAAK,KAAK,OAAO;AAAA,MACtI;AACA,UAAI,UAAU,wBAAwB;AACpC,cAAM,MAAM,UAAU,EAAE,IAAI;AAC5B,YAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,cAAM,MAAM,MAAM,GAAG,6BAA6B,EAAE,MAAM,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACjF,YAAI,IAAI,MAAO,QAAO,QAAQ,KAAK,MAAM;AACzC,eAAO,KAAK,EAAE,QAAQ,WAAW,eAAe,MAAM,QAAQ,IAAI,MAAM,cAAc,IAAI,IAAI,KAAK,eAAe,IAAI,MAAM,IAAI,CAAC,EAAE,GAAG,KAAK,KAAK,OAAO;AAAA,MACzJ;AACA,UAAI,UAAU,wBAAwB;AACpC,cAAM,MAAM,MAAM,GAAG,6BAA6B,EAAE,SAAS,CAAC;AAC9D,YAAI,IAAI,MAAO,QAAO,QAAQ,KAAK,IAAI,MAAM,SAAS,qBAAqB,aAAa,MAAS;AACjG,eAAO,KAAK,EAAE,QAAQ,UAAU,GAAG,KAAK,KAAK,OAAO;AAAA,MACtD;AACA,UAAI,UAAU,mBAAmB;AAC/B,cAAM,MAAM,MAAM,GAAG,2BAA2B,EAAE,SAAS,CAAC;AAC5D,YAAI,IAAI,MAAO,QAAO,QAAQ,KAAK,IAAI,MAAM,SAAS,qBAAqB,aAAa,MAAS;AACjG,eAAO,KAAK,EAAE,QAAQ,WAAW,GAAG,KAAK,KAAK,OAAO;AAAA,MACvD;AACA,UAAI,UAAU,0BAA0B;AACtC,cAAM,MAAM,MAAM,GAAG,kCAAkC,EAAE,SAAS,CAAC;AACnE,YAAI,IAAI,MAAO,QAAO,QAAQ,KAAK,IAAI,MAAM,SAAS,qBAAqB,aAAa,MAAS;AACjG,eAAO,KAAK,EAAE,QAAQ,WAAW,eAAe,MAAM,QAAQ,IAAI,MAAM,cAAc,IAAI,IAAI,KAAK,eAAe,IAAI,MAAM,IAAI,CAAC,EAAE,GAAG,KAAK,KAAK,OAAO;AAAA,MACzJ;AACA,UAAI,UAAU,aAAa;AACzB,cAAM,MAAM,WAAW,EAAE,KAAK;AAC9B,YAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,cAAM,QAAQ,OAAO,EAAE,KAAK,EAAE,KAAK;AACnC,cAAM,MAAM,MAAM,GAAG,qBAAqB,EAAE,OAAO,SAAS,CAAC;AAC7D,YAAI,IAAI,MAAO,QAAO,QAAQ,KAAK,IAAI,MAAM,SAAS,qBAAqB,aAAa,CAAC,iBAAiB,mBAAmB,aAAa,EAAE,SAAS,IAAI,MAAM,IAAI,IAAI,UAAU,MAAS;AAE1L,eAAO,KAAK,EAAE,QAAQ,QAAQ,MAAM,GAAG,KAAK,KAAK,OAAO;AAAA,MAC1D;AACA,UAAI,UAAU,yBAAyB;AACrC,cAAM,WAAW,OAAO,EAAE,aAAa,WAAW,EAAE,WAAW;AAC/D,YAAI,CAAC,YAAY,KAAK,QAAQ,EAAG,QAAO,QAAQ,KAAK,oBAAoB,iCAAiC,YAAY,KAAK,OAAO;AAClI,cAAM,MAAM,MAAM,GAAG,uBAAuB,QAAQ,IAAI,QAAW,QAAQ;AAC3E,YAAI,IAAI,MAAO,QAAO,QAAQ,GAAG;AACjC,eAAO,KAAK,EAAE,QAAQ,YAAY,SAAS,GAAG,KAAK,KAAK,OAAO;AAAA,MACjE;AAGA,UAAI,UAAU,0BAA0B;AACtC,cAAM,OAAO,EAAE,SAAS,YAAY,EAAE,SAAS,iBAAiB,EAAE,OAAO;AACzE,cAAM,MAAM,MAAM,GAAG,oCAAoC,EAAE,UAAU,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC,EAAG,CAAC;AAChG,YAAI,IAAI,MAAO,QAAO,QAAQ,KAAK,IAAI,MAAM,SAAS,qBAAqB,aAAa,MAAS;AACjG,cAAM,OAAa,EAAE,MAAM,SAAS,OAAO,OAAO,IAAI,MAAM,cAAc,EAAE,GAAG,UAAU,YAAY;AACrG,cAAM,IAAI,IAAI,QAAQ,KAAK,OAAO;AAClC,UAAE,OAAO,cAAc,YAAY,YAAY,MAAM,KAAK,OAAO,MAAM,UAAU,CAAC,CAAC,GAAG,MAAM,SAAS,eAAe,CAAC,CAAC;AACtH,eAAO,KAAK,EAAE,QAAQ,WAAW,SAAS,IAAI,MAAM,SAAS,aAAa,IAAI,MAAM,WAAW,KAAK,GAAG,KAAK,CAAC;AAAA,MAC/G;AACA,UAAI,UAAU,2BAA2B;AACvC,cAAM,SAAS,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,EAAE,IAAI,UAAU;AACxE,cAAM,OAAO,SAAS,MAAM,UAAgB,QAAQ,MAAM,QAAQ,IAAI;AACtE,YAAI,SAAS,QAAQ,KAAK,SAAS,QAAS,QAAO,QAAQ,KAAK,gBAAgB,kEAAkE,QAAW,KAAK,OAAO;AACzK,YAAI,CAAC,aAAa,EAAE,UAAU,EAAG,QAAO,QAAQ,KAAK,eAAe,sCAAsC,QAAW,KAAK,OAAO;AACjI,cAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,KAAK,KAAK,EAAE,MAAM,GAAG,EAAE,IAAI;AACvE,cAAM,MAAM,MAAM,GAAG,qCAAqC,EAAE,YAAY,KAAK,OAAO,UAAU,MAAM,YAAY,EAAE,WAAW,CAAC;AAC9H,cAAM,IAAI,IAAI,QAAQ,KAAK,OAAO;AAClC,UAAE,OAAO,cAAc,YAAY,YAAY,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC;AACrE,YAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,SAAS,wBAAwB,mBAAmB,IAAI,MAAM,MAAM,IAAI,MAAM,SAAS,wBAAwB,+CAA+C,IAAI,MAAM,SAAS,QAAW,CAAC;AACjP,eAAO,KAAK,EAAE,QAAQ,SAAS,SAAS,UAAU,IAAI,IAAI,EAAE,GAAG,KAAK,CAAC;AAAA,MACvE;AACA,UAAI,UAAU,uBAAuB;AACnC,cAAM,KAAK,OAAO,EAAE,OAAO,WAAW,EAAE,KAAK;AAC7C,YAAI,CAAC,mBAAmB,KAAK,EAAE,EAAG,QAAO,QAAQ,KAAK,mBAAmB,gCAAgC,QAAW,KAAK,OAAO;AAChI,cAAM,MAAM,MAAM,GAAG,iCAAiC,EAAE,IAAI,QAAW,QAAQ;AAC/E,YAAI,IAAI,MAAO,QAAO,QAAQ,GAAG;AACjC,eAAO,KAAK,EAAE,QAAQ,WAAW,GAAG,GAAG,KAAK,KAAK,OAAO;AAAA,MAC1D;AAEA,UAAI,UAAU,eAAe;AAC3B,cAAM,MAAM,aAAa,UAAU,EAAE,IAAI,GAAG,WAAW,EAAE,KAAK,GAAG,MAAM,mBAAmB,SAAS,EAAE,QAAQ,CAAC;AAC9G,YAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,cAAM,MAAM,MAAM,GAAG,8BAA8B,EAAE,OAAO,OAAO,EAAE,KAAK,EAAE,KAAK,GAAG,UAAU,EAAE,UAAU,cAAc,OAAO,EAAE,SAAS,WAAW,EAAE,KAAK,KAAK,IAAI,GAAG,CAAC;AACzK,YAAI,IAAI,MAAO,QAAO,QAAQ,KAAK,IAAI,MAAM,SAAS,kBAAkB,aAAa,OAAO;AAE5F,eAAO,SAAS,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,KAAK,OAAO,GAAG,SAAS,MAAS;AAAA,MACrF;AAGA,UAAI,UAAU,8BAA8B,UAAU,+BAA+B,UAAU,4BAA4B;AACzH,cAAM,MAAM,OAAO,EAAE,mBAAmB,WAAW,EAAE,iBAAiB;AACtE,YAAI,CAACT,MAAK,KAAK,GAAG,EAAG,QAAO,QAAQ,KAAK,wBAAwB,2BAA2B,QAAW,KAAK,OAAO;AACnH,cAAM,OAAO,6BAA6B,GAAG;AAC7C,YAAI,UAAU,4BAA4B;AACxC,gBAAM,MAAM,sBAAsB,EAAE,IAAI;AACxC,cAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,gBAAMS,OAAM,MAAM,GAAG,MAAM,EAAE,MAAM,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO;AACnE,cAAIA,KAAI,MAAO,QAAO,QAAQA,MAAKA,KAAI,MAAM,SAAS,qBAAqB,SAAS,MAAS;AAE7F,mBAAS,OAAO,KAAK,KAAK;AAC1B,iBAAO,KAAK,EAAE,QAAQ,WAAW,cAAc,OAAOA,KAAI,IAAI,EAAE,GAAG,KAAK,KAAK,OAAO;AAAA,QACtF;AACA,cAAM,MAAM,UAAU,8BAA8B,MAAM,GAAG,GAAG,IAAI,UAAU,IAAI,MAAM,GAAG,MAAM,QAAW,QAAQ;AACpH,YAAI,IAAI,MAAO,QAAO,QAAQ,GAAG;AAEjC,iBAAS,OAAO,KAAK,KAAK;AAC1B,eAAO,KAAK,EAAE,QAAQ,UAAU,8BAA8B,aAAa,WAAW,gBAAgB,IAAI,GAAG,KAAK,KAAK,OAAO;AAAA,MAChI;AAGA,UAAI,MAAM,WAAW,4BAA4B,GAAG;AAClD,cAAM,MAAM,OAAO,EAAE,mBAAmB,WAAW,EAAE,iBAAiB;AACtE,YAAI,CAACT,MAAK,KAAK,GAAG,EAAG,QAAO,QAAQ,KAAK,wBAAwB,2BAA2B,QAAW,KAAK,OAAO;AACnH,cAAM,OAAO,6BAA6B,GAAG;AAC7C,YAAI,UAAU,iCAAiC;AAC7C,gBAAM,MAAM,WAAW,EAAE,KAAK;AAC9B,cAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,gBAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,OAAO;AACnD,cAAI,SAAS,GAAI,QAAO,QAAQ,KAAK,gBAAgB,kBAAkB,QAAQ,KAAK,OAAO;AAK3F,gBAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,MAAM;AAAA,YAAE,OAAO,OAAO,EAAE,KAAK,EAAE,KAAK;AAAA,YAAG;AAAA,YAAM,MAAM,OAAO,EAAE,SAAS,WAAW,EAAE,KAAK,KAAK,IAAI;AAAA,YACrI,WAAW;AAAA,YAAU,UAAU;AAAA,YAAM,GAAI,OAAO,EAAE,WAAW,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,IAAI,CAAC;AAAA,UAAG,GAAG,MAAM,cAAc,KAAK,KAAK;AAElJ,cAAI,IAAI,OAAO,SAAS,iBAAkB,KAAI,MAAM,OAAO;AAC3D,cAAI,IAAI,MAAO,QAAO,QAAQ,KAAK,IAAI,MAAM,SAAS,iBAAiB,SAAS,OAAO;AACvF,iBAAO,KAAK,EAAE,QAAQ,SAAS,QAAQ,YAAY,IAAI,IAAI,EAAE,GAAG,KAAK,KAAK,OAAO;AAAA,QACnF;AACA,cAAM,OAAO,OAAO,EAAE,WAAW,WAAW,EAAE,SAAS;AACvD,YAAI,CAACA,MAAK,KAAK,IAAI,EAAG,QAAO,QAAQ,KAAK,kBAAkB,qBAAqB,QAAW,KAAK,OAAO;AACxG,YAAI,UAAU,kCAAkC;AAC9C,gBAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,OAAO;AACnD,cAAI,SAAS,GAAI,QAAO,QAAQ,KAAK,gBAAgB,kBAAkB,QAAQ,KAAK,OAAO;AAC3F,gBAAM,MAAM,MAAM,GAAG,GAAG,IAAI,IAAI,IAAI,IAAI,EAAE,KAAK,GAAG,KAAK;AACvD,cAAI,IAAI,MAAO,QAAO,QAAQ,KAAK,MAAM;AACzC,iBAAO,KAAK,EAAE,QAAQ,WAAW,QAAQ,MAAM,KAAK,GAAG,KAAK,KAAK,OAAO;AAAA,QAC1E;AACA,YAAI,UAAU,oCAAoC;AAChD,gBAAM,MAAM,MAAM,GAAG,GAAG,IAAI,IAAI,IAAI,IAAI,QAAW,QAAQ;AAC3D,cAAI,IAAI,MAAO,QAAO,QAAQ,GAAG;AACjC,mBAAS,OAAO,KAAK,KAAK;AAC1B,iBAAO,KAAK,EAAE,QAAQ,WAAW,QAAQ,KAAK,GAAG,KAAK,KAAK,OAAO;AAAA,QACpE;AACA,YAAI,UAAU,oCAAoC;AAChD,gBAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,GAAG,IAAI,IAAI,IAAI,WAAW,EAAE,WAAW,UAAU,GAAI,OAAO,EAAE,WAAW,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,IAAI,CAAC,EAAG,GAAG,MAAM,cAAc,KAAK,KAAK;AACnM,cAAI,IAAI,MAAO,QAAO,QAAQ,GAAG;AACjC,iBAAO,KAAK,EAAE,QAAQ,QAAQ,QAAQ,KAAK,GAAG,KAAK,KAAK,OAAO;AAAA,QACjE;AAAA,MACF;AACA,UAAI,UAAU,yBAAyB;AACrC,cAAM,KAAK,OAAO,EAAE,OAAO,WAAW,EAAE,KAAK;AAC7C,YAAI,CAAC,mBAAmB,KAAK,EAAE,EAAG,QAAO,QAAQ,KAAK,iBAAiB,kCAAkC,QAAW,KAAK,OAAO;AAChI,cAAM,MAAM,MAAM,GAAG,sBAAsB,EAAE,IAAI,QAAW,QAAQ;AACpE,YAAI,IAAI,MAAO,QAAO,QAAQ,GAAG;AACjC,eAAO,KAAK,EAAE,QAAQ,gBAAgB,GAAG,GAAG,KAAK,KAAK,OAAO;AAAA,MAC/D;AACA,UAAI,UAAU,oBAAoB;AAChC,cAAM,MAAM,MAAM,GAAG,wBAAwB,QAAW,QAAQ;AAChE,YAAI,IAAI,MAAO,QAAO,QAAQ,GAAG;AAEjC,cAAM,IAAI,IAAI,QAAQ;AACtB,mBAAW,KAAK,WAAW,YAAY,MAAM,SAAS,CAAC,GAAG,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,CAAC,EAAG,GAAE,OAAO,cAAc,CAAC;AAC/H,iBAAS,OAAO,KAAK,KAAK;AAC1B,eAAO,KAAK,EAAE,QAAQ,aAAa,GAAG,KAAK,CAAC;AAAA,MAC9C;AACA,aAAO;AAAA,IACT;AAEA,UAAM,UAAU,CAAC,MAA4B,OAAO,MAAM,YAAY,MAAM,MAAM,EAAE,UAAU;AAC9F,UAAM,UAAU,MAAM,QAAQ,KAAK,iBAAiB,4CAA4C;AAGhG,QAAI,UAAU,mBAAmB;AAC/B,UAAI,CAAC,QAAQ,EAAE,KAAK,EAAG,QAAO,QAAQ;AACtC,YAAM,MAAM,MAAM,mBAAmB,SAAS,EAAE,QAAQ;AACxD,UAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,4BAA4B,EAAE,OAAO,OAAO,EAAE,KAAK,GAAG,cAAc,EAAE,SAAS,CAAC;AACvH,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,SAAS,IAAI,MAAM,SAAS,kBAAkB,aAAa,QAAW,QAAW,IAAI,MAAM,OAAO;AACtK,aAAO,KAAK,EAAE,QAAQ,UAAU,CAAC;AAAA,IACnC;AACA,QAAI,UAAU,iBAAiB;AAC7B,UAAI,CAAC,QAAQ,EAAE,KAAK,EAAG,QAAO,QAAQ;AACtC,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,yBAAyB,EAAE,OAAO,OAAO,EAAE,KAAK,EAAE,CAAC;AAC1F,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,OAAO;AAG3E,UAAI,IAAI,MAAM,aAAc,QAAO,SAAS,SAAS,IAAI,IAAI;AAC7D,aAAO,KAAK,EAAE,QAAQ,WAAW,CAAC;AAAA,IACpC;AAKA,QAAI,UAAU,sBAAsB;AAClC,UAAI,CAAC,QAAQ,EAAE,KAAK,EAAG,QAAO,QAAQ,KAAK,iBAAiB,kDAAkD;AAC9G,YAAM,MAAM,MAAM,mBAAmB,SAAS,EAAE,QAAQ;AACxD,UAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,8BAA8B,EAAE,OAAO,OAAO,EAAE,KAAK,GAAG,UAAU,EAAE,SAAS,CAAC;AACrH,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,SAAS,IAAI,MAAM,SAAS,kBAAkB,aAAa,QAAW,QAAW,IAAI,MAAM,OAAO;AACtK,aAAO,SAAS,SAAS,IAAI,IAAI;AAAA,IACnC;AAIA,QAAI,UAAU,0BAA0B;AAGtC,YAAM,QAAQ,OAAO,EAAE,UAAU,YAAY,WAAW,EAAE,KAAK,MAAM,OAAO,EAAE,MAAM,KAAK,IAAI;AAC7F,YAAM,WAAW,MAAM,EAAE,QAAQ;AACjC,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,iCAAiC,UAAU,KAAK,EAAE,MAAM,IAAI,CAAC,GAAG,QAAW,QAAW,QAAQ;AACrI,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,OAAO;AAC3E,YAAM,OAAa,EAAE,MAAM,WAAW,OAAO,OAAO,IAAI,MAAM,cAAc,EAAE,GAAG,UAAU,aAAa,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC,EAAG;AAC1I,aAAO;AAAA,QAAK,EAAE,QAAQ,WAAW,SAAS,IAAI,MAAM,SAAS,aAAa,IAAI,MAAM,WAAW,KAAK;AAAA,QAAG;AAAA,QACrG,IAAI,QAAQ,EAAE,cAAc,YAAY,YAAY,MAAM,KAAK,OAAO,MAAM,UAAU,CAAC,CAAC,GAAG,MAAM,SAAS,eAAe,CAAC,EAAE,CAAC;AAAA,MAAC;AAAA,IAClI;AACA,QAAI,UAAU,2BAA2B;AACvC,YAAM,SAAS,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,EAAE,IAAI,UAAU;AACxE,YAAM,OAAO,SAAS,MAAM,UAAgB,QAAQ,MAAM,QAAQ,IAAI;AACtE,UAAI,SAAS,QAAQ,KAAK,SAAS,UAAW,QAAO,QAAQ,KAAK,gBAAgB,uDAAuD;AACzI,UAAI,CAAC,aAAa,EAAE,UAAU,EAAG,QAAO,QAAQ,KAAK,eAAe,6CAA6C;AACjH,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,kCAAkC,EAAE,YAAY,KAAK,OAAO,YAAY,EAAE,WAAW,GAAG,QAAW,QAAW,KAAK,aAAa,QAAQ,MAAM,EAAE,QAAQ,CAAC;AAChM,YAAM,QAAQ,YAAY,YAAY,IAAI,MAAM,SAAS,CAAC,CAAC;AAC3D,UAAI,IAAI,OAAO;AAEb,cAAMG,UAAS,CAAC,qBAAqB,mBAAmB,kBAAkB,WAAW,EAAE,SAAS,IAAI,MAAM,IAAI;AAC9G,eAAO,QAAQ,IAAI,QAAQA,UAAS,mBAAmB,IAAI,MAAM,MAAMA,UAAS,mFAAmF,IAAI,MAAM,SAAS,QAAW,IAAI,QAAQ,EAAE,cAAc,MAAM,CAAC,CAAC;AAAA,MACvO;AACA,aAAO,SAAS,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC;AAAA,IAC5C;AAKA,QAAI,UAAU,iCAAiC;AAC7C,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,iCAAiC,CAAC,CAAC;AAC1E,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,OAAO;AAC3E,aAAO,KAAK,EAAE,QAAQ,WAAW,UAAU,OAAO,IAAI,MAAM,aAAa,EAAE,GAAG,OAAO,OAAO,IAAI,MAAM,SAAS,EAAE,EAAE,CAAC;AAAA,IACtH;AACA,QAAI,UAAU,2BAA2B;AACvC,UAAI,OAAO,EAAE,eAAe,YAAY,EAAE,eAAe,GAAI,QAAO,QAAQ,KAAK,eAAe,2CAA2C;AAC3I,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,2BAA2B,EAAE,YAAY,EAAE,WAAW,GAAG,QAAW,QAAW,MAAM,EAAE,QAAQ,CAAC;AACvI,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,OAAO;AAC3E,aAAO,SAAS,SAAS,IAAI,IAAI;AAAA,IACnC;AAIA,QAAI,UAAU,uBAAuB;AACnC,YAAM,MAAM,WAAW,EAAE,KAAK;AAC9B,UAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,UAAI,MAAM,WAAW,OAAW,QAAO,QAAQ,KAAK,kBAAkB,2FAA2F;AAIjK,YAAM,QAAQ,OAAO,EAAE,KAAK,EAAE,KAAK;AAGnC,YAAM,OAAO,OAAO,EAAE,aAAa,WAAW,UAAU,EAAE,UAAU,WAAW,IAAI;AACnF,YAAM,WAAW,MAAM,EAAE,QAAQ;AAEjC,YAAM,QAAQ,CAAC,GAAI,SAAS,cAAc,CAAC,IAAI,CAAC,aAAa,mBAAmB,IAAI,CAAC,EAAE,GAAI,GAAI,WAAW,CAAC,YAAY,IAAI,CAAC,CAAE,EAAE,KAAK,GAAG;AACxI,YAAM,OAAO,UAAU,KAAK,MAAM,SAAS,GAAG,MAAM,MAAM,GAAG,MAAM,OAAO,SAAS,GAAG,IAAI,MAAM,GAAG,GAAG,KAAK;AAC3G,YAAM,IAAI,SAAS,QAAQ,+BAA+B,EAAE,OAAO,GAAI,EAAE,WAAW,OAAO,EAAE,gBAAgB,KAAK,IAAI,CAAC,EAAG,GAAG,IAAI;AAGjI,YAAM,OAAa,EAAE,MAAM,QAAQ,OAAO,OAAO,UAAU,MAAM,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC,EAAG;AACnG,aAAO,KAAK,EAAE,QAAQ,OAAO,GAAG,KAAK,IAAI,QAAQ,EAAE,cAAc,YAAY,YAAY,MAAM,KAAK,OAAO,MAAM,UAAU,CAAC,CAAC,GAAG,MAAM,SAAS,YAAY,CAAC,EAAE,CAAC,CAAC;AAAA,IAClK;AACA,QAAI,UAAU,uBAAuB;AACnC,YAAM,MAAM,UAAU,EAAE,IAAI;AAC5B,UAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,YAAM,SAAS,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,EAAE,IAAI,UAAU;AACxE,YAAM,OAAO,SAAS,MAAM,UAAgB,QAAQ,MAAM,QAAQ,IAAI;AACtE,UAAI,SAAS,QAAQ,KAAK,SAAS,OAAQ,QAAO,QAAQ,KAAK,gBAAgB,0DAA0D;AACzI,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,mCAAmC,EAAE,OAAO,KAAK,OAAO,MAAM,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAW,QAAW,KAAK,aAAa,IAAI;AAC1K,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,SAAS,MAAM;AACnF,aAAO,SAAS,SAAS,IAAI,MAAM,CAAC,YAAY,YAAY,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,KAAK,SAAS,CAAC;AAAA,IAClH;AACA,QAAI,UAAU,8BAA8B;AAC1C,UAAI,CAAC,QAAQ,EAAE,KAAK,EAAG,QAAO,QAAQ;AACtC,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,8BAA8B,EAAE,OAAO,OAAO,EAAE,KAAK,EAAE,GAAG,QAAW,QAAW,MAAM,EAAE,QAAQ,CAAC;AACxI,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,OAAO;AAC3E,aAAO,SAAS,SAAS,IAAI,IAAI;AAAA,IACnC;AACA,WAAO;AAAA,EACT;AAGA,iBAAe,QAAQ,SAAqC;AAC1D,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,SAAS,IAAI,aAAa,YAAY,IAAI,SAAS,WAAW,GAAG,QAAQ,GAAG;AAClF,UAAM,QAAQ,SAAS,uBAAuB,IAAI,SAAS,MAAM,SAAS,MAAM,CAAC,KAAK,MAAM;AAC5F,UAAMO,aAAY,SAAS,UAAa,IAAI,aAAa,UAAU,aAAa,QAAQ,WAAW,SAAS,QAAQ,WAAW;AAC/H,QAAI,YAAY,UAAU,MAAM;AAC9B,YAAM,UAAU,MAAM,aAAa;AACnC,UAAI,QAAS,QAAO,OAAO,SAAS,KAAK;AAAA,IAC3C;AACA,QAAI;AACF,aAAO,OAAO,MAAM,MAAM,OAAO,GAAG,OAAOA,UAAS;AAAA,IACtD,SAAS,KAAK;AACZ,UAAI,eAAe,mBAAoB,QAAO,OAAO,QAAQ,KAAK,kBAAkB,IAAI,OAAO,GAAG,KAAK;AAEvG,UAAI,EAAE,eAAe,kBAAkB,IAAI,SAAS,uBAAwB,OAAM;AAClF,YAAM,YAAY,QAAQ,WAAW,UAAU,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,gBAAgB;AACxG,aAAO,OAAO,YACV,IAAI,SAAS,4EAA4E,EAAE,QAAQ,KAAK,SAAS,EAAE,gBAAgB,4BAA4B,EAAE,CAAC,IAClK,QAAQ,KAAK,uBAAuB,mCAAmC,GAAG,KAAK;AAAA,IACrF;AAAA,EACF;AAQA,iBAAe,eAAyC;AACtD,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,cAAc,MAAM,QAAQ,KAAK,eAAe,sDAAsD;AAC5G,QAAI,SAAS,QAAQ,EAAG,QAAO,YAAY;AAC3C,QAAI;AACJ,UAAM,SAAS,IAAI,QAAmB,CAACb,aAAY;AAAE,cAAQ,WAAW,MAAMA,SAAQ,SAAS,GAAG,cAAc;AAAA,IAAE,CAAC;AACnH,QAAI;AACF,YAAM,QAAQ,SAAS,MAAM;AAC7B,YAAM,MAAM,MAAM,QAAQ,KAAK,CAAC,MAAM,KAAK,MAAM,IAAa,GAAG,SAAS,QAAQ,EAAE,KAAK,QAAO,KAAK,OAAgB,QAAkB,GAAG,MAAM,CAAC;AAEjJ,UAAI,QAAQ,SAAU,OAAM,QAAQ,KAAK,CAAC,OAAO,QAAQ,QAAQ,CAAC,CAAC;AACnE,aAAO,QAAQ,OAAO,OAAO,YAAY;AAAA,IAC3C,SAAS,GAAG;AACV,aAAQ,EAAwB,SAAS,kBACrC,QAAQ,KAAK,iBAAiB,8EAAgF,IAC9G,YAAY;AAAA,IAClB,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF;AAEA,iBAAe,MAAM,SAAqC;AACxD,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,QAAI,QAAQ,IAAI,aAAa,UAAU,aAAa,QAAQ,WAAW,SAAS,QAAQ,WAAW,QAAS,QAAO,KAAK,KAAK;AAC7H,QAAI,IAAI,aAAa,YAAY,CAAC,IAAI,SAAS,WAAW,GAAG,QAAQ,GAAG,EAAG,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AAC3H,UAAM,QAAQ,uBAAuB,IAAI,SAAS,MAAM,SAAS,MAAM,CAAC,KAAK;AAC7E,UAAM,MAAM,QAAQ,WAAW,SAAS,QAAQ,WAAW;AAE3D,UAAM,OAAO,MAAM,SAAS,SAAS,KAAK,KAAK;AAC/C,QAAI,SAAS,KAAM,QAAO;AAI1B,QAAI,UAAU,0BAA2B,QAAO,WAAW,OAAO;AAElE,QAAI,UAAU,YAAY,IAAK,QAAO,MAAM,SAAS,GAAG;AACxD,QAAI,UAAU,eAAe,IAAK,QAAO,SAAS,SAAS,GAAG;AAC9D,QAAI,UAAU,cAAc,OAAO,QAAQ,WAAW,QAAS,QAAO,OAAO,OAAO;AAEpF,QAAI,UAAU,cAAc,KAAK;AAC/B,YAAM,IAAI,MAAMA,SAAQ,OAAO;AAC/B,YAAM,IAAI,IAAI,QAAQ;AACtB,iBAAW,KAAK,EAAE,QAAS,GAAE,OAAO,cAAc,CAAC;AACnD,aAAO,KAAK,EAAE,SAAS,EAAE,UAAU,MAAM,SAAS,EAAE,OAAO,IAAI,MAAM,QAAQ,EAAE,OAAO,GAAG,KAAK,CAAC;AAAA,IACjG;AAGA,QAAI,UAAU,cAAc,KAAK;AAC/B,YAAM,IAAI,MAAMA,SAAQ,OAAO;AAC/B,YAAM,OAAO,UAAU,IAAI,aAAa,IAAI,WAAW,GAAG,WAAW;AACrE,UAAI,EAAE,WAAW,kBAAmB,QAAO,SAAS,KAAK,OAAO,IAAI,GAAG,EAAE,OAAO;AAChF,UAAI,EAAE,WAAW,UAAW,QAAO,IAAI,SAAS,4DAA4D,EAAE,QAAQ,IAAI,CAAC;AAC3H,aAAO,SAAS,MAAM,EAAE,OAAO;AAAA,IACjC;AAEA,QAAI,UAAU,cAAc,KAAK;AAC/B,YAAM,IAAI,IAAI,gBAAgB,EAAE,WAAW,SAAS,CAAC;AACrD,YAAM,OAAO,UAAU,IAAI,aAAa,IAAI,WAAW,GAAG,EAAE;AAC5D,UAAI,SAAS,GAAI,GAAE,IAAI,aAAa,GAAG,SAAS,OAAO,CAAC,GAAG,IAAI,EAAE;AACjE,YAAM,SAAS,IAAI,aAAa,IAAI,QAAQ;AAC5C,UAAI,UAAU,oBAAoB,KAAK,MAAM,EAAG,GAAE,IAAI,cAAc,MAAM;AAC1E,aAAO,SAAS,GAAG,MAAM,qBAAqB,CAAC,EAAE;AAAA,IACnD;AACA,WAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClD;AAEA,iBAAe,WAAW,SAAqC;AAC7D,QAAI,QAAQ,WAAW,OAAQ,QAAO,IAAI,SAAS,sBAAsB,EAAE,QAAQ,KAAK,SAAS,EAAE,OAAO,OAAO,EAAE,CAAC;AACpH,UAAM,UAAU,qBAAqB,SAAS,yBAAyB;AACvE,QAAI,QAAS,QAAO;AACpB,QAAI,CAAC,WAAW,OAAO,EAAG,QAAO,QAAQ,KAAK,cAAc,kDAAkD;AAC9G,UAAM,IAAI,MAAM,KAAK,OAAO;AAC5B,QAAI,MAAM,KAAM,QAAO,QAAQ,KAAK,eAAe,4BAA4B;AAC/E,UAAM,QAAQ,MAAM,WAAW,OAAO;AACtC,QAAI,cAAc,MAAO,QAAO,MAAM;AACtC,UAAM,MAAM,OAAO,EAAE,mBAAmB,WAAW,EAAE,iBAAiB;AACtE,QAAI,CAACG,MAAK,KAAK,GAAG,EAAG,QAAO,QAAQ,KAAK,wBAAwB,2BAA2B,QAAW,MAAM,OAAO;AACpH,UAAM,QAAQ,CAAC,MAAe,OAAO,MAAM,YAAY,MAAM,MAAM,EAAE,UAAU;AAC/E,QAAI,CAAC,MAAM,EAAE,QAAQ,KAAK,CAAC,MAAM,EAAE,MAAM,EAAG,QAAO,QAAQ,KAAK,eAAe,kCAAkC,QAAW,MAAM,OAAO;AACzI,UAAMW,cAAa,EAAE;AACrB,QAAIA,gBAAe,WAAc,OAAOA,gBAAe,YAAYA,gBAAe,QAAQ,MAAM,QAAQA,WAAU,IAAI;AACpH,aAAO,QAAQ,KAAK,eAAe,iCAAiC,QAAW,MAAM,OAAO;AAAA,IAC9F;AACA,QAAI;AACF,YAAM,IAAI,MAAM,OAAO,MAAM,OAAO;AAAA,QAClC,cAAc;AAAA,QAAK,UAAU,EAAE;AAAA,QAAoB,QAAQ,EAAE;AAAA,QAC7D,GAAIA,gBAAe,SAAY,EAAE,YAAYA,YAAsC,IAAI,CAAC;AAAA,QACxF,GAAI,OAAO,EAAE,eAAe,WAAW,EAAE,YAAY,EAAE,WAAW,IAAI,CAAC;AAAA,QACvE,GAAI,OAAO,EAAE,YAAY,WAAW,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,MAChE,CAAC;AACD,aAAO,KAAK,EAAE,QAAQ,WAAW,GAAG,EAAE,GAAG,KAAK,MAAM,OAAO;AAAA,IAC7D,SAAS,GAAG;AACV,YAAM,MAAM,aAAa,iBAAiB,IAAI,IAAI,eAAe,KAAK,eAAe,8BAA8B;AACnH,aAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,IAAI,QAAQ,QAAQ,sBAAsB,EAAE,GAAG,QAAW,MAAM,OAAO;AAAA,IAC9G;AAAA,EACF;AAEA,iBAAe,QAAQ,SAAkB;AACvC,UAAM,QAAQ,MAAM,KAAK,OAAO;AAEhC,UAAM,QAAQ,MAAM,UAAU,QAAQ,WAAW,MAAM,MAAM,CAAC,IAAI,OAAO,MAAM;AAC/E,QAAI,UAAU,QAAQ,MAAM,KAAK,EAAG,QAAO,EAAE,SAAS,UAAU,KAAK,EAAE;AACvE,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,UAAU,OAAO,SAAS;AAGxC,UAAM,OAAO,QAAQ,WAAW,UAAU,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,gBAAgB,eAChG,QAAQ,QAAQ,IAAI,QAAQ,KAAK,aAAa,SAAS,WAAW;AACrE,QAAI,CAAC,MAAM;AACT,aAAO,EAAE,UAAU,KAAK,EAAE,OAAO,mBAAmB,SAAS,MAAM,GAAG,KAAK,IAAI,QAAQ,EAAE,oBAAoB,MAAM,CAAC,CAAC,EAAE;AAAA,IACzH;AACA,UAAM,OAAO,IAAI,WAAW,IAAI;AAChC,UAAM,KAAK,UAAU,OAAO,KAAK,OAAO,IAAI,IAAI,GAAG,QAAQ,sBAAsB,mBAAmB,IAAI,CAAC;AACzG,WAAO,EAAE,UAAU,SAAS,EAAE,EAAE;AAAA,EAClC;AAIA,QAAM,SAAS,MAAM,iBAAiB,kBAAkB;AACxD,MAAI;AACJ,QAAM,gBAAyC,CAAC,IAAI,CAAC,MAAM;AAGzD,QAAI,OAAO;AACT,UAAI,YAAY,EAAE,aAAa,UAAa,EAAE,aAAa,SAAS,UAAU;AAC5E,cAAM,IAAI,kBAAkB,+BAA+B,SAAS,QAAQ,4BAA4B;AAAA,MAC1G;AACA,UAAI;AACJ,aAAO,OAAO,SAAS;AAErB,cAAM,KAAK,OAAO,aAAa,aAAa,eAAe,YAAY,CAAC,IAAI,MAAM;AAClF,YAAI,OAAO,SAAS,IAAI;AACtB,kBAAQ,EAAE,MAAM,IAAI,QAAQ,oBAAoB;AAAA,YAAE;AAAA,YAAQ,UAAU,UAAU,YAAY,GAAG,OAAO;AAAA,YAAI,UAAU,GAAG;AAAA,YAAU,OAAO,MAAM;AAAA,YAC1I,GAAI,WAAW,EAAE,UAAU,SAAS,SAAS,IAAI,CAAC;AAAA,YAAI,GAAG;AAAA,UAAE,CAAC,EAAE;AAAA,QAClE;AACA,eAAO,MAAM,OAAO,IAAI;AAAA,MAC1B;AAAA,IACF;AAGA,QAAI,YAAY,EAAE,aAAa,UAAa,EAAE,aAAa,SAAS,UAAU;AAC5E,YAAM,IAAI,kBAAkB,+BAA+B,SAAS,QAAQ,4BAA4B;AAAA,IAC1G;AACA,WAAO,oBAAoB;AAAA,MACzB;AAAA,MACA,UAAU,UAAU,YAAY,MAAM;AAAA,MACtC,UAAU,MAAM;AAAA,MAChB,OAAO,MAAM;AAAA,MACb,GAAI,WAAW,EAAE,UAAU,SAAS,SAAS,IAAI,CAAC;AAAA,MAClD,GAAG;AAAA,IACL,CAAC;AAAA,EACH;AACA,QAAM,UAA6B,CAAC,SAAS,IAAI,CAAC,MAChD,cAAc,SAAS,EAAE,QAAQ,KAAK,EAAE,OAAO,GAAG,SAAS,OAAO,CAAC,GAAG,IAAI,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,MAAM,EAAE,MAAM,KAAK,EAAE,KAAK,OAAO,CAAC;AAI3I,iBAAe,UAA6B;AAC1C,UAAM,IAAI,MAAM,QAAS;AACzB,UAAMC,QAAiB,CAAC,EAAE,GAAG,EAAE,WAAW,KAAK,EAAE,KAAK,KAAK,SAAS,KAAK,MAAM,CAAC;AAChF,QAAI,QAAS,YAAa,CAAAA,MAAK,KAAK,EAAE,GAAI,MAAM,QAAS,aAAc,KAAK,SAAS,KAAK,MAAM,CAAC;AACjG,QAAI,QAAS,CAAAA,MAAK,KAAK,IAAI,MAAM,QAAQ,UAAU,GAAG,IAAI;AAC1D,WAAO,IAAI,SAAS,KAAK,UAAU,EAAE,MAAAA,MAAK,CAAC,GAAG;AAAA,MAC5C,SAAS,EAAE,gBAAgB,mCAAmC,iBAAiB,mBAAmB,cAAc,GAAG;AAAA,IACrH,CAAC;AAAA,EACH;AACA,QAAM,UAAU,MAAa;AAC3B,UAAM,IAAI,kBAAkB,uHAAyH;AAAA,EACvJ;AACA,QAAM,UAAoB;AAAA,IACxB,SAAS,YAAY,QAAQ;AAAA,IAC7B,WAAW,aAAa,EAAE,MAAM,CAAC,EAAE;AAAA,IACnC,QAAQ,YAAY,QAAQ;AAAA,IAC5B,QAAQ,YAAY;AAAA,EACtB;AACA,QAAM,OAA+B,YAAY,UAAU;AAAA,IACzD;AAAA,IACA,MAAM,WAAW;AAAA,IACjB,MAAM;AAAA,IACN,QAAQ,MAAM,UAAU,QAAoB,OAAO,0BAA0B,mBAAmB,SAAS,MAAM,CAAC,EAAE;AAAA,EACpH,IAAI,YAAY,UAAU;AAAA,IACxB;AAAA,IACA,MAAM;AAAA,IACN,MAAM,OAAO;AAIX,aAAO,IAAI,SAAS,KAAK,UAAU,MAAM,QAAQ,UAAU,CAAC,GAAG;AAAA,QAC7D,SAAS,EAAE,gBAAgB,mCAAmC,iBAAiB,mBAAmB,cAAc,GAAG;AAAA,MACrH,CAAC;AAAA,IACH;AAAA,IACA,QAAQ,MAAM,UAAU,QAAoB,OAAO,0BAA0B,mBAAmB,SAAS,MAAM,CAAC,EAAE;AAAA,EACpH,IAAI;AAGJ,QAAM,aAAa,OAAiB;AAAA,IAClC;AAAA,IAAQ,UAAU,MAAM,YAAYpB,KAAI,iBAAiB,KAAK;AAAA,IAAI,QAAQ,EAAE,IAAI,UAAU,YAAY,MAAM,YAAYA,KAAI,kBAAkB,KAAK,IAAI,MAAM,OAAO;AAAA,IACpK;AAAA,IAAQ,WAAW;AAAA,IAAU,mBAAmB;AAAA,IAAU,UAAU,UAAU,CAAC,uBAAuB,OAAO,CAAC,IAAI,CAAC;AAAA,IAAG,eAAe,GAAG,QAAQ;AAAA,IAChJ,KAAK;AAAA,IACL,UAAU,WAAW,EAAE,MAAM,SAAS,MAAM,cAAc,SAAS,aAAa,wBAAwB,SAAS,qBAAqB,IAAI;AAAA,EAC5I;AAEA,SAAO;AAAA,IACL;AAAA,IACA,OAAO,YAAY;AACjB,UAAI,SAAU,QAAO,SAAS,MAAM;AACpC,YAAM,KAAK,WAAW;AACtB,aAAO,UAAU,EAAE,GAAG,IAAI,KAAK,EAAE,MAAM,MAAM,QAAQ,QAAQ,KAAK,YAAY,KAAK,EAAE,IAAI;AAAA,IAC3F;AAAA,IACA,YAAY,CAAC,WAAwB,WAAW,UAAU,MAAM;AAAA,IAChE;AAAA,IACA;AAAA,IACA,aAAa,OAAO,MAAM,MAAM,cAAc,CAAC,EAAE,IAAI;AAAA,IACrD,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA,SAAAK;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;AAAA,IACvB,SAAS,EAAE,QAAQ,UAAU,UAAU,aAAa,cAAc,WAAW;AAAA,EAC/E;AACF;AAOA,SAAS,QAAQ,QAAkD;AACjE,SAAO,CAAC,MAAM;AACZ,UAAM,MAAM,OAAO,GAAG,aAAa,WAAW,EAAE,SAAS,KAAK,IAAI;AAClE,QAAI,QAAQ,GAAI,QAAO,CAAC;AACxB,QAAI;AACF,YAAM,MAAM,IAAI,IAAI,IAAI,WAAW,GAAG,KAAK,CAAC,IAAI,WAAW,IAAI,IAAI,GAAG,MAAM,GAAG,GAAG,KAAK,GAAG;AAC1F,aAAO,IAAI,aAAa,YAAY,IAAI,aAAa,UAAU,EAAE,SAAS,IAAI,KAAK,IAAI,CAAC;AAAA,IAC1F,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AACF;AAGA,SAAS,QAAQ,KAAiJ;AAChK,QAAM,YAAY,MAAM,QAAQ,KAAK,SAAS,IAAI,IAAI,YAAY,CAAC;AACnE,QAAM,WAAW,MAAM,QAAQ,KAAK,gBAAgB,IAAI,IAAI,mBAAmB,CAAC;AAChF,SAAO;AAAA,IACL,WAAW,UAAU,IAAI,CAAC,OAAY,EAAE,MAAM,OAAO,EAAE,QAAQ,EAAE,GAAG,SAAS,OAAO,EAAE,WAAW,EAAE,GAAG,KAAK,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;AAAA,IACjI,iBAAiB,SAAS,IAAI,CAAC,OAAY,EAAE,KAAK,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,OAAO,EAAE,SAAS,EAAE,GAAG,UAAU,EAAE,aAAa,KAAK,EAAE;AAAA,EACvI;AACF;AAGA,SAAS,WAAW,SAA0B;AAC5C,QAAM,IAAI,QAAQ,YAAY;AAC9B,SAAO,0CAA0C,KAAK,CAAC,KAAK,6BAA6B,KAAK,CAAC,KAC7F,MAAM,SAAS,SAAS,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,KAAK,EAAE,WAAW,aAAa,KAAK,MAAM;AACnG;;;AC/mEA,SAAS,gBAAwB;AAC/B,QAAM,QAAQ,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACvD,MAAI,IAAI;AACR,aAAW,KAAK,MAAO,MAAK,OAAO,aAAa,CAAC;AACjD,SAAO,KAAK,CAAC,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC1E;AAGA,eAAsB,cAAc,GAAuC;AACzE,aAAW,iBAAiB,wDAAwD;AACpF,QAAMgB,OAAM,CAAC,MAAe,OAAO,YAAY,cAAc,QAAQ,MAAM,CAAC,IAAI;AAChF,QAAM,SAAS,uBAAuB,EAAE,UAAUA,KAAI,eAAe,KAAK,EAAE;AAC5E,QAAM,SAAS,EAAE,UAAUA,KAAI,eAAe,KAAK;AACnD,QAAM,QAAQ,EAAE,SAASA,KAAI,cAAc,KAAK;AAChD,aAAW,CAAC,MAAM,CAAC,KAAK,OAAO,QAAQ,EAAE,eAAe,QAAQ,eAAe,QAAQ,cAAc,MAAM,CAAC,GAAG;AAC7G,QAAI,MAAM,GAAI,OAAM,IAAI,MAAM,mBAAmB,IAAI,kCAAkC;AAAA,EACzF;AACA,QAAM,MAAM,MAAM,SAAS,EAAE,OAAO,EAAE,aAAa,mBAAmB,EAAE,GAAG,MAAM,eAAe;AAAA,IAC9F,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,KAAK,IAAI,gBAAgB,QAAQ,gBAAgB,mBAAmB;AAAA,IACxG,MAAM,KAAK,UAAU;AAAA,MAAE,QAAQ,EAAE;AAAA,MAAQ,SAAS,EAAE;AAAA,MAAQ,MAAM,EAAE;AAAA,MAAM,eAAe,EAAE;AAAA,MACzF,YAAY,EAAE;AAAA,MAAW,QAAQ,EAAE;AAAA,MAAQ,UAAU,EAAE;AAAA,IAAQ,CAAC;AAAA,EACpE,CAAC;AACD,QAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAK/C,MAAI,CAAC,IAAI,MAAM,CAAC,MAAM,MAAM;AAC1B,UAAM,OAAO,MAAM,UAAU,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI,KAAK,IAAI;AACzF,UAAM,IAAI,MAAM,sDAAsD,IAAI,MAAM,MAAM,GAAG,EAAE;AAAA,EAC7F;AACA,QAAM,IAAI,KAAK;AACf,SAAO;AAAA,IAAE,QAAQ,EAAE;AAAA,IAAQ,UAAU,EAAE,OAAO;AAAA,IAAW,cAAc,EAAE;AAAA,IAAe,cAAc,EAAE,OAAO;AAAA,IAC7G,SAAS,EAAE;AAAA,IAAS,KAAK,EAAE,GAAG,EAAE,KAAK,eAAe,cAAc,EAAE;AAAA,EAAE;AAC1E;","names":["out","e","out","import_jose","keys","out","encoder","out","text","env","import_jose","out","text","env","fail","out","out","import_jose","out","out","text","env","text","import_jose","text","fail","out","enc","ASSERTION_TYPE","resolve","UUID","NIL_UUID","out","published","keysOf","env","text","env","text","urls","ASSERTION_TYPE","body","resolve","token","out","UUID","status","bearer","failed","callback","code","done","s","b","res","published","attributes","keys","env"]}
+{"version":3,"sources":["../src/index.ts","../src/cookies.ts","../src/seal.ts","../src/deadline.ts","../src/url.ts","../src/permissions.ts","../src/system.ts","../src/theme.ts","../src/types.ts","../src/validate.ts","../src/webhook.ts","../src/sha256.ts","../src/cauthykey.ts","../src/protocol.ts","../src/verify.ts","../src/json.ts","../src/deprecate.ts","../src/keyderive.ts","../src/identity.ts","../src/mount.ts","../src/cauthy.ts","../src/connect.ts"],"sourcesContent":["export { createCauthy, type Cauthy, type Resolved } from './cauthy'\nexport { composeKey, KEY_REPLACES, parseKey, type CauthyKey } from './cauthykey'\nexport { type Identity } from './identity'\nexport {\n  CauthyConfigError,\n  CauthyKeyError,\n  type CauthyKeyReason,\n  type CauthyOptions,\n  type CheckQuestion,\n  type CheckResult,\n  type CheckRule,\n  type ConditionalPermission,\n  type JsonValue,\n  type OrganizationRef,\n  type PublicSession,\n  type Session,\n  type SessionOrganization,\n  type SessionStatus,\n  type SessionUser,\n} from './types'\nexport { pushTheme, themeFromStackmyth, tokensFromStackmyth, type StackmythTokens, type CauthyTheme, type ImportedTheme, type PushThemeOptions, type StackmythThemeOptions, type ThemeFont, type ThemeTexts } from './theme'\nexport { can, definePolicy, policySource, pullCatalog, pullPolicy, pushCatalog, pushPolicy, type AttributeType, type CatalogResource, type CheckOf, type Permitted, type PermissionOf, type Policy, type PolicyDefinition, type PolicyPermission, type PolicyRole, type PushPolicyOptions, type RoleOf, type SystemPolicy } from './permissions'\nexport { memoryReplayStore, verifyWebhook, CauthyWebhookError, type CauthyEvent, type ReplayStore, type VerifyWebhookOptions } from './webhook'\nexport { createSystem, CauthyApiError, type CauthySystem, type NewMember, type Organization, type OrganizationMember, type SystemKey, type SystemOptions } from './system'\nexport { connectSystem, type ConnectOptions, type Connected } from './connect'\nexport { MIN_PASSWORD, DEFAULT_PASSWORD_POLICY, checkCode, checkEmail, checkName, checkNewPassword, checkPassword, describePasswordPolicy, explainPasswordProblems, passwordPolicyOf, passwordProblems, type AuthField, type FieldProblem, type PasswordClass, type PasswordLocale, type PasswordPolicy, type PasswordReason } from './validate'\nexport { verifyToken, createTokenVerifier, createVerifierFromEnv, remoteKeys, CauthyTokenError, CauthyUnavailableError, type TokenIdentity, type TokenRefusal, type VerifyTokenOptions } from './verify'\nexport { PROTOCOL_VERSION, type NextStep } from './protocol'\nexport { type MountTarget } from './mount'\n","// Cookies, by hand: reading the Cookie header and writing Set-Cookie.\n//\n// A session can outgrow one cookie (browsers stop near 4 KB), so a value is\n// written in numbered parts — name.0, name.1 — and read back in order.\n\nconst PART = 3500\n\nexport function readCookies(header: string | null | undefined): Map<string, string> {\n  const out = new Map<string, string>()\n  for (const pair of (header ?? '').split(';')) {\n    const i = pair.indexOf('=')\n    if (i > 0) out.set(pair.slice(0, i).trim(), pair.slice(i + 1).trim())\n  }\n  return out\n}\n\n/** A value written in parts, or null when the cookie is not there. */\nexport function readParts(cookies: Map<string, string>, name: string): string | null {\n  let value = ''\n  for (let i = 0; cookies.has(`${name}.${i}`); i++) value += cookies.get(`${name}.${i}`)\n  return value === '' ? null : value\n}\n\nexport interface CookieAttributes {\n  secure: boolean\n  maxAge?: number // seconds; 0 deletes; none makes a cookie that ends with the browser session\n  path?: string\n}\n\nfunction attributes(a: CookieAttributes): string {\n  // httpOnly: script never reads it. SameSite=Lax: it rides the navigation\n  // that comes back from Cauthy, and no cross-site form post.\n  return `Path=${a.path ?? '/'}; HttpOnly; SameSite=Lax${a.maxAge === undefined ? '' : `; Max-Age=${a.maxAge}`}${a.secure ? '; Secure' : ''}`\n}\n\nexport function writeCookie(name: string, value: string, a: CookieAttributes): string {\n  return `${name}=${value}; ${attributes(a)}`\n}\n\n/**\n * The Set-Cookie headers that store a value in parts and delete whatever\n * parts an earlier, longer value left behind.\n */\nexport function writeParts(name: string, value: string, a: CookieAttributes, had: Map<string, string>): string[] {\n  const out: string[] = []\n  let n = 0\n  for (let i = 0; i < value.length; i += PART) out.push(writeCookie(`${name}.${n++}`, value.slice(i, i + PART), a))\n  for (let i = n; had.has(`${name}.${i}`); i++) out.push(writeCookie(`${name}.${i}`, '', { ...a, maxAge: 0 }))\n  return out\n}\n\nexport function clearParts(name: string, a: CookieAttributes, had: Map<string, string>): string[] {\n  const out: string[] = []\n  for (let i = 0; had.has(`${name}.${i}`) || i === 0; i++) out.push(writeCookie(`${name}.${i}`, '', { ...a, maxAge: 0 }))\n  return out\n}\n","// The session cookie's envelope: encrypted and authenticated with a key only\n// the server has, so the browser carries the session without being able to\n// read or change it.\n\nimport { CompactEncrypt, compactDecrypt } from 'jose'\n\nconst encoder = new TextEncoder()\nconst decoder = new TextDecoder()\n\n/** The 256-bit key a secret stands for. */\nexport async function keyOf(secret: string): Promise<Uint8Array> {\n  return new Uint8Array(await crypto.subtle.digest('SHA-256', encoder.encode(secret)))\n}\n\nexport async function seal(value: unknown, key: Uint8Array): Promise<string> {\n  return new CompactEncrypt(encoder.encode(JSON.stringify(value)))\n    .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })\n    .encrypt(key)\n}\n\n/** The value sealed, or null for anything that is not a cookie this key made. */\nexport async function unseal<T>(sealed: string, key: Uint8Array): Promise<T | null> {\n  try {\n    const { plaintext } = await compactDecrypt(sealed, key, {\n      keyManagementAlgorithms: ['dir'],\n      contentEncryptionAlgorithms: ['A256GCM'],\n    })\n    return JSON.parse(decoder.decode(plaintext)) as T\n  } catch {\n    return null\n  }\n}\n\n/** The value sealed with any key of the ring (the newest first), or null. */\nexport async function unsealAny<T>(sealed: string, ring: Uint8Array[]): Promise<T | null> {\n  return (await unsealIndexed<T>(sealed, ring))?.value ?? null\n}\n\n/** The value and the position in the ring of the key that opened it, or null. */\nexport async function unsealIndexed<T>(sealed: string, ring: Uint8Array[]): Promise<{ value: T; index: number } | null> {\n  for (let index = 0; index < ring.length; index++) {\n    const value = await unseal<T>(sealed, ring[index])\n    if (value !== null) return { value, index }\n  }\n  return null\n}\n","// A deadline for a call to Cauthy that does not get in the way of the caller's\n// own cancellation: the call fails with a `TimeoutError` when Cauthy has not\n// answered in time, and with the caller's own reason when the caller gave up.\n// For a stream (`accept: text/event-stream`) the deadline covers the first\n// response only: the stream then lives as long as its caller wants it.\n\nexport const DEFAULT_DEADLINE_MS = 5000\n\n/** Whether `err` is the deadline of `deadline()` passing, and not a caller giving up. */\nexport const isTimeout = (err: unknown): boolean => (err as { name?: unknown } | null)?.name === 'TimeoutError'\n\nexport function deadline(base: typeof fetch | undefined, ms: number): typeof fetch {\n  return async (input, init = {}) => {\n    const send = base ?? fetch\n    const stream = new Headers(init.headers).get('accept')?.includes('text/event-stream') === true\n    if (!stream) {\n      // The whole answer, body included, is inside the deadline.\n      const limit = AbortSignal.timeout(ms)\n      return send(input, { ...init, signal: init.signal ? anySignal([init.signal, limit]) : limit })\n    }\n    const own = new AbortController()\n    const timer = setTimeout(() => own.abort(new DOMException(`Cauthy did not answer within ${ms} ms`, 'TimeoutError')), ms)\n    try {\n      return await send(input, { ...init, signal: init.signal ? anySignal([init.signal, own.signal]) : own.signal })\n    } finally {\n      clearTimeout(timer)\n    }\n  }\n}\n\nfunction anySignal(signals: AbortSignal[]): AbortSignal {\n  if (typeof AbortSignal.any === 'function') return AbortSignal.any(signals)\n  // Node 20.0 to 20.2: no AbortSignal.any.\n  const controller = new AbortController()\n  for (const signal of signals) {\n    if (signal.aborted) {\n      controller.abort(signal.reason)\n      break\n    }\n    signal.addEventListener('abort', () => controller.abort(signal.reason), { once: true })\n  }\n  return controller.signal\n}\n","/**\n * The address without its trailing slashes: `https://auth.example.com/` and\n * `https://auth.example.com` name the same issuer. A loop, not `/\\/+$/`,\n * which backtracks over a long run of slashes.\n */\nexport function withoutTrailingSlashes(s: string): string {\n  let end = s.length\n  while (end > 0 && s.charCodeAt(end - 1) === 47) end--\n  return s.slice(0, end)\n}\n","// What a person may do in an organization.\n//\n// When a system keeps its catalog of roles in Cauthy, each of a person's\n// organizations arrives with what their role — and anything given or denied to\n// them apart from it — lets them do. Checking is a lookup in that list: no\n// call to Cauthy, on the server or in the browser.\n\nimport type { CheckQuestion, CheckResult, CheckRule, ConditionalPermission, OrganizationRef } from './types'\nimport { deadline, DEFAULT_DEADLINE_MS } from './deadline'\nimport { withoutTrailingSlashes } from './url'\n\n/** The part of an organization that says what its member may do. */\nexport interface Permitted {\n  /** \"resource:action\" entries the person is allowed; \"*\" is any. Absent when the system keeps no catalog in Cauthy. */\n  permissions?: string[]\n  /** Entries the person is denied whatever else allows them. */\n  denied?: string[]\n  /** Permissions with a condition: in neither list, so `can` never counts them. Ask with `auth.check`. */\n  conditional?: ConditionalPermission[]\n}\n\nfunction matches(entry: string, resource: string, action: string): boolean {\n  // The resource may itself hold a colon: the action is what follows the last one.\n  const i = entry.lastIndexOf(':')\n  if (i < 0) return false\n  const r = entry.slice(0, i)\n  const a = entry.slice(i + 1)\n  return (r === '*' || r === resource) && (a === '*' || a === action)\n}\n\n/**\n * Whether the person may do an action on a resource in an organization:\n * allowed by some entry, and denied by none. A denial wins.\n *\n * An organization of a system that keeps no catalog in Cauthy carries no\n * permissions, and the answer is `false`: decide by its `role` instead.\n *\n * A permission with a condition (`organization.conditional`) is not in the\n * lists, so `can` answers `false` for what only it allows: the condition reads\n * the record at hand, which only Cauthy can weigh. Ask with `auth.check`\n * (`organizations.check` in the browser).\n *\n *   if (!can(organization, 'invoicing', 'write')) return forbidden()\n */\nexport function can(organization: Permitted | null | undefined, resource: string, action: string): boolean {\n  if (!organization?.permissions) return false\n  if ((organization.denied ?? []).some((d) => matches(d, resource, action))) return false\n  return organization.permissions.some((p) => matches(p, resource, action))\n}\n\n// ── A system's catalog of roles ────────────────────────────────────────────\n\n/** Something a role may do: an action on a resource, in organizations of a kind (\"*\", the default, is every kind). */\nexport interface PolicyPermission {\n  kind?: string\n  resource: string\n  action: string\n  /**\n   * When it holds, in CEL: `resource.attrs.amount <= 1000000`. A permission\n   * with one is decided by Cauthy per question (`auth.check`), never by `can`.\n   */\n  condition?: string\n}\n\n/** The type of an attribute a condition may read: `list` is any JSON array. */\nexport type AttributeType = 'string' | 'number' | 'bool' | 'list'\n\n/** A resource of a system's catalog: the actions done on it and the attributes its conditions read. */\nexport interface CatalogResource {\n  resource: string\n  description?: string\n  actions: string[]\n  /** Name → type, as `resource.attrs.<name>` in a condition. */\n  attributes?: Record<string, AttributeType>\n}\n\nexport interface PolicyRole {\n  role: string\n  name?: string\n  description?: string\n  /** Roles whose permissions this one has as well. */\n  inherits?: string[]\n  permissions?: PolicyPermission[]\n}\n\n// ── The catalog, with its types ────────────────────────────────────────────\n//\n// A catalog written down once gives the roles and the permissions their\n// names: `can(org, 'ledger:write')` then takes only a permission the catalog\n// has, the editor offers them, and a typo does not compile.\n//\n//   export const policy = definePolicy([\n//     { role: 'reader', permissions: [{ resource: 'ledger', action: 'read' }] },\n//     { role: 'accountant', inherits: ['reader'], permissions: [{ resource: 'ledger', action: 'write' }] },\n//   ])\n//   export const { can, hasRole } = policy\n//\n//   can(organization, 'ledger:write')        // 'ledger:wirte' does not compile\n//   hasRole(organization, 'accountant')\n//\n// A system that declares its resources gives them too, with their actions and\n// the attributes a condition reads, and a check is typed by them:\n//\n//   export const policy = definePolicy({\n//     catalog: [{ resource: 'invoices', actions: ['read', 'approve'], attributes: { amount: 'number' } }],\n//     roles: [{ role: 'accountant', permissions: [{ resource: 'invoices', action: 'approve', condition: 'resource.attrs.amount <= 1000' }] }],\n//   })\n//\n//   await policy.check(auth, request, { organization, resource: 'invoices', action: 'approve', attributes: { amount: 500 } })\n//\n// Write it by hand, or let `pullPolicy` write it from the\n// catalog Cauthy has.\n\ntype PermissionShape = { readonly kind?: string; readonly resource: string; readonly action: string; readonly condition?: string }\n\n/** A role as `definePolicy` reads it: any `PolicyRole`, kept as written. */\ntype RoleShape = {\n  readonly role: string\n  readonly name?: string\n  readonly description?: string\n  readonly inherits?: readonly string[]\n  readonly permissions?: readonly PermissionShape[]\n}\n\n/** A resource as `definePolicy` reads it: any `CatalogResource`, kept as written. */\ntype ResourceShape = {\n  readonly resource: string\n  readonly description?: string\n  readonly actions: readonly string[]\n  readonly attributes?: { readonly [name: string]: AttributeType }\n}\n\n// \"*\" in a catalog is \"any\": the name it stands for is any text.\ntype Named<S extends string> = S extends '*' ? string : S\n\ntype PermissionsIn<R> = R extends { readonly permissions: readonly (infer P)[] }\n  ? P extends { readonly resource: infer Res extends string; readonly action: infer Act extends string } ? `${Named<Res>}:${Named<Act>}` : never\n  : never\n\ntype ValueOf<T> = T extends 'string' ? string : T extends 'number' ? number : T extends 'bool' ? boolean : T extends 'list' ? unknown[] : never\n\n/** What a check may say about one declared resource. */\ntype QuestionAbout<E> = E extends { readonly resource: infer R extends string; readonly actions: readonly (infer A extends string)[] }\n  ? {\n      resource: R\n      action: A\n      attributes?: E extends { readonly attributes: infer T } ? { [K in keyof T]?: ValueOf<T[K]> } : Record<string, never>\n      resourceId?: string\n      ownerId?: string\n    }\n  : never\n\n/**\n * What a role of a catalog that declares its resources may name: a declared\n * resource with one of its actions, or \"*\", or one of Cauthy's own powers.\n */\ntype PermissionFor<C extends readonly ResourceShape[]> = { readonly kind?: string; readonly condition?: string } & (\n  | (C[number] extends infer E ? E extends { readonly resource: infer R extends string; readonly actions: readonly (infer A extends string)[] } ? { readonly resource: R; readonly action: A | '*' } : never : never)\n  | { readonly resource: '*'; readonly action: string }\n  | { readonly resource: `cauthy:${string}`; readonly action: string }\n)\ntype RoleFor<C extends readonly ResourceShape[]> = Omit<RoleShape, 'permissions'> & { readonly permissions?: readonly PermissionFor<C>[] }\n\n/** The roles a catalog names: `RoleOf<typeof policy>`. */\nexport type RoleOf<P> = P extends Policy<infer R, any, any> ? R : never\n/** The \"resource:action\" permissions a catalog names: `PermissionOf<typeof policy>`. */\nexport type PermissionOf<P> = P extends Policy<any, infer X, any> ? X : never\n/** What a check about this catalog may ask: `CheckOf<typeof policy>`. Any resource when it declares none. */\nexport type CheckOf<P> = P extends Policy<any, any, infer Q> ? Q : never\n\n/** The fields of a question: whatever else the asker takes (the organization, the person) passes through. */\ntype QuestionKeys = keyof CheckQuestion\n\nexport interface Policy<Role extends string = string, Permission extends string = string, Question extends CheckQuestion = CheckQuestion> {\n  /** The catalog as Cauthy takes it: `pushPolicy({ roles: policy.roles })`. */\n  roles: PolicyRole[]\n  /** The resources the system declares, as Cauthy takes them; empty when it declares none. */\n  catalog: CatalogResource[]\n  /** Every role's name. */\n  roleNames: Role[]\n  /** Every permission some role has, as \"resource:action\". */\n  permissions: Permission[]\n  /**\n   * Whether the person may do this in the organization: `can(org, 'ledger:write')`.\n   * It reads what Cauthy sent with the session, so a catalog edited in Cauthy\n   * since this file was written is still what decides. A permission with a\n   * condition is not there: ask with `check`.\n   */\n  can(organization: Permitted | null | undefined, permission: Permission): boolean\n  /** Whether the person's role in the organization is one of these. */\n  hasRole(organization: { role: string } | null | undefined, ...roles: Role[]): boolean\n  /**\n   * What a role may do by this catalog, with what it inherits: for showing a\n   * role, never for deciding about a person (their exceptions are not here).\n   */\n  permissionsOf(role: Role): Permission[]\n  /**\n   * Asks Cauthy, with the resource, action and attributes typed by the\n   * catalog. Give it whoever asks: the server's `auth` with the request,\n   * the browser's `organizations`, or the application's `system`.\n   *\n   *   await policy.check(auth, request, { organization, resource: 'invoices', action: 'approve', attributes: { amount: 500 } })\n   *   await policy.check(auth.system, { organizationId, userId, resource: 'invoices', action: 'read' })\n   */\n  check<I extends CheckQuestion>(asker: { check(input: I): Promise<CheckResult> }, input: Omit<I, QuestionKeys> & Question): Promise<CheckResult>\n  check<R, I extends CheckQuestion>(asker: { check(request: R, input: I): Promise<CheckResult> }, request: R, input: Omit<I, QuestionKeys> & Question): Promise<CheckResult>\n}\n\n/** A catalog with its resources declared, for `definePolicy`. */\nexport interface PolicyDefinition<C extends readonly ResourceShape[], T extends readonly RoleShape[]> {\n  catalog: C\n  roles: T\n}\n\n/** Gives a catalog of roles its types. See the top of this section. */\nexport function definePolicy<const T extends readonly RoleShape[]>(roles: T): Policy<T[number]['role'], PermissionsIn<T[number]>>\n/** Gives a catalog of resources and roles its types: a role names only what the catalog declares. */\nexport function definePolicy<const C extends readonly ResourceShape[], const T extends readonly RoleFor<C>[]>(\n  definition: PolicyDefinition<C, T>,\n): Policy<T[number]['role'], PermissionsIn<T[number]>, QuestionAbout<C[number]>>\nexport function definePolicy(given: readonly RoleShape[] | PolicyDefinition<readonly ResourceShape[], readonly RoleShape[]>): Policy {\n  const roles: readonly RoleShape[] = Array.isArray(given) ? given : (given as PolicyDefinition<readonly ResourceShape[], readonly RoleShape[]>).roles\n  const resources: readonly ResourceShape[] = Array.isArray(given) ? [] : (given as PolicyDefinition<readonly ResourceShape[], readonly RoleShape[]>).catalog ?? []\n  const entry = (p: { resource: string; action: string }) => `${p.resource}:${p.action}`\n  const byName = new Map(roles.map((r) => [r.role, r]))\n  const split = (permission: string): [string, string] => {\n    const i = permission.lastIndexOf(':')\n    return i < 0 ? [permission, ''] : [permission.slice(0, i), permission.slice(i + 1)]\n  }\n  return {\n    roles: roles.map((r) => ({\n      role: r.role,\n      ...(r.name !== undefined ? { name: r.name } : {}),\n      ...(r.description !== undefined ? { description: r.description } : {}),\n      ...(r.inherits ? { inherits: [...r.inherits] } : {}),\n      ...(r.permissions ? { permissions: r.permissions.map((p) => ({ ...p })) } : {}),\n    })),\n    catalog: resources.map((c) => ({\n      resource: c.resource,\n      ...(c.description !== undefined ? { description: c.description } : {}),\n      actions: [...c.actions],\n      ...(c.attributes ? { attributes: { ...c.attributes } } : {}),\n    })),\n    roleNames: roles.map((r) => r.role),\n    permissions: [...new Set(roles.flatMap((r) => (r.permissions ?? []).map(entry)))],\n    can(organization, permission) {\n      const [resource, action] = split(permission)\n      return can(organization, resource, action)\n    },\n    hasRole(organization, ...wanted) {\n      return organization != null && wanted.includes(organization.role)\n    },\n    permissionsOf(role) {\n      const seen = new Set<string>()\n      const out = new Set<string>()\n      const walk = (name: string) => {\n        if (seen.has(name)) return // a catalog that inherits in a circle still ends\n        seen.add(name)\n        const r = byName.get(name)\n        for (const p of r?.permissions ?? []) out.add(entry(p))\n        for (const parent of r?.inherits ?? []) walk(parent)\n      }\n      walk(role)\n      return [...out]\n    },\n    // The types did the work; this only hands the question on, as a method of\n    // the asker so it keeps its `this`.\n    check(asker: { check(...args: unknown[]): Promise<CheckResult> }, ...args: unknown[]) {\n      return asker.check(...args)\n    },\n  }\n}\n\nconst IDENT = /^[A-Za-z_$][A-Za-z0-9_$]*$/\n\n/** A system's policy as Cauthy has it: the resources it declares (maybe none) and its roles. */\nexport interface SystemPolicy {\n  catalog: CatalogResource[]\n  roles: PolicyRole[]\n}\n\n/**\n * A TypeScript module that defines the catalog given, for `pullPolicy` to\n * write: the application's types then come from the catalog\n * Cauthy has. With resources declared it is `definePolicy({ catalog, roles })`;\n * without, the list of roles alone, as it always was.\n */\nexport function policySource(system: string, read: PolicyRole[] | { catalog?: CatalogResource[]; roles: PolicyRole[] }): string {\n  const roles = Array.isArray(read) ? read : read.roles\n  const catalog = Array.isArray(read) ? [] : (read.catalog ?? [])\n  const text = (v: string) => JSON.stringify(v)\n  const key = (k: string) => (IDENT.test(k) ? k : text(k))\n  const one = (r: PolicyRole, pad: string) => {\n    const parts = [`role: ${text(r.role)}`]\n    if (r.name) parts.push(`name: ${text(r.name)}`)\n    if (r.description) parts.push(`description: ${text(r.description)}`)\n    if (r.inherits?.length) parts.push(`inherits: [${r.inherits.map(text).join(', ')}]`)\n    if (r.permissions?.length) {\n      const list = r.permissions.map((p) => `${pad}      { ${[\n        ...(p.kind && p.kind !== '*' ? [`${key('kind')}: ${text(p.kind)}`] : []),\n        `resource: ${text(p.resource)}`,\n        `action: ${text(p.action)}`,\n        ...(p.condition ? [`condition: ${text(p.condition)}`] : []),\n      ].join(', ')} },`)\n      parts.push(`permissions: [\\n${list.join('\\n')}\\n${pad}    ]`)\n    }\n    return `${pad}  {\\n${pad}    ${parts.join(`,\\n${pad}    `)},\\n${pad}  },`\n  }\n  const resource = (c: CatalogResource) => {\n    const parts = [`resource: ${text(c.resource)}`]\n    if (c.description) parts.push(`description: ${text(c.description)}`)\n    parts.push(`actions: [${c.actions.map(text).join(', ')}]`)\n    const attrs = Object.entries(c.attributes ?? {})\n    if (attrs.length) parts.push(`attributes: { ${attrs.map(([k, v]) => `${key(k)}: ${text(v)}`).join(', ')} }`)\n    return `    { ${parts.join(', ')} },`\n  }\n  const head = `// The catalog of roles of ${text(system)}, as Cauthy has it.\n// Written by \\`pullPolicy\\`: run it again after the catalog\n// changes, and do not edit this file by hand.\n`\n  if (catalog.length === 0) {\n    return `${head}\nimport { definePolicy, type PermissionOf, type RoleOf } from '@cauthyhq/node'\n\nexport const policy = definePolicy([\n${roles.map((r) => one(r, '')).join('\\n')}\n])\n\nexport const { can, hasRole } = policy\nexport type Role = RoleOf<typeof policy>\nexport type Permission = PermissionOf<typeof policy>\n`\n  }\n  return `${head}\nimport { definePolicy, type CheckOf, type PermissionOf, type RoleOf } from '@cauthyhq/node'\n\nexport const policy = definePolicy({\n  catalog: [\n${catalog.map(resource).join('\\n')}\n  ],\n  roles: [\n${roles.map((r) => one(r, '  ')).join('\\n')}\n  ],\n})\n\nexport const { can, hasRole } = policy\nexport type Role = RoleOf<typeof policy>\nexport type Permission = PermissionOf<typeof policy>\n/** What a check may ask: \\`policy.check(auth, request, { organization, ...question })\\`. */\nexport type Check = CheckOf<typeof policy>\n`\n}\n\n/** Who reads or writes a system's policy: Cauthy's address, the workspace, a person's token. */\ninterface Reach {\n  issuer: string\n  system: string\n  tenant: string\n  token: string\n  fetch: typeof fetch\n}\n\nfunction reach(o: Omit<PushPolicyOptions, 'roles'>, doing: string): Reach {\n  const env = (n: string) => (typeof process !== 'undefined' ? process.env?.[n] : undefined)\n  const r = {\n    issuer: withoutTrailingSlashes(o.issuer ?? env('CAUTHY_ISSUER') ?? ''),\n    system: o.system ?? env('CAUTHY_SYSTEM') ?? '',\n    tenant: o.tenant ?? env('CAUTHY_TENANT') ?? '',\n    token: o.token ?? env('CAUTHY_TOKEN') ?? '',\n  }\n  for (const [name, v] of Object.entries({ CAUTHY_ISSUER: r.issuer, CAUTHY_SYSTEM: r.system, CAUTHY_TENANT: r.tenant, CAUTHY_TOKEN: r.token })) {\n    if (v === '') throw new Error(`@cauthyhq/node: ${name} is required to ${doing}`)\n  }\n  return { ...r, fetch: deadline(o.fetch, o.timeoutMs ?? DEFAULT_DEADLINE_MS) }\n}\n\nasync function systemCall(r: Reach, method: 'GET' | 'PUT', what: 'policy' | 'catalog', body?: unknown): Promise<any> {\n  const res = await r.fetch(`${r.issuer}/v1/systems/${encodeURIComponent(r.system)}/${what}`, {\n    ...(method === 'PUT' ? { method } : {}),\n    headers: {\n      authorization: `Bearer ${r.token}`, 'x-tenant-key': r.tenant,\n      ...(body === undefined ? { accept: 'application/json' } : { 'content-type': 'application/json' }),\n    },\n    ...(body === undefined ? {} : { body: JSON.stringify(body) }),\n  })\n  const answer = (await res.json().catch(() => null)) as { data?: any; errors?: { message?: string }[] } | null\n  if (!res.ok) {\n    const verb = method === 'GET' ? `refused to give the ${what}` : `refused the ${what}`\n    throw new Error(`@cauthyhq/node: Cauthy ${verb} (${res.status}): ${answer?.errors?.[0]?.message ?? res.statusText}`)\n  }\n  return answer?.data\n}\n\n/** Reads a system's catalog of roles from Cauthy, with a personal access token. */\nexport async function pullPolicy(o: Omit<PushPolicyOptions, 'roles'> = {}): Promise<PolicyRole[]> {\n  const data = await systemCall(reach(o, 'read a policy'), 'GET', 'policy')\n  return (data?.roles as PolicyRole[] | undefined) ?? []\n}\n\n/** Reads the resources a system declares (empty when it declares none), with a personal access token. */\nexport async function pullCatalog(o: Omit<PushPolicyOptions, 'roles'> = {}): Promise<CatalogResource[]> {\n  const data = await systemCall(reach(o, 'read a catalog'), 'GET', 'catalog')\n  return (data?.resources as CatalogResource[] | undefined) ?? []\n}\n\nexport interface PushPolicyOptions {\n  /** The system whose catalog this is. Default: `CAUTHY_SYSTEM`. */\n  system?: string\n  roles: PolicyRole[]\n  /**\n   * The resources the system declares. Given, they are sent before the roles,\n   * which Cauthy then checks against them; left out, the catalog Cauthy has\n   * stays as it is.\n   */\n  catalog?: CatalogResource[]\n  /** Cauthy's address. Default: `CAUTHY_ISSUER`. */\n  issuer?: string\n  /** The workspace's slug. Default: `CAUTHY_TENANT`. */\n  tenant?: string\n  /**\n   * A personal access token: `organizations:manage` reads, and changing a\n   * policy or a catalog takes `systems:policy`. Default: `CAUTHY_TOKEN`.\n   */\n  token?: string\n  fetch?: typeof fetch\n  /** How long the call may take, in milliseconds, before it fails with a `TimeoutError`. Default: 5000. */\n  timeoutMs?: number\n}\n\n/**\n * Gives Cauthy a system's catalog of roles, replacing the one it has. It is\n * the way to load a first catalog from what a system already had; from then on\n * the catalog is Cauthy's, edited in its dashboard, and pushing again would\n * overwrite what was edited there. With `catalog` the declared resources go\n * first: the roles are checked against them.\n */\nexport async function pushPolicy(o: PushPolicyOptions): Promise<void> {\n  const r = reach(o, 'push a policy')\n  if (o.catalog !== undefined) await systemCall(r, 'PUT', 'catalog', { resources: o.catalog })\n  await systemCall(r, 'PUT', 'policy', { roles: o.roles })\n}\n\n/**\n * Gives Cauthy the resources a system declares, replacing the ones it has.\n * Cauthy refuses (`catalog_in_use`) to drop a resource or an action the\n * policy still names.\n */\nexport async function pushCatalog(o: Omit<PushPolicyOptions, 'roles' | 'catalog'> & { resources: CatalogResource[] }): Promise<CatalogResource[]> {\n  const data = await systemCall(reach(o, 'push a catalog'), 'PUT', 'catalog', { resources: o.resources })\n  return (data?.resources as CatalogResource[] | undefined) ?? []\n}\n\n/** What a policy file holds: the roles alone (as it used to), or `{ catalog, roles }`. */\nexport function readPolicyFile(parsed: unknown): SystemPolicy {\n  if (Array.isArray(parsed)) return { catalog: [], roles: parsed as PolicyRole[] }\n  const o = (parsed ?? {}) as { roles?: unknown; catalog?: unknown }\n  if (!Array.isArray(o.roles)) throw new Error('no \"roles\" list')\n  if (o.catalog !== undefined && !Array.isArray(o.catalog)) throw new Error('\"catalog\" is not a list')\n  return { catalog: (o.catalog as CatalogResource[] | undefined) ?? [], roles: o.roles as PolicyRole[] }\n}\n\n// ── Asking Cauthy ──────────────────────────────────────────────────────────\n\n/** A check's question as Cauthy reads it. */\nexport function checkWire(q: CheckQuestion): Record<string, unknown> {\n  return {\n    resource: q.resource,\n    action: q.action,\n    ...(q.resourceId !== undefined ? { resource_id: q.resourceId } : {}),\n    ...(q.ownerId !== undefined ? { owner_id: q.ownerId } : {}),\n    ...(q.attributes !== undefined ? { attributes: q.attributes } : {}),\n  }\n}\n\n/** Cauthy's answer to a check, as the SDK gives it. Anything but a plain yes is a no. */\nexport function checkResultOf(d: any): CheckResult {\n  const r = d?.rule\n  const rule: CheckRule | undefined = r && typeof r === 'object'\n    ? {\n        source: r.source === 'exception' ? 'exception' : 'role',\n        ...(r.role ? { role: String(r.role) } : {}),\n        kind: String(r.kind ?? '*'),\n        resource: String(r.resource ?? ''),\n        action: String(r.action ?? ''),\n        effect: r.effect === 'allow' ? 'allow' : 'deny',\n        ...(r.condition ? { condition: String(r.condition) } : {}),\n      }\n    : undefined\n  return { allowed: d?.allowed === true, reason: String(d?.reason ?? ''), ...(rule ? { rule } : {}) }\n}\n\n/** The id of an organization given by its id or as the session has it. */\nexport function organizationIdOf(o: OrganizationRef | null | undefined): string {\n  return typeof o === 'string' ? o : typeof o?.id === 'string' ? o.id : ''\n}\n","// The application acting on its own: creating its organizations, adding their\n// members, inviting people. No person's token is involved — the application\n// is somebody in Cauthy, and what it may touch is its own system's\n// organizations and nothing else.\n//\n// It proves who it is with the client's secret, or with a key it holds and\n// whose public half it publishes (`publicJwks`): then nothing secret is ever\n// shared with Cauthy.\n\nimport { exportJWK, importJWK, importPKCS8, SignJWT, type JWK, type KeyLike } from 'jose'\nimport { deadline, isTimeout } from './deadline'\nimport { checkResultOf, checkWire, type CatalogResource, type PolicyRole } from './permissions'\nimport { fromWire, type CauthyTheme } from './theme'\nimport { CauthyConfigError, type CheckQuestion, type CheckResult, type JsonValue } from './types'\nimport type { Signer } from './keyderive'\nimport { withoutTrailingSlashes } from './url'\n\nconst ASSERTION_TYPE = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'\n/** Ask for a new token this long before the one held runs out. */\nconst SKEW_MS = 30_000\n\n/** The key an application signs its assertions with. */\nexport interface SystemKey {\n  /** The private key: PKCS#8 PEM, or a JWK (as an object or its JSON). RSA, for RS256. */\n  privateKey: string | JWK\n  /** The id the public key is published under (`kid`). */\n  keyId: string\n  /**\n   * The client the key belongs to, when it is not the one people sign in\n   * with: a public sign-in client has no key of its own, and the system's\n   * identity is a confidential client beside it. Default: the client id.\n   */\n  clientId?: string\n}\n\nexport interface SystemOptions {\n  /** Cauthy's address. Default: `CAUTHY_ISSUER`. */\n  issuer?: string\n  /** The application's client id. Default: `CAUTHY_CLIENT_ID`. */\n  clientId?: string\n  /** Its secret. Default: `CAUTHY_CLIENT_SECRET`. Not needed with `key`. */\n  clientSecret?: string\n  /**\n   * The key to prove who the application is with, instead of the secret.\n   * Default: `CAUTHY_SYSTEM_KEY` (the private key) and `CAUTHY_SYSTEM_KEY_ID`.\n   */\n  key?: SystemKey\n  /** The application's system, which `check` asks about. Default: `CAUTHY_SYSTEM`. */\n  system?: string\n  /**\n   * The application's own page for accepting an invitation, as an absolute\n   * address (`https://app.example.com/accept-invite`, where `<AcceptInvite />`\n   * is). The invitations `members.add` and `invite` send open it; without it,\n   * they open Cauthy's own page. Cauthy follows it only on an origin the\n   * client registered to be sent back to. Default: `CAUTHY_ACCEPT_INVITE_URL`.\n   */\n  acceptInviteUrl?: string\n  /**\n   * CAUTHY_KEY's Ed25519 key (key/cauthy-key.md §6) and the client it proves:\n   * every token is asked with an EdDSA assertion. Takes the place of `key`\n   * and the secret.\n   */\n  signer?: { clientId: string; signer: Promise<Signer> }\n  /** The system `check` asks about when it is known only later (CAUTHY_KEY: from Cauthy's answer). */\n  currentSystem?: () => string\n  fetch?: typeof fetch\n  /** How long a call to Cauthy may take before it fails with `503 unavailable`, in milliseconds. Default: 2000. */\n  timeoutMs?: number\n}\n\n/** Cauthy refused a request of the application's own. */\nexport class CauthyApiError extends Error {\n  constructor(\n    readonly status: number,\n    /** Cauthy's code for what went wrong: `organization_not_found`, `other_system`, `outside_system_scope`, `member_exists`… */\n    readonly code: string,\n    message: string,\n  ) {\n    super(`@cauthyhq/node: ${message}`)\n    this.name = 'CauthyApiError'\n  }\n}\n\n/** An organization of the application's system. Every moment is UTC. */\nexport interface Organization {\n  id: string\n  system: string\n  name: string\n  kind: string\n  /** The id the application knows it by. */\n  externalId?: string\n  status: 'active' | 'archived'\n  metadata: Record<string, JsonValue>\n  members: number\n  createdAt: string\n  updatedAt: string\n}\n\nexport interface OrganizationMember {\n  userId: string\n  email: string\n  name: string\n  /** The account's status: a disabled member is still listed. */\n  status: string\n  role: string\n  /** True when the address had no account: one was made and invited. */\n  invited?: boolean\n}\n\n/** Who to add: an account by its id, or anybody by their address (invited when new). */\nexport type NewMember = {\n  role: string\n  name?: string\n  locale?: string\n  /**\n   * Adds and nothing else (the default): a person who already belongs keeps\n   * their role, and the call throws `CauthyApiError` with code\n   * `member_exists` (409). `false` sets the role of whoever is already\n   * there, as `setRole` does.\n   */\n  onlyNew?: boolean\n} & ({ userId: string; email?: undefined } | { email: string; userId?: undefined })\n\nexport interface CauthySystem {\n  /** The application's own token, asked for when needed and kept until it is about to run out. */\n  token(): Promise<string>\n  /** Any route the application's token may call; answers what Cauthy put under `data`. */\n  request<T = unknown>(method: string, path: string, body?: unknown): Promise<T>\n  organizations: {\n    list(query?: { q?: string; status?: 'active' | 'archived'; limit?: number; offset?: number }): Promise<{ items: Organization[]; total: number }>\n    create(input: { name: string; kind?: string; externalId?: string; metadata?: Record<string, JsonValue> }): Promise<Organization>\n    get(id: string): Promise<Organization>\n    update(id: string, patch: { name?: string; kind?: string; status?: 'active' | 'archived'; metadata?: Record<string, JsonValue> }): Promise<Organization>\n    /** Removes the organization and every membership of it, for good. */\n    remove(id: string): Promise<void>\n  }\n  members: {\n    list(organizationId: string): Promise<OrganizationMember[]>\n    /** Adds a person; one who already belongs throws `member_exists` unless `onlyNew: false`. */\n    add(organizationId: string, member: NewMember): Promise<OrganizationMember>\n    setRole(organizationId: string, userId: string, role: string): Promise<OrganizationMember>\n    remove(organizationId: string, userId: string): Promise<void>\n  }\n  /** Invites a person who has no account yet; answers the account made for them. */\n  invite(person: { email: string; name?: string; locale?: string }): Promise<{ id: string; email: string }>\n  /**\n   * How the application looks on Cauthy's pages, read. It is decided in\n   * Cauthy's dashboard, by a person: an application never changes it.\n   */\n  theme: {\n    get(clientId?: string): Promise<CauthyTheme>\n  }\n  /** The catalog of roles of one of the application's systems, as Cauthy has it. */\n  policy: {\n    get(system: string): Promise<PolicyRole[]>\n  }\n  /**\n   * The resources one of the application's systems declares, with their\n   * actions and the attributes conditions read; empty when it declares none.\n   */\n  catalog: {\n    get(system: string): Promise<CatalogResource[]>\n    /** Replaces them. Cauthy refuses (`catalog_in_use`) to drop one the policy still names. */\n    set(system: string, resources: CatalogResource[]): Promise<CatalogResource[]>\n  }\n  /**\n   * Asks Cauthy whether a member of one of the system's organizations may do\n   * an action on a resource, conditions weighed. A person who is not a member\n   * is a no; an organization of another system throws (`organization_not_found`).\n   */\n  check(question: CheckQuestion & { organizationId: string; userId: string; system?: string }): Promise<CheckResult>\n  /** The public half of `key`, to serve at the address Cauthy was given (`jwks_uri`). Empty with a secret. */\n  publicJwks(): Promise<{ keys: JWK[] }>\n}\n\nfunction env(name: string): string | undefined {\n  return typeof process !== 'undefined' ? process.env?.[name] : undefined\n}\n\ninterface OrgWire {\n  id: string; system: string; name: string; kind: string; external_id?: string; status: 'active' | 'archived'\n  metadata: Record<string, JsonValue>; members: number; created_at: string; updated_at: string\n}\n\nfunction toOrganization(o: OrgWire): Organization {\n  return { id: o.id, system: o.system, name: o.name, kind: o.kind, externalId: o.external_id, status: o.status,\n    metadata: o.metadata ?? {}, members: o.members, createdAt: o.created_at, updatedAt: o.updated_at }\n}\n\ninterface MemberWire { user_id: string; email: string; name: string; status: string; role: string; invited?: boolean }\n\nfunction toMember(m: MemberWire): OrganizationMember {\n  return { userId: m.user_id, email: m.email, name: m.name, status: m.status, role: m.role, ...(m.invited === undefined ? {} : { invited: m.invited }) }\n}\n\nfunction asJwk(k: SystemKey): JWK | undefined {\n  if (typeof k.privateKey !== 'string') return k.privateKey\n  return k.privateKey.includes('BEGIN') ? undefined : (JSON.parse(k.privateKey) as JWK)\n}\n\nasync function loadKey(k: SystemKey): Promise<KeyLike | Uint8Array> {\n  const jwk = asJwk(k)\n  // Extractable, so its public half can be published (publicJwks).\n  return jwk ? importJWK(jwk, 'RS256') : importPKCS8(k.privateKey as string, 'RS256', { extractable: true })\n}\n\nexport function createSystem(given: SystemOptions = {}): CauthySystem {\n  const issuer = withoutTrailingSlashes(given.issuer ?? env('CAUTHY_ISSUER') ?? '')\n  const clientId = given.clientId ?? env('CAUTHY_CLIENT_ID') ?? ''\n  const clientSecret = given.clientSecret ?? env('CAUTHY_CLIENT_SECRET') ?? ''\n  const envKey = env('CAUTHY_SYSTEM_KEY')\n  const key = given.key ?? (envKey ? { privateKey: envKey, keyId: env('CAUTHY_SYSTEM_KEY_ID') ?? '' } : undefined)\n  const ownSystem = given.system ?? env('CAUTHY_SYSTEM') ?? ''\n  const acceptInviteUrl = given.acceptInviteUrl ?? env('CAUTHY_ACCEPT_INVITE_URL') ?? ''\n  // What a call that sends an invitation says of the page it opens: the\n  // application names itself, and the page, the same as its own screens do.\n  const inviteHeaders: Record<string, string> = /^https?:\\/\\//.test(acceptInviteUrl)\n    ? { 'x-cauthy-client-id': clientId, 'x-cauthy-link-to': acceptInviteUrl }\n    : {}\n  const timeoutMs = given.timeoutMs ?? 2000\n  if (!Number.isFinite(timeoutMs) || timeoutMs <= 0) throw new CauthyConfigError('timeoutMs must be a positive number of milliseconds')\n  // Every call has a deadline: a Cauthy that does not answer must not hold a\n  // sign-in (the proof it carries) or a job of the application forever.\n  const limited = deadline(given.fetch, timeoutMs)\n  const doFetch: typeof fetch = async (input, init) => {\n    try {\n      return await limited(input, init)\n    } catch (err) {\n      // Only the deadline is Cauthy's failure to answer; a caller giving up is the caller's.\n      if (isTimeout(err)) throw new CauthyApiError(503, 'unavailable', `Cauthy did not answer within ${timeoutMs} ms`)\n      throw err\n    }\n  }\n  const tokenEndpoint = `${issuer}/v1/oauth/token`\n\n  // Checked when it is first used, not when it is made: an application that\n  // only signs people in never needs any of this.\n  function configured(): void {\n    if (given.signer) return\n    if (!/^https?:\\/\\//.test(issuer)) throw new CauthyConfigError('issuer (CAUTHY_ISSUER) must be Cauthy\\'s address')\n    if (clientId === '') throw new CauthyConfigError('clientId (CAUTHY_CLIENT_ID) is required')\n    if (key ? key.keyId === '' : clientSecret === '') {\n      throw new CauthyConfigError(key ? 'the key needs its id (CAUTHY_SYSTEM_KEY_ID)'\n        : 'to act on its own the application needs its secret (CAUTHY_CLIENT_SECRET) or a key (CAUTHY_SYSTEM_KEY)')\n    }\n  }\n\n  let imported: Promise<KeyLike | Uint8Array> | undefined\n  const signingKey = () => (imported ??= loadKey(key as SystemKey))\n\n  // The token endpoint refuses as OAuth does ({error, error_description});\n  // every other route in Cauthy's envelope ({errors: [{code, message}]}).\n  async function fail(res: Response, what: string): Promise<never> {\n    const body = (await res.json().catch(() => null)) as\n      { error?: string; error_description?: string; errors?: { code?: string; message?: string }[] } | null\n    const first = body?.errors?.[0]\n    const code = typeof body?.error === 'string' ? body.error : first?.code\n    const message = typeof body?.error === 'string' ? body.error_description : first?.message\n    throw new CauthyApiError(res.status, code ?? 'error', `Cauthy refused ${what} (${res.status}): ${message ?? res.statusText}`)\n  }\n\n  let held: { value: string; until: number } | undefined\n  let asking: Promise<string> | undefined\n\n  async function ask(): Promise<string> {\n    configured()\n    const self = given.signer ? given.signer.clientId : key?.clientId || clientId\n    const form = new URLSearchParams({ grant_type: 'client_credentials', client_id: self })\n    if (given.signer) {\n      const s = await given.signer.signer\n      form.set('client_assertion_type', ASSERTION_TYPE)\n      form.set('client_assertion', await s.assertion(self, tokenEndpoint))\n    } else if (key) {\n      const signer = { kid: key.keyId, privateKey: await signingKey() }\n      const assertion = await new SignJWT({})\n        .setProtectedHeader({ alg: 'RS256', kid: signer.kid })\n        .setIssuer(self).setSubject(self).setAudience(tokenEndpoint)\n        .setJti(crypto.randomUUID()).setIssuedAt().setExpirationTime('2m')\n        .sign(signer.privateKey)\n      form.set('client_assertion_type', ASSERTION_TYPE)\n      form.set('client_assertion', assertion)\n    } else {\n      form.set('client_secret', clientSecret)\n    }\n    const res = await doFetch(tokenEndpoint, { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: form })\n    if (!res.ok) await fail(res, 'the application\\'s own token')\n    const t = (await res.json()) as { access_token: string; expires_in: number }\n    held = { value: t.access_token, until: Date.now() + t.expires_in * 1000 - SKEW_MS }\n    return t.access_token\n  }\n\n  function token(): Promise<string> {\n    if (held && Date.now() < held.until) return Promise.resolve(held.value)\n    // One request, however many callers arrive while it is out.\n    return (asking ??= ask().finally(() => { asking = undefined }))\n  }\n\n  async function call(method: string, path: string, body?: unknown, extra: Record<string, string> = {}): Promise<unknown> {\n    const send = async () => doFetch(`${issuer}${path}`, {\n      method,\n      headers: { authorization: `Bearer ${await token()}`, ...extra, ...(body === undefined ? {} : { 'content-type': 'application/json' }) },\n      body: body === undefined ? undefined : JSON.stringify(body),\n    })\n    let res = await send()\n    if (res.status === 401 && held) {\n      // The token was taken back early (the client's keys or secret changed): once more, with a new one.\n      held = undefined\n      res = await send()\n    }\n    if (!res.ok) await fail(res, `${method} ${path}`)\n    return res.status === 204 ? undefined : res.json()\n  }\n\n  const data = async <T>(method: string, path: string, body?: unknown, extra?: Record<string, string>) => ((await call(method, path, body, extra)) as { data: T } | undefined)?.data as T\n  const id = encodeURIComponent\n\n  return {\n    token,\n    request: data,\n    organizations: {\n      async list(query = {}) {\n        const q = new URLSearchParams()\n        for (const [k, v] of Object.entries(query)) if (v !== undefined) q.set(k, String(v))\n        const out = (await call('GET', `/v1/organizations${q.size ? `?${q}` : ''}`)) as { data: OrgWire[]; total_count: number }\n        return { items: out.data.map(toOrganization), total: out.total_count }\n      },\n      async create(input) {\n        return toOrganization(await data<OrgWire>('POST', '/v1/organizations',\n          { name: input.name, kind: input.kind, external_id: input.externalId, metadata: input.metadata }))\n      },\n      async get(orgId) {\n        return toOrganization(await data<OrgWire>('GET', `/v1/organizations/${id(orgId)}`))\n      },\n      async update(orgId, patch) {\n        return toOrganization(await data<OrgWire>('PATCH', `/v1/organizations/${id(orgId)}`, patch))\n      },\n      async remove(orgId) {\n        await call('DELETE', `/v1/organizations/${id(orgId)}`)\n      },\n    },\n    members: {\n      async list(orgId) {\n        return (await data<MemberWire[]>('GET', `/v1/organizations/${id(orgId)}/members`)).map(toMember)\n      },\n      async add(orgId, m) {\n        return toMember(await data<MemberWire>('POST', `/v1/organizations/${id(orgId)}/members`,\n          { role: m.role, user_id: m.userId, email: m.email, name: m.name, locale: m.locale, client_id: clientId, only_new: m.onlyNew !== false }, inviteHeaders))\n      },\n      async setRole(orgId, userId, role) {\n        return toMember(await data<MemberWire>('PUT', `/v1/organizations/${id(orgId)}/members/${id(userId)}`, { role }))\n      },\n      async remove(orgId, userId) {\n        await call('DELETE', `/v1/organizations/${id(orgId)}/members/${id(userId)}`)\n      },\n    },\n    async invite(person) {\n      // The invitation leads back to this application once it is accepted.\n      const u = await data<{ id: string; email: string }>('POST', '/v1/users', { ...person, client_id: clientId }, inviteHeaders)\n      return { id: u.id, email: u.email }\n    },\n    theme: {\n      async get(of = clientId) {\n        return fromWire(await data<Record<string, unknown>>('GET', `/v1/oauth/clients/${id(of)}/theme`))\n      },\n    },\n    policy: {\n      async get(system) {\n        return (await data<{ roles?: PolicyRole[] }>('GET', `/v1/systems/${id(system)}/policy`)).roles ?? []\n      },\n    },\n    catalog: {\n      async get(system) {\n        return (await data<{ resources?: CatalogResource[] }>('GET', `/v1/systems/${id(system)}/catalog`)).resources ?? []\n      },\n      async set(system, resources) {\n        return (await data<{ resources?: CatalogResource[] }>('PUT', `/v1/systems/${id(system)}/catalog`, { resources })).resources ?? []\n      },\n    },\n    async check(q) {\n      const system = q.system ?? (ownSystem || given.currentSystem?.() || '')\n      if (system === '') throw new CauthyConfigError('name the system to check in (system, or CAUTHY_SYSTEM)')\n      return checkResultOf(await data('POST', `/v1/systems/${id(system)}/check`, { organization_id: q.organizationId, user_id: q.userId, ...checkWire(q) }))\n    },\n    async publicJwks() {\n      if (!key) return { keys: [] }\n      const { kty, n, e } = asJwk(key) ?? (await exportJWK(await signingKey()))\n      return { keys: [{ kty, n, e, kid: key.keyId, alg: 'RS256', use: 'sig' }] }\n    },\n  }\n}\n","// An application's look, for Cauthy's hosted pages.\n//\n// Cauthy's pages — sign-in, sign-up, the account page — can take the colours,\n// corners, typeface and logo of the application that sends its people there,\n// so signing in reads as a page of the application. A theme is a short list of\n// values, which Cauthy checks one by one; it is never CSS.\n//\n// An application built with Stackmyth already has those values, as its\n// `--sm-*` tokens. `themeFromStackmyth` reads them out of its stylesheets.\n\nimport { deadline, DEFAULT_DEADLINE_MS } from './deadline'\nimport { withoutTrailingSlashes } from './url'\n\n/** How an application looks on Cauthy's hosted pages. Every value is optional. */\n/** One font file the application serves: a family in one weight (or a range) and one style. */\nexport interface ThemeFont {\n  family: string\n  /** An https address of a `.woff2` file. It must answer with `Access-Control-Allow-Origin` for Cauthy's origin. */\n  url: string\n  /** `400`, or `\"100 900\"` for a variable font. Default: 400. */\n  weight?: number | string\n  style?: 'normal' | 'italic'\n}\n\n/** What an application says on its sign-in page, in one language. */\nexport interface ThemeTexts {\n  /** Replaces \"Sign in\". */\n  heading?: string\n  /** Replaces \"to continue to …\". */\n  subheading?: string\n  /** The messages of the split layout's panel, shown one at a time (up to 5). */\n  panel?: string[]\n  /** Links at the foot of the split layout: privacy, terms (up to 4). */\n  links?: { label: string; url: string }[]\n}\n\nexport interface CauthyTheme {\n  /** The page. Colours are `#rrggbb` or `rgba(r, g, b, a)`. */\n  background?: string\n  /** The card, and inputs. */\n  surface?: string\n  /** Headings and what is typed. */\n  text?: string\n  /** Paragraphs, labels, small print. */\n  textMuted?: string\n  border?: string\n  /** The fields and the secondary buttons, when they are not the card's colours. */\n  inputBackground?: string\n  inputBorder?: string\n  /** The main button, and what is written on it. */\n  primary?: string\n  primaryText?: string\n  /** Links, and the focus ring. */\n  accent?: string\n  error?: string\n  errorBackground?: string\n  success?: string\n  successBackground?: string\n  /** Corners of cards and inputs, in pixels (0–40). */\n  radius?: number\n  /** Corners of buttons, in pixels (0–40). */\n  buttonRadius?: number\n  /** A CSS font-family list: the application's typeface first, a system font after it. */\n  fontFamily?: string\n  /** The files of the typefaces `fontFamily` names, for people who do not have them installed. */\n  fonts?: ThemeFont[]\n  /** An image shown where \"Cauthy\" is, over https. */\n  logoUrl?: string\n  /**\n   * How the sign-in pages are laid out: `card` (the default, one card in the\n   * middle) or `split` (the form on one side, a panel that presents the\n   * application on the other).\n   */\n  layout?: 'card' | 'split'\n  /** The colours the split layout's backdrop blends, one to four. */\n  panelColors?: string[]\n  /** The colour of what is written on the panel. */\n  panelText?: string\n  /** An https image shown over the panel's messages. */\n  panelIconUrl?: string\n  /** The application's own words on the sign-in page, by language (`en`, `es`). */\n  texts?: Record<string, ThemeTexts>\n  /**\n   * The application's Stackmyth tokens (`--sm-*`), from `tokensFromStackmyth`.\n   * Cauthy's pages are drawn with Stackmyth's components, so these make its\n   * buttons and fields the application's own. They are laid over the named values.\n   */\n  tokens?: Record<string, string>\n}\n\nexport interface StackmythThemeOptions {\n  /**\n   * The named theme to read, when the stylesheet keeps several under\n   * `[data-theme=…]` (`\"acme\"`). Without it only what applies to every\n   * page (`:root`) is read.\n   */\n  theme?: string\n  /** Which of the application's two modes to take. Default: `light`. */\n  mode?: 'light' | 'dark'\n  logoUrl?: string\n}\n\nexport interface ImportedTheme {\n  theme: CauthyTheme\n  /** Tokens that were there and could not be carried over, and why. */\n  warnings: string[]\n}\n\nconst MAX_RADIUS = 40\n\n// ── Reading custom properties out of CSS ───────────────────────────────────\n\ninterface Declaration {\n  name: string\n  value: string\n  /** The selectors and at-rules it sits inside, outermost first. */\n  within: string[]\n}\n\n// The stylesheet without its /* comments */, read in one pass. An unclosed\n// comment runs to the end, as a browser reads it.\nfunction withoutComments(css: string): string {\n  let out = ''\n  let i = 0\n  for (;;) {\n    const open = css.indexOf('/*', i)\n    if (open < 0) return out + css.slice(i)\n    out += css.slice(i, open)\n    const close = css.indexOf('*/', open + 2)\n    if (close < 0) return out\n    i = close + 2\n  }\n}\n\nfunction declarations(css: string): Declaration[] {\n  const text = withoutComments(css)\n  const out: Declaration[] = []\n  const within: string[] = []\n  let chunk = ''\n  let quote = ''\n  let depth = 0 // parentheses, so a `;` inside url(…) does not end anything\n  const flush = () => {\n    const m = /^\\s*(--[\\w-]+)\\s*:\\s*([\\s\\S]+?)\\s*$/.exec(chunk)\n    if (m) out.push({ name: m[1], value: m[2].replace(/\\s+/g, ' ').replace(/\\s*!important$/, ''), within: [...within] })\n    chunk = ''\n  }\n  for (const ch of text) {\n    if (quote) {\n      chunk += ch\n      if (ch === quote) quote = ''\n      continue\n    }\n    if (ch === '\"' || ch === \"'\") {\n      quote = ch\n      chunk += ch\n    } else if (ch === '(') {\n      depth++\n      chunk += ch\n    } else if (ch === ')') {\n      depth = Math.max(0, depth - 1)\n      chunk += ch\n    } else if (ch === '{' && depth === 0) {\n      within.push(chunk.trim().replace(/\\s+/g, ' '))\n      chunk = ''\n    } else if (ch === '}' && depth === 0) {\n      flush()\n      within.pop()\n    } else if (ch === ';' && depth === 0) {\n      flush()\n    } else {\n      chunk += ch\n    }\n  }\n  return out\n}\n\nconst DARK = /prefers-color-scheme:\\s*dark|data-(mode|theme|color-scheme)=[\"']?dark|\\.dark\\b/i\nconst LIGHT = /prefers-color-scheme:\\s*light|data-(mode|theme|color-scheme)=[\"']?light|\\.light\\b/i\nconst NAMED = /data-theme=[\"']?([\\w-]+)/i\n\n/** Whether a declaration applies to the page being themed. */\nfunction applies(d: Declaration, o: Required<Pick<StackmythThemeOptions, 'mode'>> & { theme?: string }): boolean {\n  for (const scope of d.within) {\n    if (o.mode === 'light' && DARK.test(scope)) return false\n    if (o.mode === 'dark' && LIGHT.test(scope)) return false\n    const named = NAMED.exec(scope)\n    if (named && !/^(dark|light)$/i.test(named[1]) && named[1] !== o.theme) return false\n    // Component-level rules (`.btn { --sm-… }`) are not the page's theme;\n    // the class a mode is switched with (`.dark`, as shadcn/ui does) is.\n    if (!scope.startsWith('@') && !/:root|^html\\b|^body\\b|\\[data-|^\\*$|:host|^\\.(dark|light)\\b/.test(scope)) return false\n  }\n  return true\n}\n\n// ── Tokens ─────────────────────────────────────────────────────────────────\n\n/** What a token's value may be written with, as Cauthy checks it. */\nconst TOKEN_CHARS = /^[A-Za-z0-9 #%.,()/'\"_+*-]+$/\nconst TOKEN_FUNCS = new Set(['var', 'calc', 'min', 'max', 'clamp', 'rgb', 'rgba', 'hsl', 'hsla', 'hwb', 'lab', 'lch', 'oklab', 'oklch', 'color',\n  'color-mix', 'light-dark', 'cubic-bezier', 'steps', 'linear', 'linear-gradient', 'radial-gradient', 'conic-gradient',\n  'repeating-linear-gradient', 'repeating-radial-gradient', 'drop-shadow', 'blur', 'translate', 'translatex', 'translatey', 'scale', 'rotate'])\n\nfunction tokenValue(value: string): string | null {\n  const v = value.replace(/\\s+/g, ' ').trim()\n  if (v === '' || v.length > 400 || !TOKEN_CHARS.test(v)) return null\n  for (const m of v.matchAll(/([A-Za-z-]+)\\(/g)) if (!TOKEN_FUNCS.has(m[1].toLowerCase())) return null\n  if (/^\\(|[ ,(]\\(/.test(v)) return null\n  return v\n}\n\n/** A scope that is the page's theme itself: the root, or the theme and mode attributes — never a component inside it. */\nconst THEME_SELECTOR = /^(?::root|html|body|\\[data-(?:theme|mode|color-scheme)(?:=[\"']?[\\w-]+[\"']?)?\\])$/i\n// Checked a selector at a time (split on commas and spaces) rather than with\n// one pattern over the list, which backtracks on a long one.\nconst isThemeScope = (selectors: string) => {\n  const parts = selectors.split(/[\\s,]+/).filter(Boolean)\n  return parts.length > 0 && parts.every((one) => THEME_SELECTOR.test(one))\n}\n\nexport interface StackmythTokens {\n  /** Every `--sm-*` token the stylesheets set for the page, ready for `theme.tokens`. */\n  tokens: Record<string, string>\n  /** Tokens that were there and Cauthy would not take, and why. */\n  warnings: string[]\n}\n\n/**\n * Reads an application's Stackmyth tokens out of its stylesheets: every\n * `--sm-*` custom property its theme sets, in the order the sheets are given\n * (a later one wins). Its own names — a brand palette the tokens point at —\n * are written in, so what comes out stands on Stackmyth's names alone.\n *\n * Cauthy's sign-in pages are drawn with Stackmyth's components: these tokens\n * are what makes them look like the application.\n */\nexport function tokensFromStackmyth(css: string | string[], options: StackmythThemeOptions = {}): StackmythTokens {\n  const mode = options.mode ?? 'light'\n  const all = (Array.isArray(css) ? css : [css]).flatMap(declarations)\n  const named = options.theme ?? all.map((d) => d.within.map((w) => NAMED.exec(w)?.[1]).find((n) => n && !/^(dark|light)$/i.test(n))).find(Boolean)\n  const vars = new Map<string, string>()\n  for (const d of all) {\n    if (!applies(d, { mode, theme: named })) continue\n    if (!d.within.every((w) => w.startsWith('@') || isThemeScope(w))) continue\n    vars.set(d.name, d.value)\n  }\n  // The application's own names are written in; Stackmyth's are left as references.\n  const inline = (value: string, depth = 0): string | null => {\n    if (depth > 16) return null\n    let failed = false\n    let out = value\n    for (let guard = 0; guard < 64; guard++) {\n      const next = out.replace(/var\\(\\s*(--(?!sm-)[\\w-]+)\\s*(?:,\\s*([^()]*(?:\\([^()]*\\)[^()]*)*))?\\)/, (_m, name: string, fallback?: string) => {\n        const known = vars.get(name)\n        const got = known !== undefined ? inline(known, depth + 1) : fallback !== undefined ? inline(fallback.trim(), depth + 1) : null\n        if (got === null) failed = true\n        return got ?? ''\n      })\n      if (failed) return null\n      if (next === out) break\n      out = next\n    }\n    return out\n  }\n  const tokens: Record<string, string> = {}\n  const warnings: string[] = []\n  for (const [name, raw] of vars) {\n    if (!/^--sm-[a-z0-9]+(?:-[a-z0-9]+)*$/.test(name)) continue\n    const written = inline(raw)\n    const value = written === null ? null : tokenValue(written)\n    if (value === null) warnings.push(`${name}: \"${raw.length > 60 ? raw.slice(0, 57) + '…' : raw}\" is not a value Cauthy takes`)\n    else tokens[name] = value\n  }\n  if (Object.keys(tokens).length === 0) warnings.push('no --sm-* token was found in these stylesheets')\n  return { tokens, warnings }\n}\n\n// ── Values ─────────────────────────────────────────────────────────────────\n\nfunction resolve(value: string, vars: Map<string, string>, seen = 0): string | null {\n  if (seen > 16) return null\n  let unresolved = false\n  // Innermost var() first: fallbacks may hold another var().\n  let out = value\n  for (let guard = 0; guard < 32 && /var\\(/.test(out); guard++) {\n    out = out.replace(/var\\(\\s*(--[\\w-]+)\\s*(?:,\\s*([^()]*(?:\\([^()]*\\)[^()]*)*))?\\)/, (_m, name: string, fallback?: string) => {\n      const known = vars.get(name)\n      const next = known !== undefined ? resolve(known, vars, seen + 1) : fallback !== undefined ? resolve(fallback.trim(), vars, seen + 1) : null\n      if (next === null) unresolved = true\n      return next ?? ''\n    })\n    if (unresolved) return null\n  }\n  return /var\\(/.test(out) ? null : out.trim()\n}\n\nconst clamp01 = (n: number) => Math.min(1, Math.max(0, n))\nconst hex2 = (n: number) => Math.round(clamp01(n) * 255).toString(16).padStart(2, '0')\nconst gamma = (c: number) => (c <= 0.0031308 ? 12.92 * c : 1.055 * Math.pow(c, 1 / 2.4) - 0.055)\n\nfunction out(r: number, g: number, b: number, a = 1): string {\n  if (a >= 1) return `#${hex2(r)}${hex2(g)}${hex2(b)}`\n  return `rgba(${Math.round(clamp01(r) * 255)}, ${Math.round(clamp01(g) * 255)}, ${Math.round(clamp01(b) * 255)}, ${Math.round(clamp01(a) * 1000) / 1000})`\n}\n\nconst alpha = (s: string | undefined) => (s === undefined ? 1 : s.endsWith('%') ? parseFloat(s) / 100 : parseFloat(s))\n\nconst KEYWORDS: Record<string, string> = { white: '#ffffff', black: '#000000' }\n\n/** A colour as Cauthy takes it — `#rrggbb` or `rgba(…)` — or null when it is none it can read. */\nexport function toColor(value: string): string | null {\n  const v = value.trim().toLowerCase()\n  if (KEYWORDS[v]) return KEYWORDS[v]\n  if (/^#([0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$/.test(v)) return v\n  let m = /^rgba?\\(\\s*([\\d.]+%?)[\\s,]+([\\d.]+%?)[\\s,]+([\\d.]+%?)(?:\\s*[,/]\\s*([\\d.]+%?))?\\s*\\)$/.exec(v)\n  if (m) {\n    const ch = (s: string) => (s.endsWith('%') ? parseFloat(s) / 100 : parseFloat(s) / 255)\n    return out(ch(m[1]), ch(m[2]), ch(m[3]), alpha(m[4]))\n  }\n  m = /^hsla?\\(\\s*([\\d.]+)(?:deg)?[\\s,]+([\\d.]+)%[\\s,]+([\\d.]+)%(?:\\s*[,/]\\s*([\\d.]+%?))?\\s*\\)$/.exec(v)\n  if (m) {\n    const h = ((parseFloat(m[1]) % 360) + 360) % 360\n    const s = parseFloat(m[2]) / 100\n    const l = parseFloat(m[3]) / 100\n    const f = (n: number) => {\n      const k = (n + h / 30) % 12\n      return l - s * Math.min(l, 1 - l) * Math.max(-1, Math.min(k - 3, 9 - k, 1))\n    }\n    return out(f(0), f(8), f(4), alpha(m[4]))\n  }\n  m = /^oklch\\(\\s*([\\d.]+%?)\\s+([\\d.]+%?)\\s+([\\d.]+)(?:deg)?(?:\\s*\\/\\s*([\\d.]+%?))?\\s*\\)$/.exec(v)\n  if (m) {\n    const L = m[1].endsWith('%') ? parseFloat(m[1]) / 100 : parseFloat(m[1])\n    const C = m[2].endsWith('%') ? (parseFloat(m[2]) / 100) * 0.4 : parseFloat(m[2])\n    const H = (parseFloat(m[3]) * Math.PI) / 180\n    const a = C * Math.cos(H)\n    const b = C * Math.sin(H)\n    const l = Math.pow(L + 0.3963377774 * a + 0.2158037573 * b, 3)\n    const mm = Math.pow(L - 0.1055613458 * a - 0.0638541728 * b, 3)\n    const s = Math.pow(L - 0.0894841775 * a - 1.291485548 * b, 3)\n    return out(\n      gamma(4.0767416621 * l - 3.3077115913 * mm + 0.2309699292 * s),\n      gamma(-1.2684380046 * l + 2.6097574011 * mm - 0.3413193965 * s),\n      gamma(-0.0041960863 * l - 0.7034186147 * mm + 1.707614701 * s),\n      alpha(m[4]),\n    )\n  }\n  return null\n}\n\n/** A length in pixels, within what Cauthy takes, or null. */\nfunction toRadius(value: string): number | null {\n  const m = /^([\\d.]+)(px|rem|em)?$/.exec(value.trim())\n  if (!m) return null\n  const px = parseFloat(m[1]) * (m[2] === 'rem' || m[2] === 'em' ? 16 : 1)\n  return Number.isFinite(px) ? Math.min(MAX_RADIUS, Math.max(0, Math.round(px))) : null\n}\n\n/** A font list as Cauthy takes it, or null. */\nfunction toFont(value: string): string | null {\n  const v = value.trim()\n  return /^[A-Za-z0-9 ,'\"_-]{1,200}$/.test(v) && (v.match(/\"/g)?.length ?? 0) % 2 === 0 && (v.match(/'/g)?.length ?? 0) % 2 === 0 ? v : null\n}\n\n// ── Stackmyth ──────────────────────────────────────────────────────────────\n\n/** Which Stackmyth token each value of a theme is read from, first found wins. */\nconst COLORS: [keyof CauthyTheme, string[]][] = [\n  ['background', ['--sm-bg-surface', '--sm-surface']],\n  ['surface', ['--sm-bg-surface-raised', '--sm-surface-raised']],\n  ['text', ['--sm-text-primary', '--sm-surface-text']],\n  ['textMuted', ['--sm-text-secondary']],\n  ['border', ['--sm-border-default', '--sm-surface-border']],\n  ['primary', ['--sm-primary', '--sm-bg-interactive']],\n  ['primaryText', ['--sm-primary-text', '--sm-text-inverse']],\n  ['accent', ['--sm-text-brand', '--sm-border-focus', '--sm-accent']],\n  ['error', ['--sm-error-soft-text', '--sm-error']],\n  ['errorBackground', ['--sm-error-soft']],\n  ['success', ['--sm-success-soft-text', '--sm-success']],\n  ['successBackground', ['--sm-success-soft']],\n]\n\n/**\n * Reads an application's Stackmyth theme out of its stylesheets.\n *\n * Give it the CSS that declares the tokens, in the order the application\n * loads it — Stackmyth's own (`@stackmyth/core/core.vars.css`, or a theme\n * file) and then the application's brand file that re-points them. Tokens\n * that point at the application's own variables are followed. The\n * application's dark mode is left out unless asked for.\n */\nexport function themeFromStackmyth(css: string | string[], options: StackmythThemeOptions = {}): ImportedTheme {\n  const o = { mode: options.mode ?? 'light', theme: options.theme }\n  const vars = new Map<string, string>()\n  for (const sheet of Array.isArray(css) ? css : [css]) {\n    for (const d of declarations(sheet)) if (applies(d, o)) vars.set(d.name, d.value)\n  }\n  const theme: CauthyTheme = {}\n  const warnings: string[] = []\n\n  const read = <T>(tokens: string[], to: (v: string) => T | null, what: string): T | undefined => {\n    for (const token of tokens) {\n      const raw = vars.get(token)\n      if (raw === undefined) continue\n      const value = resolve(raw, vars)\n      const got = value === null ? null : to(value)\n      if (got !== null) return got\n      warnings.push(`${token}: \"${raw}\" is not ${what} Cauthy can take`)\n    }\n    return undefined\n  }\n\n  for (const [field, tokens] of COLORS) {\n    const c = read(tokens, toColor, 'a colour')\n    if (c !== undefined) (theme as Record<string, unknown>)[field] = c\n  }\n  const radius = read(['--sm-radius-container', '--sm-radius-md'], toRadius, 'a length')\n  if (radius !== undefined) theme.radius = radius\n  const button = read(['--sm-radius-interactive', '--sm-radius-sm'], toRadius, 'a length')\n  if (button !== undefined) theme.buttonRadius = button\n  const font = read(['--sm-font-family'], toFont, 'a font list')\n  if (font !== undefined) theme.fontFamily = font\n  if (options.logoUrl) theme.logoUrl = options.logoUrl\n\n  if (vars.size === 0) warnings.push('no custom properties were found: is this the stylesheet that declares the --sm-* tokens?')\n  else if (![...vars.keys()].some((k) => k.startsWith('--sm-'))) warnings.push('no --sm-* token was found in these stylesheets')\n  return { theme, warnings }\n}\n\n// ── Any stylesheet ─────────────────────────────────────────────────────────\n\n/** The values of a theme a stylesheet can say. */\nexport type ThemeField =\n  | 'background' | 'surface' | 'text' | 'textMuted' | 'border' | 'inputBackground' | 'inputBorder'\n  | 'primary' | 'primaryText' | 'accent' | 'error' | 'errorBackground' | 'success' | 'successBackground'\n  | 'radius' | 'buttonRadius' | 'fontFamily'\n\n/** How a stylesheet names its look: Stackmyth's tokens, shadcn/ui's (and Tailwind's), or the application's own. */\nexport type CssFormat = 'stackmyth' | 'shadcn' | 'custom'\n\nexport interface CssThemeOptions {\n  /** Which names to read. Default: `auto`, told from the stylesheet itself. */\n  format?: CssFormat | 'auto'\n  /** Which of the application's two modes to take. Default: `light`. */\n  mode?: 'light' | 'dark'\n  /** The named theme to read, when the stylesheet keeps several under `[data-theme=…]`. */\n  theme?: string\n  /** For `custom`: the variable each value is read from, `{ primary: '--brand' }`. */\n  map?: Partial<Record<ThemeField, string>>\n}\n\nexport interface CssImportedTheme extends ImportedTheme {\n  /** The names that were read. */\n  format: CssFormat\n}\n\nconst RADII: ThemeField[] = ['radius', 'buttonRadius']\n\n/** shadcn/ui's names, as Tailwind 3 (`--primary`) and Tailwind 4 (`--color-primary`) write them. */\nconst SHADCN: [ThemeField, string[]][] = [\n  ['background', ['--background', '--color-background']],\n  ['surface', ['--card', '--color-card', '--popover', '--color-popover']],\n  ['text', ['--foreground', '--color-foreground']],\n  ['textMuted', ['--muted-foreground', '--color-muted-foreground']],\n  ['border', ['--border', '--color-border']],\n  ['inputBorder', ['--input', '--color-input']],\n  ['primary', ['--primary', '--color-primary']],\n  ['primaryText', ['--primary-foreground', '--color-primary-foreground']],\n  ['accent', ['--ring', '--color-ring', '--primary', '--color-primary']],\n  ['error', ['--destructive', '--color-destructive']],\n  ['radius', ['--radius']],\n  ['buttonRadius', ['--radius']],\n  ['fontFamily', ['--font-sans', '--font-family']],\n]\n\n/** A colour as shadcn/ui writes it on Tailwind 3 — `222.2 84% 4.9%`, the inside of hsl() — or any other. */\nfunction shadcnColor(value: string): string | null {\n  return /^[\\d.]+(?:deg)?\\s+[\\d.]+%\\s+[\\d.]+%(?:\\s*\\/\\s*[\\d.]+%?)?$/.test(value.trim()) ? toColor(`hsl(${value.trim()})`) : toColor(value)\n}\n\n/** Every custom property a stylesheet sets for the page, the last one winning. */\nfunction pageVariables(css: string | string[], mode: 'light' | 'dark', theme?: string): Map<string, string> {\n  const vars = new Map<string, string>()\n  for (const sheet of Array.isArray(css) ? css : [css]) {\n    for (const d of declarations(sheet)) if (applies(d, { mode, theme })) vars.set(d.name, d.value)\n  }\n  return vars\n}\n\n/** The custom properties a stylesheet sets for the page, by name: what a person picks from to map their own. */\nexport function cssVariables(css: string | string[], options: Pick<CssThemeOptions, 'mode' | 'theme'> = {}): string[] {\n  return [...pageVariables(css, options.mode ?? 'light', options.theme).keys()].sort()\n}\n\n/**\n * Reads an application's look out of its stylesheets, whatever names it uses:\n * Stackmyth's tokens, shadcn/ui's (`--primary`, `--radius`, on Tailwind 3 or\n * 4), or the application's own variables given in `map`. What comes out is a\n * theme of named values, never CSS.\n */\nexport function themeFromCss(css: string | string[], options: CssThemeOptions = {}): CssImportedTheme {\n  const mode = options.mode ?? 'light'\n  const vars = pageVariables(css, mode, options.theme)\n  const names = [...vars.keys()]\n  let format: CssFormat\n  if (options.format && options.format !== 'auto') format = options.format\n  else if (options.map && Object.keys(options.map).length > 0) format = 'custom'\n  else if (names.some((n) => n.startsWith('--sm-'))) format = 'stackmyth'\n  else if (names.some((n) => /^--(color-)?(primary|background|foreground)$/.test(n))) format = 'shadcn'\n  else format = 'custom'\n\n  if (format === 'stackmyth') return { ...themeFromStackmyth(css, { mode, theme: options.theme }), format }\n\n  const spec: [ThemeField, string[]][] = format === 'shadcn'\n    ? SHADCN\n    : Object.entries(options.map ?? {}).filter(([, v]) => v).map(([k, v]) => [k as ThemeField, [String(v).startsWith('--') ? String(v) : `--${v}`]])\n  const theme: CauthyTheme = {}\n  const warnings: string[] = []\n  for (const [field, tokens] of spec) {\n    for (const token of tokens) {\n      const raw = vars.get(token)\n      if (raw === undefined) continue\n      const value = resolve(raw, vars)\n      const got = value === null ? null\n        : RADII.includes(field) ? toRadius(value)\n        : field === 'fontFamily' ? toFont(value)\n        : format === 'shadcn' ? shadcnColor(value) : toColor(value)\n      if (got !== null) {\n        (theme as Record<string, unknown>)[field] = got\n        break\n      }\n      warnings.push(`${token}: \"${raw.length > 60 ? raw.slice(0, 57) + '…' : raw}\" is not ${RADII.includes(field) ? 'a length' : field === 'fontFamily' ? 'a font list' : 'a colour'} Cauthy can take`)\n    }\n  }\n  if (vars.size === 0) warnings.push('no custom properties were found in these stylesheets')\n  else if (format === 'custom' && spec.length === 0) warnings.push('these stylesheets use names of their own: say which variable each value is read from')\n  return { theme, warnings, format }\n}\n\n// ── On the application's own screens ───────────────────────────────────────\n\n/**\n * A theme as the CSS variables of `@cauthyhq/react/styles.css` (stage 5) (`--cauthy-*`), for\n * the forms an application shows on its own pages. The page's own background,\n * the layout and the words are Cauthy's pages' matter, and left out.\n */\nexport function themeVariables(theme: CauthyTheme): Record<string, string> {\n  const vars: Record<string, string> = {}\n  const put = (name: string, v: string | number | undefined) => {\n    if (v === undefined || v === '') return\n    vars[`--cauthy-${name}`] = typeof v === 'number' ? `${v}px` : v\n  }\n  put('surface', theme.surface)\n  put('text', theme.text)\n  put('text-muted', theme.textMuted)\n  put('border', theme.border)\n  put('input-background', theme.inputBackground)\n  put('input-border', theme.inputBorder)\n  put('primary', theme.primary)\n  put('primary-text', theme.primaryText)\n  put('accent', theme.accent)\n  put('error', theme.error)\n  put('error-background', theme.errorBackground)\n  put('success', theme.success)\n  put('success-background', theme.successBackground)\n  put('radius', theme.radius)\n  put('button-radius', theme.buttonRadius)\n  put('font', theme.fontFamily)\n  return vars\n}\n\n// ── Sending it to Cauthy ───────────────────────────────────────────────────\n\n/** A theme as Cauthy's API names its values. */\nexport function toWire(theme: CauthyTheme): Record<string, unknown> {\n  const names: Record<keyof CauthyTheme, string> = {\n    background: 'background', surface: 'surface', text: 'text', textMuted: 'text_muted', border: 'border',\n    primary: 'primary', primaryText: 'primary_text', accent: 'accent', error: 'error', errorBackground: 'error_background',\n    success: 'success', successBackground: 'success_background', radius: 'radius', buttonRadius: 'button_radius',\n    fontFamily: 'font_family', logoUrl: 'logo_url', fonts: 'fonts', layout: 'layout', panelColors: 'panel_colors',\n    panelText: 'panel_text', panelIconUrl: 'panel_icon_url', texts: 'texts', inputBackground: 'input_background', inputBorder: 'input_border', tokens: 'tokens',\n  }\n  const wire: Record<string, unknown> = {}\n  for (const [k, v] of Object.entries(theme)) {\n    if (v === undefined || v === '' || (Array.isArray(v) && v.length === 0)) continue\n    wire[names[k as keyof CauthyTheme]] = v\n  }\n  return wire\n}\n\n/** A theme as Cauthy answers it, in this package's names. */\nexport function fromWire(wire: Record<string, unknown>): CauthyTheme {\n  const names: Record<string, keyof CauthyTheme> = {\n    background: 'background', surface: 'surface', text: 'text', text_muted: 'textMuted', border: 'border',\n    primary: 'primary', primary_text: 'primaryText', accent: 'accent', error: 'error', error_background: 'errorBackground',\n    success: 'success', success_background: 'successBackground', radius: 'radius', button_radius: 'buttonRadius',\n    font_family: 'fontFamily', logo_url: 'logoUrl', fonts: 'fonts', layout: 'layout', panel_colors: 'panelColors',\n    panel_text: 'panelText', panel_icon_url: 'panelIconUrl', texts: 'texts', input_background: 'inputBackground', input_border: 'inputBorder', tokens: 'tokens',\n  }\n  const theme: Record<string, unknown> = {}\n  for (const [k, v] of Object.entries(wire ?? {})) if (names[k] && v !== undefined && v !== null && v !== '') theme[names[k]] = v\n  return theme as CauthyTheme\n}\n\nexport interface PushThemeOptions {\n  /** Cauthy's address. Default: `CAUTHY_ISSUER`. */\n  issuer?: string\n  /** The application's client id. Default: `CAUTHY_CLIENT_ID`. */\n  clientId?: string\n  /** The workspace's slug. Default: `CAUTHY_TENANT`. */\n  tenant?: string\n  /**\n   * A personal access token with `oauth_clients:manage`. Default:\n   * `CAUTHY_TOKEN`. It belongs in the deploy pipeline, never in the application.\n   */\n  token?: string\n  theme: CauthyTheme\n  fetch?: typeof fetch\n  /** How long the call may take, in milliseconds, before it fails with a `TimeoutError`. Default: 5000. */\n  timeoutMs?: number\n}\n\n/**\n * Gives the application its look on Cauthy's pages. It replaces the theme: a\n * value left out goes back to Cauthy's own. Run it when the brand changes —\n * from a script or the deploy — not on every request.\n */\nexport async function pushTheme(o: PushThemeOptions): Promise<void> {\n  const env = (n: string) => (typeof process !== 'undefined' ? process.env?.[n] : undefined)\n  const issuer = withoutTrailingSlashes(o.issuer ?? env('CAUTHY_ISSUER') ?? '')\n  const clientId = o.clientId ?? env('CAUTHY_CLIENT_ID') ?? ''\n  const tenant = o.tenant ?? env('CAUTHY_TENANT') ?? ''\n  const token = o.token ?? env('CAUTHY_TOKEN') ?? ''\n  for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_CLIENT_ID: clientId, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {\n    if (v === '') throw new Error(`@cauthyhq/node: ${name} is required to push a theme`)\n  }\n  const res = await deadline(o.fetch, o.timeoutMs ?? DEFAULT_DEADLINE_MS)(`${issuer}/v1/oauth/clients/${encodeURIComponent(clientId)}/theme`, {\n    method: 'PUT',\n    headers: { authorization: `Bearer ${token}`, 'x-tenant-key': tenant, 'content-type': 'application/json' },\n    body: JSON.stringify(toWire(o.theme)),\n  })\n  if (!res.ok) {\n    const body = (await res.json().catch(() => null)) as { errors?: { message?: string }[] } | null\n    throw new Error(`@cauthyhq/node: Cauthy refused the theme (${res.status}): ${body?.errors?.[0]?.message ?? res.statusText}`)\n  }\n}\n","/** How an application is set up to sign its people in with Cauthy. */\nexport interface CauthyOptions {\n  /**\n   * The application's CAUTHY_KEY, made in Cauthy's dashboard: Cauthy's\n   * address, the application's client and its secret, in one value. Default:\n   * `CAUTHY_KEY`. With it nothing else is read: the workspace, the system and\n   * the application's addresses come from Cauthy (`GET /v1/connect/self`),\n   * and passing `issuer`, `clientId`, `clientSecret`, `secret`, `system`,\n   * `tenant`, `audience`, `tenantId` or `systemKey` is refused.\n   */\n  key?: string\n  /** The key being replaced, during a rotation: read, never written with. Default: `CAUTHY_KEY_PREVIOUS`. */\n  keyPrevious?: string\n  /** Cauthy's public address, e.g. `https://id.example.com`. Default: `CAUTHY_ISSUER`. */\n  issuer?: string\n  /** The application's OAuth client id. Default: `CAUTHY_CLIENT_ID`. */\n  clientId?: string\n  /** Its secret, when the client is confidential. Default: `CAUTHY_CLIENT_SECRET`. */\n  clientSecret?: string\n  /**\n   * The key the session cookie is encrypted with: any string of 32 characters\n   * or more, kept on the server. Default: `CAUTHY_SECRET`.\n   */\n  secret?: string\n  /**\n   * The system this application is, as its organizations are filed under in\n   * Cauthy (`\"acme-crm\"`). When set, a session's organizations are that\n   * system's. Default: `CAUTHY_SYSTEM`.\n   */\n  system?: string\n  /**\n   * The workspace's slug in Cauthy. Needed for the application's own sign-in\n   * screens (`signIn.email`, `signUp.email`…), which sign people in through\n   * the application's server instead of Cauthy's page. Default: `CAUTHY_TENANT`.\n   */\n  tenant?: string\n  /** Where the routes are mounted. Default: `/api/auth`. */\n  basePath?: string\n  /**\n   * What happens to a POST without `X-Cauthy-Request: 1` (every POST but\n   * `/logout`). `required`, the default, answers `403 csrf_required`, as\n   * protocol level strict asks. `warn` lets it through and says so once per\n   * process: for the one deploy that moves an application whose browser still\n   * runs cauthy-auth 0.42, which does not send the header. Remove it once the\n   * browser runs cauthy-auth 0.43 or @cauthyhq/js.\n   */\n  requestHeader?: 'required' | 'warn'\n  /**\n   * The audience of the access tokens `auth.verifyToken` accepts: the\n   * deployment's `JWT_AUDIENCE`, which Cauthy requires its operator to set and\n   * has no default for. Default: `CAUTHY_AUDIENCE`.\n   */\n  audience?: string\n  /**\n   * The workspace's id (a lowercase UUID) for `auth.verifyToken`. On\n   * CAUTHY_KEY it is Cauthy's answer; otherwise: this, or `CAUTHY_TENANT_ID`.\n   */\n  tenantId?: string\n  /**\n   * The application's own public origin (`https://app.example.com`): the\n   * redirect URI, the cookies' `Secure` flag and which forms are its own come\n   * from it. Default: `CAUTHY_BASE_URL`, else the origin of each request, with\n   * the scheme a proxy names in `x-forwarded-proto`. Set it whenever a proxy\n   * also changes the host or the port.\n   */\n  baseURL?: string\n  /** Where a person lands after signing in, when no `return_to` was asked. Default: `/`. */\n  afterSignIn?: string\n  /** Where a person lands after signing out. Default: `/`. */\n  afterSignOut?: string\n  /** Name of the session cookie. Default: `cauthy_session`. */\n  cookieName?: string\n  /**\n   * A key the application proves who it is with when it acts on its own\n   * (`auth.system`), instead of its secret. Default: `CAUTHY_SYSTEM_KEY` and\n   * `CAUTHY_SYSTEM_KEY_ID`.\n   */\n  systemKey?: import('./system').SystemKey\n  /**\n   * The application's own pages for what arrives by mail. A link Cauthy mails\n   * opens the page named here, with a `token` to give back; with none, it\n   * opens Cauthy's own page.\n   *\n   *   signIn         where `<SignIn />` is: a sign-in link opens it\n   *   resetPassword  where `<ResetPassword />` is\n   *   verifyEmail    where `<VerifyEmail />` is\n   *   acceptInvite   where `<AcceptInvite />` is: an invitation opens it\n   *\n   * An invitation sent by `auth.system.members.add` or `auth.system.invite`\n   * opens `acceptInvite` only when the application knows its public origin\n   * (`baseURL`): that call has no request to read it from.\n   */\n  pages?: { signIn?: string; resetPassword?: string; verifyEmail?: string; acceptInvite?: string }\n  /**\n   * The address of the person a request comes from, passed on to Cauthy so\n   * its limits on attempts count the person and not this server. Default: the\n   * last address in `X-Forwarded-For`, which is the one the proxy in front of\n   * the application wrote. With several proxies, or none, give your own.\n   */\n  clientIp?: (request: Request) => string | undefined\n  /** `fetch` to reach Cauthy with. Default: the global one. */\n  fetch?: typeof fetch\n  /**\n   * How long a call to Cauthy may take before it fails, in milliseconds.\n   * `system`: the application's own calls (`auth.system`, and the proof its\n   * sign-ins carry). Default 2000. `request`: the sign-in screens' calls and\n   * the code, refresh and userinfo calls of a session. Default 5000. The\n   * push-approval event stream has no deadline.\n   */\n  timeouts?: { system?: number; request?: number }\n  /**\n   * Removed in 1.3: contracts are retired. Given, `createCauthy` refuses to\n   * start (as it does with `PACT_ROOT_KEY` or `PACT_ROOT_KEY_PREVIOUS` set):\n   * run on CAUTHY_KEY alone, and protect sign-in with the \"Protect sign-in\"\n   * switches on the application's card in Cauthy's dashboard.\n   */\n  contract?: never\n  /** Removed in 1.3 with contracts: given, `createCauthy` refuses to start. */\n  keys?: never\n  /** Removed in 1.3 with contracts (it was `PACT_ROOT_KEY`): given, `createCauthy` refuses to start. */\n  rootKey?: never\n  /** Removed in 1.3 with contracts (it was `PACT_ROOT_KEY_PREVIOUS`): given, `createCauthy` refuses to start. */\n  rootKeyPrevious?: never\n  /**\n   * Where `auth.webhook` remembers the deliveries it took, so one sent twice\n   * is refused. Default: this process's memory. Give a shared one (a table)\n   * when the application runs on several instances.\n   */\n  webhookReplay?: import('./webhook').ReplayStore\n}\n\n/** The person signed in. Every moment is UTC. */\nexport interface SessionUser {\n  id: string\n  email: string\n  name: string\n  emailVerified: boolean\n  /**\n   * True when the account ran out of time to confirm its address: let it read\n   * and refuse its writes.\n   */\n  restricted: boolean\n  /** When an unconfirmed address stops being enough (ISO 8601, UTC), if there is a deadline. */\n  emailVerifyBy?: string\n  /** The language the person reads in (\"es\", \"en-US\"), when Cauthy knows it. */\n  locale?: string\n  /** A guest: a visitor's session before they sign up. No email; `account.upgrade` makes it an account, keeping `id`. */\n  isAnonymous?: boolean\n}\n\n/** A value JSON can carry. What crosses from server to browser is typed as this, never `unknown`. */\nexport type JsonValue = string | number | boolean | null | JsonValue[] | { [key: string]: JsonValue }\n\n/** An organization the person belongs to, with their role in it. */\nexport interface SessionOrganization {\n  id: string\n  system: string\n  name: string\n  kind: string\n  externalId?: string\n  role: string\n  /** What the system keeps about the organization, as it filed it in Cauthy. */\n  metadata: Record<string, JsonValue>\n  /**\n   * What the person may do here, as \"resource:action\" entries (\"*\" is any):\n   * their role's permissions, what it inherits, and anything given to them\n   * apart from it. Absent when the system keeps no catalog of roles in Cauthy.\n   * Check with `can(organization, resource, action)`.\n   */\n  permissions?: string[]\n  /** What the person is denied here, whatever else allows it. */\n  denied?: string[]\n  /**\n   * Permissions that hold only when their condition does (an amount under a\n   * limit, the person's own records…). They are in neither list above: `can`\n   * answers no for them, and `auth.check` asks Cauthy. Present, maybe empty,\n   * whenever `permissions` is.\n   */\n  conditional?: ConditionalPermission[]\n}\n\n/** A permission with a condition: Cauthy decides it per question (`auth.check`). */\nexport interface ConditionalPermission {\n  resource: string\n  action: string\n  effect: 'allow' | 'deny'\n}\n\n/** What to ask Cauthy about: an action on a resource, with what the conditions read of it. */\nexport interface CheckQuestion {\n  resource: string\n  action: string\n  /** What a condition reads as `resource.attrs`: `{ amount: 500 }`. */\n  attributes?: Record<string, unknown>\n  /** The record's id, as a condition reads it (`resource.id`). */\n  resourceId?: string\n  /** Whose the record is (`resource.owner_id`): `resource.owner_id == subject.id`. */\n  ownerId?: string\n}\n\n/** An organization, by its id or as the session has it. */\nexport type OrganizationRef = string | { id: string }\n\n/** The rule that decided a check. */\nexport interface CheckRule {\n  /** A permission of the person's role, or an exception given to the person. */\n  source: 'role' | 'exception'\n  /** The role, when `source` is `role`. */\n  role?: string\n  kind: string\n  resource: string\n  action: string\n  effect: 'allow' | 'deny'\n  condition?: string\n}\n\n/** Cauthy's answer to a check. */\nexport interface CheckResult {\n  allowed: boolean\n  /** Why, in words: \"allowed by role accountant: invoices:approve\". */\n  reason: string\n  /** The rule that decided; absent when none did (nothing allows it). */\n  rule?: CheckRule\n}\n\n/** A signed-in person, as the server sees them. */\nexport interface Session {\n  user: SessionUser\n  /** The Cauthy tenant the account is of. */\n  tenantId: string\n  /** The roles the account holds in that tenant. */\n  roles: string[]\n  /**\n   * Cauthy's access token for this person: send it as `Authorization: Bearer`\n   * to another service that verifies Cauthy's tokens. Never give it to the browser.\n   */\n  accessToken: string\n  /** When the access token expires and the session is checked with Cauthy again (ISO 8601, UTC). */\n  expiresAt: string\n}\n\n/** What the browser is told of a session: who, and their organizations — never a token. */\nexport interface PublicSession {\n  user: SessionUser\n  tenantId: string\n  roles: string[]\n  organizations: SessionOrganization[]\n  expiresAt: string\n}\n\n/** Why there is no session. */\nexport type SessionStatus =\n  | 'authenticated'\n  | 'unauthenticated' // nobody is signed in\n  | 'expired' // signed in, but the session must be renewed first (see `Cauthy.resolve`)\n\nexport class CauthyConfigError extends Error {\n  constructor(message: string) {\n    super(`@cauthyhq/node: ${message}`)\n    this.name = 'CauthyConfigError'\n  }\n}\n\n/** Why a CAUTHY_KEY was refused (key/cauthy-key.md §3, §8, §9). */\nexport type CauthyKeyReason = 'key_format' | 'key_version' | 'key_checksum' | 'key_issuer' | 'key_client' | 'key_secret'\n  | 'key_previous_mismatch'\n\n/** A refused CAUTHY_KEY. The message names the reason, never the key. */\nexport class CauthyKeyError extends CauthyConfigError {\n  constructor(readonly reason: CauthyKeyReason, message: string) {\n    super(`CAUTHY_KEY: ${message} (${reason})`)\n    this.name = 'CauthyKeyError'\n  }\n}\n","// What a sign-in or sign-up form is checked for before anything is sent, in\n// the browser and again on the server: the same rules in both places, so the\n// form says what the server would.\n\nexport type AuthField = 'email' | 'password' | 'newPassword' | 'name' | 'code' | 'organization'\n\n/** A value of a form that cannot be sent as it is. */\nexport interface FieldProblem {\n  field: AuthField\n  /**\n   * Stable, for translating: `required`, `invalid_email`, `too_short`,\n   * `too_long`, and for a new password the rule of the workspace it fails:\n   * `needs_lowercase`, `needs_uppercase`, `needs_digit`, `needs_symbol`,\n   * `needs_classes`.\n   */\n  code: 'required' | 'invalid_email' | PasswordReason\n  message: string\n}\n\n/** The shortest password Cauthy takes by default: a workspace's policy may ask otherwise (`methods().password`). */\nexport const MIN_PASSWORD = 12\n/** The longest: the API bounds what Argon2id is given, whatever the workspace asks. */\nconst MAX_PASSWORD = 128\n/** The shortest any workspace may allow. */\nconst FLOOR_PASSWORD = 8\nconst MAX_NAME = 120\n\n/** A kind of character a workspace's password policy can ask for. */\nexport type PasswordClass = 'lowercase' | 'uppercase' | 'digit' | 'symbol'\n\n/** Why a new password is refused: the API's `weak_password` `meta.reasons`. */\nexport type PasswordReason = 'too_short' | 'too_long' | 'needs_lowercase' | 'needs_uppercase' | 'needs_digit' | 'needs_symbol' | 'needs_classes' | 'breached'\n\n/**\n * What a new password must be in the workspace, as `methods().password` says\n * it. Length is counted in bytes of UTF-8, as Cauthy counts it. A symbol is\n * any character that is neither a letter nor a digit, a space included.\n */\nexport interface PasswordPolicy {\n  min: number\n  max: number\n  /** The kinds the password must each carry at least once. */\n  requires: PasswordClass[]\n  /** At least this many of the four kinds; 0 asks none. */\n  min_classes: number\n  /** Cauthy refuses a password found in a published breach (checked by Cauthy alone). */\n  reject_breached: boolean\n}\n\nconst CLASSES: PasswordClass[] = ['lowercase', 'uppercase', 'digit', 'symbol']\n\n/** The policy of a workspace that set none: what every one asked before they could choose. */\nexport const DEFAULT_PASSWORD_POLICY: PasswordPolicy = Object.freeze({ min: MIN_PASSWORD, max: MAX_PASSWORD, requires: [], min_classes: 0, reject_breached: false }) as PasswordPolicy\n\nconst int = (v: unknown, fallback: number) => (typeof v === 'number' && Number.isFinite(v) ? Math.trunc(v) : fallback)\n\n/**\n * A password policy as Cauthy sent it — `{ min_length, max_length, … }` from\n * the sign-in settings, or `{ min, max, … }` from `methods()` — made safe to\n * use: the defaults where nothing is said, and never outside 8–128.\n */\nexport function passwordPolicyOf(raw: unknown): PasswordPolicy {\n  const r = (raw && typeof raw === 'object' ? raw : {}) as Record<string, unknown>\n  const min = Math.min(Math.max(int(r.min ?? r.min_length, MIN_PASSWORD) || MIN_PASSWORD, FLOOR_PASSWORD), MAX_PASSWORD)\n  const max = Math.max(Math.min(int(r.max ?? r.max_length, MAX_PASSWORD) || MAX_PASSWORD, MAX_PASSWORD), min)\n  const asked = Array.isArray(r.requires) ? r.requires : []\n  return {\n    min, max,\n    requires: CLASSES.filter((c) => asked.includes(c)),\n    min_classes: Math.min(Math.max(int(r.min_classes ?? r.minClasses, 0), 0), CLASSES.length),\n    reject_breached: (r.reject_breached ?? r.rejectBreached) === true,\n  }\n}\n\n/** Bytes of UTF-8: what Cauthy counts a password's length in. */\nfunction utf8Length(v: string): number {\n  let n = 0\n  for (const ch of v) {\n    const c = ch.codePointAt(0)!\n    n += c < 0x80 ? 1 : c < 0x800 ? 2 : c < 0x10000 ? 3 : 4\n  }\n  return n\n}\n\n/** Which of the four kinds a password carries, as Cauthy tells them apart. */\nfunction classesOf(v: string): Set<PasswordClass> {\n  const has = new Set<PasswordClass>()\n  for (const ch of v) {\n    if (/\\p{Ll}/u.test(ch)) has.add('lowercase')\n    else if (/\\p{Lu}/u.test(ch)) has.add('uppercase')\n    else if (/\\p{Nd}/u.test(ch)) has.add('digit')\n    else if (!/\\p{L}/u.test(ch)) has.add('symbol') // a letter without case is neither\n  }\n  return has\n}\n\n/**\n * Every rule of the policy a new password fails, as the API names them;\n * empty when it meets them all. Whether it was in a breach only Cauthy knows.\n */\nexport function passwordProblems(value: string, policy: PasswordPolicy = DEFAULT_PASSWORD_POLICY): PasswordReason[] {\n  const p = passwordPolicyOf(policy)\n  const out: PasswordReason[] = []\n  const length = utf8Length(value)\n  if (length < p.min) out.push('too_short')\n  if (length > p.max) out.push('too_long')\n  const has = classesOf(value)\n  for (const c of p.requires) if (!has.has(c)) out.push(`needs_${c}` as PasswordReason)\n  if (p.min_classes > 0 && CLASSES.filter((c) => has.has(c)).length < p.min_classes) out.push('needs_classes')\n  return out\n}\n\n/** The languages the rule is said in. */\nexport type PasswordLocale = 'en' | 'es'\n\nconst RULES: Record<PasswordLocale, {\n  between: string; requires: string; classes: string; breached: string; and: string; kinds: Record<PasswordClass, string>\n  reasons: Record<PasswordReason, string>\n}> = {\n  en: {\n    between: 'Between {min} and {max} characters.', requires: 'Include {kinds}.', and: 'and',\n    classes: 'Use at least {n} of these: lowercase letters, uppercase letters, digits, symbols.',\n    breached: 'Passwords found in known data breaches are not accepted.',\n    kinds: { lowercase: 'a lowercase letter', uppercase: 'an uppercase letter', digit: 'a digit', symbol: 'a symbol' },\n    reasons: {\n      too_short: 'Use at least {min} characters.', too_long: 'Use at most {max} characters.',\n      needs_lowercase: 'Include a lowercase letter.', needs_uppercase: 'Include an uppercase letter.', needs_digit: 'Include a digit.', needs_symbol: 'Include a symbol.',\n      needs_classes: 'Use at least {n} of these: lowercase letters, uppercase letters, digits, symbols.',\n      breached: 'This password appears in a known data breach. Choose a different one.',\n    },\n  },\n  es: {\n    between: 'Entre {min} y {max} caracteres.', requires: 'Incluye {kinds}.', and: 'y',\n    classes: 'Usa al menos {n} de estos tipos: minúsculas, mayúsculas, números, símbolos.',\n    breached: 'No se aceptan contraseñas que aparecen en filtraciones de datos conocidas.',\n    kinds: { lowercase: 'una minúscula', uppercase: 'una mayúscula', digit: 'un número', symbol: 'un símbolo' },\n    reasons: {\n      too_short: 'Usa al menos {min} caracteres.', too_long: 'Usa como máximo {max} caracteres.',\n      needs_lowercase: 'Incluye una minúscula.', needs_uppercase: 'Incluye una mayúscula.', needs_digit: 'Incluye un número.', needs_symbol: 'Incluye un símbolo.',\n      needs_classes: 'Usa al menos {n} de estos tipos: minúsculas, mayúsculas, números, símbolos.',\n      breached: 'Esta contraseña aparece en una filtración de datos conocida. Elige otra.',\n    },\n  },\n}\n\nconst fill = (s: string, p: PasswordPolicy) => s.replace('{min}', String(p.min)).replace('{max}', String(p.max)).replace('{n}', String(p.min_classes))\n\n/** What a new password must be, said for the person choosing it: \"Between 12 and 128 characters. Include a digit.\" */\nexport function describePasswordPolicy(policy: PasswordPolicy = DEFAULT_PASSWORD_POLICY, locale: PasswordLocale = 'en'): string {\n  const p = passwordPolicyOf(policy)\n  const t = RULES[locale] ?? RULES.en\n  const parts = [fill(t.between, p)]\n  if (p.requires.length > 0) {\n    const kinds = p.requires.map((c) => t.kinds[c])\n    const listed = kinds.length === 1 ? kinds[0] : `${kinds.slice(0, -1).join(', ')} ${t.and} ${kinds[kinds.length - 1]}`\n    parts.push(t.requires.replace('{kinds}', listed))\n  }\n  if (p.min_classes > 0) parts.push(fill(t.classes, p))\n  if (p.reject_breached) parts.push(t.breached)\n  return parts.join(' ')\n}\n\n/** Why a new password was refused, rule by rule, for the person who typed it. */\nexport function explainPasswordProblems(reasons: readonly string[], policy: PasswordPolicy = DEFAULT_PASSWORD_POLICY, locale: PasswordLocale = 'en'): string {\n  const p = passwordPolicyOf(policy)\n  const t = RULES[locale] ?? RULES.en\n  const said = reasons.filter((r): r is PasswordReason => r in t.reasons).map((r) => fill(t.reasons[r], p))\n  return said.length > 0 ? said.join(' ') : describePasswordPolicy(p, locale)\n}\n\n// One @, something on each side, a dot in the domain, no spaces: what catches\n// a typo. Whether the address exists is Cauthy's to find out.\nconst EMAIL = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/\n\nexport function checkEmail(value: unknown): FieldProblem | null {\n  const v = typeof value === 'string' ? value.trim() : ''\n  if (v === '') return { field: 'email', code: 'required', message: 'Enter your email address.' }\n  if (v.length > 254 || !EMAIL.test(v)) return { field: 'email', code: 'invalid_email', message: 'That does not look like an email address.' }\n  return null\n}\n\n/** A password being typed to sign in: only that there is one. */\nexport function checkPassword(value: unknown): FieldProblem | null {\n  if (typeof value !== 'string' || value === '') return { field: 'password', code: 'required', message: 'Enter your password.' }\n  if (value.length > MAX_PASSWORD) return { field: 'password', code: 'too_long', message: 'That password is too long.' }\n  return null\n}\n\n/**\n * A password being chosen for a new account, or a new one for an account.\n * Held to the workspace's policy when it is given (`methods().password`),\n * otherwise to the defaults: 12 to 128 characters.\n */\nexport function checkNewPassword(value: unknown, policy?: PasswordPolicy | null): FieldProblem | null {\n  if (typeof value !== 'string' || value === '') return { field: 'password', code: 'required', message: 'Enter your password.' }\n  const p = policy ? passwordPolicyOf(policy) : DEFAULT_PASSWORD_POLICY\n  const reasons = passwordProblems(value, p)\n  if (reasons.length === 0) return null\n  return { field: 'password', code: reasons[0], message: explainPasswordProblems(reasons, p) }\n}\n\nexport function checkName(value: unknown): FieldProblem | null {\n  if (value === undefined || value === null || value === '') return null\n  if (typeof value !== 'string' || value.trim().length > MAX_NAME) return { field: 'name', code: 'too_long', message: `Use at most ${MAX_NAME} characters.` }\n  return null\n}\n\n/** The company's name a sign-up carries when the application's system makes an organization per sign-up. */\nexport const MAX_ORGANIZATION = 120\n\nexport function checkOrganization(value: unknown, required = false): FieldProblem | null {\n  const v = typeof value === 'string' ? value.trim() : ''\n  if (v === '') return required ? { field: 'organization', code: 'required', message: \"Enter your company's name.\" } : null\n  if (v.length > MAX_ORGANIZATION) return { field: 'organization', code: 'too_long', message: `Use at most ${MAX_ORGANIZATION} characters.` }\n  return null\n}\n\n/** An organization's new name, when a member renames it: the same rule as at sign-up, always required. */\nexport function checkOrganizationName(value: unknown): FieldProblem | null {\n  const v = typeof value === 'string' ? value.trim() : ''\n  if (v === '') return { field: 'name', code: 'required', message: \"Enter the organization's name.\" }\n  if (v.length > MAX_ORGANIZATION) return { field: 'name', code: 'too_long', message: `Use at most ${MAX_ORGANIZATION} characters.` }\n  return null\n}\n\nexport function checkCode(value: unknown): FieldProblem | null {\n  const v = typeof value === 'string' ? value.trim() : ''\n  if (v === '') return { field: 'code', code: 'required', message: 'Enter the code.' }\n  if (v.length > 40) return { field: 'code', code: 'too_long', message: 'That is not a code.' }\n  return null\n}\n\n/** The first problem of a form, or null when it can be sent. */\nexport function firstProblem(...checks: (FieldProblem | null)[]): FieldProblem | null {\n  return checks.find((c) => c !== null) ?? null\n}\n","// Hearing from Cauthy: verifying a webhook delivery.\n//\n// Cauthy signs every delivery with its own key — the one its tokens are\n// signed with, published at /.well-known/jwks.json — so there is no secret to\n// receive, store or rotate. Verifying is one call:\n//\n//   const event = await auth.webhook(request)      // throws if it is not Cauthy's\n//\n// What is checked: the signature, against Cauthy's published keys; that the\n// delivery was meant for THIS endpoint (a signature anyone can verify must say\n// who it is for); that it is recent; and that the body is, byte for byte, the\n// one that was signed.\n\nimport { createRemoteJWKSet, jwtVerify, type JWTVerifyGetKey } from 'jose'\nimport type { JsonValue } from './types'\nimport { parseKey } from './cauthykey'\nimport { withoutTrailingSlashes } from './url'\n\n/** Something that happened in Cauthy, as a subscriber is told. Moments are UTC. */\nexport interface CauthyEvent {\n  /** This delivery's id: the same event delivered again carries the same one. */\n  id: string\n  /** What happened: \"organization.member_added\". */\n  type: string\n  tenantId: string\n  createdAt: string\n  /** The person it happened to, when it is about one. */\n  userId?: string\n  /** Who did it. */\n  actorId?: string\n  /** What the event says: for an organization, its id, system, external_id, role… */\n  data: Record<string, JsonValue>\n}\n\nexport class CauthyWebhookError extends Error {\n  constructor(readonly reason: string) {\n    super(`@cauthyhq/node: webhook refused: ${reason}`)\n    this.name = 'CauthyWebhookError'\n  }\n}\n\nexport interface VerifyWebhookOptions {\n  /** Cauthy's address. Default: the one `CAUTHY_KEY` names, else `CAUTHY_ISSUER`. */\n  issuer?: string\n  /**\n   * This endpoint's own public address, exactly as it is registered in Cauthy.\n   * Default: the request's URL, which is right unless a proxy changes it.\n   */\n  url?: string\n  /** Cauthy's keys. Default: fetched from the issuer and cached. */\n  jwks?: JWTVerifyGetKey\n  /** The moment to verify at. Default: now. */\n  now?: Date\n  /**\n   * Where deliveries already taken are remembered, so the same signed\n   * delivery sent twice is refused. Default for verifyWebhook: none;\n   * `auth.webhook` remembers them in memory unless it is given one.\n   */\n  replay?: ReplayStore\n}\n\n/**\n * Remembers what was already taken. `claim` answers true the first time a\n * key is claimed and false after, until `until` passes.\n *\n * A delivery Cauthy sends again after a failure is signed again, and passes:\n * what is refused is the very same signed delivery arriving twice. Make what\n * an event does safe to do twice anyway (its `id` stays the same).\n */\nexport interface ReplayStore {\n  claim(key: string, until: Date): Promise<boolean>\n}\n\n/** Deliveries remembered in this process's memory: enough with one instance. */\nexport function memoryReplayStore(now: () => number = Date.now): ReplayStore {\n  const seen = new Map<string, number>()\n  return {\n    async claim(key, until) {\n      const t = now()\n      if (seen.size > 10_000) for (const [k, u] of seen) if (u <= t) seen.delete(k)\n      const held = seen.get(key)\n      if (held !== undefined && held > t) return false\n      seen.set(key, until.getTime())\n      return true\n    },\n  }\n}\n\nconst keys = new Map<string, JWTVerifyGetKey>()\n\nfunction keysOf(issuer: string): JWTVerifyGetKey {\n  let set = keys.get(issuer)\n  if (set === undefined) {\n    set = createRemoteJWKSet(new URL(`${issuer}/.well-known/jwks.json`), { cooldownDuration: 30_000 })\n    keys.set(issuer, set)\n  }\n  return set\n}\n\nconst hex = (s: unknown) => (typeof s === 'string' && s !== '' ? s : undefined)\n\n/**\n * Verifies a delivery and answers the event it carries. Throws\n * `CauthyWebhookError` for anything that is not a delivery Cauthy made for\n * this endpoint just now: answer it 401 and nothing else.\n */\nexport async function verifyWebhook(request: Request, options: VerifyWebhookOptions = {}): Promise<CauthyEvent> {\n  // CAUTHY_KEY names Cauthy; without it, CAUTHY_ISSUER does (deprecated).\n  const key = typeof process !== 'undefined' ? process.env?.CAUTHY_KEY : undefined\n  const env = key ? parseKey(key).issuer : typeof process !== 'undefined' ? process.env?.CAUTHY_ISSUER : undefined\n  const issuer = withoutTrailingSlashes(options.issuer ?? env ?? '')\n  if (issuer === '') throw new CauthyWebhookError('issuer (CAUTHY_ISSUER) is not set')\n  const signature = request.headers.get('x-cauthy-signature-jwt')\n  if (!signature) throw new CauthyWebhookError('no signature')\n\n  // The bytes as they arrived: what was signed is their hash, not a re-encoding.\n  const raw = new Uint8Array(await request.arrayBuffer())\n  const audience = options.url ?? request.url.split('?')[0]\n\n  let claims: Record<string, unknown>\n  try {\n    const verified = await jwtVerify(signature, options.jwks ?? keysOf(issuer), {\n      algorithms: ['RS256'],\n      audience,\n      typ: 'cauthy-webhook+jwt',\n      requiredClaims: ['exp', 'iat', 'jti', 'body_sha256'],\n      currentDate: options.now,\n      clockTolerance: 30,\n    })\n    claims = verified.payload as Record<string, unknown>\n  } catch (err) {\n    throw new CauthyWebhookError(err instanceof Error ? err.message : 'bad signature')\n  }\n  // Signed by Cauthy, for this issuer: Cauthy's own address, or the\n  // workspace's custom domain (domain_iss) when that is the issuer here.\n  if (claims.iss !== issuer && claims.domain_iss !== issuer) {\n    throw new CauthyWebhookError('unexpected \"iss\" claim value')\n  }\n\n  // Not from the future either: a clock that far off is not Cauthy's.\n  const now = Math.floor((options.now ?? new Date()).getTime() / 1000)\n  if (typeof claims.iat !== 'number' || claims.iat > now + 30) throw new CauthyWebhookError('signed in the future')\n\n  const digest = new Uint8Array(await crypto.subtle.digest('SHA-256', raw))\n  let b64 = ''\n  for (const b of digest) b64 += String.fromCharCode(b)\n  const hash = btoa(b64).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')\n  if (hash !== claims.body_sha256) throw new CauthyWebhookError('the body is not the one that was signed')\n\n  let body: Record<string, any>\n  try {\n    body = JSON.parse(new TextDecoder().decode(raw))\n  } catch {\n    throw new CauthyWebhookError('the body is not JSON')\n  }\n  // The envelope and the signature must tell the same story.\n  if (body.id !== claims.jti || body.event !== claims.evt || body.tenant_id !== claims.tid) {\n    throw new CauthyWebhookError('the body and its signature disagree')\n  }\n  if (options.replay) {\n    // The same signature twice is a replay; a delivery sent again is signed again.\n    const exp = typeof claims.exp === 'number' ? claims.exp : now + 300\n    if (!(await options.replay.claim(`${String(claims.jti)}:${String(claims.iat)}`, new Date(exp * 1000)))) {\n      throw new CauthyWebhookError('this delivery was already taken')\n    }\n  }\n  const inner = (body.data ?? {}) as Record<string, any>\n  return {\n    id: String(body.id),\n    type: String(body.event),\n    tenantId: String(body.tenant_id),\n    createdAt: String(inner.created_at ?? body.created_at ?? ''),\n    ...(hex(inner.user_id) ? { userId: inner.user_id } : {}),\n    ...(hex(inner.actor_id) ? { actorId: inner.actor_id } : {}),\n    data: (inner.data ?? {}) as Record<string, JsonValue>,\n  }\n}\n","// SHA-256 (FIPS 180-4), synchronous and dependency-free: CAUTHY_KEY's\n// checksum is checked when createCauthy runs, before any await. Used for\n// nothing else; WebCrypto does every other hash.\nconst K = new Uint32Array([\n  0x428a2f98, 0x71374491, 0xb5c0fbcf, 0xe9b5dba5, 0x3956c25b, 0x59f111f1, 0x923f82a4, 0xab1c5ed5,\n  0xd807aa98, 0x12835b01, 0x243185be, 0x550c7dc3, 0x72be5d74, 0x80deb1fe, 0x9bdc06a7, 0xc19bf174,\n  0xe49b69c1, 0xefbe4786, 0x0fc19dc6, 0x240ca1cc, 0x2de92c6f, 0x4a7484aa, 0x5cb0a9dc, 0x76f988da,\n  0x983e5152, 0xa831c66d, 0xb00327c8, 0xbf597fc7, 0xc6e00bf3, 0xd5a79147, 0x06ca6351, 0x14292967,\n  0x27b70a85, 0x2e1b2138, 0x4d2c6dfc, 0x53380d13, 0x650a7354, 0x766a0abb, 0x81c2c92e, 0x92722c85,\n  0xa2bfe8a1, 0xa81a664b, 0xc24b8b70, 0xc76c51a3, 0xd192e819, 0xd6990624, 0xf40e3585, 0x106aa070,\n  0x19a4c116, 0x1e376c08, 0x2748774c, 0x34b0bcb5, 0x391c0cb3, 0x4ed8aa4a, 0x5b9cca4f, 0x682e6ff3,\n  0x748f82ee, 0x78a5636f, 0x84c87814, 0x8cc70208, 0x90befffa, 0xa4506ceb, 0xbef9a3f7, 0xc67178f2,\n])\n\nexport function sha256(data: Uint8Array): Uint8Array {\n  const h = new Uint32Array([0x6a09e667, 0xbb67ae85, 0x3c6ef372, 0xa54ff53a, 0x510e527f, 0x9b05688c, 0x1f83d9ab, 0x5be0cd19])\n  const len = data.length\n  const padded = new Uint8Array(((len + 9 + 63) >> 6) << 6)\n  padded.set(data)\n  padded[len] = 0x80\n  const view = new DataView(padded.buffer)\n  view.setUint32(padded.length - 8, Math.floor(len / 0x20000000))\n  view.setUint32(padded.length - 4, (len << 3) >>> 0)\n  const w = new Uint32Array(64)\n  const rotr = (x: number, n: number) => (x >>> n) | (x << (32 - n))\n  for (let off = 0; off < padded.length; off += 64) {\n    for (let i = 0; i < 16; i++) w[i] = view.getUint32(off + i * 4)\n    for (let i = 16; i < 64; i++) {\n      const s0 = rotr(w[i - 15], 7) ^ rotr(w[i - 15], 18) ^ (w[i - 15] >>> 3)\n      const s1 = rotr(w[i - 2], 17) ^ rotr(w[i - 2], 19) ^ (w[i - 2] >>> 10)\n      w[i] = (w[i - 16] + s0 + w[i - 7] + s1) >>> 0\n    }\n    let [a, b, c, d, e, f, g, hh] = h\n    for (let i = 0; i < 64; i++) {\n      const t1 = (hh + (rotr(e, 6) ^ rotr(e, 11) ^ rotr(e, 25)) + ((e & f) ^ (~e & g)) + K[i] + w[i]) >>> 0\n      const t2 = ((rotr(a, 2) ^ rotr(a, 13) ^ rotr(a, 22)) + ((a & b) ^ (a & c) ^ (b & c))) >>> 0\n      hh = g; g = f; f = e; e = (d + t1) >>> 0; d = c; c = b; b = a; a = (t1 + t2) >>> 0\n    }\n    h[0] += a; h[1] += b; h[2] += c; h[3] += d; h[4] += e; h[5] += f; h[6] += g; h[7] += hh\n  }\n  const out = new Uint8Array(32)\n  const ov = new DataView(out.buffer)\n  for (let i = 0; i < 8; i++) ov.setUint32(i * 4, h[i])\n  return out\n}\n","// CAUTHY_KEY (key/cauthy-key.md in cauthy-sdk-spec): parsing and composing,\n// synchronously. Derivation and signing are in keyderive.ts.\nimport { sha256 } from './sha256'\nimport { CauthyConfigError, CauthyKeyError, type CauthyKeyReason } from './types'\n\nexport const KEY_PREFIX = 'cauthy1'\n\n/**\n * The variables CAUTHY_KEY replaces: set beside it, each is a second source\n * of the same thing, and the application refuses to start (key/cauthy-key.md §10).\n */\nexport const KEY_REPLACES = ['CAUTHY_ISSUER', 'CAUTHY_CLIENT_ID', 'CAUTHY_CLIENT_SECRET', 'CAUTHY_SYSTEM', 'CAUTHY_TENANT',\n  'CAUTHY_SYSTEM_KEY', 'CAUTHY_SYSTEM_KEY_ID', 'CAUTHY_BASE_URL', 'CAUTHY_AUDIENCE', 'CAUTHY_TENANT_ID'] as const\n\n/** Names the KEY_REPLACES variables set in `environment`, refusing them beside CAUTHY_KEY. */\nexport function refuseBesideKey(environment: Record<string, string | undefined> | undefined): void {\n  const set = KEY_REPLACES.filter(n => (environment?.[n] ?? '') !== '')\n  if (set.length > 0) {\n    throw new CauthyConfigError(`the application runs on CAUTHY_KEY, and ${set.join(', ')} ${set.length === 1 ? 'is' : 'are'} also set: ` +\n      `remove ${set.length === 1 ? 'it' : 'them'} from the environment. Everything comes from the key.`)\n  }\n}\nconst MAX_LEN = 512\nconst enc = new TextEncoder()\nconst dec = new TextDecoder('utf-8', { fatal: true })\n\n/** What a CAUTHY_KEY names. Never logged, never printed. */\nexport interface CauthyKey {\n  /** Cauthy's origin, e.g. https://cauthy.api.example.com */\n  issuer: string\n  clientId: string\n  /** The 43-character secret segment: the HKDF input, as text. */\n  secret: string\n}\n\nexport function b64uEncode(b: Uint8Array): string {\n  let bin = ''\n  for (const x of b) bin += String.fromCharCode(x)\n  return btoa(bin).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')\n}\n\n/** Strict base64url: no padding, alphabet only, canonical. Null when it is not. */\nexport function b64uDecode(s: string): Uint8Array | null {\n  if (!/^[A-Za-z0-9_-]*$/.test(s) || s.length % 4 === 1) return null\n  const bin = atob(s.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat((4 - (s.length % 4)) % 4))\n  const out = Uint8Array.from(bin, c => c.charCodeAt(0))\n  return b64uEncode(out) === s ? out : null\n}\n\nfunction checksum(body: string): string {\n  return b64uEncode(sha256(enc.encode(body)).slice(0, 6))\n}\n\nfunction printableAscii(s: string): boolean {\n  return /^[\\x21-\\x7e]*$/.test(s)\n}\n\n/**\n * An origin as key/cauthy-key.md §3 rule 5 accepts it: exactly as a WHATWG\n * URL serializes its origin, https (http only on loopback), never an\n * IPv4-mapped IPv6 address.\n */\nexport function validIssuer(s: string): boolean {\n  if (s === '' || !printableAscii(s)) return false\n  let u: URL\n  try { u = new URL(s) } catch { return false }\n  if (u.origin !== s) return false\n  if (/^\\[::ffff:/i.test(u.host)) return false\n  if (u.protocol === 'https:') return true\n  return u.protocol === 'http:' && ['localhost', '127.0.0.1', '[::1]'].includes(u.hostname)\n}\n\nconst fail = (reason: CauthyKeyReason, message: string): never => {\n  throw new CauthyKeyError(reason, message)\n}\n\nconst NOT_A_KEY = 'not a Cauthy key (copy it again from the dashboard)'\n\n/** Reads a CAUTHY_KEY; throws CauthyKeyError with the reason, never the value. */\nexport function parseKey(text: string): CauthyKey {\n  const s = text.replace(/^[ \\t\\r\\n]+|[ \\t\\r\\n]+$/g, '')\n  if (s === '' || s.length > MAX_LEN || !printableAscii(s)) fail('key_format', NOT_A_KEY)\n  const head = s.split('.', 1)[0]\n  if (head !== KEY_PREFIX) {\n    if (/^cauthy[0-9]+$/.test(head)) fail('key_version', `this key is for a newer SDK (${head}): update @cauthyhq/node`)\n    fail('key_format', NOT_A_KEY)\n  }\n  const parts = s.split('.')\n  if (parts.length !== 5 || parts.some(p => p === '')) fail('key_format', NOT_A_KEY)\n  if (!constantTimeEqual(checksum(parts.slice(0, 4).join('.')), parts[4])) {\n    fail('key_checksum', 'the key is damaged (part of it is missing or changed): copy it again from the dashboard')\n  }\n  const issuerBytes = b64uDecode(parts[1])\n  let issuer = ''\n  try { issuer = issuerBytes ? dec.decode(issuerBytes) : '' } catch { issuer = '' }\n  if (!validIssuer(issuer)) fail('key_issuer', 'the key names no valid Cauthy address')\n  const clientBytes = b64uDecode(parts[2])\n  const clientId = clientBytes ? String.fromCharCode(...clientBytes) : ''\n  if (!/^[A-Za-z0-9._-]{1,128}$/.test(clientId)) fail('key_client', 'the key names no valid client')\n  const secret = b64uDecode(parts[3])\n  if (parts[3].length !== 43 || !secret || secret.length !== 32) fail('key_secret', 'the key\\'s secret is not 32 bytes')\n  return { issuer, clientId, secret: parts[3] }\n}\n\n/** Writes a CAUTHY_KEY (what the dashboard does in the browser; here for tests and tools). */\nexport function composeKey(issuer: string, clientId: string, secret: string): string {\n  const body = `${KEY_PREFIX}.${b64uEncode(enc.encode(issuer))}.${b64uEncode(enc.encode(clientId))}.${secret}`\n  const key = `${body}.${checksum(body)}`\n  parseKey(key) // refuses what a reader would\n  return key\n}\n\nfunction constantTimeEqual(a: string, b: string): boolean {\n  if (a.length !== b.length) return false\n  let d = 0\n  for (let i = 0; i < a.length; i++) d |= a.charCodeAt(i) ^ b.charCodeAt(i)\n  return d === 0\n}\n","// The auth-bff protocol, version 1, as every answer of the handler carries\n// it: the version header, no caching, and on a sign-in answer the step that\n// comes next — so a client never guesses which screen follows.\n\nexport const PROTOCOL_VERSION = '1'\n\n/**\n * What the screen does after a sign-in answer:\n *\n * - `done`: signed in; go on.\n * - `mfa`: ask for the second step (the code, or the push's approval).\n * - `verify_email`: the address must be confirmed first.\n * - `code`: a code (or link) was mailed; ask for the code.\n * - `passkey`: run the passkey ceremony with the options in the answer.\n * - `one_tap`: show Google's prompt with the client and nonce in the answer,\n *   then post the credential it gives.\n * - `redirect`: go to the URL the answer carries. Reserved for answers that\n *   have one; no route of version 1 answers it yet.\n */\nexport type NextStep = 'done' | 'mfa' | 'verify_email' | 'code' | 'passkey' | 'one_tap' | 'redirect'\n\n/** The routes whose answers are sign-in answers (auth-bff.md, \"Sign-in answers\"). */\nexport const SIGN_IN_ROUTES: ReadonlySet<string> = new Set([\n  '/sign-in/email', '/sign-in/mfa', '/sign-in/mfa/send', '/sign-in/mfa/email', '/sign-in/mfa/push', '/sign-in/mfa/push/finish',\n  '/sign-up/email', '/invitation/accept', '/sign-in/magic-link', '/sign-in/email-code', '/sign-in/magic-link/verify',\n  '/sign-in/passkey/begin', '/sign-in/passkey/finish', '/sign-in/google-one-tap/begin', '/sign-in/google-one-tap',\n  '/sign-in/anonymous', '/me/upgrade',\n])\n\n/** The step after a sign-in answer of `route`, or undefined when `status` is not one. */\nexport function nextOf(route: string, status: unknown): NextStep | undefined {\n  switch (status) {\n    case 'signed_in': return 'done'\n    case 'mfa_required': return 'mfa'\n    case 'verification_required': return 'verify_email'\n    // A code went out: the second step's, or the one that comes with a sign-in link.\n    case 'sent': return route.startsWith('/sign-in/mfa') ? 'mfa' : 'code'\n    // A ceremony began: the page shows Google's prompt and posts what it gives, or runs the passkey's.\n    case 'started': return route === '/sign-in/google-one-tap/begin' ? 'one_tap' : 'passkey'\n    default: return undefined\n  }\n}\n\n/**\n * The answer as the protocol sends it: `Cauthy-Protocol: 1` always,\n * `Cache-Control: no-store` unless it is `cacheable` (the published keys)\n * or already says no-store, and `next` on a successful JSON sign-in answer\n * of `route` (null: outside the routes).\n */\nexport async function finish(res: Response, route: string | null, cacheable = false): Promise<Response> {\n  const headers = new Headers()\n  res.headers.forEach((value, name) => {\n    if (name !== 'set-cookie') headers.set(name, value)\n  })\n  for (const cookie of res.headers.getSetCookie()) headers.append('set-cookie', cookie)\n  headers.set('cauthy-protocol', PROTOCOL_VERSION)\n  if (!cacheable && !(headers.get('cache-control') ?? '').includes('no-store')) headers.set('cache-control', 'no-store')\n\n  let body: BodyInit | null = res.body\n  if (route !== null && SIGN_IN_ROUTES.has(route) && res.ok && (headers.get('content-type') ?? '').startsWith('application/json')) {\n    const text = await res.text()\n    body = text\n    try {\n      const parsed = JSON.parse(text) as Record<string, unknown> | null\n      const next = nextOf(route, parsed?.status)\n      if (parsed !== null && next !== undefined) body = JSON.stringify({ ...parsed, next })\n    } catch {\n      // Not JSON after all: it goes as it came.\n    }\n    headers.delete('content-length')\n  }\n  return new Response(body, { status: res.status, statusText: res.statusText, headers })\n}\n","// A backend that is handed a Cauthy access token: is it real, and whose is it?\n//\n//   const who = await verifyToken(request)        // or the token itself\n//   who.userId, who.tenantId, who.roles\n//\n// Cauthy signs its tokens with a key it publishes (/.well-known/jwks.json), so\n// checking one needs no secret and no call to Cauthy per request: the keys are\n// fetched once and cached. Throws `CauthyTokenError` for anything else: answer\n// it 401, and read `reason`, one of the closed list of codes in the spec's\n// verification/rules.md.\n\nimport { compactVerify, createLocalJWKSet, type CompactVerifyGetKey, type JSONWebKeySet, type JWTVerifyGetKey } from 'jose'\nimport { parseStrict } from './json'\nimport { CauthyConfigError } from './types'\nimport { deprecated } from './deprecate'\nimport { parseKey, refuseBesideKey } from './cauthykey'\nimport { deriveFromKey } from './keyderive'\nimport { createIdentity } from './identity'\nimport { createSystem } from './system'\nimport { deadline } from './deadline'\nimport { withoutTrailingSlashes } from './url'\n\n/** Who a verified access token belongs to. */\nexport interface TokenIdentity {\n  /** The person. For a system's own token, the client it identifies as. */\n  userId: string\n  tenantId: string\n  email?: string\n  /** What the token says of the address, when it says (a boolean; absent otherwise). */\n  emailVerified?: boolean\n  roles: string[]\n  /** Set when the token is a system's own and not a person's (only with `allowSystem`). */\n  system?: string\n  /** Set when the token is a guest's (only with `allowAnonymous`). */\n  anonymous?: true\n  /** The client a person's token was issued through (`azp`); absent when none was named. */\n  authorizedParty?: string\n  /**\n   * The token's `client_id`: on a client's own token (only with\n   * `allowClientTokens`), the client's public id; on an AI agent's, the agent's.\n   */\n  clientId?: string\n  /** UTC, ISO 8601. */\n  expiresAt: string\n  /** The token as it arrived, to pass on. */\n  token: string\n}\n\n/** Why a token was refused: the closed list of verification/rules.md, and `no_token` when none was given. */\nexport type TokenRefusal =\n  | 'no_token' | 'too_large' | 'malformed' | 'alg_not_allowed' | 'unsupported_header' | 'missing_kid' | 'unknown_kid' | 'weak_key'\n  | 'bad_signature' | 'missing_claim' | 'invalid_claim' | 'wrong_issuer' | 'wrong_audience' | 'expired' | 'not_yet_valid'\n  | 'issued_in_future' | 'wrong_tenant' | 'system_token' | 'client_token' | 'anonymous_token' | 'wrong_client'\n\n/**\n * Cauthy's keys could not be fetched (or are not a key set): the token may be\n * good, and the application cannot tell. Answer 503, not 401. It is not a\n * `CauthyTokenError`: it says nothing about the token.\n */\nexport class CauthyUnavailableError extends Error {\n  constructor(detail: string) {\n    super(`@cauthyhq/node: Cauthy's keys are unavailable: ${detail}`)\n    this.name = 'CauthyUnavailableError'\n  }\n}\n\nexport class CauthyTokenError extends Error {\n  constructor(readonly reason: TokenRefusal, readonly detail?: string) {\n    super(`@cauthyhq/node: token refused: ${reason}${detail ? ` (${detail})` : ''}`)\n    this.name = 'CauthyTokenError'\n  }\n}\n\nexport interface VerifyTokenOptions {\n  /** Cauthy's address. Default: `CAUTHY_ISSUER`. */\n  issuer?: string\n  /**\n   * Further issuers a token may name, e.g. a workspace's custom domain. The\n   * keys always come from `issuer`. Default: none.\n   */\n  issuers?: string[]\n  /** The audience the tokens must carry. Required: this or `CAUTHY_AUDIENCE`. */\n  audience?: string\n  /** The workspace's id, a lowercase UUID. Required: this or `CAUTHY_TENANT_ID`. */\n  tenantId?: string\n  /** Cauthy's keys. Default: fetched from the issuer and cached (see `remoteKeys`). */\n  jwks?: JWTVerifyGetKey\n  /** The fetch to get the keys with. Default: the global one. */\n  fetch?: typeof fetch\n  /** The moment to verify at. Default: now. */\n  now?: Date\n  /** Clock tolerance in seconds, 0 to 60. Default: 30. */\n  leeway?: number\n  /**\n   * Accept a system's own token (a `sys` claim) too: for an endpoint another\n   * system calls. Default: false, so a system's token never stands for a\n   * person (rule R13 of the spec's verification/rules.md).\n   */\n  allowSystem?: boolean\n  /** Accept a guest's token (`anon: true`). Default: false (rule R14). */\n  allowAnonymous?: boolean\n  /**\n   * Accept a client's own token (a `token_use` claim, from a\n   * `client_credentials` grant) too: for a backend that serves machines as\n   * well as people. Default: false, so a machine never passes as a person\n   * (rule R13). The identity then carries `clientId`.\n   */\n  allowClientTokens?: boolean\n  /**\n   * The client this backend signs people in through. When set, a person's\n   * token issued through another client (an `azp` naming another) is refused\n   * with `wrong_client` (rule R15); a token with no `azp` passes. Default:\n   * none, and `azp` is not checked.\n   */\n  clientId?: string\n}\n\nconst MAX_TOKEN_BYTES = 8192\nconst UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/\nconst NIL_UUID = '00000000-0000-0000-0000-000000000000'\nconst SEGMENT = /^[A-Za-z0-9_-]+$/\n\nconst MAX_KEYS_BYTES = 64 * 1024\nconst KEYS_TIMEOUT_MS = 5000\nconst KEYS_COOLDOWN_MS = 30_000\nconst KEYS_DEFAULT_TTL_S = 300\nconst KEYS_MIN_TTL_S = 60\nconst KEYS_MAX_TTL_S = 3600\n\n/**\n * Cauthy's published keys (K1 to K5 of verification/rules.md): fetched with a\n * GET that follows no redirect, within 5 seconds, from `<issuer>/.well-known/jwks.json`;\n * only a 200 of at most 64 KiB counts. Kept for the answer's max-age (at most\n * an hour and at least a minute, 5 minutes when it names none); a `kid` the set lacks fetches again\n * only if the last fetch is older than 30 seconds; one fetch at a time; a\n * failed fetch keeps the last good set, and with none it is\n * `CauthyUnavailableError`.\n */\nexport function remoteKeys(issuer: string, fetchKeys: typeof fetch = fetch): JWTVerifyGetKey {\n  let set: JWTVerifyGetKey | undefined\n  let startedAt = 0\n  let expiresAt = 0\n  let inflight: Promise<void> | undefined\n\n  const load = async (): Promise<void> => {\n    startedAt = Date.now()\n    try {\n      const res = await fetchKeys(`${issuer}/.well-known/jwks.json`, { redirect: 'manual', signal: AbortSignal.timeout(KEYS_TIMEOUT_MS), headers: { accept: 'application/json' } })\n      if (res.status !== 200) throw new Error(`answered ${res.status}`)\n      const bytes = await readCapped(res, MAX_KEYS_BYTES)\n      const parsed = JSON.parse(new TextDecoder().decode(bytes)) as JSONWebKeySet\n      if (!parsed || !Array.isArray(parsed.keys)) throw new Error('not a key set')\n      // K6: two usable keys with one kid make the whole set untrustworthy.\n      const seen = new Set<string>()\n      for (const k of parsed.keys) {\n        const usable = k?.kty === 'RSA' && (k.use === undefined || k.use === 'sig') && (k.alg === undefined || k.alg === 'RS256')\n        if (!usable || typeof k.kid !== 'string') continue\n        if (seen.has(k.kid)) throw new Error(`two usable keys share the kid ${JSON.stringify(k.kid)}`)\n        seen.add(k.kid)\n      }\n      set = createLocalJWKSet(parsed)\n      const maxAge = /max-age=(\\d+)/.exec(res.headers.get('cache-control') ?? '')\n      // At least a minute: max-age=0 must not mean a fetch for every token.\n      const ttl = Math.max(KEYS_MIN_TTL_S, Math.min(maxAge ? Number(maxAge[1]) : KEYS_DEFAULT_TTL_S, KEYS_MAX_TTL_S))\n      expiresAt = Date.now() + ttl * 1000\n    } catch (err) {\n      // The last good set stands, and is not asked for again before the cooldown:\n      // an outage must not cost a wait on every verification. With none, the\n      // application cannot tell.\n      if (set === undefined) throw new CauthyUnavailableError(err instanceof Error ? err.message : 'unreachable')\n      expiresAt = Math.max(expiresAt, Date.now() + KEYS_COOLDOWN_MS)\n    }\n  }\n  const refresh = (): Promise<void> => {\n    inflight ??= load().finally(() => {\n      inflight = undefined\n    })\n    return inflight\n  }\n\n  return async (header, token) => {\n    if (set === undefined || Date.now() >= expiresAt) await refresh()\n    try {\n      return await set!(header, token)\n    } catch (err) {\n      const unknown = (err as { code?: unknown } | null)?.code === 'ERR_JWKS_NO_MATCHING_KEY'\n      if (unknown && Date.now() - startedAt >= KEYS_COOLDOWN_MS) {\n        await refresh()\n        return set!(header, token)\n      }\n      throw err\n    }\n  }\n}\n\nasync function readCapped(res: Response, max: number): Promise<Uint8Array> {\n  const reader = res.body?.getReader()\n  if (!reader) return new Uint8Array()\n  const chunks: Uint8Array[] = []\n  let size = 0\n  for (;;) {\n    const { done, value } = await reader.read()\n    if (done) break\n    size += value.length\n    if (size > max) {\n      await reader.cancel()\n      throw new Error(`over ${max} bytes`)\n    }\n    chunks.push(value)\n  }\n  const out = new Uint8Array(size)\n  let at = 0\n  for (const c of chunks) {\n    out.set(c, at)\n    at += c.length\n  }\n  return out\n}\n\nconst published = new Map<string, JWTVerifyGetKey>()\nconst withFetch = new WeakMap<typeof fetch, Map<string, JWTVerifyGetKey>>()\n\nfunction remoteKeysFor(issuer: string, fetchKeys: typeof fetch): JWTVerifyGetKey {\n  let byIssuer = withFetch.get(fetchKeys)\n  if (!byIssuer) withFetch.set(fetchKeys, (byIssuer = new Map()))\n  let set = byIssuer.get(issuer)\n  if (!set) byIssuer.set(issuer, (set = remoteKeys(issuer, fetchKeys)))\n  return set\n}\n\n/** Cauthy's published keys, fetched once per issuer and kept (see `remoteKeys`). */\nexport function keysOf(issuer: string): JWTVerifyGetKey {\n  let set = published.get(issuer)\n  if (set === undefined) {\n    set = remoteKeys(issuer)\n    published.set(issuer, set)\n  }\n  return set\n}\n\nfunction env(name: string): string | undefined {\n  return typeof process !== 'undefined' ? process.env?.[name] : undefined\n}\n\nfunction bearer(from: string | Request | Headers): string {\n  // A raw token is taken as it is: surrounding whitespace is the caller's mistake (R2).\n  if (typeof from === 'string') return from.replace(/^Bearer\\s+/i, '')\n  const header = (from instanceof Headers ? from : from.headers).get('authorization') ?? ''\n  return /^Bearer\\s+/i.test(header) ? header.replace(/^Bearer\\s+/i, '').trim() : ''\n}\n\nfunction issuerAddress(value: string, what: string): string {\n  let url: URL\n  try {\n    url = new URL(value)\n  } catch {\n    throw new CauthyConfigError(`${what} must be an https address, e.g. https://id.example.com`)\n  }\n  // http is for a developer's own machine: localhost, 127.0.0.1, *.localhost and *.test.\n  const local = url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname.endsWith('.localhost') || url.hostname.endsWith('.test')\n  if (url.protocol !== 'https:' && !(url.protocol === 'http:' && local)) throw new CauthyConfigError(`${what} must be https (http only for localhost, *.localhost and *.test)`)\n  if (url.search !== '' || url.hash !== '') throw new CauthyConfigError(`${what} must have no query or fragment`)\n  return withoutTrailingSlashes(value)\n}\n\nconst isObject = (v: unknown): v is Record<string, unknown> => typeof v === 'object' && v !== null && !Array.isArray(v)\n\nfunction decodeJson(segment: string): unknown {\n  const padded = segment.replace(/-/g, '+').replace(/_/g, '/')\n  return parseStrict(Buffer.from(padded, 'base64').toString('utf8'))\n}\n\n/**\n * A verifier for access tokens, configured once. Refuses to be made without\n * an issuer, an audience and a workspace: a verifier that checks none of\n * them would accept a token of any other application or workspace.\n */\nexport function createTokenVerifier(options: VerifyTokenOptions = {}): (from: string | Request | Headers) => Promise<TokenIdentity> {\n  // Read from the environment, these three leave in 2.0: CAUTHY_KEY says them all.\n  const fromEnv = (['CAUTHY_ISSUER', 'CAUTHY_AUDIENCE', 'CAUTHY_TENANT_ID'] as const)\n    .filter((name, i) => [options.issuer, options.audience, options.tenantId][i] === undefined && (env(name) ?? '') !== '')\n  if (fromEnv.length > 0) {\n    deprecated('Reading CAUTHY_ISSUER, CAUTHY_AUDIENCE and CAUTHY_TENANT_ID to verify tokens', 'Set CAUTHY_KEY and use createVerifierFromEnv().')\n  }\n  const issuerGiven = options.issuer ?? env('CAUTHY_ISSUER') ?? ''\n  if (issuerGiven === '') throw new CauthyConfigError('issuer (CAUTHY_ISSUER) is not set')\n  const issuer = issuerAddress(issuerGiven, 'issuer')\n  const issuers = [issuer, ...(options.issuers ?? []).map((i) => issuerAddress(i, 'issuers'))]\n  const audience = options.audience ?? env('CAUTHY_AUDIENCE') ?? ''\n  if (audience === '') throw new CauthyConfigError('audience (CAUTHY_AUDIENCE) is not set: without it a token issued for another application would be accepted')\n  const tenant = options.tenantId ?? env('CAUTHY_TENANT_ID') ?? ''\n  if (tenant === '') throw new CauthyConfigError('tenantId (CAUTHY_TENANT_ID) is not set: without it a token of another workspace would be accepted')\n  if (!UUID.test(tenant) || tenant === NIL_UUID) throw new CauthyConfigError('tenantId must be the workspace\\'s id, a lowercase UUID that is not the nil UUID')\n  const leeway = options.leeway ?? 30\n  if (!Number.isFinite(leeway) || leeway < 0 || leeway > 60) throw new CauthyConfigError('leeway must be 0 to 60 seconds')\n\n  return async (from) => {\n    const token = bearer(from)\n    if (token === '') throw new CauthyTokenError('no_token')\n    // R1\n    if (Buffer.byteLength(token) > MAX_TOKEN_BYTES) throw new CauthyTokenError('too_large')\n    // R2\n    const parts = token.split('.')\n    if (parts.length !== 3 || !parts.every((p) => SEGMENT.test(p) || p === '')) throw new CauthyTokenError('malformed', 'not three base64url segments')\n    let header: unknown\n    try {\n      header = decodeJson(parts[0])\n    } catch {\n      throw new CauthyTokenError('malformed', 'the header is not JSON')\n    }\n    if (!isObject(header)) throw new CauthyTokenError('malformed', 'the header is not an object')\n    // R3, R4, R5: the algorithm is the verifier's, never the token's.\n    if (header.alg !== 'RS256') throw new CauthyTokenError('alg_not_allowed')\n    if ('crit' in header) throw new CauthyTokenError('unsupported_header')\n    // R4: typ is not required, but when present it is JWT or at+jwt, in any case.\n    if ('typ' in header && !(typeof header.typ === 'string' && ['jwt', 'at+jwt'].includes(header.typ.toLowerCase()))) {\n      throw new CauthyTokenError('unsupported_header', 'typ')\n    }\n    if (typeof header.kid !== 'string' || header.kid === '') throw new CauthyTokenError('missing_kid')\n\n    // R5, R6\n    let payloadBytes: Uint8Array\n    try {\n      const verified = await compactVerify(token, (options.jwks ?? (options.fetch ? remoteKeysFor(issuer, options.fetch) : keysOf(issuer))) as CompactVerifyGetKey, { algorithms: ['RS256'] })\n      payloadBytes = verified.payload\n    } catch (err) {\n      // By code, not by class: the keys may come from another copy of jose.\n      const code = (err as { code?: unknown } | null)?.code\n      if (code === 'ERR_JWKS_NO_MATCHING_KEY') throw new CauthyTokenError('unknown_kid')\n      if (code === 'ERR_JWS_SIGNATURE_VERIFICATION_FAILED') throw new CauthyTokenError('bad_signature')\n      if (err instanceof TypeError && /2048/.test(err.message)) throw new CauthyTokenError('weak_key')\n      if (code === 'ERR_JWS_INVALID') throw new CauthyTokenError('malformed', err instanceof Error ? err.message : undefined)\n      if (err instanceof CauthyUnavailableError) throw err\n      throw new CauthyTokenError('bad_signature', err instanceof Error ? err.message : undefined)\n    }\n\n    // R7\n    let claims: unknown\n    try {\n      claims = parseStrict(new TextDecoder().decode(payloadBytes), ['exp', 'iat', 'nbf'])\n    } catch {\n      throw new CauthyTokenError('malformed', 'the payload is not JSON')\n    }\n    if (!isObject(claims)) throw new CauthyTokenError('malformed', 'the payload is not an object')\n    for (const name of ['iss', 'sub', 'aud', 'exp', 'iat', 'tid']) {\n      if (claims[name] === undefined) throw new CauthyTokenError('missing_claim', name)\n    }\n    // R8: no claim is null but roles.\n    const bad = (name: string): never => {\n      throw new CauthyTokenError('invalid_claim', name)\n    }\n    if (typeof claims.iss !== 'string') bad('iss')\n    if (typeof claims.sub !== 'string' || !UUID.test(claims.sub)) bad('sub')\n    if (typeof claims.tid !== 'string' || !UUID.test(claims.tid)) bad('tid')\n    const aud = claims.aud\n    if (!(typeof aud === 'string' || (Array.isArray(aud) && aud.length > 0 && aud.every((a) => typeof a === 'string')))) bad('aud')\n    for (const name of ['exp', 'iat', 'nbf']) if (claims[name] !== undefined && !Number.isInteger(claims[name])) bad(name)\n    if (claims.roles !== undefined && claims.roles !== null && !(Array.isArray(claims.roles) && claims.roles.every((r) => typeof r === 'string'))) bad('roles')\n    if (claims.email !== undefined && typeof claims.email !== 'string') bad('email')\n    for (const name of ['email_verified', 'anon']) if (claims[name] !== undefined && typeof claims[name] !== 'boolean') bad(name)\n    for (const name of ['token_use', 'azp']) if (claims[name] !== undefined && typeof claims[name] !== 'string') bad(name)\n\n    // R9, R10\n    if (!issuers.includes(claims.iss as string)) throw new CauthyTokenError('wrong_issuer')\n    if (!(Array.isArray(aud) ? aud.includes(audience) : aud === audience)) throw new CauthyTokenError('wrong_audience')\n    // R11\n    const now = (options.now ?? new Date()).getTime() / 1000\n    if (now >= (claims.exp as number) + leeway) throw new CauthyTokenError('expired')\n    if (claims.nbf !== undefined && now < (claims.nbf as number) - leeway) throw new CauthyTokenError('not_yet_valid')\n    if (now < (claims.iat as number) - leeway) throw new CauthyTokenError('issued_in_future')\n    // R12\n    if (claims.tid !== tenant) throw new CauthyTokenError('wrong_tenant')\n    // R13, R14\n    // Its presence is the mark, whatever the value (null and false included).\n    if ('sys' in claims && !options.allowSystem) throw new CauthyTokenError('system_token')\n    // A client's own token stands for a machine: present is the mark, as for sys.\n    if ('token_use' in claims && !options.allowClientTokens) throw new CauthyTokenError('client_token')\n    if (claims.anon === true && !options.allowAnonymous) throw new CauthyTokenError('anonymous_token')\n    // R15: a person's token issued through another client than the one named.\n    if (options.clientId && typeof claims.azp === 'string' && claims.azp !== '' && claims.azp !== options.clientId) throw new CauthyTokenError('wrong_client')\n\n    return {\n      userId: claims.sub as string,\n      tenantId: claims.tid as string,\n      ...(typeof claims.email === 'string' && claims.email !== '' ? { email: claims.email } : {}),\n      ...(typeof claims.email_verified === 'boolean' ? { emailVerified: claims.email_verified } : {}),\n      roles: Array.isArray(claims.roles) ? (claims.roles as string[]) : [],\n      ...(typeof claims.sys === 'string' && claims.sys !== '' ? { system: claims.sys } : {}),\n      ...(claims.anon === true ? { anonymous: true as const } : {}),\n      ...(typeof claims.azp === 'string' && claims.azp !== '' ? { authorizedParty: claims.azp } : {}),\n      ...(typeof claims.client_id === 'string' && claims.client_id !== '' ? { clientId: claims.client_id } : {}),\n      expiresAt: new Date((claims.exp as number) * 1000).toISOString(),\n      token,\n    }\n  }\n}\n\n/**\n * Verifies an access token (or the `Authorization: Bearer` of a request) and\n * answers who it belongs to, by the rules of the spec's verification/rules.md.\n * Needs an issuer, an audience and a workspace (see `createTokenVerifier`,\n * which checks them once, at startup).\n */\nexport async function verifyToken(from: string | Request | Headers, options: VerifyTokenOptions = {}): Promise<TokenIdentity> {\n  return createTokenVerifier(options)(from)\n}\n\n/**\n * A verifier made from the environment. With `CAUTHY_KEY` the issuer, the\n * audience and the workspace are Cauthy's answer to `GET /v1/connect/self`\n * (asked with the key's assertion, once); nothing else is read, and any of\n * `issuer`, `audience`, `tenantId` given beside it is refused. Without it,\n * `CAUTHY_ISSUER`, `CAUTHY_AUDIENCE` and `CAUTHY_TENANT_ID`, deprecated.\n *\n *   const verify = await createVerifierFromEnv()\n *   const who = await verify(request)\n */\nexport async function createVerifierFromEnv(\n  options: Omit<VerifyTokenOptions, 'issuers'> & { key?: string } = {},\n): Promise<(from: string | Request | Headers) => Promise<TokenIdentity>> {\n  const text = options.key ?? env('CAUTHY_KEY')\n  if (text === undefined || text === '') return createTokenVerifier(options)\n  refuseBesideKey(typeof process !== 'undefined' ? process.env : undefined)\n  for (const name of ['issuer', 'audience', 'tenantId'] as const) {\n    if (options[name] !== undefined) throw new CauthyConfigError(`with CAUTHY_KEY, ${name} comes from CAUTHY_KEY: do not pass it`)\n  }\n  const key = parseKey(text)\n  const system = createSystem({ issuer: key.issuer, clientId: key.clientId, signer: { clientId: key.clientId, signer: deriveFromKey(key).signer }, fetch: options.fetch })\n  const id = await createIdentity({ issuer: key.issuer, token: () => system.token(), fetch: deadline(options.fetch, KEYS_TIMEOUT_MS) }).ready()\n  const { key: _, ...rest } = options\n  return createTokenVerifier({ ...rest, issuer: id.issuer, audience: id.audience, tenantId: id.tenant.id })\n}\n","// A strict JSON reader for what a token carries: it refuses what JSON.parse\n// accepts and verification/rules.md (R2) does not — an object that repeats a\n// name, at any depth, since two readers could then see two different tokens.\n// An integer literal beyond 2^53 reads as NaN, so the claim check refuses it\n// (R8) instead of rounding it into range.\n\nconst SPACE = new Set([' ', '\\t', '\\n', '\\r'])\nconst LIMIT = 2n ** 53n\n\nexport function parseStrict(text: string, integerMembers: readonly string[] = []): unknown {\n  let i = 0\n  let depth = 0\n  const fail = (what: string): never => {\n    throw new SyntaxError(`${what} at ${i}`)\n  }\n  const skip = () => {\n    while (i < text.length && SPACE.has(text[i])) i++\n  }\n  const value = (integer = false): unknown => {\n    skip()\n    const c = text[i]\n    if (c === '{') return object()\n    if (c === '[') return array()\n    if (c === '\"') return string()\n    if (c === '-' || (c >= '0' && c <= '9')) return number(integer)\n    for (const [word, v] of [['true', true], ['false', false], ['null', null]] as const) {\n      if (text.startsWith(word, i)) {\n        i += word.length\n        return v\n      }\n    }\n    return fail('unexpected character')\n  }\n  const string = (): string => {\n    const start = i\n    i++\n    while (i < text.length && text[i] !== '\"') i += text[i] === '\\\\' ? 2 : 1\n    if (text[i] !== '\"') fail('unterminated string')\n    i++\n    return JSON.parse(text.slice(start, i)) as string\n  }\n  const number = (integer: boolean): number => {\n    const m = /^-?(0|[1-9]\\d*)(\\.\\d+)?([eE][+-]?\\d+)?/.exec(text.slice(i))\n    if (!m) return fail('bad number')\n    i += m[0].length\n    // Where the claim must be an integer, 2.0 and 1e3 are not integer literals.\n    if (integer && (m[2] !== undefined || m[3] !== undefined)) return Number.NaN\n    if (m[2] === undefined && m[3] === undefined) {\n      const big = BigInt(m[0])\n      if (big > LIMIT || big < -LIMIT) return Number.NaN\n    }\n    return Number(m[0])\n  }\n  const array = (): unknown[] => {\n    i++\n    depth++\n    const out: unknown[] = []\n    skip()\n    if (text[i] === ']') {\n      i++\n      depth--\n      return out\n    }\n    for (;;) {\n      out.push(value())\n      skip()\n      if (text[i] === ',') i++\n      else if (text[i] === ']') {\n        i++\n        depth--\n        return out\n      } else fail('expected , or ]')\n    }\n  }\n  const object = (): Record<string, unknown> => {\n    i++\n    depth++\n    const out: Record<string, unknown> = {}\n    const seen = new Set<string>()\n    skip()\n    if (text[i] === '}') {\n      i++\n      depth--\n      return out\n    }\n    for (;;) {\n      skip()\n      if (text[i] !== '\"') fail('expected a name')\n      const name = string()\n      if (seen.has(name)) fail(`repeated name ${JSON.stringify(name)}`)\n      seen.add(name)\n      skip()\n      if (text[i] !== ':') fail('expected :')\n      i++\n      Object.defineProperty(out, name, { value: value(depth === 1 && integerMembers.includes(name)), enumerable: true, writable: true, configurable: true })\n      skip()\n      if (text[i] === ',') i++\n      else if (text[i] === '}') {\n        i++\n        depth--\n        return out\n      } else fail('expected , or }')\n    }\n  }\n  const result = value()\n  skip()\n  if (i < text.length) fail('trailing characters')\n  return result\n}\n","// What leaves in 2.0 says so once per process, as Node's own deprecations do\n// (silenced with --no-deprecation, thrown with --throw-deprecation).\nconst told = new Set<string>()\n\n/** Says once per process that `what` is deprecated, and what to use instead. */\nexport function deprecated(what: string, instead: string): void {\n  if (told.has(what)) return\n  told.add(what)\n  const message = `@cauthyhq/node: ${what} is deprecated and leaves in 2.0. ${instead}`\n  // Edge runtimes have no `process`: the console says it there.\n  if (typeof process !== 'undefined' && typeof process.emitWarning === 'function') {\n    process.emitWarning(message, { type: 'DeprecationWarning', code: 'CAUTHY_DEPRECATED' })\n  } else {\n    console.warn(message)\n  }\n}\n","// Everything a CAUTHY_KEY stands for (key/cauthy-key.md §4–§6): the cookie\n// and flow rings and the Ed25519 key the application proves itself with.\n//\n// The assertion is written by hand, member by member, as §6 fixes it: the\n// vectors pin it byte for byte. WebCrypto signs; nothing here needs node:crypto.\nimport { b64uEncode, type CauthyKey } from './cauthykey'\n\nconst enc = new TextEncoder()\nconst PKCS8_ED25519 = Uint8Array.from([0x30, 0x2e, 0x02, 0x01, 0x00, 0x30, 0x05, 0x06, 0x03, 0x2b, 0x65, 0x70, 0x04, 0x22, 0x04, 0x20])\n\nexport const ASSERTION_TYPE = 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'\n\nexport type PublicJwk = { kty: 'OKP'; crv: 'Ed25519'; x: string }\n\n/** The keys of one purpose: the first writes, every one is tried to read. */\nexport type KeyRing = Uint8Array[]\n\n// One HKDF key per job, from the key's secret segment. The labels are frozen\n// (§4): every session sealed since 1.2 is opened with them.\nasync function ringKey(secret: string, purpose: 'cookie' | 'flow'): Promise<Uint8Array> {\n  const ikm = await crypto.subtle.importKey('raw', enc.encode(secret), 'HKDF', false, ['deriveBits'])\n  return new Uint8Array(await crypto.subtle.deriveBits(\n    { name: 'HKDF', hash: 'SHA-256', salt: new Uint8Array(0), info: enc.encode(`pact/${purpose}/v1`) }, ikm, 256))\n}\n\nconst ringOf = (secrets: string[], purpose: 'cookie' | 'flow'): Promise<KeyRing> => Promise.all(secrets.map(s => ringKey(s, purpose)))\n\nexport interface Signer {\n  kid: string\n  publicJwk: PublicJwk\n  /** §6's assertion. iat in seconds; jti a fresh UUID v4. */\n  assertion(clientId: string, tokenEndpoint: string, jti?: string, iat?: number): Promise<string>\n}\n\nexport interface KeyDerived {\n  cookie: Promise<KeyRing>\n  flow: Promise<KeyRing>\n  signer: Promise<Signer>\n}\n\nasync function seedOf(secret: string): Promise<Uint8Array> {\n  const ikm = await crypto.subtle.importKey('raw', enc.encode(secret), 'HKDF', false, ['deriveBits'])\n  return new Uint8Array(await crypto.subtle.deriveBits(\n    { name: 'HKDF', hash: 'SHA-256', salt: new Uint8Array(0), info: enc.encode('cauthy/sign/v1') }, ikm, 256))\n}\n\n/** RFC 7638 thumbprint of an Ed25519 public key. */\nexport async function thumbprint(x: string): Promise<string> {\n  return b64uEncode(new Uint8Array(await crypto.subtle.digest('SHA-256', enc.encode(`{\"crv\":\"Ed25519\",\"kty\":\"OKP\",\"x\":\"${x}\"}`))))\n}\n\nasync function signerOf(secret: string): Promise<Signer> {\n  const seed = await seedOf(secret)\n  const der = new Uint8Array(PKCS8_ED25519.length + 32)\n  der.set(PKCS8_ED25519)\n  der.set(seed, PKCS8_ED25519.length)\n  // Extractable only to read x; the key that signs from here on is not.\n  const readable = await crypto.subtle.importKey('pkcs8', der, { name: 'Ed25519' }, true, ['sign'])\n  const { x } = await crypto.subtle.exportKey('jwk', readable)\n  const signing = await crypto.subtle.importKey('pkcs8', der, { name: 'Ed25519' }, false, ['sign'])\n  der.fill(0)\n  seed.fill(0)\n  const publicJwk: PublicJwk = { kty: 'OKP', crv: 'Ed25519', x: x as string }\n  const kid = await thumbprint(publicJwk.x)\n  const header = b64uEncode(enc.encode(JSON.stringify({ alg: 'EdDSA', kid })))\n  return {\n    kid,\n    publicJwk,\n    async assertion(clientId, tokenEndpoint, jti = crypto.randomUUID(), iat = Math.floor(Date.now() / 1000)) {\n      const claims = { iss: clientId, sub: clientId, aud: tokenEndpoint, jti, iat, exp: iat + 120 }\n      const input = `${header}.${b64uEncode(enc.encode(JSON.stringify(claims)))}`\n      const sig = new Uint8Array(await crypto.subtle.sign({ name: 'Ed25519' }, signing, enc.encode(input)))\n      return `${input}.${b64uEncode(sig)}`\n    },\n  }\n}\n\n/** The rings of a key (and of the one it replaces during a rotation, read only) and its signer. */\nexport function deriveFromKey(key: CauthyKey, previous?: CauthyKey): KeyDerived {\n  const other = previous && previous.secret !== key.secret ? previous : undefined\n  const secrets = other ? [key.secret, other.secret] : [key.secret]\n  return {\n    cookie: ringOf(secrets, 'cookie'),\n    flow: ringOf(secrets, 'flow'),\n    signer: signerOf(key.secret),\n  }\n}\n","// Who the application is, asked of Cauthy (key/cauthy-key.md §7): once at\n// start, then revalidated every five minutes with If-None-Match. Cauthy down:\n// the last answer stands; never one yet: the auth routes say 503 unavailable\n// until it comes. Cauthy refusing the key (invalid_client): 503 misconfigured,\n// logged once with the kid.\nimport { CauthyApiError } from './system'\n\n/** What `GET /v1/connect/self` answers. */\nexport interface Identity {\n  issuer: string\n  audience: string\n  tenant: { id: string; slug: string }\n  system: string\n  client_id: string\n  sign_in_client_id: string\n  app_urls: string[]\n  callback_path: string\n  key: { kid: string; retires_at: string | null } | null\n}\n\nexport interface IdentityOptions {\n  issuer: string\n  /** The application's own access token (the system client's). */\n  token: () => Promise<string>\n  fetch?: typeof globalThis.fetch\n  now?: () => number\n  /** Backoff between first attempts, ms; the last repeats. */\n  retryMs?: number[]\n  /** For the log line when Cauthy refuses the key. */\n  kid?: string | (() => string | undefined)\n  log?: (message: string) => void\n}\n\nexport interface IdentityCache {\n  /** The identity, waiting for the first answer. Rejects with 503 misconfigured when Cauthy refuses the key. */\n  ready(): Promise<Identity>\n  /** The last answer, or undefined before the first. */\n  current(): Identity | undefined\n  /** Revalidates now; keeps the last answer on any failure. */\n  refresh(): Promise<void>\n  /** True while there is no answer yet and the last attempt failed (the retries go on). */\n  failing(): boolean\n  /** Settles when the first-answer attempt now out ends: true when it brought the answer. */\n  attempt(): Promise<boolean>\n}\n\nexport const REVALIDATE_MS = 300_000\n\nconst sleep = (ms: number) => new Promise<void>((resolve) => {\n  const t = setTimeout(resolve, ms)\n  ;(t as { unref?: () => void }).unref?.()\n})\n\nexport function createIdentity(o: IdentityOptions): IdentityCache {\n  const doFetch = o.fetch ?? globalThis.fetch\n  const now = o.now ?? Date.now\n  const retry = o.retryMs ?? [1000, 2000, 5000, 10_000, 30_000]\n  let held: Identity | undefined\n  let etag: string | undefined\n  let checkedAt = 0\n  let first: Promise<Identity> | undefined\n  let refused: CauthyApiError | undefined\n  let refreshing: Promise<void> | undefined\n  let failed = false\n  let attemptEnded: ((ok: boolean) => void) | undefined\n  let attemptOut: Promise<boolean> | undefined\n  const kid = () => (typeof o.kid === 'function' ? o.kid() : o.kid) ?? '?'\n\n  async function ask(): Promise<Identity | 'same'> {\n    const headers: Record<string, string> = { authorization: `Bearer ${await o.token()}`, accept: 'application/json' }\n    if (etag && held) headers['if-none-match'] = etag\n    const res = await doFetch(`${o.issuer}/v1/connect/self`, { headers })\n    if (res.status === 304 && held) return 'same'\n    if (res.status === 410) throw Object.assign(new Error('client_inactive'), { code: 'client_inactive' })\n    if (!res.ok) throw new CauthyApiError(503, 'unavailable', `Cauthy answered ${res.status} to /v1/connect/self`)\n    const body = (await res.json()) as { data?: Identity }\n    if (!body?.data || typeof body.data.client_id !== 'string') throw new CauthyApiError(503, 'unavailable', 'Cauthy\\'s answer to /v1/connect/self has no identity')\n    etag = res.headers.get('etag') ?? undefined\n    return body.data\n  }\n\n  /** Cauthy refuses the key itself: not a failure to reach it. */\n  function refusalOf(e: unknown): CauthyApiError | undefined {\n    const code = (e as { code?: string } | null)?.code\n    if (code !== 'invalid_client' && code !== 'client_inactive') return undefined\n    const message = code === 'client_inactive'\n      ? `Cauthy says this application's client is no longer active (kid ${kid()}). Connect it again in Cauthy's dashboard.`\n      : `Cauthy refuses this application's key (kid ${kid()}): it was revoked or never registered. Make a new key in Cauthy's dashboard.`\n    return new CauthyApiError(503, 'misconfigured', message)\n  }\n\n  function refuse(err: CauthyApiError): CauthyApiError {\n    if (refused === undefined) o.log?.(err.message.replace(/^@cauthyhq\\/node: /, ''))\n    refused = err\n    // Asked again at the next revalidation, not before: a refused key does not loop.\n    checkedAt = now()\n    return err\n  }\n\n  async function firstAnswer(): Promise<Identity> {\n    for (let attempt = 0; ; attempt++) {\n      attemptOut = new Promise<boolean>(resolve => { attemptEnded = resolve })\n      try {\n        const got = await ask()\n        if (got !== 'same') held = got\n        checkedAt = now()\n        failed = false\n        attemptEnded?.(true)\n        return held as Identity\n      } catch (e) {\n        const r = refusalOf(e)\n        failed = true\n        attemptEnded?.(false)\n        if (r) throw refuse(r)\n        await sleep(retry[Math.min(attempt, retry.length - 1)])\n      }\n    }\n  }\n\n  async function refresh(): Promise<void> {\n    checkedAt = now()\n    try {\n      const got = await ask()\n      if (got !== 'same') held = got\n      refused = undefined\n    } catch (e) {\n      const r = refusalOf(e)\n      if (r) refuse(r)\n      // Otherwise the last answer stands.\n    }\n  }\n\n  return {\n    ready(): Promise<Identity> {\n      if ((held || refused) && now() - checkedAt >= REVALIDATE_MS) {\n        refreshing ??= refresh().finally(() => { refreshing = undefined })\n      }\n      if (refused) return Promise.reject(refused)\n      if (held) return Promise.resolve(held)\n      first ??= firstAnswer()\n      return first\n    },\n    current: () => held,\n    refresh: () => (refreshing ??= refresh().finally(() => { refreshing = undefined })),\n    failing: () => held === undefined && failed && refused === undefined,\n    attempt: () => (held !== undefined ? Promise.resolve(true) : attemptOut ?? Promise.resolve(false)),\n  }\n}\n","// Is it this handler that answers under basePath? Another route there — a\n// catch-all of another auth library, a proxy rule, a route registered first —\n// takes the requests silently. Every answer of the handler carries\n// Cauthy-Protocol and nothing else's does: three requests that reach nothing\n// in Cauthy tell them apart.\n\nimport { PROTOCOL_VERSION } from './protocol'\nimport { CauthyConfigError } from './types'\nimport { withoutTrailingSlashes } from './url'\n\n/**\n * Where the probes go: the running application's origin\n * (`'http://localhost:3000'`), or a function that serves a request in\n * process (Hono's `app.fetch`, `checkFastifyMount` for Fastify).\n */\nexport type MountTarget = string | ((request: Request) => Response | Promise<Response>)\n\nexport async function checkMount(basePath: string, target: MountTarget): Promise<void> {\n  const origin = typeof target === 'string' ? withoutTrailingSlashes(target) : 'http://localhost'\n  if (!/^https?:\\/\\/[^/\\s]+$/.test(origin)) {\n    throw new CauthyConfigError(`checkMount needs the application's origin, e.g. http://localhost:3000, not ${JSON.stringify(target)}`)\n  }\n  const send = typeof target === 'string' ? (r: Request) => fetch(r, { redirect: 'manual' }) : target\n  const probes = [\n    new Request(`${origin}${basePath}/session`, { headers: { accept: 'application/json' } }),\n    new Request(`${origin}${basePath}/cauthy-mount-check`),\n    new Request(`${origin}${basePath}/sign-out`, { method: 'POST', headers: { origin, 'content-type': 'application/json', 'x-cauthy-request': '1' }, body: '{}' }),\n  ]\n  for (const probe of probes) {\n    const what = `${probe.method} ${new URL(probe.url).pathname}`\n    let res: Response\n    try {\n      res = await send(probe)\n    } catch (err) {\n      // In process, a throw is the handler's own; over HTTP, it is the connection.\n      throw new CauthyConfigError(typeof target === 'string'\n        ? `could not reach ${what} to check where the handler is mounted: ${(err as Error).message}`\n        : `the handler threw on ${what}: ${(err as Error).message}`)\n    }\n    await res.body?.cancel()\n    if (res.headers.get('cauthy-protocol') !== PROTOCOL_VERSION) {\n      // Nothing is followed: a redirect is the answer, and says where the mount goes.\n      if (res.status >= 300 && res.status < 400) {\n        throw new CauthyConfigError(`${what}: the mount redirects (${res.status} to ${res.headers.get('location') ?? 'nowhere'}): ` +\n          `a proxy rule, a trailing-slash or HTTPS redirect sits in front of ${basePath}. Cauthy is not what answers.`)\n      }\n      if (res.status >= 500) {\n        throw new CauthyConfigError(`${what} answered ${res.status} without Cauthy-Protocol: ${PROTOCOL_VERSION}: the application crashed before or instead of the handler. Look at its log.`)\n      }\n      throw new CauthyConfigError(`${what} answered ${res.status} without Cauthy-Protocol: ${PROTOCOL_VERSION}: something other than this handler answers under ${basePath}. ` +\n        'Move that route, mount Cauthy before it, or give Cauthy another basePath.')\n    }\n  }\n}\n","// Sign in with Cauthy, held by the application's own server.\n//\n// The application mounts one route (`handler`) and asks who is there\n// (`getSession`). Signing in, signing up, second factors, passkeys, recovering\n// a password and the account page are Cauthy's pages: this sends the browser\n// to them and keeps what comes back in an encrypted, httpOnly cookie. There is\n// no database and no screen to build.\n//\n// The session is Cauthy's short-lived access token plus the refresh token that\n// renews it. When the access token expires the session is renewed with Cauthy,\n// which is where an account disabled there, or signed out everywhere, stops\n// being signed in here — within minutes, with nothing to synchronise.\n\nimport { clearParts, readCookies, readParts, writeCookie, writeParts, type CookieAttributes } from './cookies'\nimport { keyOf, seal, unsealAny, unsealIndexed } from './seal'\nimport { checkResultOf, checkWire, organizationIdOf } from './permissions'\nimport { CauthyApiError, createSystem, type CauthySystem } from './system'\nimport { checkCode, checkEmail, checkName, checkNewPassword, checkPassword, firstProblem, passwordPolicyOf, type FieldProblem, type PasswordPolicy, checkOrganization, checkOrganizationName } from './validate'\nimport { memoryReplayStore, verifyWebhook, type CauthyEvent, type VerifyWebhookOptions } from './webhook'\nimport {\n  CauthyConfigError,\n  type CauthyOptions,\n  type CheckQuestion,\n  type CheckResult,\n  type ConditionalPermission,\n  type JsonValue,\n  type OrganizationRef,\n  type PublicSession,\n  type Session,\n  type SessionOrganization,\n  type SessionStatus,\n  type SessionUser,\n} from './types'\nimport { withoutTrailingSlashes } from './url'\nimport { finish } from './protocol'\nimport { deadline } from './deadline'\nimport { createTokenVerifier, type TokenIdentity, type VerifyTokenOptions } from './verify'\nimport { deprecated } from './deprecate'\nimport { checkMount as probeMount, type MountTarget } from './mount'\nimport { parseKey, refuseBesideKey, type CauthyKey } from './cauthykey'\nimport { ASSERTION_TYPE, deriveFromKey, type KeyDerived, type KeyRing } from './keyderive'\nimport { createIdentity, type Identity, type IdentityCache } from './identity'\nimport { CauthyKeyError } from './types'\n\n/** What the session cookie holds. Short names: it rides every request. */\ninterface Stored {\n  at: string // access token\n  rt: string // refresh token\n  exp: number // when the access token expires, epoch seconds\n  u: SessionUser\n  tid: string\n  roles: string[]\n  p?: 1 // the person asked to stay signed in, and Cauthy allowed it\n}\n\n/** What the sign-in in progress holds, between leaving for Cauthy and coming back. */\ninterface Flow {\n  state: string\n  verifier: string\n  returnTo: string\n}\n\n// A session that stays signed in keeps its cookie this long, renewed on each\n// use; a short one has a cookie that ends with the browser session. Cauthy\n// alone decides how long the session itself lives.\nconst PERSISTENT_SECONDS = 30 * 86_400\n// How long a sign-in may sit open at Cauthy and still be finished here. The\n// same hour Cauthy keeps its side of it.\nconst FLOW_SECONDS = 3600\n/** How long a sign-in that had to start again is remembered, so it starts again once and not forever. */\nconst AGAIN_SECONDS = 120\n/** Renew this long before the access token runs out, so a request never carries one about to. */\nconst SKEW_SECONDS = 30\nconst ORGANIZATIONS_TTL_MS = 60_000\n/** How long the workspace's look is kept before Cauthy is asked again. */\nconst LOOK_TTL_MS = 60_000\n/** A provider's id: `google`, `linkedin_oidc`, or one the workspace defined itself, `custom:<slug>`. */\nconst PROVIDER_ID = /^(custom:)?[a-z0-9_-]{1,40}$/\n\n/** The provider named in a route, as written or percent-encoded (`custom%3Aacme`). */\nfunction providerIn(segment: string): string {\n  try {\n    return decodeURIComponent(segment)\n  } catch {\n    return ''\n  }\n}\n\n/** What `resolve` answers: who is there, and the cookies that must go back. */\nexport interface Resolved {\n  session: Session | null\n  status: SessionStatus\n  /** `Set-Cookie` values to send with the response. Empty when nothing changed. */\n  cookies: string[]\n}\n\nexport interface Cauthy {\n  /** Serves the routes under `basePath`: login, callback, session, refresh, logout, account. */\n  handler(request: Request): Promise<Response>\n  /**\n   * Who the application is. On CAUTHY_KEY, Cauthy's answer to\n   * `GET /v1/connect/self`, waited for: it rejects with `CauthyApiError`\n   * `503 misconfigured` when Cauthy refuses the key. Otherwise what is\n   * configured, at once (`key: null`). Await it at startup to fail early.\n   */\n  ready(): Promise<Identity>\n  /**\n   * Checks that this handler is what answers under `basePath` in the running\n   * application, and throws `CauthyConfigError` naming the route when another\n   * one does. Call it once at startup: with the origin after the server\n   * listens (`'http://localhost:3000'`), or with a function that serves a\n   * request in process (Hono's `app.fetch`; `checkFastifyMount` for\n   * Fastify). Nothing it sends reaches Cauthy.\n   */\n  checkMount(target: MountTarget): Promise<void>\n  /**\n   * Who is signed in, or null.\n   *\n   * Give it the response's headers and a session that needs renewing is\n   * renewed on the spot, its new cookie added to them. Without them an\n   * expired session reads as null (see `status`): renewing changes the\n   * cookie, and a cookie nobody sends back is a session lost.\n   */\n  getSession(request: Request, responseHeaders?: Headers): Promise<Session | null>\n  /** Whether somebody is signed in, nobody is, or the session must be renewed first. */\n  status(request: Request): Promise<SessionStatus>\n  /**\n   * The session, renewed when it has to be, and the cookies to send back.\n   * The caller MUST send `cookies` with its response.\n   */\n  resolve(request: Request): Promise<Resolved>\n  /**\n   * For a route only a signed-in person may see: the session, or the response\n   * to give instead — a redirect to sign in (or to renew) for a page, a 401\n   * for anything else.\n   */\n  protect(request: Request): Promise<{ session: Session; response?: undefined } | { session?: undefined; response: Response }>\n  /** The organizations the person belongs to (of `system`, when set), with their role in each. */\n  organizations(session: Session): Promise<SessionOrganization[]>\n  /**\n   * Asks Cauthy whether the signed-in person may do an action on a resource\n   * in an organization, with what its conditions read (`attributes`, whose\n   * the record is). It is how a permission with a condition is decided —\n   * `can` never counts those — and it decides any other the same way.\n   *\n   *   const r = await auth.check(request, { organization, resource: 'invoices', action: 'approve', attributes: { amount: 500 } })\n   *   if (!r.allowed) return forbidden(r.reason)\n   *\n   * Nobody signed in, an organization the person is not in, or a disabled\n   * account answer `allowed: false`. A request whose session must be renewed\n   * first reads as nobody signed in: give it the `Session` from\n   * `getSession(request, responseHeaders)` instead. Throws `CauthyApiError`\n   * when Cauthy refuses the question itself (a malformed one) or cannot be reached.\n   */\n  check(who: Request | Session, question: CheckQuestion & { organization: OrganizationRef }): Promise<CheckResult>\n  /**\n   * Verifies a webhook delivery from Cauthy and answers the event it carries;\n   * throws `CauthyWebhookError` for anything else. No secret is involved: the\n   * delivery is signed with Cauthy's own key.\n   */\n  webhook(request: Request, options?: Pick<VerifyWebhookOptions, 'jwks' | 'now' | 'url'>): Promise<CauthyEvent>\n  /**\n   * Verifies a Cauthy access token (or a request's `Authorization: Bearer`) for\n   * an API of this application: `verifyToken` with this instance's issuer, its\n   * workspace (on CAUTHY_KEY, Cauthy's answer; otherwise `tenantId` or\n   * `CAUTHY_TENANT_ID`) and its audience (on CAUTHY_KEY, Cauthy's answer;\n   * otherwise `audience` or `CAUTHY_AUDIENCE`).\n   */\n  verifyToken(from: string | Request | Headers, options?: Partial<VerifyTokenOptions>): Promise<TokenIdentity>\n  /** The same, built once: throws `CauthyConfigError` now if the audience or the workspace is missing. */\n  tokenVerifier(options?: Partial<VerifyTokenOptions>): (from: string | Request | Headers) => Promise<TokenIdentity>\n  /**\n   * The application acting on its own, with no person's token: its\n   * organizations, their members, invitations. Needs the client's secret, or\n   * `systemKey`.\n   */\n  system: CauthySystem\n  /** What the browser may be told of a session. */\n  toPublic(session: Session): Promise<PublicSession>\n  /** Paths of this application that start a sign-in, a sign-out, or open the account page. */\n  urls: { signIn(returnTo?: string): string; signOut(): string; account(returnTo?: string): string; session: string }\n  options: Readonly<Required<Pick<CauthyOptions, 'issuer' | 'clientId' | 'basePath' | 'afterSignIn' | 'afterSignOut' | 'cookieName'>>>\n}\n\nfunction env(name: string): string | undefined {\n  return typeof process !== 'undefined' ? process.env?.[name] : undefined\n}\n\nfunction hostOf(origin: string): string | undefined {\n  try { return new URL(origin).hostname } catch { return undefined }\n}\n\nfunction b64url(bytes: Uint8Array): string {\n  let s = ''\n  for (const b of bytes) s += String.fromCharCode(b)\n  return btoa(s).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')\n}\n\nfunction random(bytes = 32): string {\n  return b64url(crypto.getRandomValues(new Uint8Array(bytes)))\n}\n\n/**\n * A path of this application, and nothing else: never another site, never\n * `//host`. Browsers drop tabs and line breaks from a URL, so `/\\t/evil.test`\n * would become `//evil.test`: control characters are refused outright, and\n * what is left must resolve to this origin.\n */\nfunction localPath(candidate: string | null | undefined, fallback: string): string {\n  if (!candidate || !candidate.startsWith('/') || candidate.startsWith('//') || candidate.includes('\\\\')) return fallback\n  // eslint-disable-next-line no-control-regex\n  if (/[\\u0000-\\u001f\\u007f]/.test(candidate)) return fallback\n  try {\n    if (new URL(candidate, 'http://x').origin !== 'http://x') return fallback\n  } catch {\n    return fallback\n  }\n  return candidate\n}\n\nfunction json(body: unknown, status = 200, headers?: Headers): Response {\n  const h = headers ?? new Headers()\n  h.set('content-type', 'application/json; charset=utf-8')\n  h.set('cache-control', 'no-store')\n  return new Response(JSON.stringify(body), { status, headers: h })\n}\n\nfunction redirect(location: string, cookies: string[] = []): Response {\n  const h = new Headers({ location, 'cache-control': 'no-store' })\n  for (const c of cookies) h.append('set-cookie', c)\n  return new Response(null, { status: 302, headers: h })\n}\n\n/** A permission with a condition, as Cauthy lists it with an organization. */\nfunction conditionalOf(c: any): ConditionalPermission {\n  return { resource: String(c?.resource ?? ''), action: String(c?.action ?? ''), effect: c?.effect === 'deny' ? 'deny' : 'allow' }\n}\n\n/** What an application on CAUTHY_KEY reads: the key, and the one it replaces while rotating. */\ninterface Keyed {\n  key: CauthyKey\n  previous?: CauthyKey\n  /** While moving off the variables: old sessions are read with it, never written. */\n  legacySecret?: string\n}\n\n/**\n * Contracts are retired: what only they used refuses to start, so a deploy\n * still configured for them never runs half-configured.\n */\nfunction refuseContracts(given: CauthyOptions): void {\n  const options = given as Record<string, unknown>\n  const set = [\n    ...['contract', 'keys', 'rootKey', 'rootKeyPrevious'].filter(name => options[name] !== undefined).map(name => `the ${name} option`),\n    ...['PACT_ROOT_KEY', 'PACT_ROOT_KEY_PREVIOUS'].filter(name => (env(name) ?? '') !== ''),\n  ]\n  if (set.length === 0) return\n  throw new CauthyConfigError(`contracts are retired: run on CAUTHY_KEY alone, and remove ${set.join(', ')}. ` +\n    'An application without a key makes it on its card in Cauthy\\'s dashboard; the same key keeps its people signed in. ' +\n    'Protect sign-in with the \"Protect sign-in\" switches on that card. Sessions sealed with PACT_ROOT_KEY are no longer read.')\n}\n\nfunction byKey(given: CauthyOptions): Keyed | undefined {\n  const text = given.key ?? env('CAUTHY_KEY')\n  if (text === undefined || text === '') return undefined\n  refuseBesideKey(typeof process !== 'undefined' ? process.env : undefined)\n  for (const [name, value] of [['issuer', given.issuer], ['clientId', given.clientId], ['clientSecret', given.clientSecret],\n    ['secret', given.secret], ['system', given.system], ['tenant', given.tenant], ['audience', given.audience], ['tenantId', given.tenantId],\n    ['systemKey', given.systemKey]] as const) {\n    if (value !== undefined) throw new CauthyConfigError(`with CAUTHY_KEY, ${name} comes from CAUTHY_KEY: do not pass it`)\n  }\n  const key = parseKey(text)\n  const prevText = given.keyPrevious ?? env('CAUTHY_KEY_PREVIOUS')\n  let previous: CauthyKey | undefined\n  if (prevText) {\n    try {\n      previous = parseKey(prevText)\n    } catch (e) {\n      if (e instanceof CauthyKeyError) throw new CauthyKeyError(e.reason, `CAUTHY_KEY_PREVIOUS is refused: ${e.message.replace(/^@cauthyhq\\/node: CAUTHY_KEY: /, '').replace(/ \\(key_[a-z_]+\\)$/, '')}`)\n      throw e\n    }\n  }\n  if (previous && (previous.issuer !== key.issuer || previous.clientId !== key.clientId)) {\n    throw new CauthyKeyError('key_previous_mismatch', 'CAUTHY_KEY_PREVIOUS names another Cauthy or client than CAUTHY_KEY')\n  }\n  // The secret of before, accepted beside the key only to read what it sealed.\n  const legacySecret = env('CAUTHY_SECRET') || undefined\n  if (legacySecret) deprecated('CAUTHY_SECRET beside CAUTHY_KEY', 'It is read only for sessions made before the move: remove it after the rotation window.')\n  return { key, previous, legacySecret }\n}\n\n/** A request from an origin the application did not register in Cauthy (CAUTHY_KEY). */\nclass UnknownOriginError extends Error {\n  constructor(readonly origin: string, readonly registered: string[]) {\n    super(`${origin} is not one of the application's addresses in Cauthy (${registered.join(', ') || 'none'}): add it on the application's card, or set baseURL`)\n  }\n}\n\n/** requestHeader: 'warn' says so once per process, whatever number of Cauthy instances run in it. */\nlet toldOfHeader = false\n\n/** A session cookie no key opens is said once per process: people are being signed out. */\nlet toldOfUnopened = false\nfunction toldUnopened(): void {\n  if (toldOfUnopened) return\n  toldOfUnopened = true\n  console.warn('@cauthyhq/node: a session cookie arrived that no key of this application opens; it was cleared and the person is signed out. ' +\n    'Moving to CAUTHY_KEY, keep the secret that sealed the old sessions (CAUTHY_SECRET) beside it for the rotation window; ' +\n    'rotating the key, set CAUTHY_KEY_PREVIOUS.')\n}\n\nexport function createCauthy(given: CauthyOptions = {}): Cauthy {\n  refuseContracts(given)\n  // CAUTHY_KEY first: with it, nothing else names Cauthy or the client.\n  const keyed = byKey(given)\n  const issuer = withoutTrailingSlashes(keyed?.key.issuer ?? given.issuer ?? env('CAUTHY_ISSUER') ?? '')\n  const clientId = keyed?.key.clientId ?? given.clientId ?? env('CAUTHY_CLIENT_ID') ?? ''\n  const clientSecret = keyed ? undefined : given.clientSecret ?? env('CAUTHY_CLIENT_SECRET')\n  const secret = keyed ? '' : given.secret ?? env('CAUTHY_SECRET') ?? ''\n  // On CAUTHY_KEY the workspace and the system are Cauthy's answer (identity below).\n  const system = keyed ? '' : given.system ?? env('CAUTHY_SYSTEM') ?? ''\n  const tenant = keyed ? '' : given.tenant ?? env('CAUTHY_TENANT') ?? ''\n  if (!/^https?:\\/\\//.test(issuer)) throw new CauthyConfigError('issuer (CAUTHY_ISSUER) must be Cauthy\\'s address, e.g. https://id.example.com')\n  if (clientId === '') throw new CauthyConfigError('clientId (CAUTHY_CLIENT_ID) is required')\n  if (!keyed && secret.length < 32) throw new CauthyConfigError('secret (CAUTHY_SECRET) must be at least 32 characters: it encrypts the session cookie')\n  // The keys the cookies are sealed with. On CAUTHY_KEY, one per job, derived\n  // from the key's secret; otherwise the one CAUTHY_SECRET stands for.\n  const fromKey: KeyDerived | undefined = keyed ? deriveFromKey(keyed.key, keyed.previous) : undefined\n  let signingKid: string | undefined\n  fromKey?.signer.then(s => { signingKid = s.kid }, () => undefined)\n  // Beside the key while moving: what CAUTHY_SECRET sealed is still read,\n  // after the key's own entries. Writing always uses entry 0, the key's.\n  const legacySingle = keyed?.legacySecret ? keyOf(keyed.legacySecret) : undefined\n  const withLegacy = async (own: Promise<KeyRing>): Promise<KeyRing> => [...(await own), ...(legacySingle ? [await legacySingle] : [])]\n  const single: Promise<KeyRing> = fromKey ? Promise.resolve([]) : keyOf(secret).then(k => [k])\n  const cookieKeys = fromKey ? withLegacy(fromKey.cookie) : single\n  const flowKeys = fromKey ? withLegacy(fromKey.flow) : single\n  // Applications on the variables of 1.1 are told once where to go.\n  if (!keyed) {\n    deprecated('Configuring with CAUTHY_ISSUER, CAUTHY_CLIENT_ID, CAUTHY_CLIENT_SECRET, CAUTHY_SECRET and the other CAUTHY_* variables (or their options)',\n      'Connect the application in Cauthy\\'s dashboard and use the one variable CAUTHY_KEY.')\n  }\n  const baseURL = given.baseURL ?? (keyed ? undefined : env('CAUTHY_BASE_URL'))\n  if (baseURL !== undefined && baseURL !== '' && !/^https?:\\/\\/[^/]+\\/*$/.test(baseURL)) {\n    throw new CauthyConfigError('baseURL (CAUTHY_BASE_URL) must be the application\\'s public origin, e.g. https://app.example.com')\n  }\n\n  const basePath = '/' + (given.basePath ?? '/api/auth').replace(/^\\/+|\\/+$/g, '')\n  const requestHeader = given.requestHeader ?? 'required'\n  if (requestHeader !== 'required' && requestHeader !== 'warn') throw new CauthyConfigError(\"requestHeader must be 'required' or 'warn'\")\n  const afterSignIn = localPath(given.afterSignIn, '/')\n  const afterSignOut = localPath(given.afterSignOut, '/')\n  const cookieName = given.cookieName ?? 'cauthy_session'\n  const flowCookie = `${cookieName}_flow`\n  const againCookie = `${cookieName}_again`\n  const stepCookie = `${cookieName}_step`\n  const systemTimeout = given.timeouts?.system ?? 2000\n  const requestTimeout = given.timeouts?.request ?? 5000\n  for (const [name, ms] of [['system', systemTimeout], ['request', requestTimeout]] as const) {\n    if (!Number.isFinite(ms) || ms <= 0) throw new CauthyConfigError(`timeouts.${name} must be a positive number of milliseconds`)\n  }\n  // Every call to Cauthy has a deadline; for the event stream it covers the\n  // first response only, and the page that goes away ends the rest.\n  const doFetch = deadline(given.fetch, requestTimeout)\n  const iconOf = iconFor(issuer)\n  const pages = {\n    signIn: given.pages?.signIn ? localPath(given.pages.signIn, '/') : undefined,\n    resetPassword: given.pages?.resetPassword ? localPath(given.pages.resetPassword, '/') : undefined,\n    verifyEmail: given.pages?.verifyEmail ? localPath(given.pages.verifyEmail, '/') : undefined,\n    acceptInvite: given.pages?.acceptInvite ? localPath(given.pages.acceptInvite, '/') : undefined,\n  }\n  // The application acting on its own has no request to read its origin\n  // from: its invitations open the application's page only when it was told\n  // its public origin.\n  const acceptInviteUrl = baseURL && pages.acceptInvite ? `${withoutTrailingSlashes(baseURL)}${pages.acceptInvite}` : undefined\n  const ownSystem = createSystem({ issuer, clientId, clientSecret, key: given.systemKey, system: system || undefined, acceptInviteUrl, fetch: given.fetch, timeoutMs: systemTimeout,\n    // On CAUTHY_KEY the key proves the key's own client.\n    ...(fromKey ? { signer: { clientId, signer: fromKey.signer }, currentSystem: () => identity?.current()?.system ?? '' } : {}) })\n\n  // Who the application is, on CAUTHY_KEY: asked of Cauthy now, awaited by\n  // the first request (and by auth.ready()), revalidated every five minutes.\n  const identity: IdentityCache | undefined = keyed\n    ? createIdentity({ issuer, token: () => ownSystem.token(), fetch: deadline(given.fetch, requestTimeout), kid: () => signingKid,\n      log: m => console.error(`@cauthyhq/node: ${m}`) })\n    : undefined\n  identity?.ready().catch(() => { /* answered per request: 503 unavailable or misconfigured */ })\n  const tenantNow = () => identity?.current()?.tenant.slug ?? tenant\n  // The client people sign in with. On CAUTHY_KEY it is Cauthy's to say\n  // (sign_in_client_id): an application once connected by a contract has its\n  // key on the link's service client, and its people sign in, and hold their\n  // refresh tokens, through the link's sign-in client. Otherwise the key's.\n  const signInClientNow = () => identity?.current()?.sign_in_client_id || clientId\n  // Waited for where a wrong client would cost a session (a refresh token\n  // belongs to the client it was issued to): throws while Cauthy has not answered.\n  const signInClient = async (): Promise<string> => (identity ? (await identity.ready()).sign_in_client_id || clientId : clientId)\n  const systemNow = () => identity?.current()?.system ?? system\n\n  // The application's public origin. Without baseURL it is the request's, with\n  // the scheme a TLS-terminating proxy (Railway, Fly, Render, a load balancer)\n  // says the browser used: the server itself only sees plain http.\n  const requestOrigin = (request: Request) => {\n    const url = new URL(request.url)\n    const proto = request.headers.get('x-forwarded-proto')?.split(',')[0]?.trim().toLowerCase()\n    return proto === 'https' || proto === 'http' ? `${proto}://${url.host}` : url.origin\n  }\n  // On CAUTHY_KEY the request's origin counts only when it is one the\n  // application registered in Cauthy (app_urls); else the only one there is;\n  // else the request is refused (400 unknown_origin).\n  const originOf = (request: Request) => {\n    if (baseURL) return withoutTrailingSlashes(baseURL)\n    const asked = requestOrigin(request)\n    if (!identity) return asked\n    const urls = identity.current()?.app_urls ?? []\n    if (urls.includes(asked)) return asked\n    if (urls.length === 1) return urls[0]\n    throw new UnknownOriginError(asked, urls)\n  }\n  const safeOrigin = (request: Request) => {\n    try { return originOf(request) } catch { return requestOrigin(request) }\n  }\n  const attrs = (request: Request, maxAge?: number): CookieAttributes => ({ secure: safeOrigin(request).startsWith('https://'), maxAge })\n\n  // How the application proves itself at the token and revoke endpoints: on\n  // CAUTHY_KEY a fresh Ed25519 assertion per call, never a secret. When\n  // Cauthy names a sign-in client other than the key's, that one is public:\n  // the key proves the key's client only, and the code exchange carries the\n  // system's proof (passedOn).\n  async function clientAuth(form: URLSearchParams): Promise<URLSearchParams> {\n    if (fromKey && form.get('client_id') === clientId) {\n      const s = await fromKey.signer\n      form.set('client_assertion_type', ASSERTION_TYPE)\n      form.set('client_assertion', await s.assertion(clientId, `${issuer}/v1/oauth/token`))\n    } else if (clientSecret) {\n      form.set('client_secret', clientSecret)\n    }\n    return form\n  }\n\n  // ── Talking to Cauthy ────────────────────────────────────────────────────\n\n  // `proof`: the system's own headers (passedOn), sent on a code exchange —\n  // the application's \"Protect sign-in\" switch may ask for them, so a copied\n  // client id is no use on its own.\n  async function token(form: Record<string, string>, proof: Record<string, string> = {}): Promise<{ ok: true; body: any } | { ok: false; ended: boolean; code?: string }> {\n    try {\n      const body = await clientAuth(new URLSearchParams({ client_id: await signInClient(), ...form }))\n      const res = await doFetch(`${issuer}/v1/oauth/token`, {\n        method: 'POST',\n        headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json', ...proof },\n        body,\n      })\n      if (res.ok) return { ok: true, body: await res.json() }\n      // 4xx is Cauthy's answer: the grant is no good. Anything else is a\n      // failure to ask, and says nothing about the session.\n      // Cauthy names why, as an OAuth error (RFC 6749 §5.2) with an extension code.\n      const why = (await res.json().catch(() => null)) as { error?: unknown } | null\n      return { ok: false, ended: res.status >= 400 && res.status < 500, ...(typeof why?.error === 'string' ? { code: why.error } : {}) }\n    } catch {\n      return { ok: false, ended: false }\n    }\n  }\n\n  async function userinfo(accessToken: string): Promise<{ u: SessionUser; tid: string; roles: string[] } | null> {\n    try {\n      const res = await doFetch(`${issuer}/v1/oauth/userinfo`, { headers: { authorization: `Bearer ${accessToken}` } })\n      if (!res.ok) return null\n      const b = (await res.json()) as Record<string, any>\n      return {\n        tid: String(b.tid ?? ''),\n        roles: Array.isArray(b.roles) ? b.roles.filter((r: unknown) => typeof r === 'string') : [],\n        u: {\n          id: String(b.sub ?? ''),\n          email: String(b.email ?? ''),\n          name: String(b.name ?? ''),\n          emailVerified: b.email_verified === true,\n          restricted: b.restricted === true,\n          ...(typeof b.email_verify_by === 'string' ? { emailVerifyBy: b.email_verify_by } : {}),\n          ...(typeof b.locale === 'string' && b.locale !== '' ? { locale: b.locale } : {}),\n          ...(b.anonymous === true ? { isAnonymous: true } : {}),\n        },\n      }\n    } catch {\n      return null\n    }\n  }\n\n  /** Whether the session stays signed in: as Cauthy says, or as it was when an older Cauthy says nothing. */\n  const kindOf = (body: any, was?: Stored): { p?: 1 } =>\n    (typeof body?.persistent === 'boolean' ? body.persistent : was?.p === 1) ? { p: 1 } : {}\n\n  /** Best effort: tells Cauthy a refresh token is no longer wanted. */\n  async function revoke(refreshToken: string): Promise<void> {\n    try {\n      const form = await clientAuth(new URLSearchParams({ client_id: await signInClient(), token: refreshToken }))\n      await doFetch(`${issuer}/v1/oauth/revoke`, { method: 'POST', headers: { 'content-type': 'application/x-www-form-urlencoded' }, body: form })\n    } catch {\n      // Best effort.\n    }\n  }\n\n  /** What Cauthy's answer to a token request becomes in the cookie. */\n  async function stored(body: any, was?: Stored): Promise<Stored | null> {\n    if (typeof body?.access_token !== 'string' || typeof body?.refresh_token !== 'string') return null\n    const who = await userinfo(body.access_token)\n    if (who === null || who.u.id === '') return null\n    const lifetime = typeof body.expires_in === 'number' && body.expires_in > 0 ? body.expires_in : 300\n    return { at: body.access_token, rt: body.refresh_token, exp: Math.floor(Date.now() / 1000) + lifetime, ...who, ...kindOf(body, was) }\n  }\n\n  function toSession(s: Stored): Session {\n    return { user: s.u, tenantId: s.tid, roles: s.roles, accessToken: s.at, expiresAt: new Date(s.exp * 1000).toISOString() }\n  }\n\n  // ── The cookie ───────────────────────────────────────────────────────────\n\n  // `stale`: opened by a key that only reads (CAUTHY_KEY_PREVIOUS, or the\n  // CAUTHY_SECRET of before the move), so it is sealed again\n  // with the current key on the first answer that can carry a cookie.\n  async function read(request: Request): Promise<{ had: Map<string, string>; value: Stored | null; present: boolean; stale: boolean }> {\n    const had = readCookies(request.headers.get('cookie'))\n    const raw = readParts(had, cookieName)\n    if (raw === null) return { had, value: null, present: false, stale: false }\n    const opened = await unsealIndexed<Stored>(raw, await cookieKeys)\n    const value = opened?.value ?? null\n    const sound = value !== null && typeof value.at === 'string' && typeof value.rt === 'string' && typeof value.exp === 'number'\n    return { had, value: sound ? value : null, present: true, stale: sound && opened!.index > 0 }\n  }\n\n  async function write(request: Request, s: Stored, had: Map<string, string>): Promise<string[]> {\n    return writeParts(cookieName, await seal(s, (await cookieKeys)[0]), attrs(request, s.p === 1 ? PERSISTENT_SECONDS : undefined), had)\n  }\n\n  const fresh = (s: Stored) => s.exp - Date.now() / 1000 > SKEW_SECONDS\n\n  // One renewal per refresh token at a time in this process: requests that\n  // arrive together share it. (Across processes Cauthy gives a few seconds'\n  // grace to the same token, for the same reason.)\n  const renewing = new Map<string, Promise<Stored | 'ended' | 'unreachable'>>()\n\n  function renew(was: Stored): Promise<Stored | 'ended' | 'unreachable'> {\n    let running = renewing.get(was.rt)\n    if (running === undefined) {\n      const rt = was.rt\n      running = (async (): Promise<Stored | 'ended' | 'unreachable'> => {\n        const res = await token({ grant_type: 'refresh_token', refresh_token: rt })\n        if (!res.ok) return res.ended ? 'ended' : 'unreachable'\n        const next = await stored(res.body, was)\n        if (next !== null) return next\n        // Renewed, but who it is could not be read just now. The new tokens\n        // are kept all the same — the old refresh token is spent, and losing\n        // its successor would lose the session — with what was known before.\n        if (typeof res.body?.access_token !== 'string' || typeof res.body?.refresh_token !== 'string') return 'unreachable'\n        const lifetime = typeof res.body.expires_in === 'number' && res.body.expires_in > 0 ? res.body.expires_in : 300\n        const { p: _, ...rest } = was\n        return { ...rest, at: res.body.access_token, rt: res.body.refresh_token, exp: Math.floor(Date.now() / 1000) + lifetime, ...kindOf(res.body, was) }\n      })()\n      renewing.set(rt, running)\n      // A renewal that worked is remembered for a moment, for requests still\n      // arriving with the old cookie; one that could not ask is tried again\n      // by the next request.\n      void running.then((result) => {\n        if (result === 'unreachable') return renewing.delete(rt)\n        const timer = setTimeout(() => renewing.delete(rt), 5_000)\n        ;(timer as { unref?: () => void }).unref?.()\n      })\n    }\n    return running\n  }\n\n  async function resolve(request: Request): Promise<Resolved> {\n    const { had, value, present, stale } = await read(request)\n    if (value === null) {\n      // A cookie this key did not make (a rotated secret, a tampered value) is cleared.\n      if (present) toldUnopened()\n      return { session: null, status: 'unauthenticated', cookies: present ? clearParts(cookieName, attrs(request, 0), had) : [] }\n    }\n    // Sealed with a key that only reads: sealed again now with the current\n    // one, so the session outlives the removal of the old secret.\n    if (fresh(value)) return { session: toSession(value), status: 'authenticated', cookies: stale ? await write(request, value, had) : [] }\n\n    const renewed = await renew(value)\n    if (renewed === 'ended') {\n      return { session: null, status: 'unauthenticated', cookies: clearParts(cookieName, attrs(request, 0), had) }\n    }\n    // Cauthy could not be asked: the cookie stays as it is, and the next\n    // request tries again. Nobody is let in on an expired token meanwhile.\n    if (renewed === 'unreachable') return { session: null, status: 'expired', cookies: [] }\n    return { session: toSession(renewed), status: 'authenticated', cookies: await write(request, renewed, had) }\n  }\n\n  async function getSession(request: Request, responseHeaders?: Headers): Promise<Session | null> {\n    if (responseHeaders === undefined) {\n      const { value } = await read(request)\n      return value !== null && fresh(value) ? toSession(value) : null\n    }\n    const r = await resolve(request)\n    for (const c of r.cookies) responseHeaders.append('set-cookie', c)\n    return r.session\n  }\n\n  async function status(request: Request): Promise<SessionStatus> {\n    const { value } = await read(request)\n    if (value === null) return 'unauthenticated'\n    return fresh(value) ? 'authenticated' : 'expired'\n  }\n\n  // ── Organizations ────────────────────────────────────────────────────────\n\n  const orgCache = new Map<string, { at: number; value: SessionOrganization[] }>()\n\n  async function organizations(session: Session): Promise<SessionOrganization[]> {\n    const hit = orgCache.get(session.accessToken)\n    if (hit && Date.now() - hit.at < ORGANIZATIONS_TTL_MS) return hit.value\n    const sys = systemNow()\n    const url = `${issuer}/v1/oauth/organizations${sys ? `?system=${encodeURIComponent(sys)}` : ''}`\n    const res = await doFetch(url, { headers: { authorization: `Bearer ${session.accessToken}` } })\n    if (!res.ok) throw new Error(`@cauthyhq/node: reading organizations: ${res.status}`)\n    const body = (await res.json()) as { data?: Record<string, any>[] }\n    const value = (body.data ?? []).map(\n      (o): SessionOrganization => ({\n        id: String(o.id),\n        system: String(o.system ?? ''),\n        name: String(o.name ?? ''),\n        kind: String(o.kind ?? ''),\n        role: String(o.role ?? ''),\n        metadata: (o.metadata as Record<string, JsonValue>) ?? {},\n        ...(o.external_id ? { externalId: String(o.external_id) } : {}),\n        ...(Array.isArray(o.permissions)\n          ? { permissions: o.permissions.map(String), denied: Array.isArray(o.denied) ? o.denied.map(String) : [], conditional: Array.isArray(o.conditional) ? o.conditional.map(conditionalOf) : [] }\n          : {}),\n      }),\n    )\n    if (orgCache.size > 5_000) orgCache.clear()\n    orgCache.set(session.accessToken, { at: Date.now(), value })\n    return value\n  }\n\n  // ── Asking Cauthy ────────────────────────────────────────────────────────\n\n  /** Cauthy's decision for the person whose token this is; refusals about the person are a no. */\n  async function decide(token: string, question: CheckQuestion & { organization: OrganizationRef }): Promise<CheckResult> {\n    const org = organizationIdOf(question.organization)\n    if (org === '') return { allowed: false, reason: 'no organization named' }\n    const res = await doFetch(`${issuer}/v1/oauth/organizations/${encodeURIComponent(org)}/check`, {\n      method: 'POST',\n      headers: { authorization: `Bearer ${token}`, 'content-type': 'application/json', accept: 'application/json' },\n      body: JSON.stringify(checkWire(question)),\n    }).catch(() => null)\n    if (res === null) throw new CauthyApiError(503, 'unavailable', 'Cauthy could not be reached to check a permission')\n    const body = (await res.json().catch(() => null)) as { data?: unknown; errors?: { code?: string; message?: string }[] } | null\n    if (res.ok) return checkResultOf(body?.data)\n    const first = body?.errors?.[0]\n    // About the person, not the question: a token no longer good, an account\n    // disabled, an organization they are not in. Each is a plain no.\n    if (res.status === 401 || res.status === 403 || res.status === 404) {\n      return { allowed: false, reason: first?.message ?? (res.status === 401 ? 'not signed in' : res.status === 404 ? 'not a member of the organization' : 'refused') }\n    }\n    throw new CauthyApiError(res.status, first?.code ?? 'error', `Cauthy refused to check a permission (${res.status}): ${first?.message ?? res.statusText}`)\n  }\n\n  async function check(who: Request | Session, question: CheckQuestion & { organization: OrganizationRef }): Promise<CheckResult> {\n    // A Session carries its token; anything else is the request it rides on.\n    const session = 'accessToken' in who ? who : await getSession(who)\n    if (!session) return { allowed: false, reason: 'not signed in' }\n    return decide(session.accessToken, question)\n  }\n\n  // The application's own identity, as `auth.system`. A change it makes to who\n  // belongs where (a new member, a new role, an organization gone) empties the\n  // organizations read above: a person added a moment ago sees the\n  // organization on the next page, not a minute later.\n  const forgetting = <A extends unknown[], R>(fn: (...args: A) => Promise<R>) =>\n    async (...args: A): Promise<R> => {\n      const out = await fn(...args)\n      orgCache.clear()\n      return out\n    }\n  const systemThatRefreshes: CauthySystem = {\n    ...ownSystem,\n    organizations: {\n      ...ownSystem.organizations,\n      update: forgetting(ownSystem.organizations.update),\n      remove: forgetting(ownSystem.organizations.remove),\n    },\n    members: {\n      ...ownSystem.members,\n      add: forgetting(ownSystem.members.add),\n      setRole: forgetting(ownSystem.members.setRole),\n      remove: forgetting(ownSystem.members.remove),\n    },\n  }\n\n  async function toPublic(session: Session): Promise<PublicSession> {\n    let orgs: SessionOrganization[] = []\n    try {\n      orgs = await organizations(session)\n    } catch {\n      // The person is signed in all the same; their organizations come back on the next read.\n    }\n    return { user: session.user, tenantId: session.tenantId, roles: session.roles, organizations: orgs, expiresAt: session.expiresAt }\n  }\n\n  // ── Routes ───────────────────────────────────────────────────────────────\n\n  const urls = {\n    signIn: (returnTo?: string) => `${basePath}/login${returnTo ? `?return_to=${encodeURIComponent(returnTo)}` : ''}`,\n    signOut: () => `${basePath}/logout`,\n    account: (returnTo?: string) => `${basePath}/account${returnTo ? `?return_to=${encodeURIComponent(returnTo)}` : ''}`,\n    session: `${basePath}/session`,\n  }\n\n  async function login(request: Request, url: URL): Promise<Response> {\n    const flow: Flow = { state: random(), verifier: random(48), returnTo: localPath(url.searchParams.get('return_to'), afterSignIn) }\n    const challenge = b64url(new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(flow.verifier))))\n    const q = new URLSearchParams({\n      client_id: await signInClient(),\n      redirect_uri: `${originOf(request)}${basePath}/callback`,\n      response_type: 'code',\n      state: flow.state,\n      code_challenge: challenge,\n      code_challenge_method: 'S256',\n    })\n    // What the application may ask of the sign-in page: to ask again, and a language.\n    const prompt = url.searchParams.get('prompt')\n    if (prompt === 'login' || prompt === 'none') q.set('prompt', prompt)\n    const locale = url.searchParams.get('locale') ?? url.searchParams.get('ui_locales')\n    if (locale && /^[a-zA-Z-]{2,10}$/.test(locale)) q.set('ui_locales', locale)\n    // An application whose own page cannot use the person's passkey sends\n    // them to Cauthy's for that step alone: a page that asks for the passkey\n    // and nothing else, and comes straight back.\n    let passkey = ''\n    if (url.searchParams.get('method') === 'passkey') {\n      q.set('method', 'passkey')\n      passkey = '#passkey' // what a Cauthy from before that page reads\n    }\n    return redirect(`${issuer}/v1/oauth/authorize?${q}${passkey}`, [\n      writeCookie(flowCookie, await seal(flow, (await flowKeys)[0]), attrs(request, FLOW_SECONDS)),\n    ])\n  }\n\n  function failed(request: Request, reason: string): Response {\n    const h = new Headers({ 'content-type': 'text/plain; charset=utf-8', 'cache-control': 'no-store' })\n    h.append('set-cookie', writeCookie(flowCookie, '', attrs(request, 0)))\n    h.append('set-cookie', writeCookie(againCookie, '', attrs(request, 0)))\n    return new Response(`Sign-in could not be completed (${reason}). Go back and try again.`, { status: 400, headers: h })\n  }\n\n  async function callback(request: Request, url: URL): Promise<Response> {\n    const had = readCookies(request.headers.get('cookie'))\n    const sealed = had.get(flowCookie)\n    const flow = sealed ? await unsealAny<Flow>(sealed, await flowKeys) : null\n    // The answer must be to a question THIS browser asked: without that, a\n    // stranger's link could sign a person in to the stranger's account.\n    if (flow === null || url.searchParams.get('state') !== flow.state) {\n      // Not this browser's question — or its question was asked so long ago\n      // that it is forgotten: the page sat open, or the answer is to an older\n      // tab's. Nobody is signed in by it; the sign-in starts again, once. The\n      // person is still signed in at Cauthy, so they are not asked twice.\n      if (had.get(againCookie) === undefined) {\n        const back = flow?.returnTo ?? afterSignIn\n        return redirect(`${basePath}/login?return_to=${encodeURIComponent(back)}`, [writeCookie(againCookie, '1', attrs(request, AGAIN_SECONDS))])\n      }\n      return failed(request, 'state_mismatch')\n    }\n    const error = url.searchParams.get('error')\n    if (error !== null) {\n      // prompt=none and nobody signed in: not an error, just \"nobody\".\n      if (error === 'login_required') return redirect(flow.returnTo, [writeCookie(flowCookie, '', attrs(request, 0))])\n      // The person went back from Cauthy's page: to the sign-in they came from.\n      if (error === 'access_denied') {\n        const back = pages.signIn ?? flow.returnTo\n        return redirect(`${back}${back.includes('?') ? '&' : '?'}auth_error=cancelled`, [writeCookie(flowCookie, '', attrs(request, 0))])\n      }\n      return failed(request, error.slice(0, 60))\n    }\n    const code = url.searchParams.get('code')\n    if (!code) return failed(request, 'no_code')\n    const res = await token({\n      grant_type: 'authorization_code',\n      code,\n      redirect_uri: `${originOf(request)}${basePath}/callback`,\n      code_verifier: flow.verifier,\n    }, await passedOn(request))\n    // Back to the application's sign-in page with the reason, and the question forgotten.\n    const unconfirmed = () => {\n      const page = pages.signIn ?? '/'\n      return redirect(`${page}${page.includes('?') ? '&' : '?'}auth_error=email_not_confirmed`,\n        [writeCookie(flowCookie, '', attrs(request, 0)), writeCookie(againCookie, '', attrs(request, 0))])\n    }\n    // Cauthy refuses at the token endpoint when the client requires a confirmed address.\n    if (!res.ok && res.code === 'email_not_confirmed') return unconfirmed()\n    const s = res.ok ? await stored(res.body) : null\n    if (s === null) return failed(request, 'exchange_failed')\n    return redirect(flow.returnTo, [...(await write(request, s, had)), writeCookie(flowCookie, '', attrs(request, 0)), writeCookie(againCookie, '', attrs(request, 0))])\n  }\n\n  async function logout(request: Request): Promise<Response> {\n    const { had, value } = await read(request)\n    if (value !== null) {\n      // Best effort: the session is over here whether or not Cauthy heard.\n      await revoke(value.rt)\n      orgCache.delete(value.at)\n    }\n    // Then through Cauthy, which ends its own session in this browser too:\n    // otherwise the next \"sign in\" would walk straight back in.\n    const q = new URLSearchParams({ client_id: signInClientNow(), post_logout_redirect_uri: `${originOf(request)}${afterSignOut}` })\n    return redirect(`${issuer}/v1/oauth/logout?${q}`, clearParts(cookieName, attrs(request, 0), had))\n  }\n\n  // ── The application's own screens ────────────────────────────────────────\n  //\n  // The application draws its sign-in, with its own components; these routes\n  // do the work behind it. The browser talks to the application's server and\n  // to nobody else: the password goes from the form to here and from here to\n  // Cauthy, the tokens Cauthy answers with go into the same encrypted cookie\n  // as ever, and nothing the browser could keep is sent back to it.\n\n  /** How long a sign-in waits for its second step, or for a provider to answer. */\n  const STEP_SECONDS = 600\n  /** How long a passkey ceremony waits for the person: Cauthy's own limit. */\n  const PASSKEY_SECONDS = 300\n\n  /** How an account takes its second step, as Cauthy says it. */\n  const factorsOf = (d: any) => ({\n    totp: d?.totp === true,\n    phone: d?.phone ? { number: String(d.phone.number ?? ''), channel: String(d.phone.channel ?? 'sms') } : null,\n    phoneChannels: Array.isArray(d?.phone_channels) ? d.phone_channels.map(String) : [],\n  })\n\n  /** What the browser answered a passkey ceremony with, as JSON. */\n  const isCredential = (v: unknown): v is Record<string, unknown> =>\n    typeof v === 'object' && v !== null && !Array.isArray(v) && typeof (v as { id?: unknown }).id === 'string' && typeof (v as { response?: unknown }).response === 'object'\n\n  const passkeyOf = (d: any) => ({\n    id: String(d?.id ?? ''), name: String(d?.nickname ?? ''),\n    kind: ['security_key', 'synced', 'device'].includes(d?.kind) ? d.kind : 'unknown', createdAt: String(d?.created_at ?? ''), lastUsedAt: d?.last_used_at ? String(d.last_used_at) : null,\n  })\n\n  const UUID = /^[0-9a-f-]{36}$/i\n\n  /** An organization the person belongs to, with what they may do with it and its people. */\n  const seatOf = (d: any) => ({\n    id: String(d?.id ?? ''), system: String(d?.system ?? ''), name: String(d?.name ?? ''), kind: String(d?.kind ?? ''), role: String(d?.role ?? ''),\n    // A Cauthy from before a power says nothing of it: then it is not given.\n    can: {\n      readMembers: d?.can?.read_members === true, manageMembers: d?.can?.manage_members === true, removeMembers: d?.can?.remove_members === true,\n      update: d?.can?.update === true, archive: d?.can?.archive === true, delete: d?.can?.delete === true,\n    },\n  })\n  /** A person of an organization, as a member who may see them reads it. */\n  const orgMemberOf = (d: any) => ({\n    userId: String(d?.user_id ?? ''), email: String(d?.email ?? ''), name: String(d?.name ?? ''), role: String(d?.role ?? ''),\n    status: String(d?.status ?? ''), invited: d?.invited === true, manager: d?.manager === true, you: d?.you === true, since: String(d?.since ?? ''),\n  })\n  /** A role of the organization's system that a member may give. */\n  const orgRoleOf = (d: any) => ({\n    role: String(d?.role ?? ''), name: String(d?.name ?? ''), description: String(d?.description ?? ''), manager: d?.manager === true,\n  })\n\n  /** An AI agent the person connected, as Cauthy says it. */\n  const agentOf = (d: any) => ({\n    id: String(d?.id ?? ''),\n    name: String(d?.agent?.name ?? ''),\n    redirectHost: String(d?.agent?.redirect_host ?? ''),\n    resource: { name: String(d?.resource?.name ?? ''), uri: String(d?.resource?.uri ?? '') },\n    scopes: Array.isArray(d?.scopes) ? d.scopes.map((s: any) => ({ name: String(s?.name ?? ''), description: String(s?.description ?? '') })) : [],\n    connectedAt: String(d?.created_at ?? ''),\n    lastUsedAt: String(d?.last_used_at ?? ''),\n  })\n\n  interface Step {\n    /** `mfa`: Cauthy asked for a code. `social`: a provider is answering. `link`: a provider is answering to be linked to the signed-in account. `passkey`/`enrol`: a passkey ceremony is under way on the page. `sso`: the person's company is answering; `token` is the PKCE verifier. */\n    kind: 'mfa' | 'social' | 'code' | 'link' | 'passkey' | 'enrol' | 'sso' | 'upgrade'\n    token: string\n    provider?: string\n    returnTo: string\n    /** The person asked to stay signed in: every call of the sign-in says so to Cauthy. */\n    remember?: boolean\n  }\n\n  /** A form's yes: true, \"1\" or \"on\". */\n  const wants = (v: unknown) => v === true || v === '1' || v === 'on' || v === 'true'\n\n  const problem = (status: number, code: string, message: string, field?: string, headers?: Headers, reasons?: string[]) =>\n    json({ error: { code, message, ...(field ? { field } : {}), ...(reasons && reasons.length > 0 ? { reasons } : {}) } }, status, headers)\n\n  const invalid = (p: FieldProblem) => problem(400, p.code, p.message, p.field)\n\n  let explained = false\n\n  /**\n   * A mutation carries X-Cauthy-Request: 1, which another site cannot add\n   * without CORS: the answer to send instead, or null when it may go on.\n   */\n  function withoutRequestHeader(request: Request, route: string): Response | null {\n    if (request.headers.get('x-cauthy-request') === '1') return null\n    if (requestHeader === 'warn') {\n      if (!toldOfHeader) {\n        toldOfHeader = true\n        console.warn(`@cauthyhq/node: POST ${basePath}${route} arrived without X-Cauthy-Request: 1 and was let through (requestHeader: 'warn'). ` +\n          'Update the browser to cauthy-auth 0.43 or @cauthyhq/js, then remove requestHeader.')\n      }\n      return null\n    }\n    return problem(403, 'csrf_required', 'This request did not come from this application\\'s own client.')\n  }\n\n  /** A request this application's own page made: never another site's form. */\n  function ownRequest(request: Request): boolean {\n    const origin = request.headers.get('origin')\n    if (origin !== null) {\n      const own = originOf(request)\n      if (origin === own || origin === new URL(request.url).origin) return true\n      // The same host on another scheme or port is this application seen\n      // through a proxy, not another site: say so once, where it can be fixed.\n      if (!explained && hostOf(origin) === new URL(own).hostname) {\n        explained = true\n        console.warn(`@cauthyhq/node: refused a request from ${origin} as cross_site: this application sees itself as ${own}. ` +\n          'Behind a proxy? Set CAUTHY_BASE_URL (or baseURL) to the public origin.')\n      }\n      return false\n    }\n    // No Origin: a browser sends one on every cross-site POST, so this is a\n    // same-origin form of an old browser, or not a browser at all.\n    return (request.headers.get('sec-fetch-site') ?? 'same-origin') === 'same-origin'\n  }\n\n  async function body(request: Request): Promise<Record<string, unknown> | null> {\n    if (!(request.headers.get('content-type') ?? '').includes('application/json')) return null\n    try {\n      const b = (await request.json()) as unknown\n      return typeof b === 'object' && b !== null && !Array.isArray(b) ? (b as Record<string, unknown>) : null\n    } catch {\n      return null\n    }\n  }\n\n  // Every person signing in here reaches Cauthy from this server's address.\n  // So the application says whose request it is passing on, and proves it is\n  // a system of the workspace with its own token: Cauthy believes the address\n  // from nobody else. The proof goes even when the address is unknown (no\n  // proxy in front, as in development): it also tells Cauthy which\n  // application signed the person in. An application that is no system\n  // passes nothing on.\n  // By default the address the last proxy wrote that is not the application's\n  // own network: a platform may put its own hop (127.0.0.1, 10.x) after it.\n  const clientIp = given.clientIp ?? ((request: Request) =>\n    request.headers.get('x-forwarded-for')?.split(',').map(a => a.trim()).reverse().find(a => a !== '' && !ownNetwork(a)))\n  let noProofUntil = 0\n  async function passedOn(request: Request): Promise<Record<string, string>> {\n    if (Date.now() < noProofUntil) return {}\n    const ip = clientIp(request)\n    try {\n      // The application's address too: a sign-in at a production one ticks\n      // its \"In production\" step in Cauthy's dashboard.\n      const proof = { 'x-cauthy-system-token': await ownSystem.token(), 'x-cauthy-app-origin': originOf(request) }\n      return ip ? { ...proof, 'x-cauthy-client-ip': ip } : proof\n    } catch {\n      // Not a system, or Cauthy is not answering: ask again shortly. Not\n      // long: Cauthy may ask for the proof on every sign-in.\n      noProofUntil = Date.now() + 30_000\n      return {}\n    }\n  }\n\n  /** Asks Cauthy's own API, as this workspace's application. */\n  async function ask(request: Request, method: string, path: string, payload?: unknown, page?: string, bearer?: string, remember = false): Promise<{ status: number; data: any; error?: { code: string; message: string; reasons?: string[] } }> {\n    try {\n      const res = await doFetch(`${issuer}${path}`, {\n        method,\n        headers: {\n          'x-tenant-key': tenantNow(),\n          accept: 'application/json',\n          // A link Cauthy mails opens the application's page for it when it\n          // has one; otherwise Cauthy's own. Either way in the reader's language.\n          ...(page ? { 'x-cauthy-link-to': `${originOf(request)}${page}` } : { 'x-cauthy-links': 'hosted' }),\n          // Whose request it is: what Cauthy mails goes in this application's\n          // name, under its logo.\n          ...(signInClientNow() ? { 'x-cauthy-client-id': signInClientNow() } : {}),\n          ...(await passedOn(request)),\n          ...(bearer ? { authorization: `Bearer ${bearer}` } : {}),\n          // The person asked to stay signed in: Cauthy keeps the session long if the workspace allows it.\n          ...(remember ? { 'x-cauthy-remember': '1' } : {}),\n          // The answer to the workspace's Turnstile challenge, from the\n          // person's browser: Cauthy checks it at the doors that ask for it.\n          ...(request.headers.get('x-cauthy-captcha') ? { 'x-captcha-token': request.headers.get('x-cauthy-captcha') as string } : {}),\n          ...(request.headers.get('accept-language') ? { 'accept-language': request.headers.get('accept-language') as string } : {}),\n          // The language the application says its person reads, over the browser's.\n          ...(request.headers.get('x-cauthy-locale') ? { 'x-cauthy-locale': request.headers.get('x-cauthy-locale') as string } : {}),\n          ...(request.headers.get('user-agent') ? { 'user-agent': request.headers.get('user-agent') as string } : {}),\n          ...(payload === undefined ? {} : { 'content-type': 'application/json' }),\n        },\n        body: payload === undefined ? undefined : JSON.stringify(payload),\n      })\n      const b = res.status === 204 || res.status === 202 ? null : ((await res.json().catch(() => null)) as any)\n      if (res.ok) return { status: res.status, data: b?.data ?? b }\n      const first = b?.errors?.[0]\n      // weak_password says which rules of the workspace's policy failed.\n      const reasons = Array.isArray(first?.meta?.reasons) ? (first.meta.reasons as unknown[]).map(String) : undefined\n      return { status: res.status, data: null, error: { code: String(first?.code ?? 'error'), message: String(first?.message ?? 'The request could not be completed.'), ...(reasons ? { reasons } : {}) } }\n    } catch {\n      return { status: 503, data: null, error: { code: 'unavailable', message: 'Sign-in is unavailable right now. Try again in a moment.' } }\n    }\n  }\n\n  const accountOf = (d: any) => ({\n    id: String(d?.id ?? ''), email: String(d?.email ?? ''), name: String(d?.name ?? ''),\n    emailVerified: d?.email_verified === true, hasPassword: d?.has_password === true, mfaEnabled: d?.mfa_enabled === true,\n  })\n\n  /**\n   * Who is signed in, for a route about their own account: their token, and\n   * the cookie to send back when the session had to be renewed. Nobody signed\n   * in gets the 401 to answer with.\n   */\n  async function signedInAs(request: Request): Promise<{ token: string; kept: Stored | null; headers: Headers } | { response: Response }> {\n    const r = await resolve(request)\n    const headers = new Headers()\n    for (const c of r.cookies) headers.append('set-cookie', c)\n    if (r.session === null) return { response: problem(401, 'unauthenticated', 'Sign in first.', undefined, headers) }\n    // `kept` is the session as the request's cookie holds it, or null when it\n    // was renewed just now: then the cookies above carry the new one.\n    return { token: r.session.accessToken, kept: r.cookies.length === 0 ? (await read(request)).value : null, headers }\n  }\n\n  /** Cauthy answered with tokens: the person is signed in here. */\n  async function signedIn(request: Request, tokens: any, extra: string[] = [], more: Record<string, unknown> = {}, was?: Stored): Promise<Response> {\n    const s = await stored(tokens, was)\n    if (s === null) return problem(502, 'unavailable', 'Sign-in is unavailable right now. Try again in a moment.')\n    const h = new Headers()\n    for (const c of [...(await write(request, s, readCookies(request.headers.get('cookie')))), ...extra]) h.append('set-cookie', c)\n    return json({ status: 'signed_in', session: await toPublic(toSession(s)), ...more }, 200, h)\n  }\n\n  /**\n   * Cauthy's answer to a sign-in with a password: the person is signed in, or\n   * the second step is asked for next. Then what proves the password was\n   * right stays here, sealed, and never reaches the page.\n   */\n  async function loggedIn(request: Request, data: any, remember = false): Promise<Response> {\n    if (data?.mfa_required === true) {\n      const step: Step = { kind: 'mfa', token: String(data.mfa_token ?? ''), returnTo: afterSignIn, ...(remember ? { remember } : {}) }\n      // By email: the account has no factor and a code was just mailed to it.\n      const how = data.mfa_method === 'email' ? { method: 'email' } : {}\n      return json({ status: 'mfa_required', ...how }, 200, new Headers({ 'set-cookie': writeCookie(stepCookie, await seal(step, (await flowKeys)[0]), attrs(request, STEP_SECONDS)) }))\n    }\n    return signedIn(request, data)\n  }\n\n  let lookCache: { until: number; look: Record<string, unknown> } | null = null\n\n  // The workspace's password policy, kept a minute like the look: what a new\n  // password is checked against here before it is sent. Cauthy checks it\n  // again, and alone knows whether a password was in a breach.\n  let policyCache: { until: number; policy: PasswordPolicy | null } | null = null\n  const keepPolicy = (settings: { data: any; error?: unknown }) => {\n    policyCache = { until: Date.now() + LOOK_TTL_MS, policy: settings.error || !settings.data?.password_policy ? null : passwordPolicyOf(settings.data.password_policy) }\n    return policyCache.policy\n  }\n  /** The workspace's password policy; null when Cauthy cannot say, and then only Cauthy checks. */\n  async function workspacePolicy(request: Request): Promise<PasswordPolicy | null> {\n    if (policyCache !== null && policyCache.until >= Date.now()) return policyCache.policy\n    return keepPolicy(await ask(request, 'GET', '/v1/auth/settings'))\n  }\n  /** A new password, checked here against the workspace's rule when it is known. */\n  async function newPasswordProblem(request: Request, value: unknown): Promise<FieldProblem | null> {\n    const policy = await workspacePolicy(request)\n    // Not known: only what no workspace accepts is refused here (8–128).\n    return checkNewPassword(value, policy ?? { min: 8, max: 128, requires: [], min_classes: 0, reject_breached: false })\n  }\n\n  async function ownRoute(request: Request, url: URL, route: string): Promise<Response | null> {\n    const post = request.method === 'POST'\n    const own = ['/sign-in/email', '/sign-in/mfa', '/sign-up/email', '/forgot-password', '/reset-password', '/verify-email', '/sign-in/magic-link', '/sign-in/magic-link/verify', '/sign-in/email-code', '/me', '/me/password', '/me/mfa/setup', '/me/mfa/verify', '/me/mfa/disable', '/me/mfa/recovery-codes', '/me/mfa/factors', '/me/mfa/phone', '/me/mfa/phone/verify', '/me/mfa/phone/remove', '/sign-in/mfa/methods', '/sign-in/mfa/send', '/sign-in/mfa/email', '/sign-in/mfa/push', '/sign-in/mfa/push/events', '/sign-in/mfa/push/finish', '/me/sessions', '/me/sessions/end', '/me/legal', '/me/legal/accept', '/me/email', '/me/identities', '/me/identities/unlink', '/sign-out', '/methods', '/look',\n      '/sign-in/passkey/begin', '/sign-in/passkey/finish', '/sign-in/google-one-tap/begin', '/sign-in/google-one-tap', '/me/passkeys', '/me/passkeys/add/begin', '/me/passkeys/add/finish', '/me/passkeys/remove', '/me/agents', '/me/agents/disconnect',\n      '/sign-in/anonymous', '/me/upgrade',\n      '/me/organizations', '/me/organizations/members', '/me/organizations/roles', '/me/organizations/members/add', '/me/organizations/members/role', '/me/organizations/members/remove', '/me/organizations/members/invite',\n      '/me/organizations/rename', '/me/organizations/archive', '/me/organizations/delete',\n      '/invitation', '/invitation/accept'].includes(route) ||\n      route.startsWith('/sign-in/social/') || route.startsWith('/callback/') || route.startsWith('/me/identities/link/') || route.startsWith('/me/upgrade/social/') ||\n      route === '/sign-in/sso' || route === '/sign-in/sso/discover' || route === '/sso/callback'\n    if (!own) return null\n    if (post) {\n      const refused = withoutRequestHeader(request, route)\n      if (refused) return refused\n    }\n    // Guest sessions and their upgrade leave the protocol in version 2.\n    if (route === '/sign-in/anonymous' || route === '/me/upgrade') deprecated(`POST ${route}`, 'Guest sessions leave the auth-bff protocol in version 2.')\n    if (route.startsWith('/me/upgrade/social/')) deprecated('GET /me/upgrade/social/{provider}', 'Guest sessions leave the auth-bff protocol in version 2.')\n    if (tenantNow() === '') {\n      return problem(500, 'not_configured', '@cauthyhq/node: tenant (CAUTHY_TENANT) is required for the application\\'s own sign-in screens')\n    }\n\n    // How the forms look, as a person set it in Cauthy's dashboard. Kept a\n    // minute: every form of every page reads it.\n    if (route === '/look' && !post) {\n      if (lookCache === null || lookCache.until < Date.now()) {\n        const res = await ask(request, 'GET', `/v1/auth/look/${encodeURIComponent(signInClientNow())}`)\n        lookCache = { until: Date.now() + LOOK_TTL_MS, look: res.error ? {} : (res.data ?? {}) }\n      }\n      return json(lookCache.look)\n    }\n\n    // What the screen may offer: which providers, whether people may register.\n    if (route === '/methods' && !post) {\n      const [providers, settings, place, sso] = await Promise.all([\n        ask(request, 'GET', '/v1/auth/social/providers'),\n        ask(request, 'GET', '/v1/auth/settings'),\n        ask(request, 'GET', `/v1/auth/webauthn/place?origin=${encodeURIComponent(originOf(request))}`),\n        ask(request, 'GET', '/v1/auth/sso/connections'),\n      ])\n      const list = Array.isArray(providers.data) ? providers.data : []\n      const password = keepPolicy(settings)\n      // Passkeys the workspace turned off are offered nowhere: not the\n      // button, not the email field's autofill, not Cauthy's page.\n      const passkeys = settings.data?.allow_passkeys !== false\n      // Where the person uses a passkey: on this page, or on Cauthy's for that\n      // step alone. A Cauthy that cannot say yet has them on its page.\n      const here = passkeys && place.data?.here === true\n      return json({\n        providers: list.map((p: any) => ({ id: String(p.provider ?? p.id ?? ''), name: String(p.label ?? p.name ?? p.provider ?? ''), ...iconOf(p) })).filter((p: { id: string }) => p.id !== ''),\n        // Whether the workspace signs people in with a password at all. A\n        // Cauthy from before the setting says nothing of it: then it does.\n        passwordSignIn: settings.data?.allow_password !== false,\n        // The workspace's switch, and how the application's own system takes sign-ups.\n        signUp: settings.data?.allow_signup !== false && settings.data?.signup?.mode !== 'invite_only',\n        // The application's system makes an organization per sign-up: the form asks the company's name.\n        ...(settings.data?.signup?.organization?.ask === true\n          ? { organization: { ask: true, required: settings.data.signup.organization.required === true } }\n          : {}),\n        // Whether the person may ask to stay signed in: the workspace's setting in Cauthy (persistent_sessions).\n        ...(typeof settings.data?.persistent_sessions === 'boolean' ? { persistentSessions: settings.data.persistent_sessions } : {}),\n        // A sign-in link needs a page of the application to open.\n        magicLink: settings.data?.allow_magic_link === true && pages.signIn !== undefined,\n        passkey: passkeys && (place.error ? true : here || place.data?.on_cauthy === true),\n        passkeyHere: here,\n        passkeyOnCauthy: passkeys && (place.error ? true : place.data?.on_cauthy === true),\n        // A company's sign-in, found by the person's work address.\n        sso: Array.isArray(sso.data) && sso.data.some((c: any) => c?.discoverable === true),\n        // The terms a sign-up accepts and the consents it answers, when the workspace asks any.\n        ...(settings.data?.legal ? { legal: legalOf(settings.data.legal) } : {}),\n        ...(settings.data?.captcha_enabled === true && settings.data?.captcha_site_key ? { captchaSiteKey: String(settings.data.captcha_site_key) } : {}),\n        // What a new password must be: for the form to say it and check it.\n        ...(password ? { password } : {}),\n      })\n    }\n\n    // An invitation, read before the person chooses a password: who is invited\n    // to what. Reading it does not spend it.\n    if (route === '/invitation' && !post) {\n      const token = (url.searchParams.get('token') ?? '').trim()\n      if (token === '' || token.length > 512) return problem(422, 'invalid_token', 'This invitation is not valid, or it has expired.')\n      const res = await ask(request, 'GET', `/v1/auth/invitation?token=${encodeURIComponent(token)}`)\n      if (res.error) return problem(res.status, res.error.code, res.error.message)\n      const organization = typeof res.data?.organization === 'string' && res.data.organization !== '' ? { organization: res.data.organization } : {}\n      return json({ status: 'ok', invitation: { email: String(res.data?.email ?? ''), workspace: String(res.data?.workspace ?? ''), ...organization } })\n    }\n\n    // The person's company: to its IdP and back. Cauthy ends the flow on\n    // this site's page with a code, which only the browser holding the\n    // sealed PKCE verifier can trade for the session.\n    if (route === '/sign-in/sso' && !post) {\n      const returnTo = localPath(url.searchParams.get('return_to'), afterSignIn)\n      const failed = (code: string) => redirect(`${returnTo}${returnTo.includes('?') ? '&' : '?'}auth_error=${encodeURIComponent(code)}`)\n      const email = (url.searchParams.get('email') ?? '').trim()\n      const connection = (url.searchParams.get('connection') ?? '').trim()\n      if (email === '' && connection === '') return failed('sso_not_found')\n      const verifier = random(48)\n      const challenge = b64url(new Uint8Array(await crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifier))))\n      const callback = `${basePath}/sso/callback`\n      const remember = wants(url.searchParams.get('remember'))\n      const started = await ask(request, 'POST', '/v1/auth/sso/start', {\n        ...(connection ? { connection } : { email }),\n        redirect_uri: `${originOf(request)}${callback}`, code_challenge: challenge,\n      }, callback, undefined, remember)\n      if (started.error || typeof started.data?.redirect_url !== 'string') return failed(started.error?.code ?? 'sso_unavailable')\n      const step: Step = { kind: 'sso', token: verifier, returnTo, ...(remember ? { remember } : {}) }\n      return redirect(started.data.redirect_url, [writeCookie(stepCookie, await seal(step, (await flowKeys)[0]), attrs(request, STEP_SECONDS))])\n    }\n    if (route === '/sso/callback' && !post) {\n      const sealed = readCookies(request.headers.get('cookie')).get(stepCookie)\n      const step = sealed ? await unsealAny<Step>(sealed, await flowKeys) : null\n      const clear = writeCookie(stepCookie, '', attrs(request, 0))\n      const back = step?.returnTo ?? afterSignIn\n      const failedTo = (code: string) => redirect(`${back}${back.includes('?') ? '&' : '?'}auth_error=${encodeURIComponent(code)}`, [clear])\n      if (step === null || step.kind !== 'sso') return failedTo('state_mismatch')\n      const refused = url.searchParams.get('error')\n      if (refused) return failedTo(refused)\n      const code = url.searchParams.get('code')\n      if (!code) return failedTo('sso_failed')\n      const done = await ask(request, 'POST', '/v1/auth/sso/token', { code, redirect_uri: `${originOf(request)}${basePath}/sso/callback`, code_verifier: step.token }, undefined, undefined, step.remember === true)\n      if (done.error) return failedTo(done.error.code)\n      const s = await stored(done.data)\n      if (s === null) return failedTo('unavailable')\n      return redirect(back, [...(await write(request, s, readCookies(request.headers.get('cookie')))), clear])\n    }\n\n    // A provider: to it and back. The state is this browser's, kept sealed.\n    if (route.startsWith('/sign-in/social/') && !post) {\n      const provider = providerIn(route.slice('/sign-in/social/'.length))\n      if (!PROVIDER_ID.test(provider)) return new Response('Not found', { status: 404 })\n      const returnTo = localPath(url.searchParams.get('return_to'), afterSignIn)\n      const callback = `${basePath}/callback/${provider}`\n      // The callback is named as this client's page, so a provider that\n      // answers through Cauthy's relay (Apple) may return the browser to it.\n      const remember = wants(url.searchParams.get('remember'))\n      const started = await ask(request, 'GET', `/v1/auth/social/${provider}?redirect_uri=${encodeURIComponent(`${originOf(request)}${callback}`)}`, undefined, callback, undefined, remember)\n      if (started.error || typeof started.data?.redirect_url !== 'string') {\n        return redirect(`${returnTo}${returnTo.includes('?') ? '&' : '?'}auth_error=${encodeURIComponent(started.error?.code ?? 'provider_unavailable')}`)\n      }\n      const step: Step = { kind: 'social', token: String(started.data.state ?? ''), provider, returnTo, ...(remember ? { remember } : {}) }\n      return redirect(started.data.redirect_url, [writeCookie(stepCookie, await seal(step, (await flowKeys)[0]), attrs(request, STEP_SECONDS))])\n    }\n    if (route.startsWith('/callback/') && !post) {\n      const provider = providerIn(route.slice('/callback/'.length))\n      const sealed = readCookies(request.headers.get('cookie')).get(stepCookie)\n      const step = sealed ? await unsealAny<Step>(sealed, await flowKeys) : null\n      const clear = writeCookie(stepCookie, '', attrs(request, 0))\n      const back = step?.returnTo ?? afterSignIn\n      const failedTo = (code: string) => redirect(`${back}${back.includes('?') ? '&' : '?'}auth_error=${encodeURIComponent(code)}`, [clear])\n      // The answer must be to the question this browser asked of this provider.\n      if (step === null || (step.kind !== 'social' && step.kind !== 'link' && step.kind !== 'upgrade') || step.provider !== provider || url.searchParams.get('state') !== step.token) return failedTo('state_mismatch')\n      const code = url.searchParams.get('code')\n      if (!code) return failedTo(url.searchParams.get('error') === 'access_denied' ? 'cancelled' : 'provider_refused')\n      const q = new URLSearchParams({ code, state: step.token, redirect_uri: `${originOf(request)}${basePath}/callback/${provider}` })\n      if (step.kind === 'upgrade') {\n        // The guest is now the account of that address: its session from here on.\n        const mine = await signedInAs(request)\n        if ('response' in mine) return failedTo('unauthenticated')\n        const done = await ask(request, 'GET', `/v1/auth/anonymous/upgrade/${provider}/callback?${q}`, undefined, undefined, mine.token)\n        if (done.error) return failedTo(done.error.code)\n        const s = await stored(done.data, (await read(request)).value ?? undefined)\n        if (s === null) return failedTo('unavailable')\n        return redirect(back, [...(await write(request, s, readCookies(request.headers.get('cookie')))), clear])\n      }\n      if (step.kind === 'link') {\n        // Linked to the account signed in here, and back to where it was asked.\n        const mine = await signedInAs(request)\n        if ('response' in mine) return failedTo('unauthenticated')\n        const linked = await ask(request, 'GET', `/v1/auth/identities/${provider}/link/callback?${q}`, undefined, undefined, mine.token)\n        if (linked.error) return failedTo(linked.error.code)\n        const h = new Headers(mine.headers)\n        h.append('set-cookie', clear)\n        return redirect(`${back}${back.includes('?') ? '&' : '?'}linked=${encodeURIComponent(provider)}`, [...h.getSetCookie()])\n      }\n      const done = await ask(request, 'GET', `/v1/auth/social/${provider}/callback?${q}`, undefined, undefined, undefined, step.remember === true)\n      if (done.error) return failedTo(done.error.code)\n      const s = await stored(done.data)\n      if (s === null) return failedTo('unavailable')\n      return redirect(back, [...(await write(request, s, readCookies(request.headers.get('cookie')))), clear])\n    }\n\n    // A guest becoming the account of a provider's address: to it and back.\n    if (route.startsWith('/me/upgrade/social/') && !post) {\n      const provider = providerIn(route.slice('/me/upgrade/social/'.length))\n      if (!PROVIDER_ID.test(provider)) return new Response('Not found', { status: 404 })\n      const returnTo = localPath(url.searchParams.get('return_to'), afterSignIn)\n      const failed = (code: string) => redirect(`${returnTo}${returnTo.includes('?') ? '&' : '?'}auth_error=${encodeURIComponent(code)}`)\n      const mine = await signedInAs(request)\n      if ('response' in mine) return failed('unauthenticated')\n      const callback = `${basePath}/callback/${provider}`\n      const started = await ask(request, 'GET', `/v1/auth/anonymous/upgrade/${provider}?redirect_uri=${encodeURIComponent(`${originOf(request)}${callback}`)}`, undefined, callback, mine.token)\n      if (started.error || typeof started.data?.redirect_url !== 'string') return failed(started.error?.code ?? 'provider_unavailable')\n      const step: Step = { kind: 'upgrade', token: String(started.data.state ?? ''), provider, returnTo }\n      return redirect(started.data.redirect_url, [...mine.headers.getSetCookie(), writeCookie(stepCookie, await seal(step, (await flowKeys)[0]), attrs(request, STEP_SECONDS))])\n    }\n\n    // A provider linked to the signed-in account: to it and back, like a sign-in.\n    if (route.startsWith('/me/identities/link/') && !post) {\n      const provider = providerIn(route.slice('/me/identities/link/'.length))\n      if (!PROVIDER_ID.test(provider)) return new Response('Not found', { status: 404 })\n      const returnTo = localPath(url.searchParams.get('return_to'), afterSignIn)\n      const failed = (code: string) => redirect(`${returnTo}${returnTo.includes('?') ? '&' : '?'}auth_error=${encodeURIComponent(code)}`)\n      const mine = await signedInAs(request)\n      if ('response' in mine) return failed('unauthenticated')\n      const callback = `${basePath}/callback/${provider}`\n      const started = await ask(request, 'GET', `/v1/auth/identities/${provider}/link?redirect_uri=${encodeURIComponent(`${originOf(request)}${callback}`)}`, undefined, callback, mine.token)\n      if (started.error || typeof started.data?.redirect_url !== 'string') return failed(started.error?.code ?? 'provider_unavailable')\n      const step: Step = { kind: 'link', token: String(started.data.state ?? ''), provider, returnTo }\n      return redirect(started.data.redirect_url, [...mine.headers.getSetCookie(), writeCookie(stepCookie, await seal(step, (await flowKeys)[0]), attrs(request, STEP_SECONDS))])\n    }\n\n    // The person's own account: read here, changed below.\n    if (route === '/me/identities' && !post) {\n      const mine = await signedInAs(request)\n      if ('response' in mine) return mine.response\n      const res = await ask(request, 'GET', '/v1/auth/identities', undefined, undefined, mine.token)\n      if (res.error) return problem(res.status, res.error.code, res.error.message, undefined, mine.headers)\n      const list = Array.isArray(res.data) ? res.data : []\n      return json({ identities: list.map((x: any) => ({ provider: String(x.provider ?? ''), email: String(x.email ?? ''), name: String(x.name ?? ''), linkedAt: String(x.linked_at ?? '') })) }, 200, mine.headers)\n    }\n    if (route === '/me/passkeys' && !post) {\n      const mine = await signedInAs(request)\n      if ('response' in mine) return mine.response\n      const res = await ask(request, 'GET', '/v1/auth/webauthn/credentials', undefined, undefined, mine.token)\n      if (res.error) return problem(res.status, res.error.code, res.error.message, undefined, mine.headers)\n      const list = Array.isArray(res.data) ? res.data : []\n      return json({ passkeys: list.map(passkeyOf) }, 200, mine.headers)\n    }\n    // The AI agents the person connected.\n    if (route === '/me/agents' && !post) {\n      const mine = await signedInAs(request)\n      if ('response' in mine) return mine.response\n      const res = await ask(request, 'GET', '/v1/auth/me/agents', undefined, undefined, mine.token)\n      if (res.error) return problem(res.status, res.error.code, res.error.message, undefined, mine.headers)\n      const list = Array.isArray(res.data) ? res.data : []\n      return json({ agents: list.map(agentOf) }, 200, mine.headers)\n    }\n    // The person's organizations, and the people of one: as far as their\n    // role in the system's catalog lets them see (cauthy:members read).\n    if ((route === '/me/organizations' || route === '/me/organizations/members' || route === '/me/organizations/roles') && !post) {\n      const mine = await signedInAs(request)\n      if ('response' in mine) return mine.response\n      let path = '/v1/auth/me/organizations'\n      if (route !== '/me/organizations') {\n        const id = url.searchParams.get('id') ?? ''\n        if (!UUID.test(id)) return problem(400, 'invalid_organization', 'Say which organization.', undefined, mine.headers)\n        path += `/${id}/${route.endsWith('/roles') ? 'roles' : 'members'}`\n      } else if (url.searchParams.get('system')) {\n        path += `?system=${encodeURIComponent(url.searchParams.get('system')!)}`\n      }\n      const res = await ask(request, 'GET', path, undefined, undefined, mine.token)\n      if (res.error) return problem(res.status, res.error.code, res.error.message, undefined, mine.headers)\n      const list = Array.isArray(res.data) ? res.data : []\n      if (route === '/me/organizations') return json({ organizations: list.map(seatOf) }, 200, mine.headers)\n      if (route === '/me/organizations/roles') return json({ roles: list.map(orgRoleOf) }, 200, mine.headers)\n      return json({ members: list.map(orgMemberOf) }, 200, mine.headers)\n    }\n    // How the account takes its second step, and what the workspace offers.\n    if (route === '/me/mfa/factors' && !post) {\n      const mine = await signedInAs(request)\n      if ('response' in mine) return mine.response\n      const res = await ask(request, 'GET', '/v1/auth/mfa/factors', undefined, undefined, mine.token)\n      if (res.error) return problem(res.status, res.error.code, res.error.message, undefined, mine.headers)\n      return json(factorsOf(res.data), 200, mine.headers)\n    }\n    if ((route === '/me' || route === '/me/sessions' || route === '/me/legal') && !post) {\n      const mine = await signedInAs(request)\n      if ('response' in mine) return mine.response\n      const res = await ask(request, 'GET', route === '/me' ? '/v1/auth/me' : route === '/me/legal' ? '/v1/auth/me/legal' : '/v1/auth/me/sessions', undefined, undefined, mine.token)\n      if (res.error) return problem(res.status, res.error.code, res.error.message, undefined, mine.headers)\n      // The legal documents the person has not accepted in their current version.\n      if (route === '/me/legal') {\n        const list = Array.isArray(res.data?.pending) ? res.data.pending : []\n        return json({ pending: list.map((d: any) => ({ kind: String(d.kind ?? ''), version: String(d.version ?? ''), url: String(d.url ?? '') })) }, 200, mine.headers)\n      }\n      if (route === '/me/sessions') {\n        const list = Array.isArray(res.data) ? res.data : []\n        return json({ sessions: list.map((x: any) => ({ device: String(x.device ?? ''), ip: String(x.ip ?? ''), createdAt: String(x.created_at ?? ''), expiresAt: String(x.expires_at ?? '') })) }, 200, mine.headers)\n      }\n      return json({ account: accountOf(res.data) }, 200, mine.headers)\n    }\n\n    // The phone's answer to a push, as it comes: Cauthy's server-sent events,\n    // passed through to the page that waits on them.\n    if (route === '/sign-in/mfa/push/events' && !post) {\n      const sealed = readCookies(request.headers.get('cookie')).get(stepCookie)\n      const step = sealed ? await unsealAny<Step>(sealed, await flowKeys) : null\n      if (step === null || step.kind !== 'mfa') return problem(400, 'step_expired', 'Sign in again: the code was asked for too long ago.')\n      let upstream: Response\n      try {\n        upstream = await doFetch(`${issuer}/v1/auth/mfa/push/events`, {\n          headers: { 'x-tenant-key': tenantNow(), 'x-mfa-token': step.token, accept: 'text/event-stream' },\n          signal: request.signal,\n        })\n      } catch {\n        return problem(503, 'unavailable', 'Cauthy could not be reached.')\n      }\n      if (!upstream.ok || !upstream.body) {\n        const b = (await upstream.json().catch(() => null)) as any\n        return problem(upstream.status, String(b?.errors?.[0]?.code ?? 'error'), String(b?.errors?.[0]?.message ?? 'The request could not be completed.'))\n      }\n      return new Response(upstream.body, {\n        status: 200,\n        headers: { 'content-type': 'text/event-stream', 'cache-control': 'no-cache, no-store', 'x-accel-buffering': 'no' },\n      })\n    }\n\n    if (!post) return new Response('Method not allowed', { status: 405, headers: { allow: 'POST' } })\n    if (!ownRequest(request)) return problem(403, 'cross_site', 'This request did not come from this application.')\n\n    if (route === '/sign-out') {\n      const { had, value } = await read(request)\n      if (value !== null) {\n        await revoke(value.rt)\n        orgCache.delete(value.at)\n      }\n      const h = new Headers()\n      for (const c of clearParts(cookieName, attrs(request, 0), had)) h.append('set-cookie', c)\n      return json({ status: 'signed_out' }, 200, h)\n    }\n\n    const b = await body(request)\n    if (b === null) return problem(400, 'bad_request', 'Send the form as JSON.')\n\n    // Which company's sign-in an address uses, if any: said of its domain,\n    // never of whether the address has an account.\n    if (route === '/sign-in/sso/discover') {\n      const bad = checkEmail(b.email)\n      if (bad) return invalid(bad)\n      const res = await ask(request, 'POST', '/v1/auth/sso/discover', { email: String(b.email).trim() })\n      if (res.error) return problem(res.status, res.error.code, res.error.message)\n      const c = res.data?.connection\n      return json(c ? { status: 'found', connection: { id: String(c.slug ?? ''), name: String(c.display_name ?? ''), enforced: c.enforced === true } } : { status: 'none' })\n    }\n\n    // A guest session, before the visitor signs up (the workspace's allow_anonymous).\n    if (route === '/sign-in/anonymous') {\n      if (!post) return new Response('Method not allowed', { status: 405, headers: { allow: 'POST' } })\n      const res = await ask(request, 'POST', '/v1/auth/anonymous', {})\n      if (res.error) return problem(res.status, res.error.code, res.error.message)\n      return signedIn(request, res.data)\n    }\n\n    if (route === '/sign-in/email') {\n      const bad = firstProblem(checkEmail(b.email), checkPassword(b.password))\n      if (bad) return invalid(bad)\n      const remember = wants(b.remember)\n      const res = await ask(request, 'POST', '/v1/auth/login', { email: String(b.email).trim(), password: b.password }, undefined, undefined, remember)\n      if (res.error) return problem(res.status, res.error.code, res.error.message)\n      return loggedIn(request, res.data, remember)\n    }\n\n    if (route === '/sign-in/mfa') {\n      const bad = checkCode(b.code)\n      if (bad) return invalid(bad)\n      const sealed = readCookies(request.headers.get('cookie')).get(stepCookie)\n      const step = sealed ? await unsealAny<Step>(sealed, await flowKeys) : null\n      if (step === null || step.kind !== 'mfa') return problem(400, 'step_expired', 'Sign in again: the code was asked for too long ago.')\n      const res = await ask(request, 'POST', '/v1/auth/mfa/challenge', { mfa_token: step.token, code: String(b.code).trim() }, undefined, undefined, step.remember === true)\n      if (res.error) return problem(res.status, res.error.code, res.error.message, 'code')\n      return signedIn(request, res.data, [writeCookie(stepCookie, '', attrs(request, 0))])\n    }\n\n    // The second step by phone, while signing in: which ways the account has,\n    // and a code sent to its phone. The challenge's token stays sealed here.\n    // The second step approved on the phone: a push, then the sign-in once the\n    // phone approved it (the answer itself streams from /sign-in/mfa/push/events).\n    if (route === '/sign-in/mfa/push' || route === '/sign-in/mfa/push/finish') {\n      const sealed = readCookies(request.headers.get('cookie')).get(stepCookie)\n      const step = sealed ? await unsealAny<Step>(sealed, await flowKeys) : null\n      if (step === null || step.kind !== 'mfa') return problem(400, 'step_expired', 'Sign in again: the code was asked for too long ago.')\n      if (route === '/sign-in/mfa/push') {\n        const res = await ask(request, 'POST', '/v1/auth/mfa/push', { mfa_token: step.token }, undefined, undefined, step.remember === true)\n        if (res.error) return problem(res.status, res.error.code, res.error.message)\n        return json({ status: 'sent', number: Number(res.data?.number ?? 0) })\n      }\n      const res = await ask(request, 'POST', '/v1/auth/mfa/challenge', { mfa_token: step.token, push: true }, undefined, undefined, step.remember === true)\n      if (res.error) return problem(res.status, res.error.code, res.error.message)\n      return signedIn(request, res.data, [writeCookie(stepCookie, '', attrs(request, 0))])\n    }\n\n    if (route === '/sign-in/mfa/methods' || route === '/sign-in/mfa/send' || route === '/sign-in/mfa/email') {\n      const sealed = readCookies(request.headers.get('cookie')).get(stepCookie)\n      const step = sealed ? await unsealAny<Step>(sealed, await flowKeys) : null\n      if (step === null || step.kind !== 'mfa') return problem(400, 'step_expired', 'Sign in again: the code was asked for too long ago.')\n      if (route === '/sign-in/mfa/methods') {\n        const res = await ask(request, 'POST', '/v1/auth/mfa/methods', { mfa_token: step.token }, undefined, undefined, step.remember === true)\n        if (res.error) return problem(res.status, res.error.code, res.error.message)\n        const p = res.data?.phone\n        const push = res.data?.push\n        const mail = res.data?.email\n        return json({ status: 'ok', totp: res.data?.totp === true, phone: p ? { number: String(p.number ?? ''), channel: String(p.channel ?? 'sms') } : null,\n          push: push ? { devices: Number(push.devices ?? 0) } : null, email: mail ? { to: String(mail.to ?? '') } : null })\n      }\n      if (route === '/sign-in/mfa/email') {\n        const res = await ask(request, 'POST', '/v1/auth/mfa/email', { mfa_token: step.token }, undefined, undefined, step.remember === true)\n        if (res.error) return problem(res.status, res.error.code, res.error.message)\n        return json({ status: 'sent', sentTo: String(res.data?.sent_to ?? '') })\n      }\n      const res = await ask(request, 'POST', '/v1/auth/mfa/send', { mfa_token: step.token }, undefined, undefined, step.remember === true)\n      if (res.error) return problem(res.status, res.error.code, res.error.message)\n      return json({ status: 'sent', sentTo: String(res.data?.sent_to ?? ''), channel: String(res.data?.channel ?? 'sms') })\n    }\n\n    if (route === '/sign-up/email') {\n      const bad = firstProblem(checkName(b.name), checkEmail(b.email), await newPasswordProblem(request, b.password), checkOrganization(b.organization))\n      if (bad) return invalid(bad)\n      const email = String(b.email).trim()\n      // The company's name, when the application's system makes an organization per sign-up.\n      const organization = typeof b.organization === 'string' && b.organization.trim() !== '' ? { organization: { name: b.organization.trim() } } : {}\n      // The terms accepted and the consents answered, when the workspace asks any (methods().legal).\n      const legal = { ...(b.acceptLegal === true ? { accept_legal: true } : {}), ...(b.consents && typeof b.consents === 'object' ? { consents: b.consents } : {}) }\n      const made = await ask(request, 'POST', '/v1/auth/register', { email, password: b.password, display_name: typeof b.name === 'string' ? b.name.trim() : '', ...organization, ...legal }, pages.verifyEmail)\n      if (made.error) return problem(made.status, made.error.code, made.error.message, made.error.code === 'weak_password' ? 'password' : undefined, undefined, made.error.reasons)\n      // An account that must confirm its address first cannot sign in yet.\n      if (made.data?.verification_required === true) return json({ status: 'verification_required', email })\n      const res = await ask(request, 'POST', '/v1/auth/login', { email, password: b.password })\n      if (res.error || res.data?.mfa_required === true) return json({ status: 'verification_required', email })\n      return signedIn(request, res.data)\n    }\n\n    if (route === '/forgot-password') {\n      const bad = checkEmail(b.email)\n      if (bad) return invalid(bad)\n      // The same answer whether or not the address has an account.\n      await ask(request, 'POST', '/v1/auth/password/reset', { email: String(b.email).trim() }, pages.resetPassword)\n      return json({ status: 'sent' })\n    }\n\n    if (route.startsWith('/me')) {\n      const mine = await signedInAs(request)\n      if ('response' in mine) return mine.response\n      const as = (path: string, payload?: unknown, method = 'POST') => ask(request, method, path, payload, undefined, mine.token)\n      const refused = (res: { status: number; error?: { code: string; message: string; reasons?: string[] } }, field?: string) =>\n        problem(res.status, res.error!.code, res.error!.message, field, mine.headers, res.error!.reasons)\n      // Asked again for what weakens the account; an account with no password sends none.\n      const password = typeof b.password === 'string' ? b.password : ''\n\n      if (route === '/me') {\n        const bad = checkName(b.name)\n        if (bad) return invalid(bad)\n        const res = await as('/v1/auth/me', { name: typeof b.name === 'string' ? b.name.trim() : '' }, 'PATCH')\n        if (res.error) return refused(res, 'name')\n        // The name is part of the session: the cookie says the new one at once.\n        const h = mine.headers\n        if (mine.kept !== null) {\n          const again = await stored({ access_token: mine.kept.at, refresh_token: mine.kept.rt, expires_in: Math.max(1, mine.kept.exp - Math.floor(Date.now() / 1000)) }, mine.kept)\n          if (again !== null) for (const c of await write(request, again, readCookies(request.headers.get('cookie')))) h.append('set-cookie', c)\n        }\n        return json({ status: 'saved', account: accountOf(res.data) }, 200, h)\n      }\n      if (route === '/me/legal/accept') {\n        const kinds = Array.isArray(b.kinds) ? b.kinds.filter((k: unknown) => typeof k === 'string') : []\n        const res = await as('/v1/auth/me/legal/accept', { kinds })\n        if (res.error) return refused(res)\n        return json({ status: 'accepted' }, 200, mine.headers)\n      }\n      if (route === '/me/password') {\n        const bad = await newPasswordProblem(request, b.newPassword)\n        if (bad) return problem(400, bad.code, bad.message, 'newPassword')\n        const res = await as('/v1/auth/me/password', { current_password: password, new_password: b.newPassword })\n        if (res.error) return refused(res, res.error.code === 'wrong_password' ? 'password' : res.error.code === 'weak_password' ? 'newPassword' : undefined)\n        // The change ended every session of the account. Cauthy answered with\n        // a new one for this browser, which just proved the password.\n        const next = await stored(res.data, (await read(request)).value ?? undefined)\n        const h = new Headers()\n        const had = readCookies(request.headers.get('cookie'))\n        for (const c of next !== null ? await write(request, next, had) : clearParts(cookieName, attrs(request, 0), had)) h.append('set-cookie', c)\n        return json({ status: 'changed', signedIn: next !== null }, 200, h)\n      }\n      if (route === '/me/mfa/setup') {\n        const res = await as('/v1/auth/mfa/setup', { password })\n        if (res.error) return refused(res, res.error.code === 'step_up_required' ? 'password' : undefined)\n        // The QR comes drawn by Cauthy; only a PNG data: URI goes on to the page.\n        const qr = String(res.data?.qr ?? '')\n        return json({ status: 'started', secret: String(res.data?.secret ?? ''), otpauthUri: String(res.data?.otpauth_uri ?? ''), qr: qr.startsWith('data:image/png;base64,') ? qr : '' }, 200, mine.headers)\n      }\n      if (route === '/me/mfa/verify') {\n        const bad = checkCode(b.code)\n        if (bad) return invalid(bad)\n        const res = await as('/v1/auth/mfa/verify', { code: String(b.code).trim() })\n        if (res.error) return refused(res, 'code')\n        return json({ status: 'enabled', recoveryCodes: Array.isArray(res.data?.recovery_codes) ? res.data.recovery_codes.map(String) : [] }, 200, mine.headers)\n      }\n      if (route === '/me/mfa/phone') {\n        const res = await as('/v1/auth/mfa/phone', { phone: typeof b.phone === 'string' ? b.phone : '', channel: typeof b.channel === 'string' ? b.channel : 'sms', password })\n        if (res.error) return refused(res, res.error.code === 'step_up_required' ? 'password' : res.error.code === 'validation_error' ? 'phone' : undefined)\n        return json({ status: 'sent', sentTo: String(res.data?.sent_to ?? ''), channel: String(res.data?.channel ?? '') }, 200, mine.headers)\n      }\n      if (route === '/me/mfa/phone/verify') {\n        const bad = checkCode(b.code)\n        if (bad) return invalid(bad)\n        const res = await as('/v1/auth/mfa/phone/verify', { code: String(b.code).trim() })\n        if (res.error) return refused(res, 'code')\n        return json({ status: 'enabled', recoveryCodes: Array.isArray(res.data?.recovery_codes) ? res.data.recovery_codes.map(String) : [] }, 200, mine.headers)\n      }\n      if (route === '/me/mfa/phone/remove') {\n        const res = await as('/v1/auth/mfa/phone/remove', { password })\n        if (res.error) return refused(res, res.error.code === 'step_up_required' ? 'password' : undefined)\n        return json({ status: 'removed' }, 200, mine.headers)\n      }\n      if (route === '/me/mfa/disable') {\n        const res = await as('/v1/auth/me/mfa/disable', { password })\n        if (res.error) return refused(res, res.error.code === 'step_up_required' ? 'password' : undefined)\n        return json({ status: 'disabled' }, 200, mine.headers)\n      }\n      if (route === '/me/mfa/recovery-codes') {\n        const res = await as('/v1/auth/me/mfa/recovery-codes', { password })\n        if (res.error) return refused(res, res.error.code === 'step_up_required' ? 'password' : undefined)\n        return json({ status: 'renewed', recoveryCodes: Array.isArray(res.data?.recovery_codes) ? res.data.recovery_codes.map(String) : [] }, 200, mine.headers)\n      }\n      if (route === '/me/email') {\n        const bad = checkEmail(b.email)\n        if (bad) return invalid(bad)\n        const email = String(b.email).trim()\n        const res = await as('/v1/auth/me/email', { email, password })\n        if (res.error) return refused(res, res.error.code === 'step_up_required' ? 'password' : ['invalid_email', 'email_unchanged', 'email_taken'].includes(res.error.code) ? 'email' : undefined)\n        // Nothing changed yet: the new address confirms it from the link it was sent.\n        return json({ status: 'sent', email }, 200, mine.headers)\n      }\n      if (route === '/me/identities/unlink') {\n        const provider = typeof b.provider === 'string' ? b.provider : ''\n        if (!PROVIDER_ID.test(provider)) return problem(400, 'invalid_provider', 'Say which provider to unlink.', 'provider', mine.headers)\n        const res = await as(`/v1/auth/identities/${provider}`, undefined, 'DELETE')\n        if (res.error) return refused(res)\n        return json({ status: 'unlinked', provider }, 200, mine.headers)\n      }\n      // A passkey made on this page, for the domain the workspace's passkeys\n      // belong to. The ceremony's id stays here, sealed, between its two calls.\n      if (route === '/me/passkeys/add/begin') {\n        const kind = b.kind === 'device' || b.kind === 'security_key' ? b.kind : ''\n        const res = await as('/v1/auth/webauthn/register/begin', { password, ...(kind ? { kind } : {}) })\n        if (res.error) return refused(res, res.error.code === 'step_up_required' ? 'password' : undefined)\n        const step: Step = { kind: 'enrol', token: String(res.data?.session_id ?? ''), returnTo: afterSignIn }\n        const h = new Headers(mine.headers)\n        h.append('set-cookie', writeCookie(stepCookie, await seal(step, (await flowKeys)[0]), attrs(request, PASSKEY_SECONDS)))\n        return json({ status: 'started', options: res.data?.options?.publicKey ?? res.data?.options ?? null }, 200, h)\n      }\n      if (route === '/me/passkeys/add/finish') {\n        const sealed = readCookies(request.headers.get('cookie')).get(stepCookie)\n        const step = sealed ? await unsealAny<Step>(sealed, await flowKeys) : null\n        if (step === null || step.kind !== 'enrol') return problem(400, 'step_expired', 'Start adding the passkey again: it was asked for too long ago.', undefined, mine.headers)\n        if (!isCredential(b.credential)) return problem(400, 'bad_request', 'Send the passkey the browser made.', undefined, mine.headers)\n        const name = typeof b.name === 'string' ? b.name.trim().slice(0, 60) : ''\n        const res = await as('/v1/auth/webauthn/register/finish', { session_id: step.token, nickname: name, credential: b.credential })\n        const h = new Headers(mine.headers)\n        h.append('set-cookie', writeCookie(stepCookie, '', attrs(request, 0)))\n        if (res.error) return problem(res.status, res.error.code === 'attestation_invalid' ? 'passkey_failed' : res.error.code, res.error.code === 'attestation_invalid' ? 'The passkey could not be added. Try again.' : res.error.message, undefined, h)\n        return json({ status: 'added', passkey: passkeyOf(res.data) }, 200, h)\n      }\n      if (route === '/me/passkeys/remove') {\n        const id = typeof b.id === 'string' ? b.id : ''\n        if (!/^[0-9a-f-]{36}$/i.test(id)) return problem(400, 'invalid_passkey', 'Say which passkey to remove.', undefined, mine.headers)\n        const res = await as(`/v1/auth/webauthn/credentials/${id}`, undefined, 'DELETE')\n        if (res.error) return refused(res)\n        return json({ status: 'removed', id }, 200, mine.headers)\n      }\n      // A guest becoming an account of their own, with an address and a password.\n      if (route === '/me/upgrade') {\n        const bad = firstProblem(checkName(b.name), checkEmail(b.email), await newPasswordProblem(request, b.password))\n        if (bad) return invalid(bad)\n        const res = await as('/v1/auth/anonymous/upgrade', { email: String(b.email).trim(), password: b.password, display_name: typeof b.name === 'string' ? b.name.trim() : '' })\n        if (res.error) return refused(res, res.error.code === 'weak_password' ? 'password' : 'email')\n        // The guest's session becomes the account's: of the same kind.\n        return signedIn(request, res.data, [], {}, (await read(request)).value ?? undefined)\n      }\n      // A member administering the organization itself (cauthy:organization\n      // update, archive, delete). Cauthy decides by the person's role.\n      if (route === '/me/organizations/rename' || route === '/me/organizations/archive' || route === '/me/organizations/delete') {\n        const org = typeof b.organizationId === 'string' ? b.organizationId : ''\n        if (!UUID.test(org)) return problem(400, 'invalid_organization', 'Say which organization.', undefined, mine.headers)\n        const path = `/v1/auth/me/organizations/${org}`\n        if (route === '/me/organizations/rename') {\n          const bad = checkOrganizationName(b.name)\n          if (bad) return invalid(bad)\n          const res = await as(path, { name: String(b.name).trim() }, 'PATCH')\n          if (res.error) return refused(res, res.error.code === 'validation_error' ? 'name' : undefined)\n          // The session's organizations carry the name: read them again.\n          orgCache.delete(mine.token)\n          return json({ status: 'renamed', organization: seatOf(res.data) }, 200, mine.headers)\n        }\n        const res = route === '/me/organizations/archive' ? await as(`${path}/archive`) : await as(path, undefined, 'DELETE')\n        if (res.error) return refused(res)\n        // Gone from the person's organizations either way.\n        orgCache.delete(mine.token)\n        return json({ status: route === '/me/organizations/archive' ? 'archived' : 'deleted', organizationId: org }, 200, mine.headers)\n      }\n      // A member administering their organization's people (cauthy:members\n      // manage; removing someone else, cauthy:members remove).\n      if (route.startsWith('/me/organizations/members/')) {\n        const org = typeof b.organizationId === 'string' ? b.organizationId : ''\n        if (!UUID.test(org)) return problem(400, 'invalid_organization', 'Say which organization.', undefined, mine.headers)\n        const base = `/v1/auth/me/organizations/${org}/members`\n        if (route === '/me/organizations/members/add') {\n          const bad = checkEmail(b.email)\n          if (bad) return invalid(bad)\n          const role = typeof b.role === 'string' ? b.role : ''\n          if (role === '') return problem(400, 'invalid_role', 'Choose a role.', 'role', mine.headers)\n          // A person new to the workspace is invited: the mail opens this\n          // application's page for it when it has one.\n          // Adding never changes the role of somebody already there: that is\n          // setRole's. The member's route only adds; it is asked so anyway.\n          const res = await ask(request, 'POST', base, { email: String(b.email).trim(), role, name: typeof b.name === 'string' ? b.name.trim() : '',\n            client_id: signInClientNow(), only_new: true, ...(typeof b.locale === 'string' && b.locale ? { locale: b.locale } : {}) }, pages.acceptInvite, mine.token)\n          // One code for \"already a member\", whichever route answered it.\n          if (res.error?.code === 'already_member') res.error.code = 'member_exists'\n          if (res.error) return refused(res, res.error.code === 'unknown_role' ? 'role' : 'email')\n          return json({ status: 'added', member: orgMemberOf(res.data) }, 200, mine.headers)\n        }\n        const user = typeof b.userId === 'string' ? b.userId : ''\n        if (!UUID.test(user)) return problem(400, 'invalid_member', 'Say which member.', undefined, mine.headers)\n        if (route === '/me/organizations/members/role') {\n          const role = typeof b.role === 'string' ? b.role : ''\n          if (role === '') return problem(400, 'invalid_role', 'Choose a role.', 'role', mine.headers)\n          const res = await as(`${base}/${user}`, { role }, 'PUT')\n          if (res.error) return refused(res, 'role')\n          return json({ status: 'changed', userId: user, role }, 200, mine.headers)\n        }\n        if (route === '/me/organizations/members/remove') {\n          const res = await as(`${base}/${user}`, undefined, 'DELETE')\n          if (res.error) return refused(res)\n          orgCache.delete(mine.token)\n          return json({ status: 'removed', userId: user }, 200, mine.headers)\n        }\n        if (route === '/me/organizations/members/invite') {\n          const res = await ask(request, 'POST', `${base}/${user}/invite`, { client_id: signInClientNow(), ...(typeof b.locale === 'string' && b.locale ? { locale: b.locale } : {}) }, pages.acceptInvite, mine.token)\n          if (res.error) return refused(res)\n          return json({ status: 'sent', userId: user }, 200, mine.headers)\n        }\n      }\n      if (route === '/me/agents/disconnect') {\n        const id = typeof b.id === 'string' ? b.id : ''\n        if (!/^[0-9a-f-]{36}$/i.test(id)) return problem(400, 'invalid_agent', 'Say which agent to disconnect.', undefined, mine.headers)\n        const res = await as(`/v1/auth/me/agents/${id}`, undefined, 'DELETE')\n        if (res.error) return refused(res)\n        return json({ status: 'disconnected', id }, 200, mine.headers)\n      }\n      if (route === '/me/sessions/end') {\n        const res = await as('/v1/auth/me/sessions', undefined, 'DELETE')\n        if (res.error) return refused(res)\n        // Everywhere is here too.\n        const h = new Headers()\n        for (const c of clearParts(cookieName, attrs(request, 0), readCookies(request.headers.get('cookie')))) h.append('set-cookie', c)\n        orgCache.delete(mine.token)\n        return json({ status: 'signed_out' }, 200, h)\n      }\n      return null\n    }\n\n    const isToken = (v: unknown): v is string => typeof v === 'string' && v !== '' && v.length <= 512\n    const badLink = () => problem(422, 'invalid_token', 'This link is not valid, or it has expired.')\n\n    // What a mailed link carries back: the token it was opened with.\n    if (route === '/reset-password') {\n      if (!isToken(b.token)) return badLink()\n      const bad = await newPasswordProblem(request, b.password)\n      if (bad) return invalid(bad)\n      const res = await ask(request, 'POST', '/v1/auth/password/change', { token: String(b.token), new_password: b.password })\n      if (res.error) return problem(res.status, res.error.code, res.error.message, res.error.code === 'weak_password' ? 'password' : undefined, undefined, res.error.reasons)\n      return json({ status: 'changed' })\n    }\n    if (route === '/verify-email') {\n      if (!isToken(b.token)) return badLink()\n      const res = await ask(request, 'POST', '/v1/auth/email/verify', { token: String(b.token) })\n      if (res.error) return problem(res.status, res.error.code, res.error.message)\n      // The link proved the address: Cauthy signs the person in from it, unless\n      // their account asks a second step — then they sign in the usual way.\n      if (res.data?.access_token) return signedIn(request, res.data)\n      return json({ status: 'verified' })\n    }\n    // An invitation accepted: the password the person chose, checked against\n    // the workspace's policy, and a sign-in like one with a password — the\n    // second step next, when the account owes one. A refused password does\n    // not spend the invitation.\n    if (route === '/invitation/accept') {\n      if (!isToken(b.token)) return problem(422, 'invalid_token', 'This invitation is not valid, or it has expired.')\n      const bad = await newPasswordProblem(request, b.password)\n      if (bad) return invalid(bad)\n      const res = await ask(request, 'POST', '/v1/auth/invitation/accept', { token: String(b.token), password: b.password })\n      if (res.error) return problem(res.status, res.error.code, res.error.message, res.error.code === 'weak_password' ? 'password' : undefined, undefined, res.error.reasons)\n      return loggedIn(request, res.data)\n    }\n\n    // A passkey, on this page: Cauthy says what to ask the browser for, the\n    // browser asks the person, and the answer goes back to Cauthy through here.\n    if (route === '/sign-in/passkey/begin') {\n      // With the person's address, the browser is told which passkeys are\n      // theirs; Cauthy answers the same for an address with none.\n      const email = typeof b.email === 'string' && checkEmail(b.email) === null ? b.email.trim() : ''\n      const remember = wants(b.remember)\n      const res = await ask(request, 'POST', '/v1/auth/webauthn/login/begin', email !== '' ? { email } : {}, undefined, undefined, remember)\n      if (res.error) return problem(res.status, res.error.code, res.error.message)\n      const step: Step = { kind: 'passkey', token: String(res.data?.session_id ?? ''), returnTo: afterSignIn, ...(remember ? { remember } : {}) }\n      return json({ status: 'started', options: res.data?.options?.publicKey ?? res.data?.options ?? null }, 200,\n        new Headers({ 'set-cookie': writeCookie(stepCookie, await seal(step, (await flowKeys)[0]), attrs(request, PASSKEY_SECONDS)) }))\n    }\n    if (route === '/sign-in/passkey/finish') {\n      const sealed = readCookies(request.headers.get('cookie')).get(stepCookie)\n      const step = sealed ? await unsealAny<Step>(sealed, await flowKeys) : null\n      if (step === null || step.kind !== 'passkey') return problem(400, 'step_expired', 'Try the passkey again: it was asked for too long ago.')\n      if (!isCredential(b.credential)) return problem(400, 'bad_request', 'Send the passkey the browser answered with.')\n      const res = await ask(request, 'POST', '/v1/auth/webauthn/login/finish', { session_id: step.token, credential: b.credential }, undefined, undefined, step.remember === true || wants(b.remember))\n      const clear = writeCookie(stepCookie, '', attrs(request, 0))\n      if (res.error) {\n        // Which check failed is Cauthy's to log; the page says only that it did.\n        const failed = ['assertion_invalid', 'session_expired', 'clone_detected', 'not_found'].includes(res.error.code)\n        return problem(res.status, failed ? 'passkey_failed' : res.error.code, failed ? 'The passkey sign-in could not be completed. Try again, or sign in another way.' : res.error.message, undefined, new Headers({ 'set-cookie': clear }))\n      }\n      return signedIn(request, res.data, [clear])\n    }\n\n    // Google One Tap: Cauthy gives the workspace's Google client and a nonce\n    // for one prompt; Google's prompt gives the page an ID token, which comes\n    // back here and is traded, once, for a session.\n    if (route === '/sign-in/google-one-tap/begin') {\n      const res = await ask(request, 'POST', '/v1/auth/google/one-tap/begin', {})\n      if (res.error) return problem(res.status, res.error.code, res.error.message)\n      return json({ status: 'started', clientId: String(res.data?.client_id ?? ''), nonce: String(res.data?.nonce ?? '') })\n    }\n    if (route === '/sign-in/google-one-tap') {\n      if (typeof b.credential !== 'string' || b.credential === '') return problem(400, 'bad_request', 'Send the credential Google gave the page.')\n      const res = await ask(request, 'POST', '/v1/auth/google/one-tap', { credential: b.credential }, undefined, undefined, wants(b.remember))\n      if (res.error) return problem(res.status, res.error.code, res.error.message)\n      return signedIn(request, res.data)\n    }\n\n    // A sign-in link: asked for here, mailed by Cauthy, opened on the\n    // application's sign-in page, which gives the token back.\n    if (route === '/sign-in/magic-link') {\n      const bad = checkEmail(b.email)\n      if (bad) return invalid(bad)\n      if (pages.signIn === undefined) return problem(500, 'not_configured', '@cauthyhq/node: pages.signIn is required for sign-in links: it is the page the link opens')\n      // The same answer whether or not the address has an account. With\n      // create, an address with none gets one when the link or code is used\n      // (if the workspace accepts new accounts): one screen for both.\n      const email = String(b.email).trim()\n      // Where the person goes once in travels in the link itself, as\n      // `return_to` on the page it opens: it may be opened in another browser.\n      const back = typeof b.returnTo === 'string' ? localPath(b.returnTo, afterSignIn) : afterSignIn\n      const remember = wants(b.remember)\n      // The choice to stay signed in travels in the link too: the mail may be opened anywhere.\n      const query = [...(back === afterSignIn ? [] : [`return_to=${encodeURIComponent(back)}`]), ...(remember ? ['remember=1'] : [])].join('&')\n      const page = query === '' ? pages.signIn : `${pages.signIn}${pages.signIn.includes('?') ? '&' : '?'}${query}`\n      await ask(request, 'POST', '/v1/auth/magic-link/request', { email, ...(b.create === true ? { create_account: true } : {}) }, page)\n      // The mail carries a code too. Whose it is stays here, sealed, so the\n      // page that asks for the code needs only the code.\n      const step: Step = { kind: 'code', token: email, returnTo: back, ...(remember ? { remember } : {}) }\n      return json({ status: 'sent' }, 200, new Headers({ 'set-cookie': writeCookie(stepCookie, await seal(step, (await flowKeys)[0]), attrs(request, STEP_SECONDS)) }))\n    }\n    if (route === '/sign-in/email-code') {\n      const bad = checkCode(b.code)\n      if (bad) return invalid(bad)\n      const sealed = readCookies(request.headers.get('cookie')).get(stepCookie)\n      const step = sealed ? await unsealAny<Step>(sealed, await flowKeys) : null\n      if (step === null || step.kind !== 'code') return problem(400, 'step_expired', 'Ask for a new link: this one was asked for too long ago.')\n      const res = await ask(request, 'POST', '/v1/auth/magic-link/verify-code', { email: step.token, code: String(b.code).trim() }, undefined, undefined, step.remember === true)\n      if (res.error) return problem(res.status, res.error.code, res.error.message, 'code')\n      return signedIn(request, res.data, [writeCookie(stepCookie, '', attrs(request, 0))], { returnTo: step.returnTo })\n    }\n    if (route === '/sign-in/magic-link/verify') {\n      if (!isToken(b.token)) return badLink()\n      const res = await ask(request, 'POST', '/v1/auth/magic-link/verify', { token: String(b.token) }, undefined, undefined, wants(b.remember))\n      if (res.error) return problem(res.status, res.error.code, res.error.message)\n      return signedIn(request, res.data)\n    }\n    return null\n  }\n\n  /** Every answer as protocol version 1 sends it (protocol.ts). */\n  async function handler(request: Request): Promise<Response> {\n    const url = new URL(request.url)\n    const inside = url.pathname === basePath || url.pathname.startsWith(`${basePath}/`)\n    const route = inside ? withoutTrailingSlashes(url.pathname.slice(basePath.length)) || '/' : null\n    if (identity && route !== null) {\n      const unready = await identityGate()\n      if (unready) return finish(unready, route)\n    }\n    try {\n      return finish(await serve(request), route)\n    } catch (err) {\n      if (err instanceof UnknownOriginError) return finish(problem(400, 'unknown_origin', err.message), route)\n      throw err\n    }\n  }\n\n  /**\n   * On CAUTHY_KEY, before any auth route: the identity, or the answer to give\n   * instead. Never one yet and Cauthy failing: 503 unavailable at once (the\n   * retries go on); the first ask still out: waited for, up to the request\n   * deadline. Cauthy refusing the key: 503 misconfigured.\n   */\n  async function identityGate(): Promise<Response | null> {\n    if (!identity) return null\n    const unavailable = () => problem(503, 'unavailable', 'Cauthy cannot be reached yet. Try again in a moment.')\n    if (identity.failing()) return unavailable()\n    let timer: ReturnType<typeof setTimeout> | undefined\n    const waited = new Promise<'timeout'>((resolve) => { timer = setTimeout(() => resolve('timeout'), requestTimeout) })\n    try {\n      const ready = identity.ready()\n      const got = await Promise.race([ready.then(() => 'ok' as const), identity.attempt().then(ok => (ok ? 'ok' as const : 'failed' as const)), waited])\n      // A failed attempt that was Cauthy refusing the key has rejected ready() by now.\n      if (got === 'failed') await Promise.race([ready, Promise.resolve()])\n      return got === 'ok' ? null : unavailable()\n    } catch (e) {\n      return (e as { code?: string }).code === 'misconfigured'\n        ? problem(503, 'misconfigured', 'Cauthy refuses this application\\'s key: make a new one in Cauthy\\'s dashboard.')\n        : unavailable()\n    } finally {\n      clearTimeout(timer)\n    }\n  }\n\n  async function serve(request: Request): Promise<Response> {\n    const url = new URL(request.url)\n    if (url.pathname !== basePath && !url.pathname.startsWith(`${basePath}/`)) return new Response('Not found', { status: 404 })\n    const route = withoutTrailingSlashes(url.pathname.slice(basePath.length)) || '/'\n    const get = request.method === 'GET' || request.method === 'HEAD'\n\n    const mine = await ownRoute(request, url, route)\n    if (mine !== null) return mine\n\n    // The browser asking about a permission (organizations.check). Outside the\n    // own screens: it needs no tenant, only the person's session.\n    if (route === '/me/organizations/check') return checkRoute(request)\n\n    if (route === '/login' && get) return login(request, url)\n    if (route === '/callback' && get) return callback(request, url)\n    if (route === '/logout' && (get || request.method === 'POST')) return logout(request)\n\n    if (route === '/session' && get) {\n      const r = await resolve(request)\n      const h = new Headers()\n      for (const c of r.cookies) h.append('set-cookie', c)\n      return json({ session: r.session ? await toPublic(r.session) : null, status: r.status }, 200, h)\n    }\n\n    // For a page that found its session expired: renew, and go back to it.\n    if (route === '/refresh' && get) {\n      const r = await resolve(request)\n      const back = localPath(url.searchParams.get('return_to'), afterSignIn)\n      if (r.status === 'unauthenticated') return redirect(urls.signIn(back), r.cookies)\n      if (r.status === 'expired') return new Response('Sign-in is unavailable right now. Try again in a moment.', { status: 503 })\n      return redirect(back, r.cookies)\n    }\n\n    if (route === '/account' && get) {\n      const q = new URLSearchParams({ client_id: signInClientNow() })\n      const back = localPath(url.searchParams.get('return_to'), '')\n      if (back !== '') q.set('return_to', `${originOf(request)}${back}`)\n      const locale = url.searchParams.get('locale')\n      if (locale && /^[a-zA-Z-]{2,10}$/.test(locale)) q.set('ui_locales', locale)\n      return redirect(`${issuer}/v1/oauth/account?${q}`)\n    }\n    return new Response('Not found', { status: 404 })\n  }\n\n  async function checkRoute(request: Request): Promise<Response> {\n    if (request.method !== 'POST') return new Response('Method not allowed', { status: 405, headers: { allow: 'POST' } })\n    const refused = withoutRequestHeader(request, '/me/organizations/check')\n    if (refused) return refused\n    if (!ownRequest(request)) return problem(403, 'cross_site', 'This request did not come from this application.')\n    const b = await body(request)\n    if (b === null) return problem(400, 'bad_request', 'Send the question as JSON.')\n    const asker = await signedInAs(request)\n    if ('response' in asker) return asker.response\n    const org = typeof b.organizationId === 'string' ? b.organizationId : ''\n    if (!UUID.test(org)) return problem(400, 'invalid_organization', 'Say which organization.', undefined, asker.headers)\n    const named = (v: unknown) => typeof v === 'string' && v !== '' && v.length <= 200\n    if (!named(b.resource) || !named(b.action)) return problem(400, 'bad_request', 'Say which resource and action.', undefined, asker.headers)\n    const attributes = b.attributes\n    if (attributes !== undefined && (typeof attributes !== 'object' || attributes === null || Array.isArray(attributes))) {\n      return problem(400, 'bad_request', 'The attributes are an object.', undefined, asker.headers)\n    }\n    try {\n      const r = await decide(asker.token, {\n        organization: org, resource: b.resource as string, action: b.action as string,\n        ...(attributes !== undefined ? { attributes: attributes as Record<string, unknown> } : {}),\n        ...(typeof b.resourceId === 'string' ? { resourceId: b.resourceId } : {}),\n        ...(typeof b.ownerId === 'string' ? { ownerId: b.ownerId } : {}),\n      })\n      return json({ status: 'decided', ...r }, 200, asker.headers)\n    } catch (e) {\n      const err = e instanceof CauthyApiError ? e : new CauthyApiError(503, 'unavailable', 'Cauthy could not be reached.')\n      return problem(err.status, err.code, err.message.replace(/^@cauthyhq\\/node: /, ''), undefined, asker.headers)\n    }\n  }\n\n  async function protect(request: Request) {\n    const { value } = await read(request)\n    if (value !== null && fresh(value)) return { session: toSession(value) }\n    const url = new URL(request.url)\n    const state = value === null ? 'none' : 'expired'\n    // A page is sent to sign in, or to renew and come back. Anything else —\n    // a fetch, a form post — is told, and its caller decides.\n    const page = request.method === 'GET' && (request.headers.get('sec-fetch-mode') ?? 'navigate') === 'navigate' &&\n      (request.headers.get('accept') ?? 'text/html').includes('text/html')\n    if (!page) {\n      return { response: json({ error: 'unauthenticated', session: state }, 401, new Headers({ 'x-cauthy-session': state })) }\n    }\n    const back = url.pathname + url.search\n    const to = value === null ? urls.signIn(back) : `${basePath}/refresh?return_to=${encodeURIComponent(back)}`\n    return { response: redirect(to) }\n  }\n\n  // The endpoint's public address: the application's origin when it was\n  // given (a proxy may hide it from the request), with the request's path.\n  const replay = given.webhookReplay ?? memoryReplayStore()\n  const tokenVerifier: Cauthy['tokenVerifier'] = (o = {}) => {\n    // On CAUTHY_KEY the audience and the workspace are Cauthy's answer: the\n    // verifier is built once that answer is in.\n    if (identity) {\n      let built: { from: Identity; verify: (from: string | Request | Headers) => Promise<TokenIdentity> } | undefined\n      return async (from) => {\n        const id = await identity.ready()\n        if (built?.from !== id) {\n          built = { from: id, verify: createTokenVerifier({ issuer, tenantId: id.tenant.id, audience: id.audience, fetch: given.fetch, ...o }) }\n        }\n        return built.verify(from)\n      }\n    }\n    return createTokenVerifier({\n      issuer,\n      tenantId: given.tenantId,\n      audience: given.audience,\n      fetch: given.fetch,\n      ...o,\n    })\n  }\n  const webhook: Cauthy['webhook'] = (request, o = {}) =>\n    verifyWebhook(request, { issuer, url: o.url ?? `${originOf(request)}${new URL(request.url).pathname}`, jwks: o.jwks, now: o.now, replay })\n\n  // What the application is, as configured, for the modes that do not ask Cauthy.\n  const configured = (): Identity => ({\n    issuer, audience: given.audience ?? env('CAUTHY_AUDIENCE') ?? '', tenant: { id: given.tenantId ?? env('CAUTHY_TENANT_ID') ?? '', slug: tenant },\n    system, client_id: clientId, sign_in_client_id: clientId, app_urls: baseURL ? [withoutTrailingSlashes(baseURL)] : [], callback_path: `${basePath}/callback`,\n    key: null,\n  })\n\n  return {\n    handler,\n    ready: async () => {\n      if (identity) return identity.ready()\n      const id = configured()\n      return fromKey ? { ...id, key: { kid: (await fromKey.signer).kid, retires_at: null } } : id\n    },\n    checkMount: (target: MountTarget) => probeMount(basePath, target),\n    webhook,\n    tokenVerifier,\n    verifyToken: async (from, o) => tokenVerifier(o)(from),\n    system: systemThatRefreshes,\n    getSession,\n    status,\n    resolve,\n    protect,\n    organizations,\n    check,\n    toPublic,\n    urls,\n    options: { issuer, clientId, basePath, afterSignIn, afterSignOut, cookieName },\n  }\n}\n\n/**\n * A provider's logo, as Cauthy serves it. An address of Cauthy's own path (a\n * Cauthy with no public address of its own) is read against the issuer; only\n * an http(s) address is passed on.\n */\nfunction iconFor(issuer: string): (p: any) => { iconUrl?: string } {\n  return (p) => {\n    const raw = typeof p?.icon_url === 'string' ? p.icon_url.trim() : ''\n    if (raw === '') return {}\n    try {\n      const url = new URL(raw.startsWith('/') && !raw.startsWith('//') ? `${issuer}${raw}` : raw)\n      return url.protocol === 'https:' || url.protocol === 'http:' ? { iconUrl: url.href } : {}\n    } catch {\n      return {}\n    }\n  }\n}\n\n/** What a sign-up form shows for the law: the documents to accept and the consents to ask, as the API tells them. */\nfunction legalOf(raw: any): { documents: { kind: string; version: string; url: string }[]; consentPurposes: { key: string; label: string; required: boolean }[] } {\n  const documents = Array.isArray(raw?.documents) ? raw.documents : []\n  const purposes = Array.isArray(raw?.consent_purposes) ? raw.consent_purposes : []\n  return {\n    documents: documents.map((d: any) => ({ kind: String(d.kind ?? ''), version: String(d.version ?? ''), url: String(d.url ?? '') })),\n    consentPurposes: purposes.map((p: any) => ({ key: String(p.key ?? ''), label: String(p.label ?? ''), required: p.required === true })),\n  }\n}\n\n/** A loopback, private or link-local address: a network's own hop, never a person. */\nfunction ownNetwork(address: string): boolean {\n  const a = address.toLowerCase()\n  return /^(127\\.|10\\.|192\\.168\\.|169\\.254\\.|0\\.)/.test(a) || /^172\\.(1[6-9]|2\\d|3[01])\\./.test(a) ||\n    a === '::1' || /^f[cd]/.test(a) || /^fe[89ab]/.test(a) || a.startsWith('::ffff:127.') || a === 'localhost'\n}\n","// Connecting an application to Cauthy in one call: its client, where its\n// people come back to, where it hears events, and its own identity. It is what\n// `cauthy init` runs, and what Cauthy's dashboard does under \"Connect a\n// system\".\n\nimport { withoutTrailingSlashes } from './url'\nimport { deadline, DEFAULT_DEADLINE_MS } from './deadline'\nimport { deprecated } from './deprecate'\n\nexport interface ConnectOptions {\n  /** The system's name, as its organizations are filed under: lowercase, digits, - or _. */\n  system: string\n  /** The application's public address: `https://app.example.com`, or `http://localhost:3000` while developing. */\n  appUrl: string\n  /** Shown to people on Cauthy's pages. Default: the system's name. */\n  name?: string\n  /** Where the application serves the return from a sign-in. Default: `/api/auth/callback`. */\n  callbackPath?: string\n  /** An https address of the application that receives Cauthy's events. */\n  eventsUrl?: string\n  /** The events to receive. Default: all of them. */\n  events?: string[]\n  /** Where the application publishes its keys, to prove itself without a secret. */\n  jwksUri?: string\n  /** Cauthy's address. Default: `CAUTHY_ISSUER`. */\n  issuer?: string\n  /** The workspace's slug. Default: `CAUTHY_TENANT`. */\n  tenant?: string\n  /** A personal access token with `systems:connect`. Default: `CAUTHY_TOKEN`. */\n  token?: string\n  fetch?: typeof fetch\n  /** How long the call may take, in milliseconds, before it fails with a `TimeoutError`. Default: 5000. */\n  timeoutMs?: number\n}\n\nexport interface Connected {\n  system: string\n  clientId: string\n  /** Shown this once: Cauthy keeps only its hash. */\n  clientSecret: string\n  redirectUris: string[]\n  /**\n   * The subscription to events, when `eventsUrl` was given. Its `secret` signs\n   * the HMAC header (X-Cauthy-Signature) and is shown this once; `auth.webhook`\n   * does not need it, as it verifies by Cauthy's published keys.\n   */\n  webhook: { id: string; url: string; events: string[]; secret: string } | null\n  /**\n   * Everything the application sets: what Cauthy answered, plus CAUTHY_SECRET,\n   * the key of the session cookie, generated here and known to nobody else.\n   */\n  env: Record<string, string>\n}\n\nfunction sessionSecret(): string {\n  const bytes = crypto.getRandomValues(new Uint8Array(32))\n  let s = ''\n  for (const b of bytes) s += String.fromCharCode(b)\n  return btoa(s).replace(/\\+/g, '-').replace(/\\//g, '_').replace(/=+$/, '')\n}\n\n/** @deprecated Connect a system with the cauthy CLI (`npx cauthy init`); leaves in 2.0. */\nexport async function connectSystem(o: ConnectOptions): Promise<Connected> {\n  deprecated('connectSystem', 'Connect a system with the cauthy CLI: npx cauthy init.')\n  const env = (n: string) => (typeof process !== 'undefined' ? process.env?.[n] : undefined)\n  const issuer = withoutTrailingSlashes(o.issuer ?? env('CAUTHY_ISSUER') ?? '')\n  const tenant = o.tenant ?? env('CAUTHY_TENANT') ?? ''\n  const token = o.token ?? env('CAUTHY_TOKEN') ?? ''\n  for (const [name, v] of Object.entries({ CAUTHY_ISSUER: issuer, CAUTHY_TENANT: tenant, CAUTHY_TOKEN: token })) {\n    if (v === '') throw new Error(`@cauthyhq/node: ${name} is required to connect a system`)\n  }\n  const res = await deadline(o.fetch, o.timeoutMs ?? DEFAULT_DEADLINE_MS)(`${issuer}/v1/connect`, {\n    method: 'POST',\n    headers: { authorization: `Bearer ${token}`, 'x-tenant-key': tenant, 'content-type': 'application/json' },\n    body: JSON.stringify({ system: o.system, app_url: o.appUrl, name: o.name, callback_path: o.callbackPath,\n      events_url: o.eventsUrl, events: o.events, jwks_uri: o.jwksUri }),\n  })\n  const body = (await res.json().catch(() => null)) as {\n    data?: { system: string; client_secret: string; client: { client_id: string; redirect_uris: string[] }\n      webhook: Connected['webhook']; env: Record<string, string> }\n    errors?: { field?: string; message?: string }[]\n  } | null\n  if (!res.ok || !body?.data) {\n    const why = (body?.errors ?? []).map((e) => e.message).filter(Boolean).join('; ') || res.statusText\n    throw new Error(`@cauthyhq/node: Cauthy did not connect the system (${res.status}): ${why}`)\n  }\n  const d = body.data\n  return { system: d.system, clientId: d.client.client_id, clientSecret: d.client_secret, redirectUris: d.client.redirect_uris,\n    webhook: d.webhook, env: { ...d.env, CAUTHY_SECRET: sessionSecret() } }\n}\n\n/** The variables as the lines of an env file. */\nexport function envFile(env: Record<string, string>): string {\n  return Object.entries(env).map(([k, v]) => `${k}=${v}`).join('\\n') + '\\n'\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACKA,IAAM,OAAO;AAEN,SAAS,YAAY,QAAwD;AAClF,QAAMA,OAAM,oBAAI,IAAoB;AACpC,aAAW,SAAS,UAAU,IAAI,MAAM,GAAG,GAAG;AAC5C,UAAM,IAAI,KAAK,QAAQ,GAAG;AAC1B,QAAI,IAAI,EAAG,CAAAA,KAAI,IAAI,KAAK,MAAM,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,MAAM,IAAI,CAAC,EAAE,KAAK,CAAC;AAAA,EACtE;AACA,SAAOA;AACT;AAGO,SAAS,UAAU,SAA8B,MAA6B;AACnF,MAAI,QAAQ;AACZ,WAAS,IAAI,GAAG,QAAQ,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,GAAG,IAAK,UAAS,QAAQ,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE;AACrF,SAAO,UAAU,KAAK,OAAO;AAC/B;AAQA,SAAS,WAAW,GAA6B;AAG/C,SAAO,QAAQ,EAAE,QAAQ,GAAG,2BAA2B,EAAE,WAAW,SAAY,KAAK,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,aAAa,EAAE;AAC3I;AAEO,SAAS,YAAY,MAAc,OAAe,GAA6B;AACpF,SAAO,GAAG,IAAI,IAAI,KAAK,KAAK,WAAW,CAAC,CAAC;AAC3C;AAMO,SAAS,WAAW,MAAc,OAAe,GAAqB,KAAoC;AAC/G,QAAMA,OAAgB,CAAC;AACvB,MAAI,IAAI;AACR,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,KAAM,CAAAA,KAAI,KAAK,YAAY,GAAG,IAAI,IAAI,GAAG,IAAI,MAAM,MAAM,GAAG,IAAI,IAAI,GAAG,CAAC,CAAC;AAChH,WAAS,IAAI,GAAG,IAAI,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,GAAG,IAAK,CAAAA,KAAI,KAAK,YAAY,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,GAAG,GAAG,QAAQ,EAAE,CAAC,CAAC;AAC3G,SAAOA;AACT;AAEO,SAAS,WAAW,MAAc,GAAqB,KAAoC;AAChG,QAAMA,OAAgB,CAAC;AACvB,WAAS,IAAI,GAAG,IAAI,IAAI,GAAG,IAAI,IAAI,CAAC,EAAE,KAAK,MAAM,GAAG,IAAK,CAAAA,KAAI,KAAK,YAAY,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,EAAE,GAAG,GAAG,QAAQ,EAAE,CAAC,CAAC;AACtH,SAAOA;AACT;;;ACnDA,kBAA+C;AAE/C,IAAM,UAAU,IAAI,YAAY;AAChC,IAAM,UAAU,IAAI,YAAY;AAGhC,eAAsB,MAAM,QAAqC;AAC/D,SAAO,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,WAAW,QAAQ,OAAO,MAAM,CAAC,CAAC;AACrF;AAEA,eAAsB,KAAK,OAAgB,KAAkC;AAC3E,SAAO,IAAI,2BAAe,QAAQ,OAAO,KAAK,UAAU,KAAK,CAAC,CAAC,EAC5D,mBAAmB,EAAE,KAAK,OAAO,KAAK,UAAU,CAAC,EACjD,QAAQ,GAAG;AAChB;AAGA,eAAsB,OAAU,QAAgB,KAAoC;AAClF,MAAI;AACF,UAAM,EAAE,UAAU,IAAI,UAAM,4BAAe,QAAQ,KAAK;AAAA,MACtD,yBAAyB,CAAC,KAAK;AAAA,MAC/B,6BAA6B,CAAC,SAAS;AAAA,IACzC,CAAC;AACD,WAAO,KAAK,MAAM,QAAQ,OAAO,SAAS,CAAC;AAAA,EAC7C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,eAAsB,UAAa,QAAgB,MAAuC;AACxF,UAAQ,MAAM,cAAiB,QAAQ,IAAI,IAAI,SAAS;AAC1D;AAGA,eAAsB,cAAiB,QAAgB,MAAiE;AACtH,WAAS,QAAQ,GAAG,QAAQ,KAAK,QAAQ,SAAS;AAChD,UAAM,QAAQ,MAAM,OAAU,QAAQ,KAAK,KAAK,CAAC;AACjD,QAAI,UAAU,KAAM,QAAO,EAAE,OAAO,MAAM;AAAA,EAC5C;AACA,SAAO;AACT;;;ACvCO,IAAM,sBAAsB;AAG5B,IAAM,YAAY,CAAC,QAA2B,KAAmC,SAAS;AAE1F,SAAS,SAAS,MAAgC,IAA0B;AACjF,SAAO,OAAO,OAAO,OAAO,CAAC,MAAM;AACjC,UAAM,OAAO,QAAQ;AACrB,UAAM,SAAS,IAAI,QAAQ,KAAK,OAAO,EAAE,IAAI,QAAQ,GAAG,SAAS,mBAAmB,MAAM;AAC1F,QAAI,CAAC,QAAQ;AAEX,YAAM,QAAQ,YAAY,QAAQ,EAAE;AACpC,aAAO,KAAK,OAAO,EAAE,GAAG,MAAM,QAAQ,KAAK,SAAS,UAAU,CAAC,KAAK,QAAQ,KAAK,CAAC,IAAI,MAAM,CAAC;AAAA,IAC/F;AACA,UAAM,MAAM,IAAI,gBAAgB;AAChC,UAAM,QAAQ,WAAW,MAAM,IAAI,MAAM,IAAI,aAAa,gCAAgC,EAAE,OAAO,cAAc,CAAC,GAAG,EAAE;AACvH,QAAI;AACF,aAAO,MAAM,KAAK,OAAO,EAAE,GAAG,MAAM,QAAQ,KAAK,SAAS,UAAU,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,IAAI,OAAO,CAAC;AAAA,IAC/G,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF;AACF;AAEA,SAAS,UAAU,SAAqC;AACtD,MAAI,OAAO,YAAY,QAAQ,WAAY,QAAO,YAAY,IAAI,OAAO;AAEzE,QAAM,aAAa,IAAI,gBAAgB;AACvC,aAAW,UAAU,SAAS;AAC5B,QAAI,OAAO,SAAS;AAClB,iBAAW,MAAM,OAAO,MAAM;AAC9B;AAAA,IACF;AACA,WAAO,iBAAiB,SAAS,MAAM,WAAW,MAAM,OAAO,MAAM,GAAG,EAAE,MAAM,KAAK,CAAC;AAAA,EACxF;AACA,SAAO,WAAW;AACpB;;;ACrCO,SAAS,uBAAuB,GAAmB;AACxD,MAAI,MAAM,EAAE;AACZ,SAAO,MAAM,KAAK,EAAE,WAAW,MAAM,CAAC,MAAM,GAAI;AAChD,SAAO,EAAE,MAAM,GAAG,GAAG;AACvB;;;ACYA,SAAS,QAAQ,OAAe,UAAkB,QAAyB;AAEzE,QAAM,IAAI,MAAM,YAAY,GAAG;AAC/B,MAAI,IAAI,EAAG,QAAO;AAClB,QAAM,IAAI,MAAM,MAAM,GAAG,CAAC;AAC1B,QAAM,IAAI,MAAM,MAAM,IAAI,CAAC;AAC3B,UAAQ,MAAM,OAAO,MAAM,cAAc,MAAM,OAAO,MAAM;AAC9D;AAgBO,SAAS,IAAI,cAA4C,UAAkB,QAAyB;AACzG,MAAI,CAAC,cAAc,YAAa,QAAO;AACvC,OAAK,aAAa,UAAU,CAAC,GAAG,KAAK,CAAC,MAAM,QAAQ,GAAG,UAAU,MAAM,CAAC,EAAG,QAAO;AAClF,SAAO,aAAa,YAAY,KAAK,CAAC,MAAM,QAAQ,GAAG,UAAU,MAAM,CAAC;AAC1E;AA4KO,SAAS,aAAa,OAAwG;AACnI,QAAM,QAA8B,MAAM,QAAQ,KAAK,IAAI,QAAS,MAA2E;AAC/I,QAAM,YAAsC,MAAM,QAAQ,KAAK,IAAI,CAAC,IAAK,MAA2E,WAAW,CAAC;AAChK,QAAM,QAAQ,CAAC,MAA4C,GAAG,EAAE,QAAQ,IAAI,EAAE,MAAM;AACpF,QAAM,SAAS,IAAI,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AACpD,QAAM,QAAQ,CAAC,eAAyC;AACtD,UAAM,IAAI,WAAW,YAAY,GAAG;AACpC,WAAO,IAAI,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,MAAM,GAAG,CAAC,GAAG,WAAW,MAAM,IAAI,CAAC,CAAC;AAAA,EACpF;AACA,SAAO;AAAA,IACL,OAAO,MAAM,IAAI,CAAC,OAAO;AAAA,MACvB,MAAM,EAAE;AAAA,MACR,GAAI,EAAE,SAAS,SAAY,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;AAAA,MAC/C,GAAI,EAAE,gBAAgB,SAAY,EAAE,aAAa,EAAE,YAAY,IAAI,CAAC;AAAA,MACpE,GAAI,EAAE,WAAW,EAAE,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC;AAAA,MAClD,GAAI,EAAE,cAAc,EAAE,aAAa,EAAE,YAAY,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC;AAAA,IAC/E,EAAE;AAAA,IACF,SAAS,UAAU,IAAI,CAAC,OAAO;AAAA,MAC7B,UAAU,EAAE;AAAA,MACZ,GAAI,EAAE,gBAAgB,SAAY,EAAE,aAAa,EAAE,YAAY,IAAI,CAAC;AAAA,MACpE,SAAS,CAAC,GAAG,EAAE,OAAO;AAAA,MACtB,GAAI,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,CAAC;AAAA,IAC5D,EAAE;AAAA,IACF,WAAW,MAAM,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,IAClC,aAAa,CAAC,GAAG,IAAI,IAAI,MAAM,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC;AAAA,IAChF,IAAI,cAAc,YAAY;AAC5B,YAAM,CAAC,UAAU,MAAM,IAAI,MAAM,UAAU;AAC3C,aAAO,IAAI,cAAc,UAAU,MAAM;AAAA,IAC3C;AAAA,IACA,QAAQ,iBAAiB,QAAQ;AAC/B,aAAO,gBAAgB,QAAQ,OAAO,SAAS,aAAa,IAAI;AAAA,IAClE;AAAA,IACA,cAAc,MAAM;AAClB,YAAM,OAAO,oBAAI,IAAY;AAC7B,YAAMC,OAAM,oBAAI,IAAY;AAC5B,YAAM,OAAO,CAAC,SAAiB;AAC7B,YAAI,KAAK,IAAI,IAAI,EAAG;AACpB,aAAK,IAAI,IAAI;AACb,cAAM,IAAI,OAAO,IAAI,IAAI;AACzB,mBAAW,KAAK,GAAG,eAAe,CAAC,EAAG,CAAAA,KAAI,IAAI,MAAM,CAAC,CAAC;AACtD,mBAAW,UAAU,GAAG,YAAY,CAAC,EAAG,MAAK,MAAM;AAAA,MACrD;AACA,WAAK,IAAI;AACT,aAAO,CAAC,GAAGA,IAAG;AAAA,IAChB;AAAA;AAAA;AAAA,IAGA,MAAM,UAA+D,MAAiB;AACpF,aAAO,MAAM,MAAM,GAAG,IAAI;AAAA,IAC5B;AAAA,EACF;AACF;AAEA,IAAM,QAAQ;AAcP,SAAS,aAAa,QAAgB,MAAmF;AAC9H,QAAM,QAAQ,MAAM,QAAQ,IAAI,IAAI,OAAO,KAAK;AAChD,QAAM,UAAU,MAAM,QAAQ,IAAI,IAAI,CAAC,IAAK,KAAK,WAAW,CAAC;AAC7D,QAAM,OAAO,CAAC,MAAc,KAAK,UAAU,CAAC;AAC5C,QAAM,MAAM,CAAC,MAAe,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC;AACtD,QAAM,MAAM,CAAC,GAAe,QAAgB;AAC1C,UAAM,QAAQ,CAAC,SAAS,KAAK,EAAE,IAAI,CAAC,EAAE;AACtC,QAAI,EAAE,KAAM,OAAM,KAAK,SAAS,KAAK,EAAE,IAAI,CAAC,EAAE;AAC9C,QAAI,EAAE,YAAa,OAAM,KAAK,gBAAgB,KAAK,EAAE,WAAW,CAAC,EAAE;AACnE,QAAI,EAAE,UAAU,OAAQ,OAAM,KAAK,cAAc,EAAE,SAAS,IAAI,IAAI,EAAE,KAAK,IAAI,CAAC,GAAG;AACnF,QAAI,EAAE,aAAa,QAAQ;AACzB,YAAM,OAAO,EAAE,YAAY,IAAI,CAAC,MAAM,GAAG,GAAG,WAAW;AAAA,QACrD,GAAI,EAAE,QAAQ,EAAE,SAAS,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;AAAA,QACtE,aAAa,KAAK,EAAE,QAAQ,CAAC;AAAA,QAC7B,WAAW,KAAK,EAAE,MAAM,CAAC;AAAA,QACzB,GAAI,EAAE,YAAY,CAAC,cAAc,KAAK,EAAE,SAAS,CAAC,EAAE,IAAI,CAAC;AAAA,MAC3D,EAAE,KAAK,IAAI,CAAC,KAAK;AACjB,YAAM,KAAK;AAAA,EAAmB,KAAK,KAAK,IAAI,CAAC;AAAA,EAAK,GAAG,OAAO;AAAA,IAC9D;AACA,WAAO,GAAG,GAAG;AAAA,EAAQ,GAAG,OAAO,MAAM,KAAK;AAAA,EAAM,GAAG,MAAM,CAAC;AAAA,EAAM,GAAG;AAAA,EACrE;AACA,QAAM,WAAW,CAAC,MAAuB;AACvC,UAAM,QAAQ,CAAC,aAAa,KAAK,EAAE,QAAQ,CAAC,EAAE;AAC9C,QAAI,EAAE,YAAa,OAAM,KAAK,gBAAgB,KAAK,EAAE,WAAW,CAAC,EAAE;AACnE,UAAM,KAAK,aAAa,EAAE,QAAQ,IAAI,IAAI,EAAE,KAAK,IAAI,CAAC,GAAG;AACzD,UAAM,QAAQ,OAAO,QAAQ,EAAE,cAAc,CAAC,CAAC;AAC/C,QAAI,MAAM,OAAQ,OAAM,KAAK,iBAAiB,MAAM,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,EAAE,EAAE,KAAK,IAAI,CAAC,IAAI;AAC3G,WAAO,SAAS,MAAM,KAAK,IAAI,CAAC;AAAA,EAClC;AACA,QAAM,OAAO,8BAA8B,KAAK,MAAM,CAAC;AAAA;AAAA;AAAA;AAIvD,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO,GAAG,IAAI;AAAA;AAAA;AAAA;AAAA,EAIhB,MAAM,IAAI,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOvC;AACA,SAAO,GAAG,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA,EAKd,QAAQ,IAAI,QAAQ,EAAE,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA,EAGhC,MAAM,IAAI,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAU3C;AAWA,SAAS,MAAM,GAAqC,OAAsB;AACxE,QAAMC,OAAM,CAAC,MAAe,OAAO,YAAY,cAAc,QAAQ,MAAM,CAAC,IAAI;AAChF,QAAM,IAAI;AAAA,IACR,QAAQ,uBAAuB,EAAE,UAAUA,KAAI,eAAe,KAAK,EAAE;AAAA,IACrE,QAAQ,EAAE,UAAUA,KAAI,eAAe,KAAK;AAAA,IAC5C,QAAQ,EAAE,UAAUA,KAAI,eAAe,KAAK;AAAA,IAC5C,OAAO,EAAE,SAASA,KAAI,cAAc,KAAK;AAAA,EAC3C;AACA,aAAW,CAAC,MAAM,CAAC,KAAK,OAAO,QAAQ,EAAE,eAAe,EAAE,QAAQ,eAAe,EAAE,QAAQ,eAAe,EAAE,QAAQ,cAAc,EAAE,MAAM,CAAC,GAAG;AAC5I,QAAI,MAAM,GAAI,OAAM,IAAI,MAAM,mBAAmB,IAAI,mBAAmB,KAAK,EAAE;AAAA,EACjF;AACA,SAAO,EAAE,GAAG,GAAG,OAAO,SAAS,EAAE,OAAO,EAAE,aAAa,mBAAmB,EAAE;AAC9E;AAEA,eAAe,WAAW,GAAU,QAAuB,MAA4B,MAA8B;AACnH,QAAM,MAAM,MAAM,EAAE,MAAM,GAAG,EAAE,MAAM,eAAe,mBAAmB,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI;AAAA,IAC1F,GAAI,WAAW,QAAQ,EAAE,OAAO,IAAI,CAAC;AAAA,IACrC,SAAS;AAAA,MACP,eAAe,UAAU,EAAE,KAAK;AAAA,MAAI,gBAAgB,EAAE;AAAA,MACtD,GAAI,SAAS,SAAY,EAAE,QAAQ,mBAAmB,IAAI,EAAE,gBAAgB,mBAAmB;AAAA,IACjG;AAAA,IACA,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,MAAM,KAAK,UAAU,IAAI,EAAE;AAAA,EAC7D,CAAC;AACD,QAAM,SAAU,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AACjD,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,OAAO,WAAW,QAAQ,uBAAuB,IAAI,KAAK,eAAe,IAAI;AACnF,UAAM,IAAI,MAAM,0BAA0B,IAAI,KAAK,IAAI,MAAM,MAAM,QAAQ,SAAS,CAAC,GAAG,WAAW,IAAI,UAAU,EAAE;AAAA,EACrH;AACA,SAAO,QAAQ;AACjB;AAGA,eAAsB,WAAW,IAAsC,CAAC,GAA0B;AAChG,QAAM,OAAO,MAAM,WAAW,MAAM,GAAG,eAAe,GAAG,OAAO,QAAQ;AACxE,SAAQ,MAAM,SAAsC,CAAC;AACvD;AAGA,eAAsB,YAAY,IAAsC,CAAC,GAA+B;AACtG,QAAM,OAAO,MAAM,WAAW,MAAM,GAAG,gBAAgB,GAAG,OAAO,SAAS;AAC1E,SAAQ,MAAM,aAA+C,CAAC;AAChE;AAiCA,eAAsB,WAAW,GAAqC;AACpE,QAAM,IAAI,MAAM,GAAG,eAAe;AAClC,MAAI,EAAE,YAAY,OAAW,OAAM,WAAW,GAAG,OAAO,WAAW,EAAE,WAAW,EAAE,QAAQ,CAAC;AAC3F,QAAM,WAAW,GAAG,OAAO,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC;AACzD;AAOA,eAAsB,YAAY,GAAgH;AAChJ,QAAM,OAAO,MAAM,WAAW,MAAM,GAAG,gBAAgB,GAAG,OAAO,WAAW,EAAE,WAAW,EAAE,UAAU,CAAC;AACtG,SAAQ,MAAM,aAA+C,CAAC;AAChE;AAcO,SAAS,UAAU,GAA2C;AACnE,SAAO;AAAA,IACL,UAAU,EAAE;AAAA,IACZ,QAAQ,EAAE;AAAA,IACV,GAAI,EAAE,eAAe,SAAY,EAAE,aAAa,EAAE,WAAW,IAAI,CAAC;AAAA,IAClE,GAAI,EAAE,YAAY,SAAY,EAAE,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,IACzD,GAAI,EAAE,eAAe,SAAY,EAAE,YAAY,EAAE,WAAW,IAAI,CAAC;AAAA,EACnE;AACF;AAGO,SAAS,cAAc,GAAqB;AACjD,QAAM,IAAI,GAAG;AACb,QAAM,OAA8B,KAAK,OAAO,MAAM,WAClD;AAAA,IACE,QAAQ,EAAE,WAAW,cAAc,cAAc;AAAA,IACjD,GAAI,EAAE,OAAO,EAAE,MAAM,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA,IACzC,MAAM,OAAO,EAAE,QAAQ,GAAG;AAAA,IAC1B,UAAU,OAAO,EAAE,YAAY,EAAE;AAAA,IACjC,QAAQ,OAAO,EAAE,UAAU,EAAE;AAAA,IAC7B,QAAQ,EAAE,WAAW,UAAU,UAAU;AAAA,IACzC,GAAI,EAAE,YAAY,EAAE,WAAW,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC;AAAA,EAC1D,IACA;AACJ,SAAO,EAAE,SAAS,GAAG,YAAY,MAAM,QAAQ,OAAO,GAAG,UAAU,EAAE,GAAG,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC,EAAG;AACpG;AAGO,SAAS,iBAAiB,GAA+C;AAC9E,SAAO,OAAO,MAAM,WAAW,IAAI,OAAO,GAAG,OAAO,WAAW,EAAE,KAAK;AACxE;;;ACreA,IAAAC,eAAmF;;;ACmGnF,IAAM,aAAa;AAanB,SAAS,gBAAgB,KAAqB;AAC5C,MAAIC,OAAM;AACV,MAAI,IAAI;AACR,aAAS;AACP,UAAM,OAAO,IAAI,QAAQ,MAAM,CAAC;AAChC,QAAI,OAAO,EAAG,QAAOA,OAAM,IAAI,MAAM,CAAC;AACtC,IAAAA,QAAO,IAAI,MAAM,GAAG,IAAI;AACxB,UAAM,QAAQ,IAAI,QAAQ,MAAM,OAAO,CAAC;AACxC,QAAI,QAAQ,EAAG,QAAOA;AACtB,QAAI,QAAQ;AAAA,EACd;AACF;AAEA,SAAS,aAAa,KAA4B;AAChD,QAAM,OAAO,gBAAgB,GAAG;AAChC,QAAMA,OAAqB,CAAC;AAC5B,QAAM,SAAmB,CAAC;AAC1B,MAAI,QAAQ;AACZ,MAAI,QAAQ;AACZ,MAAI,QAAQ;AACZ,QAAM,QAAQ,MAAM;AAClB,UAAM,IAAI,sCAAsC,KAAK,KAAK;AAC1D,QAAI,EAAG,CAAAA,KAAI,KAAK,EAAE,MAAM,EAAE,CAAC,GAAG,OAAO,EAAE,CAAC,EAAE,QAAQ,QAAQ,GAAG,EAAE,QAAQ,kBAAkB,EAAE,GAAG,QAAQ,CAAC,GAAG,MAAM,EAAE,CAAC;AACnH,YAAQ;AAAA,EACV;AACA,aAAW,MAAM,MAAM;AACrB,QAAI,OAAO;AACT,eAAS;AACT,UAAI,OAAO,MAAO,SAAQ;AAC1B;AAAA,IACF;AACA,QAAI,OAAO,OAAO,OAAO,KAAK;AAC5B,cAAQ;AACR,eAAS;AAAA,IACX,WAAW,OAAO,KAAK;AACrB;AACA,eAAS;AAAA,IACX,WAAW,OAAO,KAAK;AACrB,cAAQ,KAAK,IAAI,GAAG,QAAQ,CAAC;AAC7B,eAAS;AAAA,IACX,WAAW,OAAO,OAAO,UAAU,GAAG;AACpC,aAAO,KAAK,MAAM,KAAK,EAAE,QAAQ,QAAQ,GAAG,CAAC;AAC7C,cAAQ;AAAA,IACV,WAAW,OAAO,OAAO,UAAU,GAAG;AACpC,YAAM;AACN,aAAO,IAAI;AAAA,IACb,WAAW,OAAO,OAAO,UAAU,GAAG;AACpC,YAAM;AAAA,IACR,OAAO;AACL,eAAS;AAAA,IACX;AAAA,EACF;AACA,SAAOA;AACT;AAEA,IAAM,OAAO;AACb,IAAM,QAAQ;AACd,IAAM,QAAQ;AAGd,SAAS,QAAQ,GAAgB,GAAgF;AAC/G,aAAW,SAAS,EAAE,QAAQ;AAC5B,QAAI,EAAE,SAAS,WAAW,KAAK,KAAK,KAAK,EAAG,QAAO;AACnD,QAAI,EAAE,SAAS,UAAU,MAAM,KAAK,KAAK,EAAG,QAAO;AACnD,UAAM,QAAQ,MAAM,KAAK,KAAK;AAC9B,QAAI,SAAS,CAAC,kBAAkB,KAAK,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,MAAO,QAAO;AAG/E,QAAI,CAAC,MAAM,WAAW,GAAG,KAAK,CAAC,6DAA6D,KAAK,KAAK,EAAG,QAAO;AAAA,EAClH;AACA,SAAO;AACT;AAKA,IAAM,cAAc;AACpB,IAAM,cAAc,oBAAI,IAAI;AAAA,EAAC;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAO;AAAA,EAAS;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAO;AAAA,EAAO;AAAA,EAAS;AAAA,EAAS;AAAA,EACtI;AAAA,EAAa;AAAA,EAAc;AAAA,EAAgB;AAAA,EAAS;AAAA,EAAU;AAAA,EAAmB;AAAA,EAAmB;AAAA,EACpG;AAAA,EAA6B;AAAA,EAA6B;AAAA,EAAe;AAAA,EAAQ;AAAA,EAAa;AAAA,EAAc;AAAA,EAAc;AAAA,EAAS;AAAQ,CAAC;AAE9I,SAAS,WAAW,OAA8B;AAChD,QAAM,IAAI,MAAM,QAAQ,QAAQ,GAAG,EAAE,KAAK;AAC1C,MAAI,MAAM,MAAM,EAAE,SAAS,OAAO,CAAC,YAAY,KAAK,CAAC,EAAG,QAAO;AAC/D,aAAW,KAAK,EAAE,SAAS,iBAAiB,EAAG,KAAI,CAAC,YAAY,IAAI,EAAE,CAAC,EAAE,YAAY,CAAC,EAAG,QAAO;AAChG,MAAI,cAAc,KAAK,CAAC,EAAG,QAAO;AAClC,SAAO;AACT;AAGA,IAAM,iBAAiB;AAGvB,IAAM,eAAe,CAAC,cAAsB;AAC1C,QAAM,QAAQ,UAAU,MAAM,QAAQ,EAAE,OAAO,OAAO;AACtD,SAAO,MAAM,SAAS,KAAK,MAAM,MAAM,CAAC,QAAQ,eAAe,KAAK,GAAG,CAAC;AAC1E;AAkBO,SAAS,oBAAoB,KAAwB,UAAiC,CAAC,GAAoB;AAChH,QAAM,OAAO,QAAQ,QAAQ;AAC7B,QAAM,OAAO,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,QAAQ,YAAY;AACnE,QAAM,QAAQ,QAAQ,SAAS,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,KAAK,CAAC,kBAAkB,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO;AAChJ,QAAM,OAAO,oBAAI,IAAoB;AACrC,aAAW,KAAK,KAAK;AACnB,QAAI,CAAC,QAAQ,GAAG,EAAE,MAAM,OAAO,MAAM,CAAC,EAAG;AACzC,QAAI,CAAC,EAAE,OAAO,MAAM,CAAC,MAAM,EAAE,WAAW,GAAG,KAAK,aAAa,CAAC,CAAC,EAAG;AAClE,SAAK,IAAI,EAAE,MAAM,EAAE,KAAK;AAAA,EAC1B;AAEA,QAAM,SAAS,CAAC,OAAe,QAAQ,MAAqB;AAC1D,QAAI,QAAQ,GAAI,QAAO;AACvB,QAAI,SAAS;AACb,QAAIA,OAAM;AACV,aAAS,QAAQ,GAAG,QAAQ,IAAI,SAAS;AACvC,YAAM,OAAOA,KAAI,QAAQ,wEAAwE,CAAC,IAAI,MAAc,aAAsB;AACxI,cAAM,QAAQ,KAAK,IAAI,IAAI;AAC3B,cAAM,MAAM,UAAU,SAAY,OAAO,OAAO,QAAQ,CAAC,IAAI,aAAa,SAAY,OAAO,SAAS,KAAK,GAAG,QAAQ,CAAC,IAAI;AAC3H,YAAI,QAAQ,KAAM,UAAS;AAC3B,eAAO,OAAO;AAAA,MAChB,CAAC;AACD,UAAI,OAAQ,QAAO;AACnB,UAAI,SAASA,KAAK;AAClB,MAAAA,OAAM;AAAA,IACR;AACA,WAAOA;AAAA,EACT;AACA,QAAM,SAAiC,CAAC;AACxC,QAAM,WAAqB,CAAC;AAC5B,aAAW,CAAC,MAAM,GAAG,KAAK,MAAM;AAC9B,QAAI,CAAC,kCAAkC,KAAK,IAAI,EAAG;AACnD,UAAM,UAAU,OAAO,GAAG;AAC1B,UAAM,QAAQ,YAAY,OAAO,OAAO,WAAW,OAAO;AAC1D,QAAI,UAAU,KAAM,UAAS,KAAK,GAAG,IAAI,MAAM,IAAI,SAAS,KAAK,IAAI,MAAM,GAAG,EAAE,IAAI,WAAM,GAAG,+BAA+B;AAAA,QACvH,QAAO,IAAI,IAAI;AAAA,EACtB;AACA,MAAI,OAAO,KAAK,MAAM,EAAE,WAAW,EAAG,UAAS,KAAK,gDAAgD;AACpG,SAAO,EAAE,QAAQ,SAAS;AAC5B;AAIA,SAAS,QAAQ,OAAe,MAA2B,OAAO,GAAkB;AAClF,MAAI,OAAO,GAAI,QAAO;AACtB,MAAI,aAAa;AAEjB,MAAIA,OAAM;AACV,WAAS,QAAQ,GAAG,QAAQ,MAAM,QAAQ,KAAKA,IAAG,GAAG,SAAS;AAC5D,IAAAA,OAAMA,KAAI,QAAQ,iEAAiE,CAAC,IAAI,MAAc,aAAsB;AAC1H,YAAM,QAAQ,KAAK,IAAI,IAAI;AAC3B,YAAM,OAAO,UAAU,SAAY,QAAQ,OAAO,MAAM,OAAO,CAAC,IAAI,aAAa,SAAY,QAAQ,SAAS,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI;AACxI,UAAI,SAAS,KAAM,cAAa;AAChC,aAAO,QAAQ;AAAA,IACjB,CAAC;AACD,QAAI,WAAY,QAAO;AAAA,EACzB;AACA,SAAO,QAAQ,KAAKA,IAAG,IAAI,OAAOA,KAAI,KAAK;AAC7C;AAEA,IAAM,UAAU,CAAC,MAAc,KAAK,IAAI,GAAG,KAAK,IAAI,GAAG,CAAC,CAAC;AACzD,IAAM,OAAO,CAAC,MAAc,KAAK,MAAM,QAAQ,CAAC,IAAI,GAAG,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AACrF,IAAM,QAAQ,CAAC,MAAe,KAAK,WAAY,QAAQ,IAAI,QAAQ,KAAK,IAAI,GAAG,IAAI,GAAG,IAAI;AAE1F,SAAS,IAAI,GAAW,GAAW,GAAW,IAAI,GAAW;AAC3D,MAAI,KAAK,EAAG,QAAO,IAAI,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;AAClD,SAAO,QAAQ,KAAK,MAAM,QAAQ,CAAC,IAAI,GAAG,CAAC,KAAK,KAAK,MAAM,QAAQ,CAAC,IAAI,GAAG,CAAC,KAAK,KAAK,MAAM,QAAQ,CAAC,IAAI,GAAG,CAAC,KAAK,KAAK,MAAM,QAAQ,CAAC,IAAI,GAAI,IAAI,GAAI;AACxJ;AAEA,IAAM,QAAQ,CAAC,MAA2B,MAAM,SAAY,IAAI,EAAE,SAAS,GAAG,IAAI,WAAW,CAAC,IAAI,MAAM,WAAW,CAAC;AAEpH,IAAM,WAAmC,EAAE,OAAO,WAAW,OAAO,UAAU;AAGvE,SAAS,QAAQ,OAA8B;AACpD,QAAM,IAAI,MAAM,KAAK,EAAE,YAAY;AACnC,MAAI,SAAS,CAAC,EAAG,QAAO,SAAS,CAAC;AAClC,MAAI,6CAA6C,KAAK,CAAC,EAAG,QAAO;AACjE,MAAI,IAAI,uFAAuF,KAAK,CAAC;AACrG,MAAI,GAAG;AACL,UAAM,KAAK,CAAC,MAAe,EAAE,SAAS,GAAG,IAAI,WAAW,CAAC,IAAI,MAAM,WAAW,CAAC,IAAI;AACnF,WAAO,IAAI,GAAG,EAAE,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;AAAA,EACtD;AACA,MAAI,2FAA2F,KAAK,CAAC;AACrG,MAAI,GAAG;AACL,UAAM,KAAM,WAAW,EAAE,CAAC,CAAC,IAAI,MAAO,OAAO;AAC7C,UAAM,IAAI,WAAW,EAAE,CAAC,CAAC,IAAI;AAC7B,UAAM,IAAI,WAAW,EAAE,CAAC,CAAC,IAAI;AAC7B,UAAM,IAAI,CAAC,MAAc;AACvB,YAAM,KAAK,IAAI,IAAI,MAAM;AACzB,aAAO,IAAI,IAAI,KAAK,IAAI,GAAG,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC;AAAA,IAC5E;AACA,WAAO,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC,CAAC;AAAA,EAC1C;AACA,MAAI,qFAAqF,KAAK,CAAC;AAC/F,MAAI,GAAG;AACL,UAAM,IAAI,EAAE,CAAC,EAAE,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,CAAC,IAAI,MAAM,WAAW,EAAE,CAAC,CAAC;AACvE,UAAM,IAAI,EAAE,CAAC,EAAE,SAAS,GAAG,IAAK,WAAW,EAAE,CAAC,CAAC,IAAI,MAAO,MAAM,WAAW,EAAE,CAAC,CAAC;AAC/E,UAAM,IAAK,WAAW,EAAE,CAAC,CAAC,IAAI,KAAK,KAAM;AACzC,UAAM,IAAI,IAAI,KAAK,IAAI,CAAC;AACxB,UAAM,IAAI,IAAI,KAAK,IAAI,CAAC;AACxB,UAAM,IAAI,KAAK,IAAI,IAAI,eAAe,IAAI,eAAe,GAAG,CAAC;AAC7D,UAAM,KAAK,KAAK,IAAI,IAAI,eAAe,IAAI,eAAe,GAAG,CAAC;AAC9D,UAAM,IAAI,KAAK,IAAI,IAAI,eAAe,IAAI,cAAc,GAAG,CAAC;AAC5D,WAAO;AAAA,MACL,MAAM,eAAe,IAAI,eAAe,KAAK,eAAe,CAAC;AAAA,MAC7D,MAAM,gBAAgB,IAAI,eAAe,KAAK,eAAe,CAAC;AAAA,MAC9D,MAAM,gBAAgB,IAAI,eAAe,KAAK,cAAc,CAAC;AAAA,MAC7D,MAAM,EAAE,CAAC,CAAC;AAAA,IACZ;AAAA,EACF;AACA,SAAO;AACT;AAGA,SAAS,SAAS,OAA8B;AAC9C,QAAM,IAAI,yBAAyB,KAAK,MAAM,KAAK,CAAC;AACpD,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,KAAK,WAAW,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,MAAM,SAAS,EAAE,CAAC,MAAM,OAAO,KAAK;AACtE,SAAO,OAAO,SAAS,EAAE,IAAI,KAAK,IAAI,YAAY,KAAK,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC,CAAC,IAAI;AACnF;AAGA,SAAS,OAAO,OAA8B;AAC5C,QAAM,IAAI,MAAM,KAAK;AACrB,SAAO,6BAA6B,KAAK,CAAC,MAAM,EAAE,MAAM,IAAI,GAAG,UAAU,KAAK,MAAM,MAAM,EAAE,MAAM,IAAI,GAAG,UAAU,KAAK,MAAM,IAAI,IAAI;AACxI;AAKA,IAAM,SAA0C;AAAA,EAC9C,CAAC,cAAc,CAAC,mBAAmB,cAAc,CAAC;AAAA,EAClD,CAAC,WAAW,CAAC,0BAA0B,qBAAqB,CAAC;AAAA,EAC7D,CAAC,QAAQ,CAAC,qBAAqB,mBAAmB,CAAC;AAAA,EACnD,CAAC,aAAa,CAAC,qBAAqB,CAAC;AAAA,EACrC,CAAC,UAAU,CAAC,uBAAuB,qBAAqB,CAAC;AAAA,EACzD,CAAC,WAAW,CAAC,gBAAgB,qBAAqB,CAAC;AAAA,EACnD,CAAC,eAAe,CAAC,qBAAqB,mBAAmB,CAAC;AAAA,EAC1D,CAAC,UAAU,CAAC,mBAAmB,qBAAqB,aAAa,CAAC;AAAA,EAClE,CAAC,SAAS,CAAC,wBAAwB,YAAY,CAAC;AAAA,EAChD,CAAC,mBAAmB,CAAC,iBAAiB,CAAC;AAAA,EACvC,CAAC,WAAW,CAAC,0BAA0B,cAAc,CAAC;AAAA,EACtD,CAAC,qBAAqB,CAAC,mBAAmB,CAAC;AAC7C;AAWO,SAAS,mBAAmB,KAAwB,UAAiC,CAAC,GAAkB;AAC7G,QAAM,IAAI,EAAE,MAAM,QAAQ,QAAQ,SAAS,OAAO,QAAQ,MAAM;AAChE,QAAM,OAAO,oBAAI,IAAoB;AACrC,aAAW,SAAS,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG;AACpD,eAAW,KAAK,aAAa,KAAK,EAAG,KAAI,QAAQ,GAAG,CAAC,EAAG,MAAK,IAAI,EAAE,MAAM,EAAE,KAAK;AAAA,EAClF;AACA,QAAM,QAAqB,CAAC;AAC5B,QAAM,WAAqB,CAAC;AAE5B,QAAM,OAAO,CAAI,QAAkB,IAA6B,SAAgC;AAC9F,eAAW,SAAS,QAAQ;AAC1B,YAAM,MAAM,KAAK,IAAI,KAAK;AAC1B,UAAI,QAAQ,OAAW;AACvB,YAAM,QAAQ,QAAQ,KAAK,IAAI;AAC/B,YAAM,MAAM,UAAU,OAAO,OAAO,GAAG,KAAK;AAC5C,UAAI,QAAQ,KAAM,QAAO;AACzB,eAAS,KAAK,GAAG,KAAK,MAAM,GAAG,YAAY,IAAI,kBAAkB;AAAA,IACnE;AACA,WAAO;AAAA,EACT;AAEA,aAAW,CAAC,OAAO,MAAM,KAAK,QAAQ;AACpC,UAAM,IAAI,KAAK,QAAQ,SAAS,UAAU;AAC1C,QAAI,MAAM,OAAW,CAAC,MAAkC,KAAK,IAAI;AAAA,EACnE;AACA,QAAM,SAAS,KAAK,CAAC,yBAAyB,gBAAgB,GAAG,UAAU,UAAU;AACrF,MAAI,WAAW,OAAW,OAAM,SAAS;AACzC,QAAM,SAAS,KAAK,CAAC,2BAA2B,gBAAgB,GAAG,UAAU,UAAU;AACvF,MAAI,WAAW,OAAW,OAAM,eAAe;AAC/C,QAAM,OAAO,KAAK,CAAC,kBAAkB,GAAG,QAAQ,aAAa;AAC7D,MAAI,SAAS,OAAW,OAAM,aAAa;AAC3C,MAAI,QAAQ,QAAS,OAAM,UAAU,QAAQ;AAE7C,MAAI,KAAK,SAAS,EAAG,UAAS,KAAK,0FAA0F;AAAA,WACpH,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,EAAE,KAAK,CAAC,MAAM,EAAE,WAAW,OAAO,CAAC,EAAG,UAAS,KAAK,gDAAgD;AAC7H,SAAO,EAAE,OAAO,SAAS;AAC3B;AAmJO,SAAS,OAAO,OAA6C;AAClE,QAAM,QAA2C;AAAA,IAC/C,YAAY;AAAA,IAAc,SAAS;AAAA,IAAW,MAAM;AAAA,IAAQ,WAAW;AAAA,IAAc,QAAQ;AAAA,IAC7F,SAAS;AAAA,IAAW,aAAa;AAAA,IAAgB,QAAQ;AAAA,IAAU,OAAO;AAAA,IAAS,iBAAiB;AAAA,IACpG,SAAS;AAAA,IAAW,mBAAmB;AAAA,IAAsB,QAAQ;AAAA,IAAU,cAAc;AAAA,IAC7F,YAAY;AAAA,IAAe,SAAS;AAAA,IAAY,OAAO;AAAA,IAAS,QAAQ;AAAA,IAAU,aAAa;AAAA,IAC/F,WAAW;AAAA,IAAc,cAAc;AAAA,IAAkB,OAAO;AAAA,IAAS,iBAAiB;AAAA,IAAoB,aAAa;AAAA,IAAgB,QAAQ;AAAA,EACrJ;AACA,QAAM,OAAgC,CAAC;AACvC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,GAAG;AAC1C,QAAI,MAAM,UAAa,MAAM,MAAO,MAAM,QAAQ,CAAC,KAAK,EAAE,WAAW,EAAI;AACzE,SAAK,MAAM,CAAsB,CAAC,IAAI;AAAA,EACxC;AACA,SAAO;AACT;AAGO,SAAS,SAAS,MAA4C;AACnE,QAAM,QAA2C;AAAA,IAC/C,YAAY;AAAA,IAAc,SAAS;AAAA,IAAW,MAAM;AAAA,IAAQ,YAAY;AAAA,IAAa,QAAQ;AAAA,IAC7F,SAAS;AAAA,IAAW,cAAc;AAAA,IAAe,QAAQ;AAAA,IAAU,OAAO;AAAA,IAAS,kBAAkB;AAAA,IACrG,SAAS;AAAA,IAAW,oBAAoB;AAAA,IAAqB,QAAQ;AAAA,IAAU,eAAe;AAAA,IAC9F,aAAa;AAAA,IAAc,UAAU;AAAA,IAAW,OAAO;AAAA,IAAS,QAAQ;AAAA,IAAU,cAAc;AAAA,IAChG,YAAY;AAAA,IAAa,gBAAgB;AAAA,IAAgB,OAAO;AAAA,IAAS,kBAAkB;AAAA,IAAmB,cAAc;AAAA,IAAe,QAAQ;AAAA,EACrJ;AACA,QAAM,QAAiC,CAAC;AACxC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,QAAQ,CAAC,CAAC,EAAG,KAAI,MAAM,CAAC,KAAK,MAAM,UAAa,MAAM,QAAQ,MAAM,GAAI,OAAM,MAAM,CAAC,CAAC,IAAI;AAC9H,SAAO;AACT;AAyBA,eAAsB,UAAU,GAAoC;AAClE,QAAMC,OAAM,CAAC,MAAe,OAAO,YAAY,cAAc,QAAQ,MAAM,CAAC,IAAI;AAChF,QAAM,SAAS,uBAAuB,EAAE,UAAUA,KAAI,eAAe,KAAK,EAAE;AAC5E,QAAM,WAAW,EAAE,YAAYA,KAAI,kBAAkB,KAAK;AAC1D,QAAM,SAAS,EAAE,UAAUA,KAAI,eAAe,KAAK;AACnD,QAAM,QAAQ,EAAE,SAASA,KAAI,cAAc,KAAK;AAChD,aAAW,CAAC,MAAM,CAAC,KAAK,OAAO,QAAQ,EAAE,eAAe,QAAQ,kBAAkB,UAAU,eAAe,QAAQ,cAAc,MAAM,CAAC,GAAG;AACzI,QAAI,MAAM,GAAI,OAAM,IAAI,MAAM,mBAAmB,IAAI,8BAA8B;AAAA,EACrF;AACA,QAAM,MAAM,MAAM,SAAS,EAAE,OAAO,EAAE,aAAa,mBAAmB,EAAE,GAAG,MAAM,qBAAqB,mBAAmB,QAAQ,CAAC,UAAU;AAAA,IAC1I,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,KAAK,IAAI,gBAAgB,QAAQ,gBAAgB,mBAAmB;AAAA,IACxG,MAAM,KAAK,UAAU,OAAO,EAAE,KAAK,CAAC;AAAA,EACtC,CAAC;AACD,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC/C,UAAM,IAAI,MAAM,6CAA6C,IAAI,MAAM,MAAM,MAAM,SAAS,CAAC,GAAG,WAAW,IAAI,UAAU,EAAE;AAAA,EAC7H;AACF;;;ACpYO,IAAM,oBAAN,cAAgC,MAAM;AAAA,EAC3C,YAAY,SAAiB;AAC3B,UAAM,mBAAmB,OAAO,EAAE;AAClC,SAAK,OAAO;AAAA,EACd;AACF;AAOO,IAAM,iBAAN,cAA6B,kBAAkB;AAAA,EACpD,YAAqB,QAAyB,SAAiB;AAC7D,UAAM,eAAe,OAAO,KAAK,MAAM,GAAG;AADvB;AAEnB,SAAK,OAAO;AAAA,EACd;AAAA,EAHqB;AAIvB;;;AFhQA,IAAM,iBAAiB;AAEvB,IAAM,UAAU;AAoDT,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,YACW,QAEA,MACT,SACA;AACA,UAAM,mBAAmB,OAAO,EAAE;AALzB;AAEA;AAIT,SAAK,OAAO;AAAA,EACd;AAAA,EAPW;AAAA,EAEA;AAMb;AA8FA,SAAS,IAAI,MAAkC;AAC7C,SAAO,OAAO,YAAY,cAAc,QAAQ,MAAM,IAAI,IAAI;AAChE;AAOA,SAAS,eAAe,GAA0B;AAChD,SAAO;AAAA,IAAE,IAAI,EAAE;AAAA,IAAI,QAAQ,EAAE;AAAA,IAAQ,MAAM,EAAE;AAAA,IAAM,MAAM,EAAE;AAAA,IAAM,YAAY,EAAE;AAAA,IAAa,QAAQ,EAAE;AAAA,IACpG,UAAU,EAAE,YAAY,CAAC;AAAA,IAAG,SAAS,EAAE;AAAA,IAAS,WAAW,EAAE;AAAA,IAAY,WAAW,EAAE;AAAA,EAAW;AACrG;AAIA,SAAS,SAAS,GAAmC;AACnD,SAAO,EAAE,QAAQ,EAAE,SAAS,OAAO,EAAE,OAAO,MAAM,EAAE,MAAM,QAAQ,EAAE,QAAQ,MAAM,EAAE,MAAM,GAAI,EAAE,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAG;AACvJ;AAEA,SAAS,MAAM,GAA+B;AAC5C,MAAI,OAAO,EAAE,eAAe,SAAU,QAAO,EAAE;AAC/C,SAAO,EAAE,WAAW,SAAS,OAAO,IAAI,SAAa,KAAK,MAAM,EAAE,UAAU;AAC9E;AAEA,eAAe,QAAQ,GAA6C;AAClE,QAAM,MAAM,MAAM,CAAC;AAEnB,SAAO,UAAM,wBAAU,KAAK,OAAO,QAAI,0BAAY,EAAE,YAAsB,SAAS,EAAE,aAAa,KAAK,CAAC;AAC3G;AAEO,SAAS,aAAa,QAAuB,CAAC,GAAiB;AACpE,QAAM,SAAS,uBAAuB,MAAM,UAAU,IAAI,eAAe,KAAK,EAAE;AAChF,QAAM,WAAW,MAAM,YAAY,IAAI,kBAAkB,KAAK;AAC9D,QAAM,eAAe,MAAM,gBAAgB,IAAI,sBAAsB,KAAK;AAC1E,QAAM,SAAS,IAAI,mBAAmB;AACtC,QAAM,MAAM,MAAM,QAAQ,SAAS,EAAE,YAAY,QAAQ,OAAO,IAAI,sBAAsB,KAAK,GAAG,IAAI;AACtG,QAAM,YAAY,MAAM,UAAU,IAAI,eAAe,KAAK;AAC1D,QAAM,kBAAkB,MAAM,mBAAmB,IAAI,0BAA0B,KAAK;AAGpF,QAAM,gBAAwC,eAAe,KAAK,eAAe,IAC7E,EAAE,sBAAsB,UAAU,oBAAoB,gBAAgB,IACtE,CAAC;AACL,QAAM,YAAY,MAAM,aAAa;AACrC,MAAI,CAAC,OAAO,SAAS,SAAS,KAAK,aAAa,EAAG,OAAM,IAAI,kBAAkB,qDAAqD;AAGpI,QAAM,UAAU,SAAS,MAAM,OAAO,SAAS;AAC/C,QAAM,UAAwB,OAAO,OAAO,SAAS;AACnD,QAAI;AACF,aAAO,MAAM,QAAQ,OAAO,IAAI;AAAA,IAClC,SAAS,KAAK;AAEZ,UAAI,UAAU,GAAG,EAAG,OAAM,IAAI,eAAe,KAAK,eAAe,gCAAgC,SAAS,KAAK;AAC/G,YAAM;AAAA,IACR;AAAA,EACF;AACA,QAAM,gBAAgB,GAAG,MAAM;AAI/B,WAAS,aAAmB;AAC1B,QAAI,MAAM,OAAQ;AAClB,QAAI,CAAC,eAAe,KAAK,MAAM,EAAG,OAAM,IAAI,kBAAkB,iDAAkD;AAChH,QAAI,aAAa,GAAI,OAAM,IAAI,kBAAkB,yCAAyC;AAC1F,QAAI,MAAM,IAAI,UAAU,KAAK,iBAAiB,IAAI;AAChD,YAAM,IAAI,kBAAkB,MAAM,gDAC9B,wGAAwG;AAAA,IAC9G;AAAA,EACF;AAEA,MAAI;AACJ,QAAM,aAAa,MAAO,aAAa,QAAQ,GAAgB;AAI/D,iBAAeC,MAAK,KAAe,MAA8B;AAC/D,UAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAE/C,UAAM,QAAQ,MAAM,SAAS,CAAC;AAC9B,UAAM,OAAO,OAAO,MAAM,UAAU,WAAW,KAAK,QAAQ,OAAO;AACnE,UAAM,UAAU,OAAO,MAAM,UAAU,WAAW,KAAK,oBAAoB,OAAO;AAClF,UAAM,IAAI,eAAe,IAAI,QAAQ,QAAQ,SAAS,kBAAkB,IAAI,KAAK,IAAI,MAAM,MAAM,WAAW,IAAI,UAAU,EAAE;AAAA,EAC9H;AAEA,MAAI;AACJ,MAAI;AAEJ,iBAAe,MAAuB;AACpC,eAAW;AACX,UAAM,OAAO,MAAM,SAAS,MAAM,OAAO,WAAW,KAAK,YAAY;AACrE,UAAM,OAAO,IAAI,gBAAgB,EAAE,YAAY,sBAAsB,WAAW,KAAK,CAAC;AACtF,QAAI,MAAM,QAAQ;AAChB,YAAM,IAAI,MAAM,MAAM,OAAO;AAC7B,WAAK,IAAI,yBAAyB,cAAc;AAChD,WAAK,IAAI,oBAAoB,MAAM,EAAE,UAAU,MAAM,aAAa,CAAC;AAAA,IACrE,WAAW,KAAK;AACd,YAAM,SAAS,EAAE,KAAK,IAAI,OAAO,YAAY,MAAM,WAAW,EAAE;AAChE,YAAM,YAAY,MAAM,IAAI,qBAAQ,CAAC,CAAC,EACnC,mBAAmB,EAAE,KAAK,SAAS,KAAK,OAAO,IAAI,CAAC,EACpD,UAAU,IAAI,EAAE,WAAW,IAAI,EAAE,YAAY,aAAa,EAC1D,OAAO,OAAO,WAAW,CAAC,EAAE,YAAY,EAAE,kBAAkB,IAAI,EAChE,KAAK,OAAO,UAAU;AACzB,WAAK,IAAI,yBAAyB,cAAc;AAChD,WAAK,IAAI,oBAAoB,SAAS;AAAA,IACxC,OAAO;AACL,WAAK,IAAI,iBAAiB,YAAY;AAAA,IACxC;AACA,UAAM,MAAM,MAAM,QAAQ,eAAe,EAAE,QAAQ,QAAQ,SAAS,EAAE,gBAAgB,oCAAoC,GAAG,MAAM,KAAK,CAAC;AACzI,QAAI,CAAC,IAAI,GAAI,OAAMA,MAAK,KAAK,6BAA8B;AAC3D,UAAM,IAAK,MAAM,IAAI,KAAK;AAC1B,WAAO,EAAE,OAAO,EAAE,cAAc,OAAO,KAAK,IAAI,IAAI,EAAE,aAAa,MAAO,QAAQ;AAClF,WAAO,EAAE;AAAA,EACX;AAEA,WAAS,QAAyB;AAChC,QAAI,QAAQ,KAAK,IAAI,IAAI,KAAK,MAAO,QAAO,QAAQ,QAAQ,KAAK,KAAK;AAEtE,WAAQ,WAAW,IAAI,EAAE,QAAQ,MAAM;AAAE,eAAS;AAAA,IAAU,CAAC;AAAA,EAC/D;AAEA,iBAAe,KAAK,QAAgB,MAAc,MAAgB,QAAgC,CAAC,GAAqB;AACtH,UAAM,OAAO,YAAY,QAAQ,GAAG,MAAM,GAAG,IAAI,IAAI;AAAA,MACnD;AAAA,MACA,SAAS,EAAE,eAAe,UAAU,MAAM,MAAM,CAAC,IAAI,GAAG,OAAO,GAAI,SAAS,SAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB,EAAG;AAAA,MACrI,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,IAAI;AAAA,IAC5D,CAAC;AACD,QAAI,MAAM,MAAM,KAAK;AACrB,QAAI,IAAI,WAAW,OAAO,MAAM;AAE9B,aAAO;AACP,YAAM,MAAM,KAAK;AAAA,IACnB;AACA,QAAI,CAAC,IAAI,GAAI,OAAMA,MAAK,KAAK,GAAG,MAAM,IAAI,IAAI,EAAE;AAChD,WAAO,IAAI,WAAW,MAAM,SAAY,IAAI,KAAK;AAAA,EACnD;AAEA,QAAM,OAAO,OAAU,QAAgB,MAAc,MAAgB,WAAqC,MAAM,KAAK,QAAQ,MAAM,MAAM,KAAK,IAAgC;AAC9K,QAAM,KAAK;AAEX,SAAO;AAAA,IACL;AAAA,IACA,SAAS;AAAA,IACT,eAAe;AAAA,MACb,MAAM,KAAK,QAAQ,CAAC,GAAG;AACrB,cAAM,IAAI,IAAI,gBAAgB;AAC9B,mBAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,EAAG,KAAI,MAAM,OAAW,GAAE,IAAI,GAAG,OAAO,CAAC,CAAC;AACnF,cAAMC,OAAO,MAAM,KAAK,OAAO,oBAAoB,EAAE,OAAO,IAAI,CAAC,KAAK,EAAE,EAAE;AAC1E,eAAO,EAAE,OAAOA,KAAI,KAAK,IAAI,cAAc,GAAG,OAAOA,KAAI,YAAY;AAAA,MACvE;AAAA,MACA,MAAM,OAAO,OAAO;AAClB,eAAO,eAAe,MAAM;AAAA,UAAc;AAAA,UAAQ;AAAA,UAChD,EAAE,MAAM,MAAM,MAAM,MAAM,MAAM,MAAM,aAAa,MAAM,YAAY,UAAU,MAAM,SAAS;AAAA,QAAC,CAAC;AAAA,MACpG;AAAA,MACA,MAAM,IAAI,OAAO;AACf,eAAO,eAAe,MAAM,KAAc,OAAO,qBAAqB,GAAG,KAAK,CAAC,EAAE,CAAC;AAAA,MACpF;AAAA,MACA,MAAM,OAAO,OAAO,OAAO;AACzB,eAAO,eAAe,MAAM,KAAc,SAAS,qBAAqB,GAAG,KAAK,CAAC,IAAI,KAAK,CAAC;AAAA,MAC7F;AAAA,MACA,MAAM,OAAO,OAAO;AAClB,cAAM,KAAK,UAAU,qBAAqB,GAAG,KAAK,CAAC,EAAE;AAAA,MACvD;AAAA,IACF;AAAA,IACA,SAAS;AAAA,MACP,MAAM,KAAK,OAAO;AAChB,gBAAQ,MAAM,KAAmB,OAAO,qBAAqB,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,QAAQ;AAAA,MACjG;AAAA,MACA,MAAM,IAAI,OAAO,GAAG;AAClB,eAAO,SAAS,MAAM;AAAA,UAAiB;AAAA,UAAQ,qBAAqB,GAAG,KAAK,CAAC;AAAA,UAC3E,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,QAAQ,OAAO,EAAE,OAAO,MAAM,EAAE,MAAM,QAAQ,EAAE,QAAQ,WAAW,UAAU,UAAU,EAAE,YAAY,MAAM;AAAA,UAAG;AAAA,QAAa,CAAC;AAAA,MAC3J;AAAA,MACA,MAAM,QAAQ,OAAO,QAAQ,MAAM;AACjC,eAAO,SAAS,MAAM,KAAiB,OAAO,qBAAqB,GAAG,KAAK,CAAC,YAAY,GAAG,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AAAA,MACjH;AAAA,MACA,MAAM,OAAO,OAAO,QAAQ;AAC1B,cAAM,KAAK,UAAU,qBAAqB,GAAG,KAAK,CAAC,YAAY,GAAG,MAAM,CAAC,EAAE;AAAA,MAC7E;AAAA,IACF;AAAA,IACA,MAAM,OAAO,QAAQ;AAEnB,YAAM,IAAI,MAAM,KAAoC,QAAQ,aAAa,EAAE,GAAG,QAAQ,WAAW,SAAS,GAAG,aAAa;AAC1H,aAAO,EAAE,IAAI,EAAE,IAAI,OAAO,EAAE,MAAM;AAAA,IACpC;AAAA,IACA,OAAO;AAAA,MACL,MAAM,IAAI,KAAK,UAAU;AACvB,eAAO,SAAS,MAAM,KAA8B,OAAO,qBAAqB,GAAG,EAAE,CAAC,QAAQ,CAAC;AAAA,MACjG;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,MAAM,IAAI,QAAQ;AAChB,gBAAQ,MAAM,KAA+B,OAAO,eAAe,GAAG,MAAM,CAAC,SAAS,GAAG,SAAS,CAAC;AAAA,MACrG;AAAA,IACF;AAAA,IACA,SAAS;AAAA,MACP,MAAM,IAAI,QAAQ;AAChB,gBAAQ,MAAM,KAAwC,OAAO,eAAe,GAAG,MAAM,CAAC,UAAU,GAAG,aAAa,CAAC;AAAA,MACnH;AAAA,MACA,MAAM,IAAI,QAAQ,WAAW;AAC3B,gBAAQ,MAAM,KAAwC,OAAO,eAAe,GAAG,MAAM,CAAC,YAAY,EAAE,UAAU,CAAC,GAAG,aAAa,CAAC;AAAA,MAClI;AAAA,IACF;AAAA,IACA,MAAM,MAAM,GAAG;AACb,YAAM,SAAS,EAAE,WAAW,aAAa,MAAM,gBAAgB,KAAK;AACpE,UAAI,WAAW,GAAI,OAAM,IAAI,kBAAkB,wDAAwD;AACvG,aAAO,cAAc,MAAM,KAAK,QAAQ,eAAe,GAAG,MAAM,CAAC,UAAU,EAAE,iBAAiB,EAAE,gBAAgB,SAAS,EAAE,QAAQ,GAAG,UAAU,CAAC,EAAE,CAAC,CAAC;AAAA,IACvJ;AAAA,IACA,MAAM,aAAa;AACjB,UAAI,CAAC,IAAK,QAAO,EAAE,MAAM,CAAC,EAAE;AAC5B,YAAM,EAAE,KAAK,GAAG,EAAE,IAAI,MAAM,GAAG,KAAM,UAAM,wBAAU,MAAM,WAAW,CAAC;AACvE,aAAO,EAAE,MAAM,CAAC,EAAE,KAAK,GAAG,GAAG,KAAK,IAAI,OAAO,KAAK,SAAS,KAAK,MAAM,CAAC,EAAE;AAAA,IAC3E;AAAA,EACF;AACF;;;AGjXO,IAAM,eAAe;AAE5B,IAAM,eAAe;AAErB,IAAM,iBAAiB;AACvB,IAAM,WAAW;AAwBjB,IAAM,UAA2B,CAAC,aAAa,aAAa,SAAS,QAAQ;AAGtE,IAAM,0BAA0C,OAAO,OAAO,EAAE,KAAK,cAAc,KAAK,cAAc,UAAU,CAAC,GAAG,aAAa,GAAG,iBAAiB,MAAM,CAAC;AAEnK,IAAM,MAAM,CAAC,GAAY,aAAsB,OAAO,MAAM,YAAY,OAAO,SAAS,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;AAOtG,SAAS,iBAAiB,KAA8B;AAC7D,QAAM,IAAK,OAAO,OAAO,QAAQ,WAAW,MAAM,CAAC;AACnD,QAAM,MAAM,KAAK,IAAI,KAAK,IAAI,IAAI,EAAE,OAAO,EAAE,YAAY,YAAY,KAAK,cAAc,cAAc,GAAG,YAAY;AACrH,QAAM,MAAM,KAAK,IAAI,KAAK,IAAI,IAAI,EAAE,OAAO,EAAE,YAAY,YAAY,KAAK,cAAc,YAAY,GAAG,GAAG;AAC1G,QAAM,QAAQ,MAAM,QAAQ,EAAE,QAAQ,IAAI,EAAE,WAAW,CAAC;AACxD,SAAO;AAAA,IACL;AAAA,IAAK;AAAA,IACL,UAAU,QAAQ,OAAO,CAAC,MAAM,MAAM,SAAS,CAAC,CAAC;AAAA,IACjD,aAAa,KAAK,IAAI,KAAK,IAAI,IAAI,EAAE,eAAe,EAAE,YAAY,CAAC,GAAG,CAAC,GAAG,QAAQ,MAAM;AAAA,IACxF,kBAAkB,EAAE,mBAAmB,EAAE,oBAAoB;AAAA,EAC/D;AACF;AAGA,SAAS,WAAW,GAAmB;AACrC,MAAI,IAAI;AACR,aAAW,MAAM,GAAG;AAClB,UAAM,IAAI,GAAG,YAAY,CAAC;AAC1B,SAAK,IAAI,MAAO,IAAI,IAAI,OAAQ,IAAI,IAAI,QAAU,IAAI;AAAA,EACxD;AACA,SAAO;AACT;AAGA,SAAS,UAAU,GAA+B;AAChD,QAAM,MAAM,oBAAI,IAAmB;AACnC,aAAW,MAAM,GAAG;AAClB,QAAI,WAAC,WAAO,GAAC,EAAC,KAAK,EAAE,EAAG,KAAI,IAAI,WAAW;AAAA,aAClC,WAAC,WAAO,GAAC,EAAC,KAAK,EAAE,EAAG,KAAI,IAAI,WAAW;AAAA,aACvC,WAAC,WAAO,GAAC,EAAC,KAAK,EAAE,EAAG,KAAI,IAAI,OAAO;AAAA,aACnC,CAAC,WAAC,UAAM,GAAC,EAAC,KAAK,EAAE,EAAG,KAAI,IAAI,QAAQ;AAAA,EAC/C;AACA,SAAO;AACT;AAMO,SAAS,iBAAiB,OAAe,SAAyB,yBAA2C;AAClH,QAAM,IAAI,iBAAiB,MAAM;AACjC,QAAMC,OAAwB,CAAC;AAC/B,QAAM,SAAS,WAAW,KAAK;AAC/B,MAAI,SAAS,EAAE,IAAK,CAAAA,KAAI,KAAK,WAAW;AACxC,MAAI,SAAS,EAAE,IAAK,CAAAA,KAAI,KAAK,UAAU;AACvC,QAAM,MAAM,UAAU,KAAK;AAC3B,aAAW,KAAK,EAAE,SAAU,KAAI,CAAC,IAAI,IAAI,CAAC,EAAG,CAAAA,KAAI,KAAK,SAAS,CAAC,EAAoB;AACpF,MAAI,EAAE,cAAc,KAAK,QAAQ,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,EAAE,SAAS,EAAE,YAAa,CAAAA,KAAI,KAAK,eAAe;AAC3G,SAAOA;AACT;AAKA,IAAM,QAGD;AAAA,EACH,IAAI;AAAA,IACF,SAAS;AAAA,IAAuC,UAAU;AAAA,IAAoB,KAAK;AAAA,IACnF,SAAS;AAAA,IACT,UAAU;AAAA,IACV,OAAO,EAAE,WAAW,sBAAsB,WAAW,uBAAuB,OAAO,WAAW,QAAQ,WAAW;AAAA,IACjH,SAAS;AAAA,MACP,WAAW;AAAA,MAAkC,UAAU;AAAA,MACvD,iBAAiB;AAAA,MAA+B,iBAAiB;AAAA,MAAgC,aAAa;AAAA,MAAoB,cAAc;AAAA,MAChJ,eAAe;AAAA,MACf,UAAU;AAAA,IACZ;AAAA,EACF;AAAA,EACA,IAAI;AAAA,IACF,SAAS;AAAA,IAAmC,UAAU;AAAA,IAAoB,KAAK;AAAA,IAC/E,SAAS;AAAA,IACT,UAAU;AAAA,IACV,OAAO,EAAE,WAAW,oBAAiB,WAAW,oBAAiB,OAAO,gBAAa,QAAQ,gBAAa;AAAA,IAC1G,SAAS;AAAA,MACP,WAAW;AAAA,MAAkC,UAAU;AAAA,MACvD,iBAAiB;AAAA,MAA0B,iBAAiB;AAAA,MAA0B,aAAa;AAAA,MAAsB,cAAc;AAAA,MACvI,eAAe;AAAA,MACf,UAAU;AAAA,IACZ;AAAA,EACF;AACF;AAEA,IAAM,OAAO,CAAC,GAAW,MAAsB,EAAE,QAAQ,SAAS,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,SAAS,OAAO,EAAE,GAAG,CAAC,EAAE,QAAQ,OAAO,OAAO,EAAE,WAAW,CAAC;AAG9I,SAAS,uBAAuB,SAAyB,yBAAyB,SAAyB,MAAc;AAC9H,QAAM,IAAI,iBAAiB,MAAM;AACjC,QAAM,IAAI,MAAM,MAAM,KAAK,MAAM;AACjC,QAAM,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;AACjC,MAAI,EAAE,SAAS,SAAS,GAAG;AACzB,UAAM,QAAQ,EAAE,SAAS,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAC9C,UAAM,SAAS,MAAM,WAAW,IAAI,MAAM,CAAC,IAAI,GAAG,MAAM,MAAM,GAAG,EAAE,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,GAAG,IAAI,MAAM,MAAM,SAAS,CAAC,CAAC;AACnH,UAAM,KAAK,EAAE,SAAS,QAAQ,WAAW,MAAM,CAAC;AAAA,EAClD;AACA,MAAI,EAAE,cAAc,EAAG,OAAM,KAAK,KAAK,EAAE,SAAS,CAAC,CAAC;AACpD,MAAI,EAAE,gBAAiB,OAAM,KAAK,EAAE,QAAQ;AAC5C,SAAO,MAAM,KAAK,GAAG;AACvB;AAGO,SAAS,wBAAwB,SAA4B,SAAyB,yBAAyB,SAAyB,MAAc;AAC3J,QAAM,IAAI,iBAAiB,MAAM;AACjC,QAAM,IAAI,MAAM,MAAM,KAAK,MAAM;AACjC,QAAM,OAAO,QAAQ,OAAO,CAAC,MAA2B,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC;AACxG,SAAO,KAAK,SAAS,IAAI,KAAK,KAAK,GAAG,IAAI,uBAAuB,GAAG,MAAM;AAC5E;AAIA,IAAM,QAAQ;AAEP,SAAS,WAAW,OAAqC;AAC9D,QAAM,IAAI,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AACrD,MAAI,MAAM,GAAI,QAAO,EAAE,OAAO,SAAS,MAAM,YAAY,SAAS,4BAA4B;AAC9F,MAAI,EAAE,SAAS,OAAO,CAAC,MAAM,KAAK,CAAC,EAAG,QAAO,EAAE,OAAO,SAAS,MAAM,iBAAiB,SAAS,4CAA4C;AAC3I,SAAO;AACT;AAGO,SAAS,cAAc,OAAqC;AACjE,MAAI,OAAO,UAAU,YAAY,UAAU,GAAI,QAAO,EAAE,OAAO,YAAY,MAAM,YAAY,SAAS,uBAAuB;AAC7H,MAAI,MAAM,SAAS,aAAc,QAAO,EAAE,OAAO,YAAY,MAAM,YAAY,SAAS,6BAA6B;AACrH,SAAO;AACT;AAOO,SAAS,iBAAiB,OAAgB,QAAqD;AACpG,MAAI,OAAO,UAAU,YAAY,UAAU,GAAI,QAAO,EAAE,OAAO,YAAY,MAAM,YAAY,SAAS,uBAAuB;AAC7H,QAAM,IAAI,SAAS,iBAAiB,MAAM,IAAI;AAC9C,QAAM,UAAU,iBAAiB,OAAO,CAAC;AACzC,MAAI,QAAQ,WAAW,EAAG,QAAO;AACjC,SAAO,EAAE,OAAO,YAAY,MAAM,QAAQ,CAAC,GAAG,SAAS,wBAAwB,SAAS,CAAC,EAAE;AAC7F;AAEO,SAAS,UAAU,OAAqC;AAC7D,MAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,GAAI,QAAO;AAClE,MAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,SAAU,QAAO,EAAE,OAAO,QAAQ,MAAM,YAAY,SAAS,eAAe,QAAQ,eAAe;AAC1J,SAAO;AACT;AAGO,IAAM,mBAAmB;AAEzB,SAAS,kBAAkB,OAAgB,WAAW,OAA4B;AACvF,QAAM,IAAI,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AACrD,MAAI,MAAM,GAAI,QAAO,WAAW,EAAE,OAAO,gBAAgB,MAAM,YAAY,SAAS,6BAA6B,IAAI;AACrH,MAAI,EAAE,SAAS,iBAAkB,QAAO,EAAE,OAAO,gBAAgB,MAAM,YAAY,SAAS,eAAe,gBAAgB,eAAe;AAC1I,SAAO;AACT;AAGO,SAAS,sBAAsB,OAAqC;AACzE,QAAM,IAAI,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AACrD,MAAI,MAAM,GAAI,QAAO,EAAE,OAAO,QAAQ,MAAM,YAAY,SAAS,iCAAiC;AAClG,MAAI,EAAE,SAAS,iBAAkB,QAAO,EAAE,OAAO,QAAQ,MAAM,YAAY,SAAS,eAAe,gBAAgB,eAAe;AAClI,SAAO;AACT;AAEO,SAAS,UAAU,OAAqC;AAC7D,QAAM,IAAI,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AACrD,MAAI,MAAM,GAAI,QAAO,EAAE,OAAO,QAAQ,MAAM,YAAY,SAAS,kBAAkB;AACnF,MAAI,EAAE,SAAS,GAAI,QAAO,EAAE,OAAO,QAAQ,MAAM,YAAY,SAAS,sBAAsB;AAC5F,SAAO;AACT;AAGO,SAAS,gBAAgB,QAAsD;AACpF,SAAO,OAAO,KAAK,CAAC,MAAM,MAAM,IAAI,KAAK;AAC3C;;;AC9NA,IAAAC,eAAoE;;;ACVpE,IAAM,IAAI,IAAI,YAAY;AAAA,EACxB;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EACpF;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AAAA,EAAY;AACtF,CAAC;AAEM,SAAS,OAAO,MAA8B;AACnD,QAAM,IAAI,IAAI,YAAY,CAAC,YAAY,YAAY,YAAY,YAAY,YAAY,YAAY,WAAY,UAAU,CAAC;AAC1H,QAAM,MAAM,KAAK;AACjB,QAAM,SAAS,IAAI,WAAa,MAAM,IAAI,MAAO,KAAM,CAAC;AACxD,SAAO,IAAI,IAAI;AACf,SAAO,GAAG,IAAI;AACd,QAAM,OAAO,IAAI,SAAS,OAAO,MAAM;AACvC,OAAK,UAAU,OAAO,SAAS,GAAG,KAAK,MAAM,MAAM,SAAU,CAAC;AAC9D,OAAK,UAAU,OAAO,SAAS,GAAI,OAAO,MAAO,CAAC;AAClD,QAAM,IAAI,IAAI,YAAY,EAAE;AAC5B,QAAM,OAAO,CAAC,GAAW,MAAe,MAAM,IAAM,KAAM,KAAK;AAC/D,WAAS,MAAM,GAAG,MAAM,OAAO,QAAQ,OAAO,IAAI;AAChD,aAAS,IAAI,GAAG,IAAI,IAAI,IAAK,GAAE,CAAC,IAAI,KAAK,UAAU,MAAM,IAAI,CAAC;AAC9D,aAAS,IAAI,IAAI,IAAI,IAAI,KAAK;AAC5B,YAAM,KAAK,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,IAAK,EAAE,IAAI,EAAE,MAAM;AACrE,YAAM,KAAK,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,IAAK,EAAE,IAAI,CAAC,MAAM;AACnE,QAAE,CAAC,IAAK,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,IAAI,CAAC,IAAI,OAAQ;AAAA,IAC9C;AACA,QAAI,CAAC,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,EAAE,IAAI;AAChC,aAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAC3B,YAAM,KAAM,MAAM,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,GAAG,EAAE,MAAO,IAAI,IAAM,CAAC,IAAI,KAAM,EAAE,CAAC,IAAI,EAAE,CAAC,MAAO;AACpG,YAAM,MAAO,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,EAAE,IAAI,KAAK,GAAG,EAAE,MAAO,IAAI,IAAM,IAAI,IAAM,IAAI,OAAS;AAC1F,WAAK;AAAG,UAAI;AAAG,UAAI;AAAG,UAAK,IAAI,OAAQ;AAAG,UAAI;AAAG,UAAI;AAAG,UAAI;AAAG,UAAK,KAAK,OAAQ;AAAA,IACnF;AACA,MAAE,CAAC,KAAK;AAAG,MAAE,CAAC,KAAK;AAAG,MAAE,CAAC,KAAK;AAAG,MAAE,CAAC,KAAK;AAAG,MAAE,CAAC,KAAK;AAAG,MAAE,CAAC,KAAK;AAAG,MAAE,CAAC,KAAK;AAAG,MAAE,CAAC,KAAK;AAAA,EACvF;AACA,QAAMC,OAAM,IAAI,WAAW,EAAE;AAC7B,QAAM,KAAK,IAAI,SAASA,KAAI,MAAM;AAClC,WAAS,IAAI,GAAG,IAAI,GAAG,IAAK,IAAG,UAAU,IAAI,GAAG,EAAE,CAAC,CAAC;AACpD,SAAOA;AACT;;;ACvCO,IAAM,aAAa;AAMnB,IAAM,eAAe;AAAA,EAAC;AAAA,EAAiB;AAAA,EAAoB;AAAA,EAAwB;AAAA,EAAiB;AAAA,EACzG;AAAA,EAAqB;AAAA,EAAwB;AAAA,EAAmB;AAAA,EAAmB;AAAkB;AAGhG,SAAS,gBAAgB,aAAmE;AACjG,QAAM,MAAM,aAAa,OAAO,QAAM,cAAc,CAAC,KAAK,QAAQ,EAAE;AACpE,MAAI,IAAI,SAAS,GAAG;AAClB,UAAM,IAAI,kBAAkB,2CAA2C,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,WAAW,IAAI,OAAO,KAAK,qBAC5G,IAAI,WAAW,IAAI,OAAO,MAAM,uDAAuD;AAAA,EACrG;AACF;AACA,IAAM,UAAU;AAChB,IAAM,MAAM,IAAI,YAAY;AAC5B,IAAM,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC;AAW7C,SAAS,WAAW,GAAuB;AAChD,MAAI,MAAM;AACV,aAAW,KAAK,EAAG,QAAO,OAAO,aAAa,CAAC;AAC/C,SAAO,KAAK,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC5E;AAGO,SAAS,WAAW,GAA8B;AACvD,MAAI,CAAC,mBAAmB,KAAK,CAAC,KAAK,EAAE,SAAS,MAAM,EAAG,QAAO;AAC9D,QAAM,MAAM,KAAK,EAAE,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG,IAAI,IAAI,QAAQ,IAAK,EAAE,SAAS,KAAM,CAAC,CAAC;AAC/F,QAAMC,OAAM,WAAW,KAAK,KAAK,OAAK,EAAE,WAAW,CAAC,CAAC;AACrD,SAAO,WAAWA,IAAG,MAAM,IAAIA,OAAM;AACvC;AAEA,SAAS,SAAS,MAAsB;AACtC,SAAO,WAAW,OAAO,IAAI,OAAO,IAAI,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC;AACxD;AAEA,SAAS,eAAe,GAAoB;AAC1C,SAAO,iBAAiB,KAAK,CAAC;AAChC;AAOO,SAAS,YAAY,GAAoB;AAC9C,MAAI,MAAM,MAAM,CAAC,eAAe,CAAC,EAAG,QAAO;AAC3C,MAAI;AACJ,MAAI;AAAE,QAAI,IAAI,IAAI,CAAC;AAAA,EAAE,QAAQ;AAAE,WAAO;AAAA,EAAM;AAC5C,MAAI,EAAE,WAAW,EAAG,QAAO;AAC3B,MAAI,cAAc,KAAK,EAAE,IAAI,EAAG,QAAO;AACvC,MAAI,EAAE,aAAa,SAAU,QAAO;AACpC,SAAO,EAAE,aAAa,WAAW,CAAC,aAAa,aAAa,OAAO,EAAE,SAAS,EAAE,QAAQ;AAC1F;AAEA,IAAM,OAAO,CAAC,QAAyB,YAA2B;AAChE,QAAM,IAAI,eAAe,QAAQ,OAAO;AAC1C;AAEA,IAAM,YAAY;AAGX,SAAS,SAAS,MAAyB;AAChD,QAAM,IAAI,KAAK,QAAQ,4BAA4B,EAAE;AACrD,MAAI,MAAM,MAAM,EAAE,SAAS,WAAW,CAAC,eAAe,CAAC,EAAG,MAAK,cAAc,SAAS;AACtF,QAAM,OAAO,EAAE,MAAM,KAAK,CAAC,EAAE,CAAC;AAC9B,MAAI,SAAS,YAAY;AACvB,QAAI,iBAAiB,KAAK,IAAI,EAAG,MAAK,eAAe,gCAAgC,IAAI,0BAA0B;AACnH,SAAK,cAAc,SAAS;AAAA,EAC9B;AACA,QAAM,QAAQ,EAAE,MAAM,GAAG;AACzB,MAAI,MAAM,WAAW,KAAK,MAAM,KAAK,OAAK,MAAM,EAAE,EAAG,MAAK,cAAc,SAAS;AACjF,MAAI,CAAC,kBAAkB,SAAS,MAAM,MAAM,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG;AACvE,SAAK,gBAAgB,yFAAyF;AAAA,EAChH;AACA,QAAM,cAAc,WAAW,MAAM,CAAC,CAAC;AACvC,MAAI,SAAS;AACb,MAAI;AAAE,aAAS,cAAc,IAAI,OAAO,WAAW,IAAI;AAAA,EAAG,QAAQ;AAAE,aAAS;AAAA,EAAG;AAChF,MAAI,CAAC,YAAY,MAAM,EAAG,MAAK,cAAc,uCAAuC;AACpF,QAAM,cAAc,WAAW,MAAM,CAAC,CAAC;AACvC,QAAM,WAAW,cAAc,OAAO,aAAa,GAAG,WAAW,IAAI;AACrE,MAAI,CAAC,0BAA0B,KAAK,QAAQ,EAAG,MAAK,cAAc,+BAA+B;AACjG,QAAM,SAAS,WAAW,MAAM,CAAC,CAAC;AAClC,MAAI,MAAM,CAAC,EAAE,WAAW,MAAM,CAAC,UAAU,OAAO,WAAW,GAAI,MAAK,cAAc,kCAAmC;AACrH,SAAO,EAAE,QAAQ,UAAU,QAAQ,MAAM,CAAC,EAAE;AAC9C;AAGO,SAAS,WAAW,QAAgB,UAAkB,QAAwB;AACnF,QAAM,OAAO,GAAG,UAAU,IAAI,WAAW,IAAI,OAAO,MAAM,CAAC,CAAC,IAAI,WAAW,IAAI,OAAO,QAAQ,CAAC,CAAC,IAAI,MAAM;AAC1G,QAAM,MAAM,GAAG,IAAI,IAAI,SAAS,IAAI,CAAC;AACrC,WAAS,GAAG;AACZ,SAAO;AACT;AAEA,SAAS,kBAAkB,GAAW,GAAoB;AACxD,MAAI,EAAE,WAAW,EAAE,OAAQ,QAAO;AAClC,MAAI,IAAI;AACR,WAAS,IAAI,GAAG,IAAI,EAAE,QAAQ,IAAK,MAAK,EAAE,WAAW,CAAC,IAAI,EAAE,WAAW,CAAC;AACxE,SAAO,MAAM;AACf;;;AFnFO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EAC5C,YAAqB,QAAgB;AACnC,UAAM,oCAAoC,MAAM,EAAE;AAD/B;AAEnB,SAAK,OAAO;AAAA,EACd;AAAA,EAHqB;AAIvB;AAmCO,SAAS,kBAAkB,MAAoB,KAAK,KAAkB;AAC3E,QAAM,OAAO,oBAAI,IAAoB;AACrC,SAAO;AAAA,IACL,MAAM,MAAM,KAAK,OAAO;AACtB,YAAM,IAAI,IAAI;AACd,UAAI,KAAK,OAAO;AAAQ,mBAAW,CAAC,GAAG,CAAC,KAAK,KAAM,KAAI,KAAK,EAAG,MAAK,OAAO,CAAC;AAAA;AAC5E,YAAM,OAAO,KAAK,IAAI,GAAG;AACzB,UAAI,SAAS,UAAa,OAAO,EAAG,QAAO;AAC3C,WAAK,IAAI,KAAK,MAAM,QAAQ,CAAC;AAC7B,aAAO;AAAA,IACT;AAAA,EACF;AACF;AAEA,IAAM,OAAO,oBAAI,IAA6B;AAE9C,SAAS,OAAO,QAAiC;AAC/C,MAAI,MAAM,KAAK,IAAI,MAAM;AACzB,MAAI,QAAQ,QAAW;AACrB,cAAM,iCAAmB,IAAI,IAAI,GAAG,MAAM,wBAAwB,GAAG,EAAE,kBAAkB,IAAO,CAAC;AACjG,SAAK,IAAI,QAAQ,GAAG;AAAA,EACtB;AACA,SAAO;AACT;AAEA,IAAM,MAAM,CAAC,MAAgB,OAAO,MAAM,YAAY,MAAM,KAAK,IAAI;AAOrE,eAAsB,cAAc,SAAkB,UAAgC,CAAC,GAAyB;AAE9G,QAAM,MAAM,OAAO,YAAY,cAAc,QAAQ,KAAK,aAAa;AACvE,QAAMC,OAAM,MAAM,SAAS,GAAG,EAAE,SAAS,OAAO,YAAY,cAAc,QAAQ,KAAK,gBAAgB;AACvG,QAAM,SAAS,uBAAuB,QAAQ,UAAUA,QAAO,EAAE;AACjE,MAAI,WAAW,GAAI,OAAM,IAAI,mBAAmB,mCAAmC;AACnF,QAAM,YAAY,QAAQ,QAAQ,IAAI,wBAAwB;AAC9D,MAAI,CAAC,UAAW,OAAM,IAAI,mBAAmB,cAAc;AAG3D,QAAM,MAAM,IAAI,WAAW,MAAM,QAAQ,YAAY,CAAC;AACtD,QAAM,WAAW,QAAQ,OAAO,QAAQ,IAAI,MAAM,GAAG,EAAE,CAAC;AAExD,MAAI;AACJ,MAAI;AACF,UAAM,WAAW,UAAM,wBAAU,WAAW,QAAQ,QAAQ,OAAO,MAAM,GAAG;AAAA,MAC1E,YAAY,CAAC,OAAO;AAAA,MACpB;AAAA,MACA,KAAK;AAAA,MACL,gBAAgB,CAAC,OAAO,OAAO,OAAO,aAAa;AAAA,MACnD,aAAa,QAAQ;AAAA,MACrB,gBAAgB;AAAA,IAClB,CAAC;AACD,aAAS,SAAS;AAAA,EACpB,SAAS,KAAK;AACZ,UAAM,IAAI,mBAAmB,eAAe,QAAQ,IAAI,UAAU,eAAe;AAAA,EACnF;AAGA,MAAI,OAAO,QAAQ,UAAU,OAAO,eAAe,QAAQ;AACzD,UAAM,IAAI,mBAAmB,8BAA8B;AAAA,EAC7D;AAGA,QAAM,MAAM,KAAK,OAAO,QAAQ,OAAO,oBAAI,KAAK,GAAG,QAAQ,IAAI,GAAI;AACnE,MAAI,OAAO,OAAO,QAAQ,YAAY,OAAO,MAAM,MAAM,GAAI,OAAM,IAAI,mBAAmB,sBAAsB;AAEhH,QAAM,SAAS,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,WAAW,GAAG,CAAC;AACxE,MAAI,MAAM;AACV,aAAW,KAAK,OAAQ,QAAO,OAAO,aAAa,CAAC;AACpD,QAAM,OAAO,KAAK,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAChF,MAAI,SAAS,OAAO,YAAa,OAAM,IAAI,mBAAmB,yCAAyC;AAEvG,MAAI;AACJ,MAAI;AACF,WAAO,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,GAAG,CAAC;AAAA,EACjD,QAAQ;AACN,UAAM,IAAI,mBAAmB,sBAAsB;AAAA,EACrD;AAEA,MAAI,KAAK,OAAO,OAAO,OAAO,KAAK,UAAU,OAAO,OAAO,KAAK,cAAc,OAAO,KAAK;AACxF,UAAM,IAAI,mBAAmB,qCAAqC;AAAA,EACpE;AACA,MAAI,QAAQ,QAAQ;AAElB,UAAM,MAAM,OAAO,OAAO,QAAQ,WAAW,OAAO,MAAM,MAAM;AAChE,QAAI,CAAE,MAAM,QAAQ,OAAO,MAAM,GAAG,OAAO,OAAO,GAAG,CAAC,IAAI,OAAO,OAAO,GAAG,CAAC,IAAI,IAAI,KAAK,MAAM,GAAI,CAAC,GAAI;AACtG,YAAM,IAAI,mBAAmB,iCAAiC;AAAA,IAChE;AAAA,EACF;AACA,QAAM,QAAS,KAAK,QAAQ,CAAC;AAC7B,SAAO;AAAA,IACL,IAAI,OAAO,KAAK,EAAE;AAAA,IAClB,MAAM,OAAO,KAAK,KAAK;AAAA,IACvB,UAAU,OAAO,KAAK,SAAS;AAAA,IAC/B,WAAW,OAAO,MAAM,cAAc,KAAK,cAAc,EAAE;AAAA,IAC3D,GAAI,IAAI,MAAM,OAAO,IAAI,EAAE,QAAQ,MAAM,QAAQ,IAAI,CAAC;AAAA,IACtD,GAAI,IAAI,MAAM,QAAQ,IAAI,EAAE,SAAS,MAAM,SAAS,IAAI,CAAC;AAAA,IACzD,MAAO,MAAM,QAAQ,CAAC;AAAA,EACxB;AACF;;;AG5KO,IAAM,mBAAmB;AAkBzB,IAAM,iBAAsC,oBAAI,IAAI;AAAA,EACzD;AAAA,EAAkB;AAAA,EAAgB;AAAA,EAAqB;AAAA,EAAsB;AAAA,EAAqB;AAAA,EAClG;AAAA,EAAkB;AAAA,EAAsB;AAAA,EAAuB;AAAA,EAAuB;AAAA,EACtF;AAAA,EAA0B;AAAA,EAA2B;AAAA,EAAiC;AAAA,EACtF;AAAA,EAAsB;AACxB,CAAC;AAGM,SAAS,OAAO,OAAe,QAAuC;AAC3E,UAAQ,QAAQ;AAAA,IACd,KAAK;AAAa,aAAO;AAAA,IACzB,KAAK;AAAgB,aAAO;AAAA,IAC5B,KAAK;AAAyB,aAAO;AAAA;AAAA,IAErC,KAAK;AAAQ,aAAO,MAAM,WAAW,cAAc,IAAI,QAAQ;AAAA;AAAA,IAE/D,KAAK;AAAW,aAAO,UAAU,kCAAkC,YAAY;AAAA,IAC/E;AAAS,aAAO;AAAA,EAClB;AACF;AAQA,eAAsB,OAAO,KAAe,OAAsB,YAAY,OAA0B;AACtG,QAAM,UAAU,IAAI,QAAQ;AAC5B,MAAI,QAAQ,QAAQ,CAAC,OAAO,SAAS;AACnC,QAAI,SAAS,aAAc,SAAQ,IAAI,MAAM,KAAK;AAAA,EACpD,CAAC;AACD,aAAW,UAAU,IAAI,QAAQ,aAAa,EAAG,SAAQ,OAAO,cAAc,MAAM;AACpF,UAAQ,IAAI,mBAAmB,gBAAgB;AAC/C,MAAI,CAAC,aAAa,EAAE,QAAQ,IAAI,eAAe,KAAK,IAAI,SAAS,UAAU,EAAG,SAAQ,IAAI,iBAAiB,UAAU;AAErH,MAAI,OAAwB,IAAI;AAChC,MAAI,UAAU,QAAQ,eAAe,IAAI,KAAK,KAAK,IAAI,OAAO,QAAQ,IAAI,cAAc,KAAK,IAAI,WAAW,kBAAkB,GAAG;AAC/H,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,WAAO;AACP,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,IAAI;AAC9B,YAAM,OAAO,OAAO,OAAO,QAAQ,MAAM;AACzC,UAAI,WAAW,QAAQ,SAAS,OAAW,QAAO,KAAK,UAAU,EAAE,GAAG,QAAQ,KAAK,CAAC;AAAA,IACtF,QAAQ;AAAA,IAER;AACA,YAAQ,OAAO,gBAAgB;AAAA,EACjC;AACA,SAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,IAAI,QAAQ,YAAY,IAAI,YAAY,QAAQ,CAAC;AACvF;;;AC7DA,IAAAC,eAAqH;;;ACLrH,IAAM,QAAQ,oBAAI,IAAI,CAAC,KAAK,KAAM,MAAM,IAAI,CAAC;AAC7C,IAAM,QAAQ,MAAM;AAEb,SAAS,YAAY,MAAc,iBAAoC,CAAC,GAAY;AACzF,MAAI,IAAI;AACR,MAAI,QAAQ;AACZ,QAAMC,QAAO,CAAC,SAAwB;AACpC,UAAM,IAAI,YAAY,GAAG,IAAI,OAAO,CAAC,EAAE;AAAA,EACzC;AACA,QAAM,OAAO,MAAM;AACjB,WAAO,IAAI,KAAK,UAAU,MAAM,IAAI,KAAK,CAAC,CAAC,EAAG;AAAA,EAChD;AACA,QAAM,QAAQ,CAAC,UAAU,UAAmB;AAC1C,SAAK;AACL,UAAM,IAAI,KAAK,CAAC;AAChB,QAAI,MAAM,IAAK,QAAO,OAAO;AAC7B,QAAI,MAAM,IAAK,QAAO,MAAM;AAC5B,QAAI,MAAM,IAAK,QAAO,OAAO;AAC7B,QAAI,MAAM,OAAQ,KAAK,OAAO,KAAK,IAAM,QAAO,OAAO,OAAO;AAC9D,eAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,QAAQ,IAAI,GAAG,CAAC,SAAS,KAAK,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAY;AACnF,UAAI,KAAK,WAAW,MAAM,CAAC,GAAG;AAC5B,aAAK,KAAK;AACV,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAOA,MAAK,sBAAsB;AAAA,EACpC;AACA,QAAM,SAAS,MAAc;AAC3B,UAAM,QAAQ;AACd;AACA,WAAO,IAAI,KAAK,UAAU,KAAK,CAAC,MAAM,IAAK,MAAK,KAAK,CAAC,MAAM,OAAO,IAAI;AACvE,QAAI,KAAK,CAAC,MAAM,IAAK,CAAAA,MAAK,qBAAqB;AAC/C;AACA,WAAO,KAAK,MAAM,KAAK,MAAM,OAAO,CAAC,CAAC;AAAA,EACxC;AACA,QAAM,SAAS,CAAC,YAA6B;AAC3C,UAAM,IAAI,yCAAyC,KAAK,KAAK,MAAM,CAAC,CAAC;AACrE,QAAI,CAAC,EAAG,QAAOA,MAAK,YAAY;AAChC,SAAK,EAAE,CAAC,EAAE;AAEV,QAAI,YAAY,EAAE,CAAC,MAAM,UAAa,EAAE,CAAC,MAAM,QAAY,QAAO,OAAO;AACzE,QAAI,EAAE,CAAC,MAAM,UAAa,EAAE,CAAC,MAAM,QAAW;AAC5C,YAAM,MAAM,OAAO,EAAE,CAAC,CAAC;AACvB,UAAI,MAAM,SAAS,MAAM,CAAC,MAAO,QAAO,OAAO;AAAA,IACjD;AACA,WAAO,OAAO,EAAE,CAAC,CAAC;AAAA,EACpB;AACA,QAAM,QAAQ,MAAiB;AAC7B;AACA;AACA,UAAMC,OAAiB,CAAC;AACxB,SAAK;AACL,QAAI,KAAK,CAAC,MAAM,KAAK;AACnB;AACA;AACA,aAAOA;AAAA,IACT;AACA,eAAS;AACP,MAAAA,KAAI,KAAK,MAAM,CAAC;AAChB,WAAK;AACL,UAAI,KAAK,CAAC,MAAM,IAAK;AAAA,eACZ,KAAK,CAAC,MAAM,KAAK;AACxB;AACA;AACA,eAAOA;AAAA,MACT,MAAO,CAAAD,MAAK,iBAAiB;AAAA,IAC/B;AAAA,EACF;AACA,QAAM,SAAS,MAA+B;AAC5C;AACA;AACA,UAAMC,OAA+B,CAAC;AACtC,UAAM,OAAO,oBAAI,IAAY;AAC7B,SAAK;AACL,QAAI,KAAK,CAAC,MAAM,KAAK;AACnB;AACA;AACA,aAAOA;AAAA,IACT;AACA,eAAS;AACP,WAAK;AACL,UAAI,KAAK,CAAC,MAAM,IAAK,CAAAD,MAAK,iBAAiB;AAC3C,YAAM,OAAO,OAAO;AACpB,UAAI,KAAK,IAAI,IAAI,EAAG,CAAAA,MAAK,iBAAiB,KAAK,UAAU,IAAI,CAAC,EAAE;AAChE,WAAK,IAAI,IAAI;AACb,WAAK;AACL,UAAI,KAAK,CAAC,MAAM,IAAK,CAAAA,MAAK,YAAY;AACtC;AACA,aAAO,eAAeC,MAAK,MAAM,EAAE,OAAO,MAAM,UAAU,KAAK,eAAe,SAAS,IAAI,CAAC,GAAG,YAAY,MAAM,UAAU,MAAM,cAAc,KAAK,CAAC;AACrJ,WAAK;AACL,UAAI,KAAK,CAAC,MAAM,IAAK;AAAA,eACZ,KAAK,CAAC,MAAM,KAAK;AACxB;AACA;AACA,eAAOA;AAAA,MACT,MAAO,CAAAD,MAAK,iBAAiB;AAAA,IAC/B;AAAA,EACF;AACA,QAAM,SAAS,MAAM;AACrB,OAAK;AACL,MAAI,IAAI,KAAK,OAAQ,CAAAA,MAAK,qBAAqB;AAC/C,SAAO;AACT;;;AC1GA,IAAM,OAAO,oBAAI,IAAY;AAGtB,SAAS,WAAW,MAAc,SAAuB;AAC9D,MAAI,KAAK,IAAI,IAAI,EAAG;AACpB,OAAK,IAAI,IAAI;AACb,QAAM,UAAU,mBAAmB,IAAI,qCAAqC,OAAO;AAEnF,MAAI,OAAO,YAAY,eAAe,OAAO,QAAQ,gBAAgB,YAAY;AAC/E,YAAQ,YAAY,SAAS,EAAE,MAAM,sBAAsB,MAAM,oBAAoB,CAAC;AAAA,EACxF,OAAO;AACL,YAAQ,KAAK,OAAO;AAAA,EACtB;AACF;;;ACRA,IAAME,OAAM,IAAI,YAAY;AAC5B,IAAM,gBAAgB,WAAW,KAAK,CAAC,IAAM,IAAM,GAAM,GAAM,GAAM,IAAM,GAAM,GAAM,GAAM,IAAM,KAAM,KAAM,GAAM,IAAM,GAAM,EAAI,CAAC;AAE/H,IAAMC,kBAAiB;AAS9B,eAAe,QAAQ,QAAgB,SAAiD;AACtF,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAOD,KAAI,OAAO,MAAM,GAAG,QAAQ,OAAO,CAAC,YAAY,CAAC;AAClG,SAAO,IAAI,WAAW,MAAM,OAAO,OAAO;AAAA,IACxC,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,IAAI,WAAW,CAAC,GAAG,MAAMA,KAAI,OAAO,QAAQ,OAAO,KAAK,EAAE;AAAA,IAAG;AAAA,IAAK;AAAA,EAAG,CAAC;AACjH;AAEA,IAAM,SAAS,CAAC,SAAmB,YAAiD,QAAQ,IAAI,QAAQ,IAAI,OAAK,QAAQ,GAAG,OAAO,CAAC,CAAC;AAerI,eAAe,OAAO,QAAqC;AACzD,QAAM,MAAM,MAAM,OAAO,OAAO,UAAU,OAAOA,KAAI,OAAO,MAAM,GAAG,QAAQ,OAAO,CAAC,YAAY,CAAC;AAClG,SAAO,IAAI,WAAW,MAAM,OAAO,OAAO;AAAA,IACxC,EAAE,MAAM,QAAQ,MAAM,WAAW,MAAM,IAAI,WAAW,CAAC,GAAG,MAAMA,KAAI,OAAO,gBAAgB,EAAE;AAAA,IAAG;AAAA,IAAK;AAAA,EAAG,CAAC;AAC7G;AAGA,eAAsB,WAAW,GAA4B;AAC3D,SAAO,WAAW,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,WAAWA,KAAI,OAAO,qCAAqC,CAAC,IAAI,CAAC,CAAC,CAAC;AACjI;AAEA,eAAe,SAAS,QAAiC;AACvD,QAAM,OAAO,MAAM,OAAO,MAAM;AAChC,QAAM,MAAM,IAAI,WAAW,cAAc,SAAS,EAAE;AACpD,MAAI,IAAI,aAAa;AACrB,MAAI,IAAI,MAAM,cAAc,MAAM;AAElC,QAAM,WAAW,MAAM,OAAO,OAAO,UAAU,SAAS,KAAK,EAAE,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;AAChG,QAAM,EAAE,EAAE,IAAI,MAAM,OAAO,OAAO,UAAU,OAAO,QAAQ;AAC3D,QAAM,UAAU,MAAM,OAAO,OAAO,UAAU,SAAS,KAAK,EAAE,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC;AAChG,MAAI,KAAK,CAAC;AACV,OAAK,KAAK,CAAC;AACX,QAAM,YAAuB,EAAE,KAAK,OAAO,KAAK,WAAW,EAAe;AAC1E,QAAM,MAAM,MAAM,WAAW,UAAU,CAAC;AACxC,QAAM,SAAS,WAAWA,KAAI,OAAO,KAAK,UAAU,EAAE,KAAK,SAAS,IAAI,CAAC,CAAC,CAAC;AAC3E,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,MAAM,UAAU,UAAU,eAAe,MAAM,OAAO,WAAW,GAAG,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAAG;AACvG,YAAM,SAAS,EAAE,KAAK,UAAU,KAAK,UAAU,KAAK,eAAe,KAAK,KAAK,KAAK,MAAM,IAAI;AAC5F,YAAM,QAAQ,GAAG,MAAM,IAAI,WAAWA,KAAI,OAAO,KAAK,UAAU,MAAM,CAAC,CAAC,CAAC;AACzE,YAAM,MAAM,IAAI,WAAW,MAAM,OAAO,OAAO,KAAK,EAAE,MAAM,UAAU,GAAG,SAASA,KAAI,OAAO,KAAK,CAAC,CAAC;AACpG,aAAO,GAAG,KAAK,IAAI,WAAW,GAAG,CAAC;AAAA,IACpC;AAAA,EACF;AACF;AAGO,SAAS,cAAc,KAAgB,UAAkC;AAC9E,QAAM,QAAQ,YAAY,SAAS,WAAW,IAAI,SAAS,WAAW;AACtE,QAAM,UAAU,QAAQ,CAAC,IAAI,QAAQ,MAAM,MAAM,IAAI,CAAC,IAAI,MAAM;AAChE,SAAO;AAAA,IACL,QAAQ,OAAO,SAAS,QAAQ;AAAA,IAChC,MAAM,OAAO,SAAS,MAAM;AAAA,IAC5B,QAAQ,SAAS,IAAI,MAAM;AAAA,EAC7B;AACF;;;ACxCO,IAAM,gBAAgB;AAE7B,IAAM,QAAQ,CAAC,OAAe,IAAI,QAAc,CAACE,aAAY;AAC3D,QAAM,IAAI,WAAWA,UAAS,EAAE;AAC/B,EAAC,EAA6B,QAAQ;AACzC,CAAC;AAEM,SAAS,eAAe,GAAmC;AAChE,QAAM,UAAU,EAAE,SAAS,WAAW;AACtC,QAAM,MAAM,EAAE,OAAO,KAAK;AAC1B,QAAM,QAAQ,EAAE,WAAW,CAAC,KAAM,KAAM,KAAM,KAAQ,GAAM;AAC5D,MAAI;AACJ,MAAI;AACJ,MAAI,YAAY;AAChB,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI,SAAS;AACb,MAAI;AACJ,MAAI;AACJ,QAAM,MAAM,OAAO,OAAO,EAAE,QAAQ,aAAa,EAAE,IAAI,IAAI,EAAE,QAAQ;AAErE,iBAAe,MAAkC;AAC/C,UAAM,UAAkC,EAAE,eAAe,UAAU,MAAM,EAAE,MAAM,CAAC,IAAI,QAAQ,mBAAmB;AACjH,QAAI,QAAQ,KAAM,SAAQ,eAAe,IAAI;AAC7C,UAAM,MAAM,MAAM,QAAQ,GAAG,EAAE,MAAM,oBAAoB,EAAE,QAAQ,CAAC;AACpE,QAAI,IAAI,WAAW,OAAO,KAAM,QAAO;AACvC,QAAI,IAAI,WAAW,IAAK,OAAM,OAAO,OAAO,IAAI,MAAM,iBAAiB,GAAG,EAAE,MAAM,kBAAkB,CAAC;AACrG,QAAI,CAAC,IAAI,GAAI,OAAM,IAAI,eAAe,KAAK,eAAe,mBAAmB,IAAI,MAAM,sBAAsB;AAC7G,UAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,QAAI,CAAC,MAAM,QAAQ,OAAO,KAAK,KAAK,cAAc,SAAU,OAAM,IAAI,eAAe,KAAK,eAAe,qDAAsD;AAC/J,WAAO,IAAI,QAAQ,IAAI,MAAM,KAAK;AAClC,WAAO,KAAK;AAAA,EACd;AAGA,WAAS,UAAU,GAAwC;AACzD,UAAM,OAAQ,GAAgC;AAC9C,QAAI,SAAS,oBAAoB,SAAS,kBAAmB,QAAO;AACpE,UAAM,UAAU,SAAS,oBACrB,kEAAkE,IAAI,CAAC,+CACvE,8CAA8C,IAAI,CAAC;AACvD,WAAO,IAAI,eAAe,KAAK,iBAAiB,OAAO;AAAA,EACzD;AAEA,WAAS,OAAO,KAAqC;AACnD,QAAI,YAAY,OAAW,GAAE,MAAM,IAAI,QAAQ,QAAQ,sBAAsB,EAAE,CAAC;AAChF,cAAU;AAEV,gBAAY,IAAI;AAChB,WAAO;AAAA,EACT;AAEA,iBAAe,cAAiC;AAC9C,aAAS,UAAU,KAAK,WAAW;AACjC,mBAAa,IAAI,QAAiB,CAAAA,aAAW;AAAE,uBAAeA;AAAA,MAAQ,CAAC;AACvE,UAAI;AACF,cAAM,MAAM,MAAM,IAAI;AACtB,YAAI,QAAQ,OAAQ,QAAO;AAC3B,oBAAY,IAAI;AAChB,iBAAS;AACT,uBAAe,IAAI;AACnB,eAAO;AAAA,MACT,SAAS,GAAG;AACV,cAAM,IAAI,UAAU,CAAC;AACrB,iBAAS;AACT,uBAAe,KAAK;AACpB,YAAI,EAAG,OAAM,OAAO,CAAC;AACrB,cAAM,MAAM,MAAM,KAAK,IAAI,SAAS,MAAM,SAAS,CAAC,CAAC,CAAC;AAAA,MACxD;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,UAAyB;AACtC,gBAAY,IAAI;AAChB,QAAI;AACF,YAAM,MAAM,MAAM,IAAI;AACtB,UAAI,QAAQ,OAAQ,QAAO;AAC3B,gBAAU;AAAA,IACZ,SAAS,GAAG;AACV,YAAM,IAAI,UAAU,CAAC;AACrB,UAAI,EAAG,QAAO,CAAC;AAAA,IAEjB;AAAA,EACF;AAEA,SAAO;AAAA,IACL,QAA2B;AACzB,WAAK,QAAQ,YAAY,IAAI,IAAI,aAAa,eAAe;AAC3D,uBAAe,QAAQ,EAAE,QAAQ,MAAM;AAAE,uBAAa;AAAA,QAAU,CAAC;AAAA,MACnE;AACA,UAAI,QAAS,QAAO,QAAQ,OAAO,OAAO;AAC1C,UAAI,KAAM,QAAO,QAAQ,QAAQ,IAAI;AACrC,gBAAU,YAAY;AACtB,aAAO;AAAA,IACT;AAAA,IACA,SAAS,MAAM;AAAA,IACf,SAAS,MAAO,eAAe,QAAQ,EAAE,QAAQ,MAAM;AAAE,mBAAa;AAAA,IAAU,CAAC;AAAA,IACjF,SAAS,MAAM,SAAS,UAAa,UAAU,YAAY;AAAA,IAC3D,SAAS,MAAO,SAAS,SAAY,QAAQ,QAAQ,IAAI,IAAI,cAAc,QAAQ,QAAQ,KAAK;AAAA,EAClG;AACF;;;AJxFO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EAChD,YAAY,QAAgB;AAC1B,UAAM,kDAAkD,MAAM,EAAE;AAChE,SAAK,OAAO;AAAA,EACd;AACF;AAEO,IAAM,mBAAN,cAA+B,MAAM;AAAA,EAC1C,YAAqB,QAA+B,QAAiB;AACnE,UAAM,kCAAkC,MAAM,GAAG,SAAS,KAAK,MAAM,MAAM,EAAE,EAAE;AAD5D;AAA+B;AAElD,SAAK,OAAO;AAAA,EACd;AAAA,EAHqB;AAAA,EAA+B;AAItD;AA8CA,IAAM,kBAAkB;AACxB,IAAM,OAAO;AACb,IAAM,WAAW;AACjB,IAAM,UAAU;AAEhB,IAAM,iBAAiB,KAAK;AAC5B,IAAM,kBAAkB;AACxB,IAAM,mBAAmB;AACzB,IAAM,qBAAqB;AAC3B,IAAM,iBAAiB;AACvB,IAAM,iBAAiB;AAWhB,SAAS,WAAW,QAAgB,YAA0B,OAAwB;AAC3F,MAAI;AACJ,MAAI,YAAY;AAChB,MAAI,YAAY;AAChB,MAAI;AAEJ,QAAM,OAAO,YAA2B;AACtC,gBAAY,KAAK,IAAI;AACrB,QAAI;AACF,YAAM,MAAM,MAAM,UAAU,GAAG,MAAM,0BAA0B,EAAE,UAAU,UAAU,QAAQ,YAAY,QAAQ,eAAe,GAAG,SAAS,EAAE,QAAQ,mBAAmB,EAAE,CAAC;AAC5K,UAAI,IAAI,WAAW,IAAK,OAAM,IAAI,MAAM,YAAY,IAAI,MAAM,EAAE;AAChE,YAAM,QAAQ,MAAM,WAAW,KAAK,cAAc;AAClD,YAAM,SAAS,KAAK,MAAM,IAAI,YAAY,EAAE,OAAO,KAAK,CAAC;AACzD,UAAI,CAAC,UAAU,CAAC,MAAM,QAAQ,OAAO,IAAI,EAAG,OAAM,IAAI,MAAM,eAAe;AAE3E,YAAM,OAAO,oBAAI,IAAY;AAC7B,iBAAW,KAAK,OAAO,MAAM;AAC3B,cAAM,SAAS,GAAG,QAAQ,UAAU,EAAE,QAAQ,UAAa,EAAE,QAAQ,WAAW,EAAE,QAAQ,UAAa,EAAE,QAAQ;AACjH,YAAI,CAAC,UAAU,OAAO,EAAE,QAAQ,SAAU;AAC1C,YAAI,KAAK,IAAI,EAAE,GAAG,EAAG,OAAM,IAAI,MAAM,iCAAiC,KAAK,UAAU,EAAE,GAAG,CAAC,EAAE;AAC7F,aAAK,IAAI,EAAE,GAAG;AAAA,MAChB;AACA,gBAAM,gCAAkB,MAAM;AAC9B,YAAM,SAAS,gBAAgB,KAAK,IAAI,QAAQ,IAAI,eAAe,KAAK,EAAE;AAE1E,YAAM,MAAM,KAAK,IAAI,gBAAgB,KAAK,IAAI,SAAS,OAAO,OAAO,CAAC,CAAC,IAAI,oBAAoB,cAAc,CAAC;AAC9G,kBAAY,KAAK,IAAI,IAAI,MAAM;AAAA,IACjC,SAAS,KAAK;AAIZ,UAAI,QAAQ,OAAW,OAAM,IAAI,uBAAuB,eAAe,QAAQ,IAAI,UAAU,aAAa;AAC1G,kBAAY,KAAK,IAAI,WAAW,KAAK,IAAI,IAAI,gBAAgB;AAAA,IAC/D;AAAA,EACF;AACA,QAAM,UAAU,MAAqB;AACnC,iBAAa,KAAK,EAAE,QAAQ,MAAM;AAChC,iBAAW;AAAA,IACb,CAAC;AACD,WAAO;AAAA,EACT;AAEA,SAAO,OAAO,QAAQ,UAAU;AAC9B,QAAI,QAAQ,UAAa,KAAK,IAAI,KAAK,UAAW,OAAM,QAAQ;AAChE,QAAI;AACF,aAAO,MAAM,IAAK,QAAQ,KAAK;AAAA,IACjC,SAAS,KAAK;AACZ,YAAM,UAAW,KAAmC,SAAS;AAC7D,UAAI,WAAW,KAAK,IAAI,IAAI,aAAa,kBAAkB;AACzD,cAAM,QAAQ;AACd,eAAO,IAAK,QAAQ,KAAK;AAAA,MAC3B;AACA,YAAM;AAAA,IACR;AAAA,EACF;AACF;AAEA,eAAe,WAAW,KAAe,KAAkC;AACzE,QAAM,SAAS,IAAI,MAAM,UAAU;AACnC,MAAI,CAAC,OAAQ,QAAO,IAAI,WAAW;AACnC,QAAM,SAAuB,CAAC;AAC9B,MAAI,OAAO;AACX,aAAS;AACP,UAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,KAAK;AAC1C,QAAI,KAAM;AACV,YAAQ,MAAM;AACd,QAAI,OAAO,KAAK;AACd,YAAM,OAAO,OAAO;AACpB,YAAM,IAAI,MAAM,QAAQ,GAAG,QAAQ;AAAA,IACrC;AACA,WAAO,KAAK,KAAK;AAAA,EACnB;AACA,QAAMC,OAAM,IAAI,WAAW,IAAI;AAC/B,MAAI,KAAK;AACT,aAAW,KAAK,QAAQ;AACtB,IAAAA,KAAI,IAAI,GAAG,EAAE;AACb,UAAM,EAAE;AAAA,EACV;AACA,SAAOA;AACT;AAEA,IAAM,YAAY,oBAAI,IAA6B;AACnD,IAAM,YAAY,oBAAI,QAAoD;AAE1E,SAAS,cAAc,QAAgB,WAA0C;AAC/E,MAAI,WAAW,UAAU,IAAI,SAAS;AACtC,MAAI,CAAC,SAAU,WAAU,IAAI,WAAY,WAAW,oBAAI,IAAI,CAAE;AAC9D,MAAI,MAAM,SAAS,IAAI,MAAM;AAC7B,MAAI,CAAC,IAAK,UAAS,IAAI,QAAS,MAAM,WAAW,QAAQ,SAAS,CAAE;AACpE,SAAO;AACT;AAGO,SAASC,QAAO,QAAiC;AACtD,MAAI,MAAM,UAAU,IAAI,MAAM;AAC9B,MAAI,QAAQ,QAAW;AACrB,UAAM,WAAW,MAAM;AACvB,cAAU,IAAI,QAAQ,GAAG;AAAA,EAC3B;AACA,SAAO;AACT;AAEA,SAASC,KAAI,MAAkC;AAC7C,SAAO,OAAO,YAAY,cAAc,QAAQ,MAAM,IAAI,IAAI;AAChE;AAEA,SAAS,OAAO,MAA0C;AAExD,MAAI,OAAO,SAAS,SAAU,QAAO,KAAK,QAAQ,eAAe,EAAE;AACnE,QAAM,UAAU,gBAAgB,UAAU,OAAO,KAAK,SAAS,IAAI,eAAe,KAAK;AACvF,SAAO,cAAc,KAAK,MAAM,IAAI,OAAO,QAAQ,eAAe,EAAE,EAAE,KAAK,IAAI;AACjF;AAEA,SAAS,cAAc,OAAe,MAAsB;AAC1D,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,KAAK;AAAA,EACrB,QAAQ;AACN,UAAM,IAAI,kBAAkB,GAAG,IAAI,wDAAwD;AAAA,EAC7F;AAEA,QAAM,QAAQ,IAAI,aAAa,eAAe,IAAI,aAAa,eAAe,IAAI,SAAS,SAAS,YAAY,KAAK,IAAI,SAAS,SAAS,OAAO;AAClJ,MAAI,IAAI,aAAa,YAAY,EAAE,IAAI,aAAa,WAAW,OAAQ,OAAM,IAAI,kBAAkB,GAAG,IAAI,kEAAkE;AAC5K,MAAI,IAAI,WAAW,MAAM,IAAI,SAAS,GAAI,OAAM,IAAI,kBAAkB,GAAG,IAAI,iCAAiC;AAC9G,SAAO,uBAAuB,KAAK;AACrC;AAEA,IAAM,WAAW,CAAC,MAA6C,OAAO,MAAM,YAAY,MAAM,QAAQ,CAAC,MAAM,QAAQ,CAAC;AAEtH,SAAS,WAAW,SAA0B;AAC5C,QAAM,SAAS,QAAQ,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAC3D,SAAO,YAAY,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,MAAM,CAAC;AACnE;AAOO,SAAS,oBAAoB,UAA8B,CAAC,GAAiE;AAElI,QAAM,UAAW,CAAC,iBAAiB,mBAAmB,kBAAkB,EACrE,OAAO,CAAC,MAAM,MAAM,CAAC,QAAQ,QAAQ,QAAQ,UAAU,QAAQ,QAAQ,EAAE,CAAC,MAAM,WAAcA,KAAI,IAAI,KAAK,QAAQ,EAAE;AACxH,MAAI,QAAQ,SAAS,GAAG;AACtB,eAAW,gFAAgF,iDAAiD;AAAA,EAC9I;AACA,QAAM,cAAc,QAAQ,UAAUA,KAAI,eAAe,KAAK;AAC9D,MAAI,gBAAgB,GAAI,OAAM,IAAI,kBAAkB,mCAAmC;AACvF,QAAM,SAAS,cAAc,aAAa,QAAQ;AAClD,QAAM,UAAU,CAAC,QAAQ,IAAI,QAAQ,WAAW,CAAC,GAAG,IAAI,CAAC,MAAM,cAAc,GAAG,SAAS,CAAC,CAAC;AAC3F,QAAM,WAAW,QAAQ,YAAYA,KAAI,iBAAiB,KAAK;AAC/D,MAAI,aAAa,GAAI,OAAM,IAAI,kBAAkB,4GAA4G;AAC7J,QAAM,SAAS,QAAQ,YAAYA,KAAI,kBAAkB,KAAK;AAC9D,MAAI,WAAW,GAAI,OAAM,IAAI,kBAAkB,mGAAmG;AAClJ,MAAI,CAAC,KAAK,KAAK,MAAM,KAAK,WAAW,SAAU,OAAM,IAAI,kBAAkB,gFAAiF;AAC5J,QAAM,SAAS,QAAQ,UAAU;AACjC,MAAI,CAAC,OAAO,SAAS,MAAM,KAAK,SAAS,KAAK,SAAS,GAAI,OAAM,IAAI,kBAAkB,gCAAgC;AAEvH,SAAO,OAAO,SAAS;AACrB,UAAM,QAAQ,OAAO,IAAI;AACzB,QAAI,UAAU,GAAI,OAAM,IAAI,iBAAiB,UAAU;AAEvD,QAAI,OAAO,WAAW,KAAK,IAAI,gBAAiB,OAAM,IAAI,iBAAiB,WAAW;AAEtF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,KAAK,CAAC,MAAM,MAAM,CAAC,MAAM,QAAQ,KAAK,CAAC,KAAK,MAAM,EAAE,EAAG,OAAM,IAAI,iBAAiB,aAAa,8BAA8B;AAClJ,QAAI;AACJ,QAAI;AACF,eAAS,WAAW,MAAM,CAAC,CAAC;AAAA,IAC9B,QAAQ;AACN,YAAM,IAAI,iBAAiB,aAAa,wBAAwB;AAAA,IAClE;AACA,QAAI,CAAC,SAAS,MAAM,EAAG,OAAM,IAAI,iBAAiB,aAAa,6BAA6B;AAE5F,QAAI,OAAO,QAAQ,QAAS,OAAM,IAAI,iBAAiB,iBAAiB;AACxE,QAAI,UAAU,OAAQ,OAAM,IAAI,iBAAiB,oBAAoB;AAErE,QAAI,SAAS,UAAU,EAAE,OAAO,OAAO,QAAQ,YAAY,CAAC,OAAO,QAAQ,EAAE,SAAS,OAAO,IAAI,YAAY,CAAC,IAAI;AAChH,YAAM,IAAI,iBAAiB,sBAAsB,KAAK;AAAA,IACxD;AACA,QAAI,OAAO,OAAO,QAAQ,YAAY,OAAO,QAAQ,GAAI,OAAM,IAAI,iBAAiB,aAAa;AAGjG,QAAI;AACJ,QAAI;AACF,YAAM,WAAW,UAAM,4BAAc,OAAQ,QAAQ,SAAS,QAAQ,QAAQ,cAAc,QAAQ,QAAQ,KAAK,IAAID,QAAO,MAAM,IAA4B,EAAE,YAAY,CAAC,OAAO,EAAE,CAAC;AACvL,qBAAe,SAAS;AAAA,IAC1B,SAAS,KAAK;AAEZ,YAAM,OAAQ,KAAmC;AACjD,UAAI,SAAS,2BAA4B,OAAM,IAAI,iBAAiB,aAAa;AACjF,UAAI,SAAS,wCAAyC,OAAM,IAAI,iBAAiB,eAAe;AAChG,UAAI,eAAe,aAAa,OAAO,KAAK,IAAI,OAAO,EAAG,OAAM,IAAI,iBAAiB,UAAU;AAC/F,UAAI,SAAS,kBAAmB,OAAM,IAAI,iBAAiB,aAAa,eAAe,QAAQ,IAAI,UAAU,MAAS;AACtH,UAAI,eAAe,uBAAwB,OAAM;AACjD,YAAM,IAAI,iBAAiB,iBAAiB,eAAe,QAAQ,IAAI,UAAU,MAAS;AAAA,IAC5F;AAGA,QAAI;AACJ,QAAI;AACF,eAAS,YAAY,IAAI,YAAY,EAAE,OAAO,YAAY,GAAG,CAAC,OAAO,OAAO,KAAK,CAAC;AAAA,IACpF,QAAQ;AACN,YAAM,IAAI,iBAAiB,aAAa,yBAAyB;AAAA,IACnE;AACA,QAAI,CAAC,SAAS,MAAM,EAAG,OAAM,IAAI,iBAAiB,aAAa,8BAA8B;AAC7F,eAAW,QAAQ,CAAC,OAAO,OAAO,OAAO,OAAO,OAAO,KAAK,GAAG;AAC7D,UAAI,OAAO,IAAI,MAAM,OAAW,OAAM,IAAI,iBAAiB,iBAAiB,IAAI;AAAA,IAClF;AAEA,UAAM,MAAM,CAAC,SAAwB;AACnC,YAAM,IAAI,iBAAiB,iBAAiB,IAAI;AAAA,IAClD;AACA,QAAI,OAAO,OAAO,QAAQ,SAAU,KAAI,KAAK;AAC7C,QAAI,OAAO,OAAO,QAAQ,YAAY,CAAC,KAAK,KAAK,OAAO,GAAG,EAAG,KAAI,KAAK;AACvE,QAAI,OAAO,OAAO,QAAQ,YAAY,CAAC,KAAK,KAAK,OAAO,GAAG,EAAG,KAAI,KAAK;AACvE,UAAM,MAAM,OAAO;AACnB,QAAI,EAAE,OAAO,QAAQ,YAAa,MAAM,QAAQ,GAAG,KAAK,IAAI,SAAS,KAAK,IAAI,MAAM,CAAC,MAAM,OAAO,MAAM,QAAQ,GAAK,KAAI,KAAK;AAC9H,eAAW,QAAQ,CAAC,OAAO,OAAO,KAAK,EAAG,KAAI,OAAO,IAAI,MAAM,UAAa,CAAC,OAAO,UAAU,OAAO,IAAI,CAAC,EAAG,KAAI,IAAI;AACrH,QAAI,OAAO,UAAU,UAAa,OAAO,UAAU,QAAQ,EAAE,MAAM,QAAQ,OAAO,KAAK,KAAK,OAAO,MAAM,MAAM,CAAC,MAAM,OAAO,MAAM,QAAQ,GAAI,KAAI,OAAO;AAC1J,QAAI,OAAO,UAAU,UAAa,OAAO,OAAO,UAAU,SAAU,KAAI,OAAO;AAC/E,eAAW,QAAQ,CAAC,kBAAkB,MAAM,EAAG,KAAI,OAAO,IAAI,MAAM,UAAa,OAAO,OAAO,IAAI,MAAM,UAAW,KAAI,IAAI;AAC5H,eAAW,QAAQ,CAAC,aAAa,KAAK,EAAG,KAAI,OAAO,IAAI,MAAM,UAAa,OAAO,OAAO,IAAI,MAAM,SAAU,KAAI,IAAI;AAGrH,QAAI,CAAC,QAAQ,SAAS,OAAO,GAAa,EAAG,OAAM,IAAI,iBAAiB,cAAc;AACtF,QAAI,EAAE,MAAM,QAAQ,GAAG,IAAI,IAAI,SAAS,QAAQ,IAAI,QAAQ,UAAW,OAAM,IAAI,iBAAiB,gBAAgB;AAElH,UAAM,OAAO,QAAQ,OAAO,oBAAI,KAAK,GAAG,QAAQ,IAAI;AACpD,QAAI,OAAQ,OAAO,MAAiB,OAAQ,OAAM,IAAI,iBAAiB,SAAS;AAChF,QAAI,OAAO,QAAQ,UAAa,MAAO,OAAO,MAAiB,OAAQ,OAAM,IAAI,iBAAiB,eAAe;AACjH,QAAI,MAAO,OAAO,MAAiB,OAAQ,OAAM,IAAI,iBAAiB,kBAAkB;AAExF,QAAI,OAAO,QAAQ,OAAQ,OAAM,IAAI,iBAAiB,cAAc;AAGpE,QAAI,SAAS,UAAU,CAAC,QAAQ,YAAa,OAAM,IAAI,iBAAiB,cAAc;AAEtF,QAAI,eAAe,UAAU,CAAC,QAAQ,kBAAmB,OAAM,IAAI,iBAAiB,cAAc;AAClG,QAAI,OAAO,SAAS,QAAQ,CAAC,QAAQ,eAAgB,OAAM,IAAI,iBAAiB,iBAAiB;AAEjG,QAAI,QAAQ,YAAY,OAAO,OAAO,QAAQ,YAAY,OAAO,QAAQ,MAAM,OAAO,QAAQ,QAAQ,SAAU,OAAM,IAAI,iBAAiB,cAAc;AAEzJ,WAAO;AAAA,MACL,QAAQ,OAAO;AAAA,MACf,UAAU,OAAO;AAAA,MACjB,GAAI,OAAO,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,MACzF,GAAI,OAAO,OAAO,mBAAmB,YAAY,EAAE,eAAe,OAAO,eAAe,IAAI,CAAC;AAAA,MAC7F,OAAO,MAAM,QAAQ,OAAO,KAAK,IAAK,OAAO,QAAqB,CAAC;AAAA,MACnE,GAAI,OAAO,OAAO,QAAQ,YAAY,OAAO,QAAQ,KAAK,EAAE,QAAQ,OAAO,IAAI,IAAI,CAAC;AAAA,MACpF,GAAI,OAAO,SAAS,OAAO,EAAE,WAAW,KAAc,IAAI,CAAC;AAAA,MAC3D,GAAI,OAAO,OAAO,QAAQ,YAAY,OAAO,QAAQ,KAAK,EAAE,iBAAiB,OAAO,IAAI,IAAI,CAAC;AAAA,MAC7F,GAAI,OAAO,OAAO,cAAc,YAAY,OAAO,cAAc,KAAK,EAAE,UAAU,OAAO,UAAU,IAAI,CAAC;AAAA,MACxG,WAAW,IAAI,KAAM,OAAO,MAAiB,GAAI,EAAE,YAAY;AAAA,MAC/D;AAAA,IACF;AAAA,EACF;AACF;AAQA,eAAsB,YAAY,MAAkC,UAA8B,CAAC,GAA2B;AAC5H,SAAO,oBAAoB,OAAO,EAAE,IAAI;AAC1C;AAYA,eAAsB,sBACpB,UAAkE,CAAC,GACI;AACvE,QAAM,OAAO,QAAQ,OAAOC,KAAI,YAAY;AAC5C,MAAI,SAAS,UAAa,SAAS,GAAI,QAAO,oBAAoB,OAAO;AACzE,kBAAgB,OAAO,YAAY,cAAc,QAAQ,MAAM,MAAS;AACxE,aAAW,QAAQ,CAAC,UAAU,YAAY,UAAU,GAAY;AAC9D,QAAI,QAAQ,IAAI,MAAM,OAAW,OAAM,IAAI,kBAAkB,oBAAoB,IAAI,wCAAwC;AAAA,EAC/H;AACA,QAAM,MAAM,SAAS,IAAI;AACzB,QAAM,SAAS,aAAa,EAAE,QAAQ,IAAI,QAAQ,UAAU,IAAI,UAAU,QAAQ,EAAE,UAAU,IAAI,UAAU,QAAQ,cAAc,GAAG,EAAE,OAAO,GAAG,OAAO,QAAQ,MAAM,CAAC;AACvK,QAAM,KAAK,MAAM,eAAe,EAAE,QAAQ,IAAI,QAAQ,OAAO,MAAM,OAAO,MAAM,GAAG,OAAO,SAAS,QAAQ,OAAO,eAAe,EAAE,CAAC,EAAE,MAAM;AAC5I,QAAM,EAAE,KAAK,GAAG,GAAG,KAAK,IAAI;AAC5B,SAAO,oBAAoB,EAAE,GAAG,MAAM,QAAQ,GAAG,QAAQ,UAAU,GAAG,UAAU,UAAU,GAAG,OAAO,GAAG,CAAC;AAC1G;;;AK9ZA,eAAsB,WAAW,UAAkB,QAAoC;AACrF,QAAM,SAAS,OAAO,WAAW,WAAW,uBAAuB,MAAM,IAAI;AAC7E,MAAI,CAAC,uBAAuB,KAAK,MAAM,GAAG;AACxC,UAAM,IAAI,kBAAkB,8EAA8E,KAAK,UAAU,MAAM,CAAC,EAAE;AAAA,EACpI;AACA,QAAM,OAAO,OAAO,WAAW,WAAW,CAAC,MAAe,MAAM,GAAG,EAAE,UAAU,SAAS,CAAC,IAAI;AAC7F,QAAM,SAAS;AAAA,IACb,IAAI,QAAQ,GAAG,MAAM,GAAG,QAAQ,YAAY,EAAE,SAAS,EAAE,QAAQ,mBAAmB,EAAE,CAAC;AAAA,IACvF,IAAI,QAAQ,GAAG,MAAM,GAAG,QAAQ,qBAAqB;AAAA,IACrD,IAAI,QAAQ,GAAG,MAAM,GAAG,QAAQ,aAAa,EAAE,QAAQ,QAAQ,SAAS,EAAE,QAAQ,gBAAgB,oBAAoB,oBAAoB,IAAI,GAAG,MAAM,KAAK,CAAC;AAAA,EAC/J;AACA,aAAW,SAAS,QAAQ;AAC1B,UAAM,OAAO,GAAG,MAAM,MAAM,IAAI,IAAI,IAAI,MAAM,GAAG,EAAE,QAAQ;AAC3D,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,KAAK,KAAK;AAAA,IACxB,SAAS,KAAK;AAEZ,YAAM,IAAI,kBAAkB,OAAO,WAAW,WAC1C,mBAAmB,IAAI,2CAA4C,IAAc,OAAO,KACxF,wBAAwB,IAAI,KAAM,IAAc,OAAO,EAAE;AAAA,IAC/D;AACA,UAAM,IAAI,MAAM,OAAO;AACvB,QAAI,IAAI,QAAQ,IAAI,iBAAiB,MAAM,kBAAkB;AAE3D,UAAI,IAAI,UAAU,OAAO,IAAI,SAAS,KAAK;AACzC,cAAM,IAAI,kBAAkB,GAAG,IAAI,0BAA0B,IAAI,MAAM,OAAO,IAAI,QAAQ,IAAI,UAAU,KAAK,SAAS,wEAC/C,QAAQ,+BAA+B;AAAA,MAChH;AACA,UAAI,IAAI,UAAU,KAAK;AACrB,cAAM,IAAI,kBAAkB,GAAG,IAAI,aAAa,IAAI,MAAM,6BAA6B,gBAAgB,8EAA8E;AAAA,MACvL;AACA,YAAM,IAAI,kBAAkB,GAAG,IAAI,aAAa,IAAI,MAAM,6BAA6B,gBAAgB,qDAAqD,QAAQ,6EACvF;AAAA,IAC/E;AAAA,EACF;AACF;;;ACYA,IAAM,qBAAqB,KAAK;AAGhC,IAAM,eAAe;AAErB,IAAM,gBAAgB;AAEtB,IAAM,eAAe;AACrB,IAAM,uBAAuB;AAE7B,IAAM,cAAc;AAEpB,IAAM,cAAc;AAGpB,SAAS,WAAW,SAAyB;AAC3C,MAAI;AACF,WAAO,mBAAmB,OAAO;AAAA,EACnC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAkGA,SAASC,KAAI,MAAkC;AAC7C,SAAO,OAAO,YAAY,cAAc,QAAQ,MAAM,IAAI,IAAI;AAChE;AAEA,SAAS,OAAO,QAAoC;AAClD,MAAI;AAAE,WAAO,IAAI,IAAI,MAAM,EAAE;AAAA,EAAS,QAAQ;AAAE,WAAO;AAAA,EAAU;AACnE;AAEA,SAAS,OAAO,OAA2B;AACzC,MAAI,IAAI;AACR,aAAW,KAAK,MAAO,MAAK,OAAO,aAAa,CAAC;AACjD,SAAO,KAAK,CAAC,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC1E;AAEA,SAAS,OAAO,QAAQ,IAAY;AAClC,SAAO,OAAO,OAAO,gBAAgB,IAAI,WAAW,KAAK,CAAC,CAAC;AAC7D;AAQA,SAAS,UAAU,WAAsC,UAA0B;AACjF,MAAI,CAAC,aAAa,CAAC,UAAU,WAAW,GAAG,KAAK,UAAU,WAAW,IAAI,KAAK,UAAU,SAAS,IAAI,EAAG,QAAO;AAE/G,MAAI,wBAAwB,KAAK,SAAS,EAAG,QAAO;AACpD,MAAI;AACF,QAAI,IAAI,IAAI,WAAW,UAAU,EAAE,WAAW,WAAY,QAAO;AAAA,EACnE,QAAQ;AACN,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEA,SAAS,KAAK,MAAe,SAAS,KAAK,SAA6B;AACtE,QAAM,IAAI,WAAW,IAAI,QAAQ;AACjC,IAAE,IAAI,gBAAgB,iCAAiC;AACvD,IAAE,IAAI,iBAAiB,UAAU;AACjC,SAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG,EAAE,QAAQ,SAAS,EAAE,CAAC;AAClE;AAEA,SAAS,SAAS,UAAkB,UAAoB,CAAC,GAAa;AACpE,QAAM,IAAI,IAAI,QAAQ,EAAE,UAAU,iBAAiB,WAAW,CAAC;AAC/D,aAAW,KAAK,QAAS,GAAE,OAAO,cAAc,CAAC;AACjD,SAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;AACvD;AAGA,SAAS,cAAc,GAA+B;AACpD,SAAO,EAAE,UAAU,OAAO,GAAG,YAAY,EAAE,GAAG,QAAQ,OAAO,GAAG,UAAU,EAAE,GAAG,QAAQ,GAAG,WAAW,SAAS,SAAS,QAAQ;AACjI;AAcA,SAAS,gBAAgB,OAA4B;AACnD,QAAM,UAAU;AAChB,QAAM,MAAM;AAAA,IACV,GAAG,CAAC,YAAY,QAAQ,WAAW,iBAAiB,EAAE,OAAO,UAAQ,QAAQ,IAAI,MAAM,MAAS,EAAE,IAAI,UAAQ,OAAO,IAAI,SAAS;AAAA,IAClI,GAAG,CAAC,iBAAiB,wBAAwB,EAAE,OAAO,WAASA,KAAI,IAAI,KAAK,QAAQ,EAAE;AAAA,EACxF;AACA,MAAI,IAAI,WAAW,EAAG;AACtB,QAAM,IAAI,kBAAkB,8DAA8D,IAAI,KAAK,IAAI,CAAC,8OAEoB;AAC9H;AAEA,SAAS,MAAM,OAAyC;AACtD,QAAM,OAAO,MAAM,OAAOA,KAAI,YAAY;AAC1C,MAAI,SAAS,UAAa,SAAS,GAAI,QAAO;AAC9C,kBAAgB,OAAO,YAAY,cAAc,QAAQ,MAAM,MAAS;AACxE,aAAW,CAAC,MAAM,KAAK,KAAK;AAAA,IAAC,CAAC,UAAU,MAAM,MAAM;AAAA,IAAG,CAAC,YAAY,MAAM,QAAQ;AAAA,IAAG,CAAC,gBAAgB,MAAM,YAAY;AAAA,IACtH,CAAC,UAAU,MAAM,MAAM;AAAA,IAAG,CAAC,UAAU,MAAM,MAAM;AAAA,IAAG,CAAC,UAAU,MAAM,MAAM;AAAA,IAAG,CAAC,YAAY,MAAM,QAAQ;AAAA,IAAG,CAAC,YAAY,MAAM,QAAQ;AAAA,IACvI,CAAC,aAAa,MAAM,SAAS;AAAA,EAAC,GAAY;AAC1C,QAAI,UAAU,OAAW,OAAM,IAAI,kBAAkB,oBAAoB,IAAI,wCAAwC;AAAA,EACvH;AACA,QAAM,MAAM,SAAS,IAAI;AACzB,QAAM,WAAW,MAAM,eAAeA,KAAI,qBAAqB;AAC/D,MAAI;AACJ,MAAI,UAAU;AACZ,QAAI;AACF,iBAAW,SAAS,QAAQ;AAAA,IAC9B,SAAS,GAAG;AACV,UAAI,aAAa,eAAgB,OAAM,IAAI,eAAe,EAAE,QAAQ,mCAAmC,EAAE,QAAQ,QAAQ,kCAAkC,EAAE,EAAE,QAAQ,qBAAqB,EAAE,CAAC,EAAE;AACjM,YAAM;AAAA,IACR;AAAA,EACF;AACA,MAAI,aAAa,SAAS,WAAW,IAAI,UAAU,SAAS,aAAa,IAAI,WAAW;AACtF,UAAM,IAAI,eAAe,yBAAyB,oEAAoE;AAAA,EACxH;AAEA,QAAM,eAAeA,KAAI,eAAe,KAAK;AAC7C,MAAI,aAAc,YAAW,mCAAmC,yFAAyF;AACzJ,SAAO,EAAE,KAAK,UAAU,aAAa;AACvC;AAGA,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACrC,YAAqB,QAAyB,YAAsB;AAClE,UAAM,GAAG,MAAM,yDAAyD,WAAW,KAAK,IAAI,KAAK,MAAM,qDAAqD;AADzI;AAAyB;AAAA,EAE9C;AAAA,EAFqB;AAAA,EAAyB;AAGhD;AAGA,IAAI,eAAe;AAGnB,IAAI,iBAAiB;AACrB,SAAS,eAAqB;AAC5B,MAAI,eAAgB;AACpB,mBAAiB;AACjB,UAAQ,KAAK,+RAEiC;AAChD;AAEO,SAAS,aAAa,QAAuB,CAAC,GAAW;AAC9D,kBAAgB,KAAK;AAErB,QAAM,QAAQ,MAAM,KAAK;AACzB,QAAM,SAAS,uBAAuB,OAAO,IAAI,UAAU,MAAM,UAAUA,KAAI,eAAe,KAAK,EAAE;AACrG,QAAM,WAAW,OAAO,IAAI,YAAY,MAAM,YAAYA,KAAI,kBAAkB,KAAK;AACrF,QAAM,eAAe,QAAQ,SAAY,MAAM,gBAAgBA,KAAI,sBAAsB;AACzF,QAAM,SAAS,QAAQ,KAAK,MAAM,UAAUA,KAAI,eAAe,KAAK;AAEpE,QAAM,SAAS,QAAQ,KAAK,MAAM,UAAUA,KAAI,eAAe,KAAK;AACpE,QAAM,SAAS,QAAQ,KAAK,MAAM,UAAUA,KAAI,eAAe,KAAK;AACpE,MAAI,CAAC,eAAe,KAAK,MAAM,EAAG,OAAM,IAAI,kBAAkB,8EAA+E;AAC7I,MAAI,aAAa,GAAI,OAAM,IAAI,kBAAkB,yCAAyC;AAC1F,MAAI,CAAC,SAAS,OAAO,SAAS,GAAI,OAAM,IAAI,kBAAkB,uFAAuF;AAGrJ,QAAM,UAAkC,QAAQ,cAAc,MAAM,KAAK,MAAM,QAAQ,IAAI;AAC3F,MAAI;AACJ,WAAS,OAAO,KAAK,OAAK;AAAE,iBAAa,EAAE;AAAA,EAAI,GAAG,MAAM,MAAS;AAGjE,QAAM,eAAe,OAAO,eAAe,MAAM,MAAM,YAAY,IAAI;AACvE,QAAM,aAAa,OAAO,QAA4C,CAAC,GAAI,MAAM,KAAM,GAAI,eAAe,CAAC,MAAM,YAAY,IAAI,CAAC,CAAE;AACpI,QAAM,SAA2B,UAAU,QAAQ,QAAQ,CAAC,CAAC,IAAI,MAAM,MAAM,EAAE,KAAK,OAAK,CAAC,CAAC,CAAC;AAC5F,QAAM,aAAa,UAAU,WAAW,QAAQ,MAAM,IAAI;AAC1D,QAAM,WAAW,UAAU,WAAW,QAAQ,IAAI,IAAI;AAEtD,MAAI,CAAC,OAAO;AACV;AAAA,MAAW;AAAA,MACT;AAAA,IAAqF;AAAA,EACzF;AACA,QAAM,UAAU,MAAM,YAAY,QAAQ,SAAYA,KAAI,iBAAiB;AAC3E,MAAI,YAAY,UAAa,YAAY,MAAM,CAAC,wBAAwB,KAAK,OAAO,GAAG;AACrF,UAAM,IAAI,kBAAkB,iGAAkG;AAAA,EAChI;AAEA,QAAM,WAAW,OAAO,MAAM,YAAY,aAAa,QAAQ,cAAc,EAAE;AAC/E,QAAM,gBAAgB,MAAM,iBAAiB;AAC7C,MAAI,kBAAkB,cAAc,kBAAkB,OAAQ,OAAM,IAAI,kBAAkB,4CAA4C;AACtI,QAAM,cAAc,UAAU,MAAM,aAAa,GAAG;AACpD,QAAM,eAAe,UAAU,MAAM,cAAc,GAAG;AACtD,QAAM,aAAa,MAAM,cAAc;AACvC,QAAM,aAAa,GAAG,UAAU;AAChC,QAAM,cAAc,GAAG,UAAU;AACjC,QAAM,aAAa,GAAG,UAAU;AAChC,QAAM,gBAAgB,MAAM,UAAU,UAAU;AAChD,QAAM,iBAAiB,MAAM,UAAU,WAAW;AAClD,aAAW,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,UAAU,aAAa,GAAG,CAAC,WAAW,cAAc,CAAC,GAAY;AAC1F,QAAI,CAAC,OAAO,SAAS,EAAE,KAAK,MAAM,EAAG,OAAM,IAAI,kBAAkB,YAAY,IAAI,4CAA4C;AAAA,EAC/H;AAGA,QAAM,UAAU,SAAS,MAAM,OAAO,cAAc;AACpD,QAAM,SAAS,QAAQ,MAAM;AAC7B,QAAM,QAAQ;AAAA,IACZ,QAAQ,MAAM,OAAO,SAAS,UAAU,MAAM,MAAM,QAAQ,GAAG,IAAI;AAAA,IACnE,eAAe,MAAM,OAAO,gBAAgB,UAAU,MAAM,MAAM,eAAe,GAAG,IAAI;AAAA,IACxF,aAAa,MAAM,OAAO,cAAc,UAAU,MAAM,MAAM,aAAa,GAAG,IAAI;AAAA,IAClF,cAAc,MAAM,OAAO,eAAe,UAAU,MAAM,MAAM,cAAc,GAAG,IAAI;AAAA,EACvF;AAIA,QAAM,kBAAkB,WAAW,MAAM,eAAe,GAAG,uBAAuB,OAAO,CAAC,GAAG,MAAM,YAAY,KAAK;AACpH,QAAM,YAAY,aAAa;AAAA,IAAE;AAAA,IAAQ;AAAA,IAAU;AAAA,IAAc,KAAK,MAAM;AAAA,IAAW,QAAQ,UAAU;AAAA,IAAW;AAAA,IAAiB,OAAO,MAAM;AAAA,IAAO,WAAW;AAAA;AAAA,IAElK,GAAI,UAAU,EAAE,QAAQ,EAAE,UAAU,QAAQ,QAAQ,OAAO,GAAG,eAAe,MAAM,UAAU,QAAQ,GAAG,UAAU,GAAG,IAAI,CAAC;AAAA,EAAG,CAAC;AAIhI,QAAM,WAAsC,QACxC,eAAe;AAAA,IAAE;AAAA,IAAQ,OAAO,MAAM,UAAU,MAAM;AAAA,IAAG,OAAO,SAAS,MAAM,OAAO,cAAc;AAAA,IAAG,KAAK,MAAM;AAAA,IAClH,KAAK,OAAK,QAAQ,MAAM,mBAAmB,CAAC,EAAE;AAAA,EAAE,CAAC,IACjD;AACJ,YAAU,MAAM,EAAE,MAAM,MAAM;AAAA,EAA+D,CAAC;AAC9F,QAAM,YAAY,MAAM,UAAU,QAAQ,GAAG,OAAO,QAAQ;AAK5D,QAAM,kBAAkB,MAAM,UAAU,QAAQ,GAAG,qBAAqB;AAGxE,QAAM,eAAe,YAA8B,YAAY,MAAM,SAAS,MAAM,GAAG,qBAAqB,WAAW;AACvH,QAAM,YAAY,MAAM,UAAU,QAAQ,GAAG,UAAU;AAKvD,QAAM,gBAAgB,CAAC,YAAqB;AAC1C,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,QAAQ,QAAQ,IAAI,mBAAmB,GAAG,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,EAAE,YAAY;AAC1F,WAAO,UAAU,WAAW,UAAU,SAAS,GAAG,KAAK,MAAM,IAAI,IAAI,KAAK,IAAI;AAAA,EAChF;AAIA,QAAM,WAAW,CAAC,YAAqB;AACrC,QAAI,QAAS,QAAO,uBAAuB,OAAO;AAClD,UAAM,QAAQ,cAAc,OAAO;AACnC,QAAI,CAAC,SAAU,QAAO;AACtB,UAAMC,QAAO,SAAS,QAAQ,GAAG,YAAY,CAAC;AAC9C,QAAIA,MAAK,SAAS,KAAK,EAAG,QAAO;AACjC,QAAIA,MAAK,WAAW,EAAG,QAAOA,MAAK,CAAC;AACpC,UAAM,IAAI,mBAAmB,OAAOA,KAAI;AAAA,EAC1C;AACA,QAAM,aAAa,CAAC,YAAqB;AACvC,QAAI;AAAE,aAAO,SAAS,OAAO;AAAA,IAAE,QAAQ;AAAE,aAAO,cAAc,OAAO;AAAA,IAAE;AAAA,EACzE;AACA,QAAM,QAAQ,CAAC,SAAkB,YAAuC,EAAE,QAAQ,WAAW,OAAO,EAAE,WAAW,UAAU,GAAG,OAAO;AAOrI,iBAAe,WAAW,MAAiD;AACzE,QAAI,WAAW,KAAK,IAAI,WAAW,MAAM,UAAU;AACjD,YAAM,IAAI,MAAM,QAAQ;AACxB,WAAK,IAAI,yBAAyBC,eAAc;AAChD,WAAK,IAAI,oBAAoB,MAAM,EAAE,UAAU,UAAU,GAAG,MAAM,iBAAiB,CAAC;AAAA,IACtF,WAAW,cAAc;AACvB,WAAK,IAAI,iBAAiB,YAAY;AAAA,IACxC;AACA,WAAO;AAAA,EACT;AAOA,iBAAe,MAAM,MAA8B,QAAgC,CAAC,GAAoF;AACtK,QAAI;AACF,YAAMC,QAAO,MAAM,WAAW,IAAI,gBAAgB,EAAE,WAAW,MAAM,aAAa,GAAG,GAAG,KAAK,CAAC,CAAC;AAC/F,YAAM,MAAM,MAAM,QAAQ,GAAG,MAAM,mBAAmB;AAAA,QACpD,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,qCAAqC,QAAQ,oBAAoB,GAAG,MAAM;AAAA,QACrG,MAAAA;AAAA,MACF,CAAC;AACD,UAAI,IAAI,GAAI,QAAO,EAAE,IAAI,MAAM,MAAM,MAAM,IAAI,KAAK,EAAE;AAItD,YAAM,MAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC9C,aAAO,EAAE,IAAI,OAAO,OAAO,IAAI,UAAU,OAAO,IAAI,SAAS,KAAK,GAAI,OAAO,KAAK,UAAU,WAAW,EAAE,MAAM,IAAI,MAAM,IAAI,CAAC,EAAG;AAAA,IACnI,QAAQ;AACN,aAAO,EAAE,IAAI,OAAO,OAAO,MAAM;AAAA,IACnC;AAAA,EACF;AAEA,iBAAe,SAAS,aAAuF;AAC7G,QAAI;AACF,YAAM,MAAM,MAAM,QAAQ,GAAG,MAAM,sBAAsB,EAAE,SAAS,EAAE,eAAe,UAAU,WAAW,GAAG,EAAE,CAAC;AAChH,UAAI,CAAC,IAAI,GAAI,QAAO;AACpB,YAAM,IAAK,MAAM,IAAI,KAAK;AAC1B,aAAO;AAAA,QACL,KAAK,OAAO,EAAE,OAAO,EAAE;AAAA,QACvB,OAAO,MAAM,QAAQ,EAAE,KAAK,IAAI,EAAE,MAAM,OAAO,CAAC,MAAe,OAAO,MAAM,QAAQ,IAAI,CAAC;AAAA,QACzF,GAAG;AAAA,UACD,IAAI,OAAO,EAAE,OAAO,EAAE;AAAA,UACtB,OAAO,OAAO,EAAE,SAAS,EAAE;AAAA,UAC3B,MAAM,OAAO,EAAE,QAAQ,EAAE;AAAA,UACzB,eAAe,EAAE,mBAAmB;AAAA,UACpC,YAAY,EAAE,eAAe;AAAA,UAC7B,GAAI,OAAO,EAAE,oBAAoB,WAAW,EAAE,eAAe,EAAE,gBAAgB,IAAI,CAAC;AAAA,UACpF,GAAI,OAAO,EAAE,WAAW,YAAY,EAAE,WAAW,KAAK,EAAE,QAAQ,EAAE,OAAO,IAAI,CAAC;AAAA,UAC9E,GAAI,EAAE,cAAc,OAAO,EAAE,aAAa,KAAK,IAAI,CAAC;AAAA,QACtD;AAAA,MACF;AAAA,IACF,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAGA,QAAM,SAAS,CAACA,OAAW,SACxB,OAAOA,OAAM,eAAe,YAAYA,MAAK,aAAa,KAAK,MAAM,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC;AAGzF,iBAAe,OAAO,cAAqC;AACzD,QAAI;AACF,YAAM,OAAO,MAAM,WAAW,IAAI,gBAAgB,EAAE,WAAW,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,CAAC;AAC3G,YAAM,QAAQ,GAAG,MAAM,oBAAoB,EAAE,QAAQ,QAAQ,SAAS,EAAE,gBAAgB,oCAAoC,GAAG,MAAM,KAAK,CAAC;AAAA,IAC7I,QAAQ;AAAA,IAER;AAAA,EACF;AAGA,iBAAe,OAAOA,OAAW,KAAsC;AACrE,QAAI,OAAOA,OAAM,iBAAiB,YAAY,OAAOA,OAAM,kBAAkB,SAAU,QAAO;AAC9F,UAAM,MAAM,MAAM,SAASA,MAAK,YAAY;AAC5C,QAAI,QAAQ,QAAQ,IAAI,EAAE,OAAO,GAAI,QAAO;AAC5C,UAAM,WAAW,OAAOA,MAAK,eAAe,YAAYA,MAAK,aAAa,IAAIA,MAAK,aAAa;AAChG,WAAO,EAAE,IAAIA,MAAK,cAAc,IAAIA,MAAK,eAAe,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,UAAU,GAAG,KAAK,GAAG,OAAOA,OAAM,GAAG,EAAE;AAAA,EACtI;AAEA,WAAS,UAAU,GAAoB;AACrC,WAAO,EAAE,MAAM,EAAE,GAAG,UAAU,EAAE,KAAK,OAAO,EAAE,OAAO,aAAa,EAAE,IAAI,WAAW,IAAI,KAAK,EAAE,MAAM,GAAI,EAAE,YAAY,EAAE;AAAA,EAC1H;AAOA,iBAAe,KAAK,SAAiH;AACnI,UAAM,MAAM,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AACrD,UAAM,MAAM,UAAU,KAAK,UAAU;AACrC,QAAI,QAAQ,KAAM,QAAO,EAAE,KAAK,OAAO,MAAM,SAAS,OAAO,OAAO,MAAM;AAC1E,UAAM,SAAS,MAAM,cAAsB,KAAK,MAAM,UAAU;AAChE,UAAM,QAAQ,QAAQ,SAAS;AAC/B,UAAM,QAAQ,UAAU,QAAQ,OAAO,MAAM,OAAO,YAAY,OAAO,MAAM,OAAO,YAAY,OAAO,MAAM,QAAQ;AACrH,WAAO,EAAE,KAAK,OAAO,QAAQ,QAAQ,MAAM,SAAS,MAAM,OAAO,SAAS,OAAQ,QAAQ,EAAE;AAAA,EAC9F;AAEA,iBAAe,MAAM,SAAkB,GAAW,KAA6C;AAC7F,WAAO,WAAW,YAAY,MAAM,KAAK,IAAI,MAAM,YAAY,CAAC,CAAC,GAAG,MAAM,SAAS,EAAE,MAAM,IAAI,qBAAqB,MAAS,GAAG,GAAG;AAAA,EACrI;AAEA,QAAM,QAAQ,CAAC,MAAc,EAAE,MAAM,KAAK,IAAI,IAAI,MAAO;AAKzD,QAAM,WAAW,oBAAI,IAAuD;AAE5E,WAAS,MAAM,KAAwD;AACrE,QAAI,UAAU,SAAS,IAAI,IAAI,EAAE;AACjC,QAAI,YAAY,QAAW;AACzB,YAAM,KAAK,IAAI;AACf,iBAAW,YAAuD;AAChE,cAAM,MAAM,MAAM,MAAM,EAAE,YAAY,iBAAiB,eAAe,GAAG,CAAC;AAC1E,YAAI,CAAC,IAAI,GAAI,QAAO,IAAI,QAAQ,UAAU;AAC1C,cAAM,OAAO,MAAM,OAAO,IAAI,MAAM,GAAG;AACvC,YAAI,SAAS,KAAM,QAAO;AAI1B,YAAI,OAAO,IAAI,MAAM,iBAAiB,YAAY,OAAO,IAAI,MAAM,kBAAkB,SAAU,QAAO;AACtG,cAAM,WAAW,OAAO,IAAI,KAAK,eAAe,YAAY,IAAI,KAAK,aAAa,IAAI,IAAI,KAAK,aAAa;AAC5G,cAAM,EAAE,GAAG,GAAG,GAAG,KAAK,IAAI;AAC1B,eAAO,EAAE,GAAG,MAAM,IAAI,IAAI,KAAK,cAAc,IAAI,IAAI,KAAK,eAAe,KAAK,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,UAAU,GAAG,OAAO,IAAI,MAAM,GAAG,EAAE;AAAA,MACnJ,GAAG;AACH,eAAS,IAAI,IAAI,OAAO;AAIxB,WAAK,QAAQ,KAAK,CAAC,WAAW;AAC5B,YAAI,WAAW,cAAe,QAAO,SAAS,OAAO,EAAE;AACvD,cAAM,QAAQ,WAAW,MAAM,SAAS,OAAO,EAAE,GAAG,GAAK;AACxD,QAAC,MAAiC,QAAQ;AAAA,MAC7C,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AAEA,iBAAeC,SAAQ,SAAqC;AAC1D,UAAM,EAAE,KAAK,OAAO,SAAS,MAAM,IAAI,MAAM,KAAK,OAAO;AACzD,QAAI,UAAU,MAAM;AAElB,UAAI,QAAS,cAAa;AAC1B,aAAO,EAAE,SAAS,MAAM,QAAQ,mBAAmB,SAAS,UAAU,WAAW,YAAY,MAAM,SAAS,CAAC,GAAG,GAAG,IAAI,CAAC,EAAE;AAAA,IAC5H;AAGA,QAAI,MAAM,KAAK,EAAG,QAAO,EAAE,SAAS,UAAU,KAAK,GAAG,QAAQ,iBAAiB,SAAS,QAAQ,MAAM,MAAM,SAAS,OAAO,GAAG,IAAI,CAAC,EAAE;AAEtI,UAAM,UAAU,MAAM,MAAM,KAAK;AACjC,QAAI,YAAY,SAAS;AACvB,aAAO,EAAE,SAAS,MAAM,QAAQ,mBAAmB,SAAS,WAAW,YAAY,MAAM,SAAS,CAAC,GAAG,GAAG,EAAE;AAAA,IAC7G;AAGA,QAAI,YAAY,cAAe,QAAO,EAAE,SAAS,MAAM,QAAQ,WAAW,SAAS,CAAC,EAAE;AACtF,WAAO,EAAE,SAAS,UAAU,OAAO,GAAG,QAAQ,iBAAiB,SAAS,MAAM,MAAM,SAAS,SAAS,GAAG,EAAE;AAAA,EAC7G;AAEA,iBAAe,WAAW,SAAkB,iBAAoD;AAC9F,QAAI,oBAAoB,QAAW;AACjC,YAAM,EAAE,MAAM,IAAI,MAAM,KAAK,OAAO;AACpC,aAAO,UAAU,QAAQ,MAAM,KAAK,IAAI,UAAU,KAAK,IAAI;AAAA,IAC7D;AACA,UAAM,IAAI,MAAMA,SAAQ,OAAO;AAC/B,eAAW,KAAK,EAAE,QAAS,iBAAgB,OAAO,cAAc,CAAC;AACjE,WAAO,EAAE;AAAA,EACX;AAEA,iBAAe,OAAO,SAA0C;AAC9D,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,OAAO;AACpC,QAAI,UAAU,KAAM,QAAO;AAC3B,WAAO,MAAM,KAAK,IAAI,kBAAkB;AAAA,EAC1C;AAIA,QAAM,WAAW,oBAAI,IAA0D;AAE/E,iBAAe,cAAc,SAAkD;AAC7E,UAAM,MAAM,SAAS,IAAI,QAAQ,WAAW;AAC5C,QAAI,OAAO,KAAK,IAAI,IAAI,IAAI,KAAK,qBAAsB,QAAO,IAAI;AAClE,UAAM,MAAM,UAAU;AACtB,UAAM,MAAM,GAAG,MAAM,0BAA0B,MAAM,WAAW,mBAAmB,GAAG,CAAC,KAAK,EAAE;AAC9F,UAAM,MAAM,MAAM,QAAQ,KAAK,EAAE,SAAS,EAAE,eAAe,UAAU,QAAQ,WAAW,GAAG,EAAE,CAAC;AAC9F,QAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,0CAA0C,IAAI,MAAM,EAAE;AACnF,UAAMD,QAAQ,MAAM,IAAI,KAAK;AAC7B,UAAM,SAASA,MAAK,QAAQ,CAAC,GAAG;AAAA,MAC9B,CAAC,OAA4B;AAAA,QAC3B,IAAI,OAAO,EAAE,EAAE;AAAA,QACf,QAAQ,OAAO,EAAE,UAAU,EAAE;AAAA,QAC7B,MAAM,OAAO,EAAE,QAAQ,EAAE;AAAA,QACzB,MAAM,OAAO,EAAE,QAAQ,EAAE;AAAA,QACzB,MAAM,OAAO,EAAE,QAAQ,EAAE;AAAA,QACzB,UAAW,EAAE,YAA0C,CAAC;AAAA,QACxD,GAAI,EAAE,cAAc,EAAE,YAAY,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC;AAAA,QAC7D,GAAI,MAAM,QAAQ,EAAE,WAAW,IAC3B,EAAE,aAAa,EAAE,YAAY,IAAI,MAAM,GAAG,QAAQ,MAAM,QAAQ,EAAE,MAAM,IAAI,EAAE,OAAO,IAAI,MAAM,IAAI,CAAC,GAAG,aAAa,MAAM,QAAQ,EAAE,WAAW,IAAI,EAAE,YAAY,IAAI,aAAa,IAAI,CAAC,EAAE,IACzL,CAAC;AAAA,MACP;AAAA,IACF;AACA,QAAI,SAAS,OAAO,IAAO,UAAS,MAAM;AAC1C,aAAS,IAAI,QAAQ,aAAa,EAAE,IAAI,KAAK,IAAI,GAAG,MAAM,CAAC;AAC3D,WAAO;AAAA,EACT;AAKA,iBAAe,OAAOE,QAAe,UAAmF;AACtH,UAAM,MAAM,iBAAiB,SAAS,YAAY;AAClD,QAAI,QAAQ,GAAI,QAAO,EAAE,SAAS,OAAO,QAAQ,wBAAwB;AACzE,UAAM,MAAM,MAAM,QAAQ,GAAG,MAAM,2BAA2B,mBAAmB,GAAG,CAAC,UAAU;AAAA,MAC7F,QAAQ;AAAA,MACR,SAAS,EAAE,eAAe,UAAUA,MAAK,IAAI,gBAAgB,oBAAoB,QAAQ,mBAAmB;AAAA,MAC5G,MAAM,KAAK,UAAU,UAAU,QAAQ,CAAC;AAAA,IAC1C,CAAC,EAAE,MAAM,MAAM,IAAI;AACnB,QAAI,QAAQ,KAAM,OAAM,IAAI,eAAe,KAAK,eAAe,mDAAmD;AAClH,UAAMF,QAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC/C,QAAI,IAAI,GAAI,QAAO,cAAcA,OAAM,IAAI;AAC3C,UAAM,QAAQA,OAAM,SAAS,CAAC;AAG9B,QAAI,IAAI,WAAW,OAAO,IAAI,WAAW,OAAO,IAAI,WAAW,KAAK;AAClE,aAAO,EAAE,SAAS,OAAO,QAAQ,OAAO,YAAY,IAAI,WAAW,MAAM,kBAAkB,IAAI,WAAW,MAAM,qCAAqC,WAAW;AAAA,IAClK;AACA,UAAM,IAAI,eAAe,IAAI,QAAQ,OAAO,QAAQ,SAAS,yCAAyC,IAAI,MAAM,MAAM,OAAO,WAAW,IAAI,UAAU,EAAE;AAAA,EAC1J;AAEA,iBAAe,MAAM,KAAwB,UAAmF;AAE9H,UAAM,UAAU,iBAAiB,MAAM,MAAM,MAAM,WAAW,GAAG;AACjE,QAAI,CAAC,QAAS,QAAO,EAAE,SAAS,OAAO,QAAQ,gBAAgB;AAC/D,WAAO,OAAO,QAAQ,aAAa,QAAQ;AAAA,EAC7C;AAMA,QAAM,aAAa,CAAyB,OAC1C,UAAU,SAAwB;AAChC,UAAMG,OAAM,MAAM,GAAG,GAAG,IAAI;AAC5B,aAAS,MAAM;AACf,WAAOA;AAAA,EACT;AACF,QAAM,sBAAoC;AAAA,IACxC,GAAG;AAAA,IACH,eAAe;AAAA,MACb,GAAG,UAAU;AAAA,MACb,QAAQ,WAAW,UAAU,cAAc,MAAM;AAAA,MACjD,QAAQ,WAAW,UAAU,cAAc,MAAM;AAAA,IACnD;AAAA,IACA,SAAS;AAAA,MACP,GAAG,UAAU;AAAA,MACb,KAAK,WAAW,UAAU,QAAQ,GAAG;AAAA,MACrC,SAAS,WAAW,UAAU,QAAQ,OAAO;AAAA,MAC7C,QAAQ,WAAW,UAAU,QAAQ,MAAM;AAAA,IAC7C;AAAA,EACF;AAEA,iBAAe,SAAS,SAA0C;AAChE,QAAI,OAA8B,CAAC;AACnC,QAAI;AACF,aAAO,MAAM,cAAc,OAAO;AAAA,IACpC,QAAQ;AAAA,IAER;AACA,WAAO,EAAE,MAAM,QAAQ,MAAM,UAAU,QAAQ,UAAU,OAAO,QAAQ,OAAO,eAAe,MAAM,WAAW,QAAQ,UAAU;AAAA,EACnI;AAIA,QAAM,OAAO;AAAA,IACX,QAAQ,CAAC,aAAsB,GAAG,QAAQ,SAAS,WAAW,cAAc,mBAAmB,QAAQ,CAAC,KAAK,EAAE;AAAA,IAC/G,SAAS,MAAM,GAAG,QAAQ;AAAA,IAC1B,SAAS,CAAC,aAAsB,GAAG,QAAQ,WAAW,WAAW,cAAc,mBAAmB,QAAQ,CAAC,KAAK,EAAE;AAAA,IAClH,SAAS,GAAG,QAAQ;AAAA,EACtB;AAEA,iBAAe,MAAM,SAAkB,KAA6B;AAClE,UAAM,OAAa,EAAE,OAAO,OAAO,GAAG,UAAU,OAAO,EAAE,GAAG,UAAU,UAAU,IAAI,aAAa,IAAI,WAAW,GAAG,WAAW,EAAE;AAChI,UAAM,YAAY,OAAO,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC;AACvH,UAAM,IAAI,IAAI,gBAAgB;AAAA,MAC5B,WAAW,MAAM,aAAa;AAAA,MAC9B,cAAc,GAAG,SAAS,OAAO,CAAC,GAAG,QAAQ;AAAA,MAC7C,eAAe;AAAA,MACf,OAAO,KAAK;AAAA,MACZ,gBAAgB;AAAA,MAChB,uBAAuB;AAAA,IACzB,CAAC;AAED,UAAM,SAAS,IAAI,aAAa,IAAI,QAAQ;AAC5C,QAAI,WAAW,WAAW,WAAW,OAAQ,GAAE,IAAI,UAAU,MAAM;AACnE,UAAM,SAAS,IAAI,aAAa,IAAI,QAAQ,KAAK,IAAI,aAAa,IAAI,YAAY;AAClF,QAAI,UAAU,oBAAoB,KAAK,MAAM,EAAG,GAAE,IAAI,cAAc,MAAM;AAI1E,QAAI,UAAU;AACd,QAAI,IAAI,aAAa,IAAI,QAAQ,MAAM,WAAW;AAChD,QAAE,IAAI,UAAU,SAAS;AACzB,gBAAU;AAAA,IACZ;AACA,WAAO,SAAS,GAAG,MAAM,uBAAuB,CAAC,GAAG,OAAO,IAAI;AAAA,MAC7D,YAAY,YAAY,MAAM,KAAK,OAAO,MAAM,UAAU,CAAC,CAAC,GAAG,MAAM,SAAS,YAAY,CAAC;AAAA,IAC7F,CAAC;AAAA,EACH;AAEA,WAAS,OAAO,SAAkB,QAA0B;AAC1D,UAAM,IAAI,IAAI,QAAQ,EAAE,gBAAgB,6BAA6B,iBAAiB,WAAW,CAAC;AAClG,MAAE,OAAO,cAAc,YAAY,YAAY,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC;AACrE,MAAE,OAAO,cAAc,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC;AACtE,WAAO,IAAI,SAAS,mCAAmC,MAAM,6BAA6B,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;AAAA,EACvH;AAEA,iBAAe,SAAS,SAAkB,KAA6B;AACrE,UAAM,MAAM,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AACrD,UAAM,SAAS,IAAI,IAAI,UAAU;AACjC,UAAM,OAAO,SAAS,MAAM,UAAgB,QAAQ,MAAM,QAAQ,IAAI;AAGtE,QAAI,SAAS,QAAQ,IAAI,aAAa,IAAI,OAAO,MAAM,KAAK,OAAO;AAKjE,UAAI,IAAI,IAAI,WAAW,MAAM,QAAW;AACtC,cAAM,OAAO,MAAM,YAAY;AAC/B,eAAO,SAAS,GAAG,QAAQ,oBAAoB,mBAAmB,IAAI,CAAC,IAAI,CAAC,YAAY,aAAa,KAAK,MAAM,SAAS,aAAa,CAAC,CAAC,CAAC;AAAA,MAC3I;AACA,aAAO,OAAO,SAAS,gBAAgB;AAAA,IACzC;AACA,UAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;AAC1C,QAAI,UAAU,MAAM;AAElB,UAAI,UAAU,iBAAkB,QAAO,SAAS,KAAK,UAAU,CAAC,YAAY,YAAY,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;AAE/G,UAAI,UAAU,iBAAiB;AAC7B,cAAM,OAAO,MAAM,UAAU,KAAK;AAClC,eAAO,SAAS,GAAG,IAAI,GAAG,KAAK,SAAS,GAAG,IAAI,MAAM,GAAG,wBAAwB,CAAC,YAAY,YAAY,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;AAAA,MAClI;AACA,aAAO,OAAO,SAAS,MAAM,MAAM,GAAG,EAAE,CAAC;AAAA,IAC3C;AACA,UAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,QAAI,CAAC,KAAM,QAAO,OAAO,SAAS,SAAS;AAC3C,UAAM,MAAM,MAAM,MAAM;AAAA,MACtB,YAAY;AAAA,MACZ;AAAA,MACA,cAAc,GAAG,SAAS,OAAO,CAAC,GAAG,QAAQ;AAAA,MAC7C,eAAe,KAAK;AAAA,IACtB,GAAG,MAAM,SAAS,OAAO,CAAC;AAE1B,UAAM,cAAc,MAAM;AACxB,YAAM,OAAO,MAAM,UAAU;AAC7B,aAAO;AAAA,QAAS,GAAG,IAAI,GAAG,KAAK,SAAS,GAAG,IAAI,MAAM,GAAG;AAAA,QACtD,CAAC,YAAY,YAAY,IAAI,MAAM,SAAS,CAAC,CAAC,GAAG,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC;AAAA,MAAC;AAAA,IACrG;AAEA,QAAI,CAAC,IAAI,MAAM,IAAI,SAAS,sBAAuB,QAAO,YAAY;AACtE,UAAM,IAAI,IAAI,KAAK,MAAM,OAAO,IAAI,IAAI,IAAI;AAC5C,QAAI,MAAM,KAAM,QAAO,OAAO,SAAS,iBAAiB;AACxD,WAAO,SAAS,KAAK,UAAU,CAAC,GAAI,MAAM,MAAM,SAAS,GAAG,GAAG,GAAI,YAAY,YAAY,IAAI,MAAM,SAAS,CAAC,CAAC,GAAG,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;AAAA,EACrK;AAEA,iBAAe,OAAO,SAAqC;AACzD,UAAM,EAAE,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO;AACzC,QAAI,UAAU,MAAM;AAElB,YAAM,OAAO,MAAM,EAAE;AACrB,eAAS,OAAO,MAAM,EAAE;AAAA,IAC1B;AAGA,UAAM,IAAI,IAAI,gBAAgB,EAAE,WAAW,gBAAgB,GAAG,0BAA0B,GAAG,SAAS,OAAO,CAAC,GAAG,YAAY,GAAG,CAAC;AAC/H,WAAO,SAAS,GAAG,MAAM,oBAAoB,CAAC,IAAI,WAAW,YAAY,MAAM,SAAS,CAAC,GAAG,GAAG,CAAC;AAAA,EAClG;AAWA,QAAM,eAAe;AAErB,QAAM,kBAAkB;AAGxB,QAAM,YAAY,CAAC,OAAY;AAAA,IAC7B,MAAM,GAAG,SAAS;AAAA,IAClB,OAAO,GAAG,QAAQ,EAAE,QAAQ,OAAO,EAAE,MAAM,UAAU,EAAE,GAAG,SAAS,OAAO,EAAE,MAAM,WAAW,KAAK,EAAE,IAAI;AAAA,IACxG,eAAe,MAAM,QAAQ,GAAG,cAAc,IAAI,EAAE,eAAe,IAAI,MAAM,IAAI,CAAC;AAAA,EACpF;AAGA,QAAM,eAAe,CAAC,MACpB,OAAO,MAAM,YAAY,MAAM,QAAQ,CAAC,MAAM,QAAQ,CAAC,KAAK,OAAQ,EAAuB,OAAO,YAAY,OAAQ,EAA6B,aAAa;AAElK,QAAM,YAAY,CAAC,OAAY;AAAA,IAC7B,IAAI,OAAO,GAAG,MAAM,EAAE;AAAA,IAAG,MAAM,OAAO,GAAG,YAAY,EAAE;AAAA,IACvD,MAAM,CAAC,gBAAgB,UAAU,QAAQ,EAAE,SAAS,GAAG,IAAI,IAAI,EAAE,OAAO;AAAA,IAAW,WAAW,OAAO,GAAG,cAAc,EAAE;AAAA,IAAG,YAAY,GAAG,eAAe,OAAO,EAAE,YAAY,IAAI;AAAA,EACpL;AAEA,QAAMC,QAAO;AAGb,QAAM,SAAS,CAAC,OAAY;AAAA,IAC1B,IAAI,OAAO,GAAG,MAAM,EAAE;AAAA,IAAG,QAAQ,OAAO,GAAG,UAAU,EAAE;AAAA,IAAG,MAAM,OAAO,GAAG,QAAQ,EAAE;AAAA,IAAG,MAAM,OAAO,GAAG,QAAQ,EAAE;AAAA,IAAG,MAAM,OAAO,GAAG,QAAQ,EAAE;AAAA;AAAA,IAE9I,KAAK;AAAA,MACH,aAAa,GAAG,KAAK,iBAAiB;AAAA,MAAM,eAAe,GAAG,KAAK,mBAAmB;AAAA,MAAM,eAAe,GAAG,KAAK,mBAAmB;AAAA,MACtI,QAAQ,GAAG,KAAK,WAAW;AAAA,MAAM,SAAS,GAAG,KAAK,YAAY;AAAA,MAAM,QAAQ,GAAG,KAAK,WAAW;AAAA,IACjG;AAAA,EACF;AAEA,QAAM,cAAc,CAAC,OAAY;AAAA,IAC/B,QAAQ,OAAO,GAAG,WAAW,EAAE;AAAA,IAAG,OAAO,OAAO,GAAG,SAAS,EAAE;AAAA,IAAG,MAAM,OAAO,GAAG,QAAQ,EAAE;AAAA,IAAG,MAAM,OAAO,GAAG,QAAQ,EAAE;AAAA,IACxH,QAAQ,OAAO,GAAG,UAAU,EAAE;AAAA,IAAG,SAAS,GAAG,YAAY;AAAA,IAAM,SAAS,GAAG,YAAY;AAAA,IAAM,KAAK,GAAG,QAAQ;AAAA,IAAM,OAAO,OAAO,GAAG,SAAS,EAAE;AAAA,EACjJ;AAEA,QAAM,YAAY,CAAC,OAAY;AAAA,IAC7B,MAAM,OAAO,GAAG,QAAQ,EAAE;AAAA,IAAG,MAAM,OAAO,GAAG,QAAQ,EAAE;AAAA,IAAG,aAAa,OAAO,GAAG,eAAe,EAAE;AAAA,IAAG,SAAS,GAAG,YAAY;AAAA,EAC/H;AAGA,QAAM,UAAU,CAAC,OAAY;AAAA,IAC3B,IAAI,OAAO,GAAG,MAAM,EAAE;AAAA,IACtB,MAAM,OAAO,GAAG,OAAO,QAAQ,EAAE;AAAA,IACjC,cAAc,OAAO,GAAG,OAAO,iBAAiB,EAAE;AAAA,IAClD,UAAU,EAAE,MAAM,OAAO,GAAG,UAAU,QAAQ,EAAE,GAAG,KAAK,OAAO,GAAG,UAAU,OAAO,EAAE,EAAE;AAAA,IACvF,QAAQ,MAAM,QAAQ,GAAG,MAAM,IAAI,EAAE,OAAO,IAAI,CAAC,OAAY,EAAE,MAAM,OAAO,GAAG,QAAQ,EAAE,GAAG,aAAa,OAAO,GAAG,eAAe,EAAE,EAAE,EAAE,IAAI,CAAC;AAAA,IAC7I,aAAa,OAAO,GAAG,cAAc,EAAE;AAAA,IACvC,YAAY,OAAO,GAAG,gBAAgB,EAAE;AAAA,EAC1C;AAaA,QAAM,QAAQ,CAAC,MAAe,MAAM,QAAQ,MAAM,OAAO,MAAM,QAAQ,MAAM;AAE7E,QAAM,UAAU,CAACC,SAAgB,MAAc,SAAiB,OAAgB,SAAmB,YACjG,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC,GAAI,GAAI,WAAW,QAAQ,SAAS,IAAI,EAAE,QAAQ,IAAI,CAAC,EAAG,EAAE,GAAGA,SAAQ,OAAO;AAExI,QAAM,UAAU,CAAC,MAAoB,QAAQ,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK;AAE5E,MAAI,YAAY;AAMhB,WAAS,qBAAqB,SAAkB,OAAgC;AAC9E,QAAI,QAAQ,QAAQ,IAAI,kBAAkB,MAAM,IAAK,QAAO;AAC5D,QAAI,kBAAkB,QAAQ;AAC5B,UAAI,CAAC,cAAc;AACjB,uBAAe;AACf,gBAAQ,KAAK,wBAAwB,QAAQ,GAAG,KAAK,sKACiC;AAAA,MACxF;AACA,aAAO;AAAA,IACT;AACA,WAAO,QAAQ,KAAK,iBAAiB,+DAAgE;AAAA,EACvG;AAGA,WAAS,WAAW,SAA2B;AAC7C,UAAM,SAAS,QAAQ,QAAQ,IAAI,QAAQ;AAC3C,QAAI,WAAW,MAAM;AACnB,YAAM,MAAM,SAAS,OAAO;AAC5B,UAAI,WAAW,OAAO,WAAW,IAAI,IAAI,QAAQ,GAAG,EAAE,OAAQ,QAAO;AAGrE,UAAI,CAAC,aAAa,OAAO,MAAM,MAAM,IAAI,IAAI,GAAG,EAAE,UAAU;AAC1D,oBAAY;AACZ,gBAAQ,KAAK,0CAA0C,MAAM,mDAAmD,GAAG,0EACzC;AAAA,MAC5E;AACA,aAAO;AAAA,IACT;AAGA,YAAQ,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,mBAAmB;AAAA,EACtE;AAEA,iBAAe,KAAK,SAA2D;AAC7E,QAAI,EAAE,QAAQ,QAAQ,IAAI,cAAc,KAAK,IAAI,SAAS,kBAAkB,EAAG,QAAO;AACtF,QAAI;AACF,YAAM,IAAK,MAAM,QAAQ,KAAK;AAC9B,aAAO,OAAO,MAAM,YAAY,MAAM,QAAQ,CAAC,MAAM,QAAQ,CAAC,IAAK,IAAgC;AAAA,IACrG,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAWA,QAAM,WAAW,MAAM,aAAa,CAAC,YACnC,QAAQ,QAAQ,IAAI,iBAAiB,GAAG,MAAM,GAAG,EAAE,IAAI,OAAK,EAAE,KAAK,CAAC,EAAE,QAAQ,EAAE,KAAK,OAAK,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;AACtH,MAAI,eAAe;AACnB,iBAAe,SAAS,SAAmD;AACzE,QAAI,KAAK,IAAI,IAAI,aAAc,QAAO,CAAC;AACvC,UAAM,KAAK,SAAS,OAAO;AAC3B,QAAI;AAGF,YAAM,QAAQ,EAAE,yBAAyB,MAAM,UAAU,MAAM,GAAG,uBAAuB,SAAS,OAAO,EAAE;AAC3G,aAAO,KAAK,EAAE,GAAG,OAAO,sBAAsB,GAAG,IAAI;AAAA,IACvD,QAAQ;AAGN,qBAAe,KAAK,IAAI,IAAI;AAC5B,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AAGA,iBAAe,IAAI,SAAkB,QAAgB,MAAc,SAAmB,MAAeC,SAAiB,WAAW,OAA8G;AAC7O,QAAI;AACF,YAAM,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,IAAI,IAAI;AAAA,QAC5C;AAAA,QACA,SAAS;AAAA,UACP,gBAAgB,UAAU;AAAA,UAC1B,QAAQ;AAAA;AAAA;AAAA,UAGR,GAAI,OAAO,EAAE,oBAAoB,GAAG,SAAS,OAAO,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,kBAAkB,SAAS;AAAA;AAAA;AAAA,UAGhG,GAAI,gBAAgB,IAAI,EAAE,sBAAsB,gBAAgB,EAAE,IAAI,CAAC;AAAA,UACvE,GAAI,MAAM,SAAS,OAAO;AAAA,UAC1B,GAAIA,UAAS,EAAE,eAAe,UAAUA,OAAM,GAAG,IAAI,CAAC;AAAA;AAAA,UAEtD,GAAI,WAAW,EAAE,qBAAqB,IAAI,IAAI,CAAC;AAAA;AAAA;AAAA,UAG/C,GAAI,QAAQ,QAAQ,IAAI,kBAAkB,IAAI,EAAE,mBAAmB,QAAQ,QAAQ,IAAI,kBAAkB,EAAY,IAAI,CAAC;AAAA,UAC1H,GAAI,QAAQ,QAAQ,IAAI,iBAAiB,IAAI,EAAE,mBAAmB,QAAQ,QAAQ,IAAI,iBAAiB,EAAY,IAAI,CAAC;AAAA;AAAA,UAExH,GAAI,QAAQ,QAAQ,IAAI,iBAAiB,IAAI,EAAE,mBAAmB,QAAQ,QAAQ,IAAI,iBAAiB,EAAY,IAAI,CAAC;AAAA,UACxH,GAAI,QAAQ,QAAQ,IAAI,YAAY,IAAI,EAAE,cAAc,QAAQ,QAAQ,IAAI,YAAY,EAAY,IAAI,CAAC;AAAA,UACzG,GAAI,YAAY,SAAY,CAAC,IAAI,EAAE,gBAAgB,mBAAmB;AAAA,QACxE;AAAA,QACA,MAAM,YAAY,SAAY,SAAY,KAAK,UAAU,OAAO;AAAA,MAClE,CAAC;AACD,YAAM,IAAI,IAAI,WAAW,OAAO,IAAI,WAAW,MAAM,OAAS,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC/F,UAAI,IAAI,GAAI,QAAO,EAAE,QAAQ,IAAI,QAAQ,MAAM,GAAG,QAAQ,EAAE;AAC5D,YAAM,QAAQ,GAAG,SAAS,CAAC;AAE3B,YAAM,UAAU,MAAM,QAAQ,OAAO,MAAM,OAAO,IAAK,MAAM,KAAK,QAAsB,IAAI,MAAM,IAAI;AACtG,aAAO,EAAE,QAAQ,IAAI,QAAQ,MAAM,MAAM,OAAO,EAAE,MAAM,OAAO,OAAO,QAAQ,OAAO,GAAG,SAAS,OAAO,OAAO,WAAW,qCAAqC,GAAG,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC,EAAG,EAAE;AAAA,IACtM,QAAQ;AACN,aAAO,EAAE,QAAQ,KAAK,MAAM,MAAM,OAAO,EAAE,MAAM,eAAe,SAAS,2DAA2D,EAAE;AAAA,IACxI;AAAA,EACF;AAEA,QAAM,YAAY,CAAC,OAAY;AAAA,IAC7B,IAAI,OAAO,GAAG,MAAM,EAAE;AAAA,IAAG,OAAO,OAAO,GAAG,SAAS,EAAE;AAAA,IAAG,MAAM,OAAO,GAAG,QAAQ,EAAE;AAAA,IAClF,eAAe,GAAG,mBAAmB;AAAA,IAAM,aAAa,GAAG,iBAAiB;AAAA,IAAM,YAAY,GAAG,gBAAgB;AAAA,EACnH;AAOA,iBAAe,WAAW,SAA8G;AACtI,UAAM,IAAI,MAAML,SAAQ,OAAO;AAC/B,UAAM,UAAU,IAAI,QAAQ;AAC5B,eAAW,KAAK,EAAE,QAAS,SAAQ,OAAO,cAAc,CAAC;AACzD,QAAI,EAAE,YAAY,KAAM,QAAO,EAAE,UAAU,QAAQ,KAAK,mBAAmB,kBAAkB,QAAW,OAAO,EAAE;AAGjH,WAAO,EAAE,OAAO,EAAE,QAAQ,aAAa,MAAM,EAAE,QAAQ,WAAW,KAAK,MAAM,KAAK,OAAO,GAAG,QAAQ,MAAM,QAAQ;AAAA,EACpH;AAGA,iBAAe,SAAS,SAAkB,QAAa,QAAkB,CAAC,GAAG,OAAgC,CAAC,GAAG,KAAiC;AAChJ,UAAM,IAAI,MAAM,OAAO,QAAQ,GAAG;AAClC,QAAI,MAAM,KAAM,QAAO,QAAQ,KAAK,eAAe,0DAA0D;AAC7G,UAAM,IAAI,IAAI,QAAQ;AACtB,eAAW,KAAK,CAAC,GAAI,MAAM,MAAM,SAAS,GAAG,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,CAAC,GAAI,GAAG,KAAK,EAAG,GAAE,OAAO,cAAc,CAAC;AAC9H,WAAO,KAAK,EAAE,QAAQ,aAAa,SAAS,MAAM,SAAS,UAAU,CAAC,CAAC,GAAG,GAAG,KAAK,GAAG,KAAK,CAAC;AAAA,EAC7F;AAOA,iBAAe,SAAS,SAAkB,MAAW,WAAW,OAA0B;AACxF,QAAI,MAAM,iBAAiB,MAAM;AAC/B,YAAM,OAAa,EAAE,MAAM,OAAO,OAAO,OAAO,KAAK,aAAa,EAAE,GAAG,UAAU,aAAa,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC,EAAG;AAEhI,YAAM,MAAM,KAAK,eAAe,UAAU,EAAE,QAAQ,QAAQ,IAAI,CAAC;AACjE,aAAO,KAAK,EAAE,QAAQ,gBAAgB,GAAG,IAAI,GAAG,KAAK,IAAI,QAAQ,EAAE,cAAc,YAAY,YAAY,MAAM,KAAK,OAAO,MAAM,UAAU,CAAC,CAAC,GAAG,MAAM,SAAS,YAAY,CAAC,EAAE,CAAC,CAAC;AAAA,IAClL;AACA,WAAO,SAAS,SAAS,IAAI;AAAA,EAC/B;AAEA,MAAI,YAAqE;AAKzE,MAAI,cAAuE;AAC3E,QAAM,aAAa,CAAC,aAA6C;AAC/D,kBAAc,EAAE,OAAO,KAAK,IAAI,IAAI,aAAa,QAAQ,SAAS,SAAS,CAAC,SAAS,MAAM,kBAAkB,OAAO,iBAAiB,SAAS,KAAK,eAAe,EAAE;AACpK,WAAO,YAAY;AAAA,EACrB;AAEA,iBAAe,gBAAgB,SAAkD;AAC/E,QAAI,gBAAgB,QAAQ,YAAY,SAAS,KAAK,IAAI,EAAG,QAAO,YAAY;AAChF,WAAO,WAAW,MAAM,IAAI,SAAS,OAAO,mBAAmB,CAAC;AAAA,EAClE;AAEA,iBAAe,mBAAmB,SAAkB,OAA8C;AAChG,UAAM,SAAS,MAAM,gBAAgB,OAAO;AAE5C,WAAO,iBAAiB,OAAO,UAAU,EAAE,KAAK,GAAG,KAAK,KAAK,UAAU,CAAC,GAAG,aAAa,GAAG,iBAAiB,MAAM,CAAC;AAAA,EACrH;AAEA,iBAAe,SAAS,SAAkB,KAAU,OAAyC;AAC3F,UAAM,OAAO,QAAQ,WAAW;AAChC,UAAM,MAAM;AAAA,MAAC;AAAA,MAAkB;AAAA,MAAgB;AAAA,MAAkB;AAAA,MAAoB;AAAA,MAAmB;AAAA,MAAiB;AAAA,MAAuB;AAAA,MAA8B;AAAA,MAAuB;AAAA,MAAO;AAAA,MAAgB;AAAA,MAAiB;AAAA,MAAkB;AAAA,MAAmB;AAAA,MAA0B;AAAA,MAAmB;AAAA,MAAiB;AAAA,MAAwB;AAAA,MAAwB;AAAA,MAAwB;AAAA,MAAqB;AAAA,MAAsB;AAAA,MAAqB;AAAA,MAA4B;AAAA,MAA4B;AAAA,MAAgB;AAAA,MAAoB;AAAA,MAAa;AAAA,MAAoB;AAAA,MAAa;AAAA,MAAkB;AAAA,MAAyB;AAAA,MAAa;AAAA,MAAY;AAAA,MACpqB;AAAA,MAA0B;AAAA,MAA2B;AAAA,MAAiC;AAAA,MAA2B;AAAA,MAAgB;AAAA,MAA0B;AAAA,MAA2B;AAAA,MAAuB;AAAA,MAAc;AAAA,MAC3N;AAAA,MAAsB;AAAA,MACtB;AAAA,MAAqB;AAAA,MAA6B;AAAA,MAA2B;AAAA,MAAiC;AAAA,MAAkC;AAAA,MAAoC;AAAA,MACpL;AAAA,MAA4B;AAAA,MAA6B;AAAA,MACzD;AAAA,MAAe;AAAA,IAAoB,EAAE,SAAS,KAAK,KACnD,MAAM,WAAW,kBAAkB,KAAK,MAAM,WAAW,YAAY,KAAK,MAAM,WAAW,sBAAsB,KAAK,MAAM,WAAW,qBAAqB,KAC5J,UAAU,kBAAkB,UAAU,2BAA2B,UAAU;AAC7E,QAAI,CAAC,IAAK,QAAO;AACjB,QAAI,MAAM;AACR,YAAM,UAAU,qBAAqB,SAAS,KAAK;AACnD,UAAI,QAAS,QAAO;AAAA,IACtB;AAEA,QAAI,UAAU,wBAAwB,UAAU,cAAe,YAAW,QAAQ,KAAK,IAAI,0DAA0D;AACrJ,QAAI,MAAM,WAAW,qBAAqB,EAAG,YAAW,qCAAqC,0DAA0D;AACvJ,QAAI,UAAU,MAAM,IAAI;AACtB,aAAO,QAAQ,KAAK,kBAAkB,8FAA+F;AAAA,IACvI;AAIA,QAAI,UAAU,WAAW,CAAC,MAAM;AAC9B,UAAI,cAAc,QAAQ,UAAU,QAAQ,KAAK,IAAI,GAAG;AACtD,cAAM,MAAM,MAAM,IAAI,SAAS,OAAO,iBAAiB,mBAAmB,gBAAgB,CAAC,CAAC,EAAE;AAC9F,oBAAY,EAAE,OAAO,KAAK,IAAI,IAAI,aAAa,MAAM,IAAI,QAAQ,CAAC,IAAK,IAAI,QAAQ,CAAC,EAAG;AAAA,MACzF;AACA,aAAO,KAAK,UAAU,IAAI;AAAA,IAC5B;AAGA,QAAI,UAAU,cAAc,CAAC,MAAM;AACjC,YAAM,CAAC,WAAW,UAAU,OAAO,GAAG,IAAI,MAAM,QAAQ,IAAI;AAAA,QAC1D,IAAI,SAAS,OAAO,2BAA2B;AAAA,QAC/C,IAAI,SAAS,OAAO,mBAAmB;AAAA,QACvC,IAAI,SAAS,OAAO,kCAAkC,mBAAmB,SAAS,OAAO,CAAC,CAAC,EAAE;AAAA,QAC7F,IAAI,SAAS,OAAO,0BAA0B;AAAA,MAChD,CAAC;AACD,YAAM,OAAO,MAAM,QAAQ,UAAU,IAAI,IAAI,UAAU,OAAO,CAAC;AAC/D,YAAM,WAAW,WAAW,QAAQ;AAGpC,YAAM,WAAW,SAAS,MAAM,mBAAmB;AAGnD,YAAM,OAAO,YAAY,MAAM,MAAM,SAAS;AAC9C,aAAO,KAAK;AAAA,QACV,WAAW,KAAK,IAAI,CAAC,OAAY,EAAE,IAAI,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,GAAG,OAAO,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,MAAsB,EAAE,OAAO,EAAE;AAAA;AAAA;AAAA,QAGxL,gBAAgB,SAAS,MAAM,mBAAmB;AAAA;AAAA,QAElD,QAAQ,SAAS,MAAM,iBAAiB,SAAS,SAAS,MAAM,QAAQ,SAAS;AAAA;AAAA,QAEjF,GAAI,SAAS,MAAM,QAAQ,cAAc,QAAQ,OAC7C,EAAE,cAAc,EAAE,KAAK,MAAM,UAAU,SAAS,KAAK,OAAO,aAAa,aAAa,KAAK,EAAE,IAC7F,CAAC;AAAA;AAAA,QAEL,GAAI,OAAO,SAAS,MAAM,wBAAwB,YAAY,EAAE,oBAAoB,SAAS,KAAK,oBAAoB,IAAI,CAAC;AAAA;AAAA,QAE3H,WAAW,SAAS,MAAM,qBAAqB,QAAQ,MAAM,WAAW;AAAA,QACxE,SAAS,aAAa,MAAM,QAAQ,OAAO,QAAQ,MAAM,MAAM,cAAc;AAAA,QAC7E,aAAa;AAAA,QACb,iBAAiB,aAAa,MAAM,QAAQ,OAAO,MAAM,MAAM,cAAc;AAAA;AAAA,QAE7E,KAAK,MAAM,QAAQ,IAAI,IAAI,KAAK,IAAI,KAAK,KAAK,CAAC,MAAW,GAAG,iBAAiB,IAAI;AAAA;AAAA,QAElF,GAAI,SAAS,MAAM,QAAQ,EAAE,OAAO,QAAQ,SAAS,KAAK,KAAK,EAAE,IAAI,CAAC;AAAA,QACtE,GAAI,SAAS,MAAM,oBAAoB,QAAQ,SAAS,MAAM,mBAAmB,EAAE,gBAAgB,OAAO,SAAS,KAAK,gBAAgB,EAAE,IAAI,CAAC;AAAA;AAAA,QAE/I,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,MACjC,CAAC;AAAA,IACH;AAIA,QAAI,UAAU,iBAAiB,CAAC,MAAM;AACpC,YAAMC,UAAS,IAAI,aAAa,IAAI,OAAO,KAAK,IAAI,KAAK;AACzD,UAAIA,WAAU,MAAMA,OAAM,SAAS,IAAK,QAAO,QAAQ,KAAK,iBAAiB,kDAAkD;AAC/H,YAAM,MAAM,MAAM,IAAI,SAAS,OAAO,6BAA6B,mBAAmBA,MAAK,CAAC,EAAE;AAC9F,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,OAAO;AAC3E,YAAM,eAAe,OAAO,IAAI,MAAM,iBAAiB,YAAY,IAAI,KAAK,iBAAiB,KAAK,EAAE,cAAc,IAAI,KAAK,aAAa,IAAI,CAAC;AAC7I,aAAO,KAAK,EAAE,QAAQ,MAAM,YAAY,EAAE,OAAO,OAAO,IAAI,MAAM,SAAS,EAAE,GAAG,WAAW,OAAO,IAAI,MAAM,aAAa,EAAE,GAAG,GAAG,aAAa,EAAE,CAAC;AAAA,IACnJ;AAKA,QAAI,UAAU,kBAAkB,CAAC,MAAM;AACrC,YAAM,WAAW,UAAU,IAAI,aAAa,IAAI,WAAW,GAAG,WAAW;AACzE,YAAMK,UAAS,CAAC,SAAiB,SAAS,GAAG,QAAQ,GAAG,SAAS,SAAS,GAAG,IAAI,MAAM,GAAG,cAAc,mBAAmB,IAAI,CAAC,EAAE;AAClI,YAAM,SAAS,IAAI,aAAa,IAAI,OAAO,KAAK,IAAI,KAAK;AACzD,YAAM,cAAc,IAAI,aAAa,IAAI,YAAY,KAAK,IAAI,KAAK;AACnE,UAAI,UAAU,MAAM,eAAe,GAAI,QAAOA,QAAO,eAAe;AACpE,YAAM,WAAW,OAAO,EAAE;AAC1B,YAAM,YAAY,OAAO,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,QAAQ,CAAC,CAAC,CAAC;AAClH,YAAMC,YAAW,GAAG,QAAQ;AAC5B,YAAM,WAAW,MAAM,IAAI,aAAa,IAAI,UAAU,CAAC;AACvD,YAAM,UAAU,MAAM,IAAI,SAAS,QAAQ,sBAAsB;AAAA,QAC/D,GAAI,aAAa,EAAE,WAAW,IAAI,EAAE,MAAM;AAAA,QAC1C,cAAc,GAAG,SAAS,OAAO,CAAC,GAAGA,SAAQ;AAAA,QAAI,gBAAgB;AAAA,MACnE,GAAGA,WAAU,QAAW,QAAQ;AAChC,UAAI,QAAQ,SAAS,OAAO,QAAQ,MAAM,iBAAiB,SAAU,QAAOD,QAAO,QAAQ,OAAO,QAAQ,iBAAiB;AAC3H,YAAM,OAAa,EAAE,MAAM,OAAO,OAAO,UAAU,UAAU,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC,EAAG;AAC/F,aAAO,SAAS,QAAQ,KAAK,cAAc,CAAC,YAAY,YAAY,MAAM,KAAK,OAAO,MAAM,UAAU,CAAC,CAAC,GAAG,MAAM,SAAS,YAAY,CAAC,CAAC,CAAC;AAAA,IAC3I;AACA,QAAI,UAAU,mBAAmB,CAAC,MAAM;AACtC,YAAM,SAAS,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,EAAE,IAAI,UAAU;AACxE,YAAM,OAAO,SAAS,MAAM,UAAgB,QAAQ,MAAM,QAAQ,IAAI;AACtE,YAAM,QAAQ,YAAY,YAAY,IAAI,MAAM,SAAS,CAAC,CAAC;AAC3D,YAAM,OAAO,MAAM,YAAY;AAC/B,YAAM,WAAW,CAACE,UAAiB,SAAS,GAAG,IAAI,GAAG,KAAK,SAAS,GAAG,IAAI,MAAM,GAAG,cAAc,mBAAmBA,KAAI,CAAC,IAAI,CAAC,KAAK,CAAC;AACrI,UAAI,SAAS,QAAQ,KAAK,SAAS,MAAO,QAAO,SAAS,gBAAgB;AAC1E,YAAM,UAAU,IAAI,aAAa,IAAI,OAAO;AAC5C,UAAI,QAAS,QAAO,SAAS,OAAO;AACpC,YAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,UAAI,CAAC,KAAM,QAAO,SAAS,YAAY;AACvC,YAAM,OAAO,MAAM,IAAI,SAAS,QAAQ,sBAAsB,EAAE,MAAM,cAAc,GAAG,SAAS,OAAO,CAAC,GAAG,QAAQ,iBAAiB,eAAe,KAAK,MAAM,GAAG,QAAW,QAAW,KAAK,aAAa,IAAI;AAC7M,UAAI,KAAK,MAAO,QAAO,SAAS,KAAK,MAAM,IAAI;AAC/C,YAAM,IAAI,MAAM,OAAO,KAAK,IAAI;AAChC,UAAI,MAAM,KAAM,QAAO,SAAS,aAAa;AAC7C,aAAO,SAAS,MAAM,CAAC,GAAI,MAAM,MAAM,SAAS,GAAG,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,CAAC,GAAI,KAAK,CAAC;AAAA,IACzG;AAGA,QAAI,MAAM,WAAW,kBAAkB,KAAK,CAAC,MAAM;AACjD,YAAM,WAAW,WAAW,MAAM,MAAM,mBAAmB,MAAM,CAAC;AAClE,UAAI,CAAC,YAAY,KAAK,QAAQ,EAAG,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AACjF,YAAM,WAAW,UAAU,IAAI,aAAa,IAAI,WAAW,GAAG,WAAW;AACzE,YAAMD,YAAW,GAAG,QAAQ,aAAa,QAAQ;AAGjD,YAAM,WAAW,MAAM,IAAI,aAAa,IAAI,UAAU,CAAC;AACvD,YAAM,UAAU,MAAM,IAAI,SAAS,OAAO,mBAAmB,QAAQ,iBAAiB,mBAAmB,GAAG,SAAS,OAAO,CAAC,GAAGA,SAAQ,EAAE,CAAC,IAAI,QAAWA,WAAU,QAAW,QAAQ;AACvL,UAAI,QAAQ,SAAS,OAAO,QAAQ,MAAM,iBAAiB,UAAU;AACnE,eAAO,SAAS,GAAG,QAAQ,GAAG,SAAS,SAAS,GAAG,IAAI,MAAM,GAAG,cAAc,mBAAmB,QAAQ,OAAO,QAAQ,sBAAsB,CAAC,EAAE;AAAA,MACnJ;AACA,YAAM,OAAa,EAAE,MAAM,UAAU,OAAO,OAAO,QAAQ,KAAK,SAAS,EAAE,GAAG,UAAU,UAAU,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC,EAAG;AACpI,aAAO,SAAS,QAAQ,KAAK,cAAc,CAAC,YAAY,YAAY,MAAM,KAAK,OAAO,MAAM,UAAU,CAAC,CAAC,GAAG,MAAM,SAAS,YAAY,CAAC,CAAC,CAAC;AAAA,IAC3I;AACA,QAAI,MAAM,WAAW,YAAY,KAAK,CAAC,MAAM;AAC3C,YAAM,WAAW,WAAW,MAAM,MAAM,aAAa,MAAM,CAAC;AAC5D,YAAM,SAAS,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,EAAE,IAAI,UAAU;AACxE,YAAM,OAAO,SAAS,MAAM,UAAgB,QAAQ,MAAM,QAAQ,IAAI;AACtE,YAAM,QAAQ,YAAY,YAAY,IAAI,MAAM,SAAS,CAAC,CAAC;AAC3D,YAAM,OAAO,MAAM,YAAY;AAC/B,YAAM,WAAW,CAACC,UAAiB,SAAS,GAAG,IAAI,GAAG,KAAK,SAAS,GAAG,IAAI,MAAM,GAAG,cAAc,mBAAmBA,KAAI,CAAC,IAAI,CAAC,KAAK,CAAC;AAErI,UAAI,SAAS,QAAS,KAAK,SAAS,YAAY,KAAK,SAAS,UAAU,KAAK,SAAS,aAAc,KAAK,aAAa,YAAY,IAAI,aAAa,IAAI,OAAO,MAAM,KAAK,MAAO,QAAO,SAAS,gBAAgB;AAChN,YAAM,OAAO,IAAI,aAAa,IAAI,MAAM;AACxC,UAAI,CAAC,KAAM,QAAO,SAAS,IAAI,aAAa,IAAI,OAAO,MAAM,kBAAkB,cAAc,kBAAkB;AAC/G,YAAM,IAAI,IAAI,gBAAgB,EAAE,MAAM,OAAO,KAAK,OAAO,cAAc,GAAG,SAAS,OAAO,CAAC,GAAG,QAAQ,aAAa,QAAQ,GAAG,CAAC;AAC/H,UAAI,KAAK,SAAS,WAAW;AAE3B,cAAM,OAAO,MAAM,WAAW,OAAO;AACrC,YAAI,cAAc,KAAM,QAAO,SAAS,iBAAiB;AACzD,cAAMC,QAAO,MAAM,IAAI,SAAS,OAAO,8BAA8B,QAAQ,aAAa,CAAC,IAAI,QAAW,QAAW,KAAK,KAAK;AAC/H,YAAIA,MAAK,MAAO,QAAO,SAASA,MAAK,MAAM,IAAI;AAC/C,cAAMC,KAAI,MAAM,OAAOD,MAAK,OAAO,MAAM,KAAK,OAAO,GAAG,SAAS,MAAS;AAC1E,YAAIC,OAAM,KAAM,QAAO,SAAS,aAAa;AAC7C,eAAO,SAAS,MAAM,CAAC,GAAI,MAAM,MAAM,SAASA,IAAG,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,CAAC,GAAI,KAAK,CAAC;AAAA,MACzG;AACA,UAAI,KAAK,SAAS,QAAQ;AAExB,cAAM,OAAO,MAAM,WAAW,OAAO;AACrC,YAAI,cAAc,KAAM,QAAO,SAAS,iBAAiB;AACzD,cAAM,SAAS,MAAM,IAAI,SAAS,OAAO,uBAAuB,QAAQ,kBAAkB,CAAC,IAAI,QAAW,QAAW,KAAK,KAAK;AAC/H,YAAI,OAAO,MAAO,QAAO,SAAS,OAAO,MAAM,IAAI;AACnD,cAAM,IAAI,IAAI,QAAQ,KAAK,OAAO;AAClC,UAAE,OAAO,cAAc,KAAK;AAC5B,eAAO,SAAS,GAAG,IAAI,GAAG,KAAK,SAAS,GAAG,IAAI,MAAM,GAAG,UAAU,mBAAmB,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;AAAA,MACzH;AACA,YAAM,OAAO,MAAM,IAAI,SAAS,OAAO,mBAAmB,QAAQ,aAAa,CAAC,IAAI,QAAW,QAAW,QAAW,KAAK,aAAa,IAAI;AAC3I,UAAI,KAAK,MAAO,QAAO,SAAS,KAAK,MAAM,IAAI;AAC/C,YAAM,IAAI,MAAM,OAAO,KAAK,IAAI;AAChC,UAAI,MAAM,KAAM,QAAO,SAAS,aAAa;AAC7C,aAAO,SAAS,MAAM,CAAC,GAAI,MAAM,MAAM,SAAS,GAAG,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,CAAC,GAAI,KAAK,CAAC;AAAA,IACzG;AAGA,QAAI,MAAM,WAAW,qBAAqB,KAAK,CAAC,MAAM;AACpD,YAAM,WAAW,WAAW,MAAM,MAAM,sBAAsB,MAAM,CAAC;AACrE,UAAI,CAAC,YAAY,KAAK,QAAQ,EAAG,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AACjF,YAAM,WAAW,UAAU,IAAI,aAAa,IAAI,WAAW,GAAG,WAAW;AACzE,YAAMJ,UAAS,CAAC,SAAiB,SAAS,GAAG,QAAQ,GAAG,SAAS,SAAS,GAAG,IAAI,MAAM,GAAG,cAAc,mBAAmB,IAAI,CAAC,EAAE;AAClI,YAAM,OAAO,MAAM,WAAW,OAAO;AACrC,UAAI,cAAc,KAAM,QAAOA,QAAO,iBAAiB;AACvD,YAAMC,YAAW,GAAG,QAAQ,aAAa,QAAQ;AACjD,YAAM,UAAU,MAAM,IAAI,SAAS,OAAO,8BAA8B,QAAQ,iBAAiB,mBAAmB,GAAG,SAAS,OAAO,CAAC,GAAGA,SAAQ,EAAE,CAAC,IAAI,QAAWA,WAAU,KAAK,KAAK;AACzL,UAAI,QAAQ,SAAS,OAAO,QAAQ,MAAM,iBAAiB,SAAU,QAAOD,QAAO,QAAQ,OAAO,QAAQ,sBAAsB;AAChI,YAAM,OAAa,EAAE,MAAM,WAAW,OAAO,OAAO,QAAQ,KAAK,SAAS,EAAE,GAAG,UAAU,SAAS;AAClG,aAAO,SAAS,QAAQ,KAAK,cAAc,CAAC,GAAG,KAAK,QAAQ,aAAa,GAAG,YAAY,YAAY,MAAM,KAAK,OAAO,MAAM,UAAU,CAAC,CAAC,GAAG,MAAM,SAAS,YAAY,CAAC,CAAC,CAAC;AAAA,IAC3K;AAGA,QAAI,MAAM,WAAW,sBAAsB,KAAK,CAAC,MAAM;AACrD,YAAM,WAAW,WAAW,MAAM,MAAM,uBAAuB,MAAM,CAAC;AACtE,UAAI,CAAC,YAAY,KAAK,QAAQ,EAAG,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AACjF,YAAM,WAAW,UAAU,IAAI,aAAa,IAAI,WAAW,GAAG,WAAW;AACzE,YAAMA,UAAS,CAAC,SAAiB,SAAS,GAAG,QAAQ,GAAG,SAAS,SAAS,GAAG,IAAI,MAAM,GAAG,cAAc,mBAAmB,IAAI,CAAC,EAAE;AAClI,YAAM,OAAO,MAAM,WAAW,OAAO;AACrC,UAAI,cAAc,KAAM,QAAOA,QAAO,iBAAiB;AACvD,YAAMC,YAAW,GAAG,QAAQ,aAAa,QAAQ;AACjD,YAAM,UAAU,MAAM,IAAI,SAAS,OAAO,uBAAuB,QAAQ,sBAAsB,mBAAmB,GAAG,SAAS,OAAO,CAAC,GAAGA,SAAQ,EAAE,CAAC,IAAI,QAAWA,WAAU,KAAK,KAAK;AACvL,UAAI,QAAQ,SAAS,OAAO,QAAQ,MAAM,iBAAiB,SAAU,QAAOD,QAAO,QAAQ,OAAO,QAAQ,sBAAsB;AAChI,YAAM,OAAa,EAAE,MAAM,QAAQ,OAAO,OAAO,QAAQ,KAAK,SAAS,EAAE,GAAG,UAAU,SAAS;AAC/F,aAAO,SAAS,QAAQ,KAAK,cAAc,CAAC,GAAG,KAAK,QAAQ,aAAa,GAAG,YAAY,YAAY,MAAM,KAAK,OAAO,MAAM,UAAU,CAAC,CAAC,GAAG,MAAM,SAAS,YAAY,CAAC,CAAC,CAAC;AAAA,IAC3K;AAGA,QAAI,UAAU,oBAAoB,CAAC,MAAM;AACvC,YAAM,OAAO,MAAM,WAAW,OAAO;AACrC,UAAI,cAAc,KAAM,QAAO,KAAK;AACpC,YAAM,MAAM,MAAM,IAAI,SAAS,OAAO,uBAAuB,QAAW,QAAW,KAAK,KAAK;AAC7F,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,SAAS,QAAW,KAAK,OAAO;AACpG,YAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,IAAI,IAAI,OAAO,CAAC;AACnD,aAAO,KAAK,EAAE,YAAY,KAAK,IAAI,CAAC,OAAY,EAAE,UAAU,OAAO,EAAE,YAAY,EAAE,GAAG,OAAO,OAAO,EAAE,SAAS,EAAE,GAAG,MAAM,OAAO,EAAE,QAAQ,EAAE,GAAG,UAAU,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,KAAK,OAAO;AAAA,IAC9M;AACA,QAAI,UAAU,kBAAkB,CAAC,MAAM;AACrC,YAAM,OAAO,MAAM,WAAW,OAAO;AACrC,UAAI,cAAc,KAAM,QAAO,KAAK;AACpC,YAAM,MAAM,MAAM,IAAI,SAAS,OAAO,iCAAiC,QAAW,QAAW,KAAK,KAAK;AACvG,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,SAAS,QAAW,KAAK,OAAO;AACpG,YAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,IAAI,IAAI,OAAO,CAAC;AACnD,aAAO,KAAK,EAAE,UAAU,KAAK,IAAI,SAAS,EAAE,GAAG,KAAK,KAAK,OAAO;AAAA,IAClE;AAEA,QAAI,UAAU,gBAAgB,CAAC,MAAM;AACnC,YAAM,OAAO,MAAM,WAAW,OAAO;AACrC,UAAI,cAAc,KAAM,QAAO,KAAK;AACpC,YAAM,MAAM,MAAM,IAAI,SAAS,OAAO,sBAAsB,QAAW,QAAW,KAAK,KAAK;AAC5F,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,SAAS,QAAW,KAAK,OAAO;AACpG,YAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,IAAI,IAAI,OAAO,CAAC;AACnD,aAAO,KAAK,EAAE,QAAQ,KAAK,IAAI,OAAO,EAAE,GAAG,KAAK,KAAK,OAAO;AAAA,IAC9D;AAGA,SAAK,UAAU,uBAAuB,UAAU,+BAA+B,UAAU,8BAA8B,CAAC,MAAM;AAC5H,YAAM,OAAO,MAAM,WAAW,OAAO;AACrC,UAAI,cAAc,KAAM,QAAO,KAAK;AACpC,UAAI,OAAO;AACX,UAAI,UAAU,qBAAqB;AACjC,cAAM,KAAK,IAAI,aAAa,IAAI,IAAI,KAAK;AACzC,YAAI,CAACH,MAAK,KAAK,EAAE,EAAG,QAAO,QAAQ,KAAK,wBAAwB,2BAA2B,QAAW,KAAK,OAAO;AAClH,gBAAQ,IAAI,EAAE,IAAI,MAAM,SAAS,QAAQ,IAAI,UAAU,SAAS;AAAA,MAClE,WAAW,IAAI,aAAa,IAAI,QAAQ,GAAG;AACzC,gBAAQ,WAAW,mBAAmB,IAAI,aAAa,IAAI,QAAQ,CAAE,CAAC;AAAA,MACxE;AACA,YAAM,MAAM,MAAM,IAAI,SAAS,OAAO,MAAM,QAAW,QAAW,KAAK,KAAK;AAC5E,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,SAAS,QAAW,KAAK,OAAO;AACpG,YAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,IAAI,IAAI,OAAO,CAAC;AACnD,UAAI,UAAU,oBAAqB,QAAO,KAAK,EAAE,eAAe,KAAK,IAAI,MAAM,EAAE,GAAG,KAAK,KAAK,OAAO;AACrG,UAAI,UAAU,0BAA2B,QAAO,KAAK,EAAE,OAAO,KAAK,IAAI,SAAS,EAAE,GAAG,KAAK,KAAK,OAAO;AACtG,aAAO,KAAK,EAAE,SAAS,KAAK,IAAI,WAAW,EAAE,GAAG,KAAK,KAAK,OAAO;AAAA,IACnE;AAEA,QAAI,UAAU,qBAAqB,CAAC,MAAM;AACxC,YAAM,OAAO,MAAM,WAAW,OAAO;AACrC,UAAI,cAAc,KAAM,QAAO,KAAK;AACpC,YAAM,MAAM,MAAM,IAAI,SAAS,OAAO,wBAAwB,QAAW,QAAW,KAAK,KAAK;AAC9F,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,SAAS,QAAW,KAAK,OAAO;AACpG,aAAO,KAAK,UAAU,IAAI,IAAI,GAAG,KAAK,KAAK,OAAO;AAAA,IACpD;AACA,SAAK,UAAU,SAAS,UAAU,kBAAkB,UAAU,gBAAgB,CAAC,MAAM;AACnF,YAAM,OAAO,MAAM,WAAW,OAAO;AACrC,UAAI,cAAc,KAAM,QAAO,KAAK;AACpC,YAAM,MAAM,MAAM,IAAI,SAAS,OAAO,UAAU,QAAQ,gBAAgB,UAAU,cAAc,sBAAsB,wBAAwB,QAAW,QAAW,KAAK,KAAK;AAC9K,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,SAAS,QAAW,KAAK,OAAO;AAEpG,UAAI,UAAU,aAAa;AACzB,cAAM,OAAO,MAAM,QAAQ,IAAI,MAAM,OAAO,IAAI,IAAI,KAAK,UAAU,CAAC;AACpE,eAAO,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC,OAAY,EAAE,MAAM,OAAO,EAAE,QAAQ,EAAE,GAAG,SAAS,OAAO,EAAE,WAAW,EAAE,GAAG,KAAK,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,KAAK,OAAO;AAAA,MAChK;AACA,UAAI,UAAU,gBAAgB;AAC5B,cAAM,OAAO,MAAM,QAAQ,IAAI,IAAI,IAAI,IAAI,OAAO,CAAC;AACnD,eAAO,KAAK,EAAE,UAAU,KAAK,IAAI,CAAC,OAAY,EAAE,QAAQ,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,OAAO,EAAE,MAAM,EAAE,GAAG,WAAW,OAAO,EAAE,cAAc,EAAE,GAAG,WAAW,OAAO,EAAE,cAAc,EAAE,EAAE,EAAE,EAAE,GAAG,KAAK,KAAK,OAAO;AAAA,MAC/M;AACA,aAAO,KAAK,EAAE,SAAS,UAAU,IAAI,IAAI,EAAE,GAAG,KAAK,KAAK,OAAO;AAAA,IACjE;AAIA,QAAI,UAAU,8BAA8B,CAAC,MAAM;AACjD,YAAM,SAAS,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,EAAE,IAAI,UAAU;AACxE,YAAM,OAAO,SAAS,MAAM,UAAgB,QAAQ,MAAM,QAAQ,IAAI;AACtE,UAAI,SAAS,QAAQ,KAAK,SAAS,MAAO,QAAO,QAAQ,KAAK,gBAAgB,qDAAqD;AACnI,UAAI;AACJ,UAAI;AACF,mBAAW,MAAM,QAAQ,GAAG,MAAM,4BAA4B;AAAA,UAC5D,SAAS,EAAE,gBAAgB,UAAU,GAAG,eAAe,KAAK,OAAO,QAAQ,oBAAoB;AAAA,UAC/F,QAAQ,QAAQ;AAAA,QAClB,CAAC;AAAA,MACH,QAAQ;AACN,eAAO,QAAQ,KAAK,eAAe,8BAA8B;AAAA,MACnE;AACA,UAAI,CAAC,SAAS,MAAM,CAAC,SAAS,MAAM;AAClC,cAAMQ,KAAK,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AACjD,eAAO,QAAQ,SAAS,QAAQ,OAAOA,IAAG,SAAS,CAAC,GAAG,QAAQ,OAAO,GAAG,OAAOA,IAAG,SAAS,CAAC,GAAG,WAAW,qCAAqC,CAAC;AAAA,MACnJ;AACA,aAAO,IAAI,SAAS,SAAS,MAAM;AAAA,QACjC,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,qBAAqB,iBAAiB,sBAAsB,qBAAqB,KAAK;AAAA,MACnH,CAAC;AAAA,IACH;AAEA,QAAI,CAAC,KAAM,QAAO,IAAI,SAAS,sBAAsB,EAAE,QAAQ,KAAK,SAAS,EAAE,OAAO,OAAO,EAAE,CAAC;AAChG,QAAI,CAAC,WAAW,OAAO,EAAG,QAAO,QAAQ,KAAK,cAAc,kDAAkD;AAE9G,QAAI,UAAU,aAAa;AACzB,YAAM,EAAE,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO;AACzC,UAAI,UAAU,MAAM;AAClB,cAAM,OAAO,MAAM,EAAE;AACrB,iBAAS,OAAO,MAAM,EAAE;AAAA,MAC1B;AACA,YAAM,IAAI,IAAI,QAAQ;AACtB,iBAAW,KAAK,WAAW,YAAY,MAAM,SAAS,CAAC,GAAG,GAAG,EAAG,GAAE,OAAO,cAAc,CAAC;AACxF,aAAO,KAAK,EAAE,QAAQ,aAAa,GAAG,KAAK,CAAC;AAAA,IAC9C;AAEA,UAAM,IAAI,MAAM,KAAK,OAAO;AAC5B,QAAI,MAAM,KAAM,QAAO,QAAQ,KAAK,eAAe,wBAAwB;AAI3E,QAAI,UAAU,yBAAyB;AACrC,YAAM,MAAM,WAAW,EAAE,KAAK;AAC9B,UAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,yBAAyB,EAAE,OAAO,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACjG,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,OAAO;AAC3E,YAAM,IAAI,IAAI,MAAM;AACpB,aAAO,KAAK,IAAI,EAAE,QAAQ,SAAS,YAAY,EAAE,IAAI,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,OAAO,EAAE,gBAAgB,EAAE,GAAG,UAAU,EAAE,aAAa,KAAK,EAAE,IAAI,EAAE,QAAQ,OAAO,CAAC;AAAA,IACvK;AAGA,QAAI,UAAU,sBAAsB;AAClC,UAAI,CAAC,KAAM,QAAO,IAAI,SAAS,sBAAsB,EAAE,QAAQ,KAAK,SAAS,EAAE,OAAO,OAAO,EAAE,CAAC;AAChG,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,sBAAsB,CAAC,CAAC;AAC/D,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,OAAO;AAC3E,aAAO,SAAS,SAAS,IAAI,IAAI;AAAA,IACnC;AAEA,QAAI,UAAU,kBAAkB;AAC9B,YAAM,MAAM,aAAa,WAAW,EAAE,KAAK,GAAG,cAAc,EAAE,QAAQ,CAAC;AACvE,UAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,YAAM,WAAW,MAAM,EAAE,QAAQ;AACjC,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,kBAAkB,EAAE,OAAO,OAAO,EAAE,KAAK,EAAE,KAAK,GAAG,UAAU,EAAE,SAAS,GAAG,QAAW,QAAW,QAAQ;AAChJ,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,OAAO;AAC3E,aAAO,SAAS,SAAS,IAAI,MAAM,QAAQ;AAAA,IAC7C;AAEA,QAAI,UAAU,gBAAgB;AAC5B,YAAM,MAAM,UAAU,EAAE,IAAI;AAC5B,UAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,YAAM,SAAS,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,EAAE,IAAI,UAAU;AACxE,YAAM,OAAO,SAAS,MAAM,UAAgB,QAAQ,MAAM,QAAQ,IAAI;AACtE,UAAI,SAAS,QAAQ,KAAK,SAAS,MAAO,QAAO,QAAQ,KAAK,gBAAgB,qDAAqD;AACnI,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,0BAA0B,EAAE,WAAW,KAAK,OAAO,MAAM,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAW,QAAW,KAAK,aAAa,IAAI;AACrK,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,SAAS,MAAM;AACnF,aAAO,SAAS,SAAS,IAAI,MAAM,CAAC,YAAY,YAAY,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;AAAA,IACrF;AAMA,QAAI,UAAU,uBAAuB,UAAU,4BAA4B;AACzE,YAAM,SAAS,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,EAAE,IAAI,UAAU;AACxE,YAAM,OAAO,SAAS,MAAM,UAAgB,QAAQ,MAAM,QAAQ,IAAI;AACtE,UAAI,SAAS,QAAQ,KAAK,SAAS,MAAO,QAAO,QAAQ,KAAK,gBAAgB,qDAAqD;AACnI,UAAI,UAAU,qBAAqB;AACjC,cAAMC,OAAM,MAAM,IAAI,SAAS,QAAQ,qBAAqB,EAAE,WAAW,KAAK,MAAM,GAAG,QAAW,QAAW,KAAK,aAAa,IAAI;AACnI,YAAIA,KAAI,MAAO,QAAO,QAAQA,KAAI,QAAQA,KAAI,MAAM,MAAMA,KAAI,MAAM,OAAO;AAC3E,eAAO,KAAK,EAAE,QAAQ,QAAQ,QAAQ,OAAOA,KAAI,MAAM,UAAU,CAAC,EAAE,CAAC;AAAA,MACvE;AACA,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,0BAA0B,EAAE,WAAW,KAAK,OAAO,MAAM,KAAK,GAAG,QAAW,QAAW,KAAK,aAAa,IAAI;AACpJ,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,OAAO;AAC3E,aAAO,SAAS,SAAS,IAAI,MAAM,CAAC,YAAY,YAAY,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,CAAC;AAAA,IACrF;AAEA,QAAI,UAAU,0BAA0B,UAAU,uBAAuB,UAAU,sBAAsB;AACvG,YAAM,SAAS,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,EAAE,IAAI,UAAU;AACxE,YAAM,OAAO,SAAS,MAAM,UAAgB,QAAQ,MAAM,QAAQ,IAAI;AACtE,UAAI,SAAS,QAAQ,KAAK,SAAS,MAAO,QAAO,QAAQ,KAAK,gBAAgB,qDAAqD;AACnI,UAAI,UAAU,wBAAwB;AACpC,cAAMA,OAAM,MAAM,IAAI,SAAS,QAAQ,wBAAwB,EAAE,WAAW,KAAK,MAAM,GAAG,QAAW,QAAW,KAAK,aAAa,IAAI;AACtI,YAAIA,KAAI,MAAO,QAAO,QAAQA,KAAI,QAAQA,KAAI,MAAM,MAAMA,KAAI,MAAM,OAAO;AAC3E,cAAM,IAAIA,KAAI,MAAM;AACpB,cAAM,OAAOA,KAAI,MAAM;AACvB,cAAM,OAAOA,KAAI,MAAM;AACvB,eAAO,KAAK;AAAA,UAAE,QAAQ;AAAA,UAAM,MAAMA,KAAI,MAAM,SAAS;AAAA,UAAM,OAAO,IAAI,EAAE,QAAQ,OAAO,EAAE,UAAU,EAAE,GAAG,SAAS,OAAO,EAAE,WAAW,KAAK,EAAE,IAAI;AAAA,UAC9I,MAAM,OAAO,EAAE,SAAS,OAAO,KAAK,WAAW,CAAC,EAAE,IAAI;AAAA,UAAM,OAAO,OAAO,EAAE,IAAI,OAAO,KAAK,MAAM,EAAE,EAAE,IAAI;AAAA,QAAK,CAAC;AAAA,MACpH;AACA,UAAI,UAAU,sBAAsB;AAClC,cAAMA,OAAM,MAAM,IAAI,SAAS,QAAQ,sBAAsB,EAAE,WAAW,KAAK,MAAM,GAAG,QAAW,QAAW,KAAK,aAAa,IAAI;AACpI,YAAIA,KAAI,MAAO,QAAO,QAAQA,KAAI,QAAQA,KAAI,MAAM,MAAMA,KAAI,MAAM,OAAO;AAC3E,eAAO,KAAK,EAAE,QAAQ,QAAQ,QAAQ,OAAOA,KAAI,MAAM,WAAW,EAAE,EAAE,CAAC;AAAA,MACzE;AACA,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,qBAAqB,EAAE,WAAW,KAAK,MAAM,GAAG,QAAW,QAAW,KAAK,aAAa,IAAI;AACnI,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,OAAO;AAC3E,aAAO,KAAK,EAAE,QAAQ,QAAQ,QAAQ,OAAO,IAAI,MAAM,WAAW,EAAE,GAAG,SAAS,OAAO,IAAI,MAAM,WAAW,KAAK,EAAE,CAAC;AAAA,IACtH;AAEA,QAAI,UAAU,kBAAkB;AAC9B,YAAM,MAAM,aAAa,UAAU,EAAE,IAAI,GAAG,WAAW,EAAE,KAAK,GAAG,MAAM,mBAAmB,SAAS,EAAE,QAAQ,GAAG,kBAAkB,EAAE,YAAY,CAAC;AACjJ,UAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,YAAM,QAAQ,OAAO,EAAE,KAAK,EAAE,KAAK;AAEnC,YAAM,eAAe,OAAO,EAAE,iBAAiB,YAAY,EAAE,aAAa,KAAK,MAAM,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,aAAa,KAAK,EAAE,EAAE,IAAI,CAAC;AAE/I,YAAM,QAAQ,EAAE,GAAI,EAAE,gBAAgB,OAAO,EAAE,cAAc,KAAK,IAAI,CAAC,GAAI,GAAI,EAAE,YAAY,OAAO,EAAE,aAAa,WAAW,EAAE,UAAU,EAAE,SAAS,IAAI,CAAC,EAAG;AAC7J,YAAM,OAAO,MAAM,IAAI,SAAS,QAAQ,qBAAqB,EAAE,OAAO,UAAU,EAAE,UAAU,cAAc,OAAO,EAAE,SAAS,WAAW,EAAE,KAAK,KAAK,IAAI,IAAI,GAAG,cAAc,GAAG,MAAM,GAAG,MAAM,WAAW;AACzM,UAAI,KAAK,MAAO,QAAO,QAAQ,KAAK,QAAQ,KAAK,MAAM,MAAM,KAAK,MAAM,SAAS,KAAK,MAAM,SAAS,kBAAkB,aAAa,QAAW,QAAW,KAAK,MAAM,OAAO;AAE5K,UAAI,KAAK,MAAM,0BAA0B,KAAM,QAAO,KAAK,EAAE,QAAQ,yBAAyB,MAAM,CAAC;AACrG,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,kBAAkB,EAAE,OAAO,UAAU,EAAE,SAAS,CAAC;AACxF,UAAI,IAAI,SAAS,IAAI,MAAM,iBAAiB,KAAM,QAAO,KAAK,EAAE,QAAQ,yBAAyB,MAAM,CAAC;AACxG,aAAO,SAAS,SAAS,IAAI,IAAI;AAAA,IACnC;AAEA,QAAI,UAAU,oBAAoB;AAChC,YAAM,MAAM,WAAW,EAAE,KAAK;AAC9B,UAAI,IAAK,QAAO,QAAQ,GAAG;AAE3B,YAAM,IAAI,SAAS,QAAQ,2BAA2B,EAAE,OAAO,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,aAAa;AAC5G,aAAO,KAAK,EAAE,QAAQ,OAAO,CAAC;AAAA,IAChC;AAEA,QAAI,MAAM,WAAW,KAAK,GAAG;AAC3B,YAAM,OAAO,MAAM,WAAW,OAAO;AACrC,UAAI,cAAc,KAAM,QAAO,KAAK;AACpC,YAAM,KAAK,CAAC,MAAc,SAAmB,SAAS,WAAW,IAAI,SAAS,QAAQ,MAAM,SAAS,QAAW,KAAK,KAAK;AAC1H,YAAM,UAAU,CAAC,KAAwF,UACvG,QAAQ,IAAI,QAAQ,IAAI,MAAO,MAAM,IAAI,MAAO,SAAS,OAAO,KAAK,SAAS,IAAI,MAAO,OAAO;AAElG,YAAM,WAAW,OAAO,EAAE,aAAa,WAAW,EAAE,WAAW;AAE/D,UAAI,UAAU,OAAO;AACnB,cAAM,MAAM,UAAU,EAAE,IAAI;AAC5B,YAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,cAAM,MAAM,MAAM,GAAG,eAAe,EAAE,MAAM,OAAO,EAAE,SAAS,WAAW,EAAE,KAAK,KAAK,IAAI,GAAG,GAAG,OAAO;AACtG,YAAI,IAAI,MAAO,QAAO,QAAQ,KAAK,MAAM;AAEzC,cAAM,IAAI,KAAK;AACf,YAAI,KAAK,SAAS,MAAM;AACtB,gBAAM,QAAQ,MAAM,OAAO,EAAE,cAAc,KAAK,KAAK,IAAI,eAAe,KAAK,KAAK,IAAI,YAAY,KAAK,IAAI,GAAG,KAAK,KAAK,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,CAAC,EAAE,GAAG,KAAK,IAAI;AACzK,cAAI,UAAU,KAAM,YAAW,KAAK,MAAM,MAAM,SAAS,OAAO,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,CAAC,EAAG,GAAE,OAAO,cAAc,CAAC;AAAA,QACvI;AACA,eAAO,KAAK,EAAE,QAAQ,SAAS,SAAS,UAAU,IAAI,IAAI,EAAE,GAAG,KAAK,CAAC;AAAA,MACvE;AACA,UAAI,UAAU,oBAAoB;AAChC,cAAM,QAAQ,MAAM,QAAQ,EAAE,KAAK,IAAI,EAAE,MAAM,OAAO,CAAC,MAAe,OAAO,MAAM,QAAQ,IAAI,CAAC;AAChG,cAAM,MAAM,MAAM,GAAG,4BAA4B,EAAE,MAAM,CAAC;AAC1D,YAAI,IAAI,MAAO,QAAO,QAAQ,GAAG;AACjC,eAAO,KAAK,EAAE,QAAQ,WAAW,GAAG,KAAK,KAAK,OAAO;AAAA,MACvD;AACA,UAAI,UAAU,gBAAgB;AAC5B,cAAM,MAAM,MAAM,mBAAmB,SAAS,EAAE,WAAW;AAC3D,YAAI,IAAK,QAAO,QAAQ,KAAK,IAAI,MAAM,IAAI,SAAS,aAAa;AACjE,cAAM,MAAM,MAAM,GAAG,wBAAwB,EAAE,kBAAkB,UAAU,cAAc,EAAE,YAAY,CAAC;AACxG,YAAI,IAAI,MAAO,QAAO,QAAQ,KAAK,IAAI,MAAM,SAAS,mBAAmB,aAAa,IAAI,MAAM,SAAS,kBAAkB,gBAAgB,MAAS;AAGpJ,cAAM,OAAO,MAAM,OAAO,IAAI,OAAO,MAAM,KAAK,OAAO,GAAG,SAAS,MAAS;AAC5E,cAAM,IAAI,IAAI,QAAQ;AACtB,cAAM,MAAM,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC;AACrD,mBAAW,KAAK,SAAS,OAAO,MAAM,MAAM,SAAS,MAAM,GAAG,IAAI,WAAW,YAAY,MAAM,SAAS,CAAC,GAAG,GAAG,EAAG,GAAE,OAAO,cAAc,CAAC;AAC1I,eAAO,KAAK,EAAE,QAAQ,WAAW,UAAU,SAAS,KAAK,GAAG,KAAK,CAAC;AAAA,MACpE;AACA,UAAI,UAAU,iBAAiB;AAC7B,cAAM,MAAM,MAAM,GAAG,sBAAsB,EAAE,SAAS,CAAC;AACvD,YAAI,IAAI,MAAO,QAAO,QAAQ,KAAK,IAAI,MAAM,SAAS,qBAAqB,aAAa,MAAS;AAEjG,cAAM,KAAK,OAAO,IAAI,MAAM,MAAM,EAAE;AACpC,eAAO,KAAK,EAAE,QAAQ,WAAW,QAAQ,OAAO,IAAI,MAAM,UAAU,EAAE,GAAG,YAAY,OAAO,IAAI,MAAM,eAAe,EAAE,GAAG,IAAI,GAAG,WAAW,wBAAwB,IAAI,KAAK,GAAG,GAAG,KAAK,KAAK,OAAO;AAAA,MACtM;AACA,UAAI,UAAU,kBAAkB;AAC9B,cAAM,MAAM,UAAU,EAAE,IAAI;AAC5B,YAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,cAAM,MAAM,MAAM,GAAG,uBAAuB,EAAE,MAAM,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC3E,YAAI,IAAI,MAAO,QAAO,QAAQ,KAAK,MAAM;AACzC,eAAO,KAAK,EAAE,QAAQ,WAAW,eAAe,MAAM,QAAQ,IAAI,MAAM,cAAc,IAAI,IAAI,KAAK,eAAe,IAAI,MAAM,IAAI,CAAC,EAAE,GAAG,KAAK,KAAK,OAAO;AAAA,MACzJ;AACA,UAAI,UAAU,iBAAiB;AAC7B,cAAM,MAAM,MAAM,GAAG,sBAAsB,EAAE,OAAO,OAAO,EAAE,UAAU,WAAW,EAAE,QAAQ,IAAI,SAAS,OAAO,EAAE,YAAY,WAAW,EAAE,UAAU,OAAO,SAAS,CAAC;AACtK,YAAI,IAAI,MAAO,QAAO,QAAQ,KAAK,IAAI,MAAM,SAAS,qBAAqB,aAAa,IAAI,MAAM,SAAS,qBAAqB,UAAU,MAAS;AACnJ,eAAO,KAAK,EAAE,QAAQ,QAAQ,QAAQ,OAAO,IAAI,MAAM,WAAW,EAAE,GAAG,SAAS,OAAO,IAAI,MAAM,WAAW,EAAE,EAAE,GAAG,KAAK,KAAK,OAAO;AAAA,MACtI;AACA,UAAI,UAAU,wBAAwB;AACpC,cAAM,MAAM,UAAU,EAAE,IAAI;AAC5B,YAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,cAAM,MAAM,MAAM,GAAG,6BAA6B,EAAE,MAAM,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACjF,YAAI,IAAI,MAAO,QAAO,QAAQ,KAAK,MAAM;AACzC,eAAO,KAAK,EAAE,QAAQ,WAAW,eAAe,MAAM,QAAQ,IAAI,MAAM,cAAc,IAAI,IAAI,KAAK,eAAe,IAAI,MAAM,IAAI,CAAC,EAAE,GAAG,KAAK,KAAK,OAAO;AAAA,MACzJ;AACA,UAAI,UAAU,wBAAwB;AACpC,cAAM,MAAM,MAAM,GAAG,6BAA6B,EAAE,SAAS,CAAC;AAC9D,YAAI,IAAI,MAAO,QAAO,QAAQ,KAAK,IAAI,MAAM,SAAS,qBAAqB,aAAa,MAAS;AACjG,eAAO,KAAK,EAAE,QAAQ,UAAU,GAAG,KAAK,KAAK,OAAO;AAAA,MACtD;AACA,UAAI,UAAU,mBAAmB;AAC/B,cAAM,MAAM,MAAM,GAAG,2BAA2B,EAAE,SAAS,CAAC;AAC5D,YAAI,IAAI,MAAO,QAAO,QAAQ,KAAK,IAAI,MAAM,SAAS,qBAAqB,aAAa,MAAS;AACjG,eAAO,KAAK,EAAE,QAAQ,WAAW,GAAG,KAAK,KAAK,OAAO;AAAA,MACvD;AACA,UAAI,UAAU,0BAA0B;AACtC,cAAM,MAAM,MAAM,GAAG,kCAAkC,EAAE,SAAS,CAAC;AACnE,YAAI,IAAI,MAAO,QAAO,QAAQ,KAAK,IAAI,MAAM,SAAS,qBAAqB,aAAa,MAAS;AACjG,eAAO,KAAK,EAAE,QAAQ,WAAW,eAAe,MAAM,QAAQ,IAAI,MAAM,cAAc,IAAI,IAAI,KAAK,eAAe,IAAI,MAAM,IAAI,CAAC,EAAE,GAAG,KAAK,KAAK,OAAO;AAAA,MACzJ;AACA,UAAI,UAAU,aAAa;AACzB,cAAM,MAAM,WAAW,EAAE,KAAK;AAC9B,YAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,cAAM,QAAQ,OAAO,EAAE,KAAK,EAAE,KAAK;AACnC,cAAM,MAAM,MAAM,GAAG,qBAAqB,EAAE,OAAO,SAAS,CAAC;AAC7D,YAAI,IAAI,MAAO,QAAO,QAAQ,KAAK,IAAI,MAAM,SAAS,qBAAqB,aAAa,CAAC,iBAAiB,mBAAmB,aAAa,EAAE,SAAS,IAAI,MAAM,IAAI,IAAI,UAAU,MAAS;AAE1L,eAAO,KAAK,EAAE,QAAQ,QAAQ,MAAM,GAAG,KAAK,KAAK,OAAO;AAAA,MAC1D;AACA,UAAI,UAAU,yBAAyB;AACrC,cAAM,WAAW,OAAO,EAAE,aAAa,WAAW,EAAE,WAAW;AAC/D,YAAI,CAAC,YAAY,KAAK,QAAQ,EAAG,QAAO,QAAQ,KAAK,oBAAoB,iCAAiC,YAAY,KAAK,OAAO;AAClI,cAAM,MAAM,MAAM,GAAG,uBAAuB,QAAQ,IAAI,QAAW,QAAQ;AAC3E,YAAI,IAAI,MAAO,QAAO,QAAQ,GAAG;AACjC,eAAO,KAAK,EAAE,QAAQ,YAAY,SAAS,GAAG,KAAK,KAAK,OAAO;AAAA,MACjE;AAGA,UAAI,UAAU,0BAA0B;AACtC,cAAM,OAAO,EAAE,SAAS,YAAY,EAAE,SAAS,iBAAiB,EAAE,OAAO;AACzE,cAAM,MAAM,MAAM,GAAG,oCAAoC,EAAE,UAAU,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC,EAAG,CAAC;AAChG,YAAI,IAAI,MAAO,QAAO,QAAQ,KAAK,IAAI,MAAM,SAAS,qBAAqB,aAAa,MAAS;AACjG,cAAM,OAAa,EAAE,MAAM,SAAS,OAAO,OAAO,IAAI,MAAM,cAAc,EAAE,GAAG,UAAU,YAAY;AACrG,cAAM,IAAI,IAAI,QAAQ,KAAK,OAAO;AAClC,UAAE,OAAO,cAAc,YAAY,YAAY,MAAM,KAAK,OAAO,MAAM,UAAU,CAAC,CAAC,GAAG,MAAM,SAAS,eAAe,CAAC,CAAC;AACtH,eAAO,KAAK,EAAE,QAAQ,WAAW,SAAS,IAAI,MAAM,SAAS,aAAa,IAAI,MAAM,WAAW,KAAK,GAAG,KAAK,CAAC;AAAA,MAC/G;AACA,UAAI,UAAU,2BAA2B;AACvC,cAAM,SAAS,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,EAAE,IAAI,UAAU;AACxE,cAAM,OAAO,SAAS,MAAM,UAAgB,QAAQ,MAAM,QAAQ,IAAI;AACtE,YAAI,SAAS,QAAQ,KAAK,SAAS,QAAS,QAAO,QAAQ,KAAK,gBAAgB,kEAAkE,QAAW,KAAK,OAAO;AACzK,YAAI,CAAC,aAAa,EAAE,UAAU,EAAG,QAAO,QAAQ,KAAK,eAAe,sCAAsC,QAAW,KAAK,OAAO;AACjI,cAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,KAAK,KAAK,EAAE,MAAM,GAAG,EAAE,IAAI;AACvE,cAAM,MAAM,MAAM,GAAG,qCAAqC,EAAE,YAAY,KAAK,OAAO,UAAU,MAAM,YAAY,EAAE,WAAW,CAAC;AAC9H,cAAM,IAAI,IAAI,QAAQ,KAAK,OAAO;AAClC,UAAE,OAAO,cAAc,YAAY,YAAY,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC;AACrE,YAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,SAAS,wBAAwB,mBAAmB,IAAI,MAAM,MAAM,IAAI,MAAM,SAAS,wBAAwB,+CAA+C,IAAI,MAAM,SAAS,QAAW,CAAC;AACjP,eAAO,KAAK,EAAE,QAAQ,SAAS,SAAS,UAAU,IAAI,IAAI,EAAE,GAAG,KAAK,CAAC;AAAA,MACvE;AACA,UAAI,UAAU,uBAAuB;AACnC,cAAM,KAAK,OAAO,EAAE,OAAO,WAAW,EAAE,KAAK;AAC7C,YAAI,CAAC,mBAAmB,KAAK,EAAE,EAAG,QAAO,QAAQ,KAAK,mBAAmB,gCAAgC,QAAW,KAAK,OAAO;AAChI,cAAM,MAAM,MAAM,GAAG,iCAAiC,EAAE,IAAI,QAAW,QAAQ;AAC/E,YAAI,IAAI,MAAO,QAAO,QAAQ,GAAG;AACjC,eAAO,KAAK,EAAE,QAAQ,WAAW,GAAG,GAAG,KAAK,KAAK,OAAO;AAAA,MAC1D;AAEA,UAAI,UAAU,eAAe;AAC3B,cAAM,MAAM,aAAa,UAAU,EAAE,IAAI,GAAG,WAAW,EAAE,KAAK,GAAG,MAAM,mBAAmB,SAAS,EAAE,QAAQ,CAAC;AAC9G,YAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,cAAM,MAAM,MAAM,GAAG,8BAA8B,EAAE,OAAO,OAAO,EAAE,KAAK,EAAE,KAAK,GAAG,UAAU,EAAE,UAAU,cAAc,OAAO,EAAE,SAAS,WAAW,EAAE,KAAK,KAAK,IAAI,GAAG,CAAC;AACzK,YAAI,IAAI,MAAO,QAAO,QAAQ,KAAK,IAAI,MAAM,SAAS,kBAAkB,aAAa,OAAO;AAE5F,eAAO,SAAS,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,KAAK,OAAO,GAAG,SAAS,MAAS;AAAA,MACrF;AAGA,UAAI,UAAU,8BAA8B,UAAU,+BAA+B,UAAU,4BAA4B;AACzH,cAAM,MAAM,OAAO,EAAE,mBAAmB,WAAW,EAAE,iBAAiB;AACtE,YAAI,CAACT,MAAK,KAAK,GAAG,EAAG,QAAO,QAAQ,KAAK,wBAAwB,2BAA2B,QAAW,KAAK,OAAO;AACnH,cAAM,OAAO,6BAA6B,GAAG;AAC7C,YAAI,UAAU,4BAA4B;AACxC,gBAAM,MAAM,sBAAsB,EAAE,IAAI;AACxC,cAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,gBAAMS,OAAM,MAAM,GAAG,MAAM,EAAE,MAAM,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,OAAO;AACnE,cAAIA,KAAI,MAAO,QAAO,QAAQA,MAAKA,KAAI,MAAM,SAAS,qBAAqB,SAAS,MAAS;AAE7F,mBAAS,OAAO,KAAK,KAAK;AAC1B,iBAAO,KAAK,EAAE,QAAQ,WAAW,cAAc,OAAOA,KAAI,IAAI,EAAE,GAAG,KAAK,KAAK,OAAO;AAAA,QACtF;AACA,cAAM,MAAM,UAAU,8BAA8B,MAAM,GAAG,GAAG,IAAI,UAAU,IAAI,MAAM,GAAG,MAAM,QAAW,QAAQ;AACpH,YAAI,IAAI,MAAO,QAAO,QAAQ,GAAG;AAEjC,iBAAS,OAAO,KAAK,KAAK;AAC1B,eAAO,KAAK,EAAE,QAAQ,UAAU,8BAA8B,aAAa,WAAW,gBAAgB,IAAI,GAAG,KAAK,KAAK,OAAO;AAAA,MAChI;AAGA,UAAI,MAAM,WAAW,4BAA4B,GAAG;AAClD,cAAM,MAAM,OAAO,EAAE,mBAAmB,WAAW,EAAE,iBAAiB;AACtE,YAAI,CAACT,MAAK,KAAK,GAAG,EAAG,QAAO,QAAQ,KAAK,wBAAwB,2BAA2B,QAAW,KAAK,OAAO;AACnH,cAAM,OAAO,6BAA6B,GAAG;AAC7C,YAAI,UAAU,iCAAiC;AAC7C,gBAAM,MAAM,WAAW,EAAE,KAAK;AAC9B,cAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,gBAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,OAAO;AACnD,cAAI,SAAS,GAAI,QAAO,QAAQ,KAAK,gBAAgB,kBAAkB,QAAQ,KAAK,OAAO;AAK3F,gBAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,MAAM;AAAA,YAAE,OAAO,OAAO,EAAE,KAAK,EAAE,KAAK;AAAA,YAAG;AAAA,YAAM,MAAM,OAAO,EAAE,SAAS,WAAW,EAAE,KAAK,KAAK,IAAI;AAAA,YACrI,WAAW,gBAAgB;AAAA,YAAG,UAAU;AAAA,YAAM,GAAI,OAAO,EAAE,WAAW,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,IAAI,CAAC;AAAA,UAAG,GAAG,MAAM,cAAc,KAAK,KAAK;AAE3J,cAAI,IAAI,OAAO,SAAS,iBAAkB,KAAI,MAAM,OAAO;AAC3D,cAAI,IAAI,MAAO,QAAO,QAAQ,KAAK,IAAI,MAAM,SAAS,iBAAiB,SAAS,OAAO;AACvF,iBAAO,KAAK,EAAE,QAAQ,SAAS,QAAQ,YAAY,IAAI,IAAI,EAAE,GAAG,KAAK,KAAK,OAAO;AAAA,QACnF;AACA,cAAM,OAAO,OAAO,EAAE,WAAW,WAAW,EAAE,SAAS;AACvD,YAAI,CAACA,MAAK,KAAK,IAAI,EAAG,QAAO,QAAQ,KAAK,kBAAkB,qBAAqB,QAAW,KAAK,OAAO;AACxG,YAAI,UAAU,kCAAkC;AAC9C,gBAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,OAAO;AACnD,cAAI,SAAS,GAAI,QAAO,QAAQ,KAAK,gBAAgB,kBAAkB,QAAQ,KAAK,OAAO;AAC3F,gBAAM,MAAM,MAAM,GAAG,GAAG,IAAI,IAAI,IAAI,IAAI,EAAE,KAAK,GAAG,KAAK;AACvD,cAAI,IAAI,MAAO,QAAO,QAAQ,KAAK,MAAM;AACzC,iBAAO,KAAK,EAAE,QAAQ,WAAW,QAAQ,MAAM,KAAK,GAAG,KAAK,KAAK,OAAO;AAAA,QAC1E;AACA,YAAI,UAAU,oCAAoC;AAChD,gBAAM,MAAM,MAAM,GAAG,GAAG,IAAI,IAAI,IAAI,IAAI,QAAW,QAAQ;AAC3D,cAAI,IAAI,MAAO,QAAO,QAAQ,GAAG;AACjC,mBAAS,OAAO,KAAK,KAAK;AAC1B,iBAAO,KAAK,EAAE,QAAQ,WAAW,QAAQ,KAAK,GAAG,KAAK,KAAK,OAAO;AAAA,QACpE;AACA,YAAI,UAAU,oCAAoC;AAChD,gBAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,GAAG,IAAI,IAAI,IAAI,WAAW,EAAE,WAAW,gBAAgB,GAAG,GAAI,OAAO,EAAE,WAAW,YAAY,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,IAAI,CAAC,EAAG,GAAG,MAAM,cAAc,KAAK,KAAK;AAC5M,cAAI,IAAI,MAAO,QAAO,QAAQ,GAAG;AACjC,iBAAO,KAAK,EAAE,QAAQ,QAAQ,QAAQ,KAAK,GAAG,KAAK,KAAK,OAAO;AAAA,QACjE;AAAA,MACF;AACA,UAAI,UAAU,yBAAyB;AACrC,cAAM,KAAK,OAAO,EAAE,OAAO,WAAW,EAAE,KAAK;AAC7C,YAAI,CAAC,mBAAmB,KAAK,EAAE,EAAG,QAAO,QAAQ,KAAK,iBAAiB,kCAAkC,QAAW,KAAK,OAAO;AAChI,cAAM,MAAM,MAAM,GAAG,sBAAsB,EAAE,IAAI,QAAW,QAAQ;AACpE,YAAI,IAAI,MAAO,QAAO,QAAQ,GAAG;AACjC,eAAO,KAAK,EAAE,QAAQ,gBAAgB,GAAG,GAAG,KAAK,KAAK,OAAO;AAAA,MAC/D;AACA,UAAI,UAAU,oBAAoB;AAChC,cAAM,MAAM,MAAM,GAAG,wBAAwB,QAAW,QAAQ;AAChE,YAAI,IAAI,MAAO,QAAO,QAAQ,GAAG;AAEjC,cAAM,IAAI,IAAI,QAAQ;AACtB,mBAAW,KAAK,WAAW,YAAY,MAAM,SAAS,CAAC,GAAG,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,CAAC,EAAG,GAAE,OAAO,cAAc,CAAC;AAC/H,iBAAS,OAAO,KAAK,KAAK;AAC1B,eAAO,KAAK,EAAE,QAAQ,aAAa,GAAG,KAAK,CAAC;AAAA,MAC9C;AACA,aAAO;AAAA,IACT;AAEA,UAAM,UAAU,CAAC,MAA4B,OAAO,MAAM,YAAY,MAAM,MAAM,EAAE,UAAU;AAC9F,UAAM,UAAU,MAAM,QAAQ,KAAK,iBAAiB,4CAA4C;AAGhG,QAAI,UAAU,mBAAmB;AAC/B,UAAI,CAAC,QAAQ,EAAE,KAAK,EAAG,QAAO,QAAQ;AACtC,YAAM,MAAM,MAAM,mBAAmB,SAAS,EAAE,QAAQ;AACxD,UAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,4BAA4B,EAAE,OAAO,OAAO,EAAE,KAAK,GAAG,cAAc,EAAE,SAAS,CAAC;AACvH,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,SAAS,IAAI,MAAM,SAAS,kBAAkB,aAAa,QAAW,QAAW,IAAI,MAAM,OAAO;AACtK,aAAO,KAAK,EAAE,QAAQ,UAAU,CAAC;AAAA,IACnC;AACA,QAAI,UAAU,iBAAiB;AAC7B,UAAI,CAAC,QAAQ,EAAE,KAAK,EAAG,QAAO,QAAQ;AACtC,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,yBAAyB,EAAE,OAAO,OAAO,EAAE,KAAK,EAAE,CAAC;AAC1F,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,OAAO;AAG3E,UAAI,IAAI,MAAM,aAAc,QAAO,SAAS,SAAS,IAAI,IAAI;AAC7D,aAAO,KAAK,EAAE,QAAQ,WAAW,CAAC;AAAA,IACpC;AAKA,QAAI,UAAU,sBAAsB;AAClC,UAAI,CAAC,QAAQ,EAAE,KAAK,EAAG,QAAO,QAAQ,KAAK,iBAAiB,kDAAkD;AAC9G,YAAM,MAAM,MAAM,mBAAmB,SAAS,EAAE,QAAQ;AACxD,UAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,8BAA8B,EAAE,OAAO,OAAO,EAAE,KAAK,GAAG,UAAU,EAAE,SAAS,CAAC;AACrH,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,SAAS,IAAI,MAAM,SAAS,kBAAkB,aAAa,QAAW,QAAW,IAAI,MAAM,OAAO;AACtK,aAAO,SAAS,SAAS,IAAI,IAAI;AAAA,IACnC;AAIA,QAAI,UAAU,0BAA0B;AAGtC,YAAM,QAAQ,OAAO,EAAE,UAAU,YAAY,WAAW,EAAE,KAAK,MAAM,OAAO,EAAE,MAAM,KAAK,IAAI;AAC7F,YAAM,WAAW,MAAM,EAAE,QAAQ;AACjC,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,iCAAiC,UAAU,KAAK,EAAE,MAAM,IAAI,CAAC,GAAG,QAAW,QAAW,QAAQ;AACrI,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,OAAO;AAC3E,YAAM,OAAa,EAAE,MAAM,WAAW,OAAO,OAAO,IAAI,MAAM,cAAc,EAAE,GAAG,UAAU,aAAa,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC,EAAG;AAC1I,aAAO;AAAA,QAAK,EAAE,QAAQ,WAAW,SAAS,IAAI,MAAM,SAAS,aAAa,IAAI,MAAM,WAAW,KAAK;AAAA,QAAG;AAAA,QACrG,IAAI,QAAQ,EAAE,cAAc,YAAY,YAAY,MAAM,KAAK,OAAO,MAAM,UAAU,CAAC,CAAC,GAAG,MAAM,SAAS,eAAe,CAAC,EAAE,CAAC;AAAA,MAAC;AAAA,IAClI;AACA,QAAI,UAAU,2BAA2B;AACvC,YAAM,SAAS,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,EAAE,IAAI,UAAU;AACxE,YAAM,OAAO,SAAS,MAAM,UAAgB,QAAQ,MAAM,QAAQ,IAAI;AACtE,UAAI,SAAS,QAAQ,KAAK,SAAS,UAAW,QAAO,QAAQ,KAAK,gBAAgB,uDAAuD;AACzI,UAAI,CAAC,aAAa,EAAE,UAAU,EAAG,QAAO,QAAQ,KAAK,eAAe,6CAA6C;AACjH,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,kCAAkC,EAAE,YAAY,KAAK,OAAO,YAAY,EAAE,WAAW,GAAG,QAAW,QAAW,KAAK,aAAa,QAAQ,MAAM,EAAE,QAAQ,CAAC;AAChM,YAAM,QAAQ,YAAY,YAAY,IAAI,MAAM,SAAS,CAAC,CAAC;AAC3D,UAAI,IAAI,OAAO;AAEb,cAAMG,UAAS,CAAC,qBAAqB,mBAAmB,kBAAkB,WAAW,EAAE,SAAS,IAAI,MAAM,IAAI;AAC9G,eAAO,QAAQ,IAAI,QAAQA,UAAS,mBAAmB,IAAI,MAAM,MAAMA,UAAS,mFAAmF,IAAI,MAAM,SAAS,QAAW,IAAI,QAAQ,EAAE,cAAc,MAAM,CAAC,CAAC;AAAA,MACvO;AACA,aAAO,SAAS,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC;AAAA,IAC5C;AAKA,QAAI,UAAU,iCAAiC;AAC7C,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,iCAAiC,CAAC,CAAC;AAC1E,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,OAAO;AAC3E,aAAO,KAAK,EAAE,QAAQ,WAAW,UAAU,OAAO,IAAI,MAAM,aAAa,EAAE,GAAG,OAAO,OAAO,IAAI,MAAM,SAAS,EAAE,EAAE,CAAC;AAAA,IACtH;AACA,QAAI,UAAU,2BAA2B;AACvC,UAAI,OAAO,EAAE,eAAe,YAAY,EAAE,eAAe,GAAI,QAAO,QAAQ,KAAK,eAAe,2CAA2C;AAC3I,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,2BAA2B,EAAE,YAAY,EAAE,WAAW,GAAG,QAAW,QAAW,MAAM,EAAE,QAAQ,CAAC;AACvI,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,OAAO;AAC3E,aAAO,SAAS,SAAS,IAAI,IAAI;AAAA,IACnC;AAIA,QAAI,UAAU,uBAAuB;AACnC,YAAM,MAAM,WAAW,EAAE,KAAK;AAC9B,UAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,UAAI,MAAM,WAAW,OAAW,QAAO,QAAQ,KAAK,kBAAkB,2FAA2F;AAIjK,YAAM,QAAQ,OAAO,EAAE,KAAK,EAAE,KAAK;AAGnC,YAAM,OAAO,OAAO,EAAE,aAAa,WAAW,UAAU,EAAE,UAAU,WAAW,IAAI;AACnF,YAAM,WAAW,MAAM,EAAE,QAAQ;AAEjC,YAAM,QAAQ,CAAC,GAAI,SAAS,cAAc,CAAC,IAAI,CAAC,aAAa,mBAAmB,IAAI,CAAC,EAAE,GAAI,GAAI,WAAW,CAAC,YAAY,IAAI,CAAC,CAAE,EAAE,KAAK,GAAG;AACxI,YAAM,OAAO,UAAU,KAAK,MAAM,SAAS,GAAG,MAAM,MAAM,GAAG,MAAM,OAAO,SAAS,GAAG,IAAI,MAAM,GAAG,GAAG,KAAK;AAC3G,YAAM,IAAI,SAAS,QAAQ,+BAA+B,EAAE,OAAO,GAAI,EAAE,WAAW,OAAO,EAAE,gBAAgB,KAAK,IAAI,CAAC,EAAG,GAAG,IAAI;AAGjI,YAAM,OAAa,EAAE,MAAM,QAAQ,OAAO,OAAO,UAAU,MAAM,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC,EAAG;AACnG,aAAO,KAAK,EAAE,QAAQ,OAAO,GAAG,KAAK,IAAI,QAAQ,EAAE,cAAc,YAAY,YAAY,MAAM,KAAK,OAAO,MAAM,UAAU,CAAC,CAAC,GAAG,MAAM,SAAS,YAAY,CAAC,EAAE,CAAC,CAAC;AAAA,IAClK;AACA,QAAI,UAAU,uBAAuB;AACnC,YAAM,MAAM,UAAU,EAAE,IAAI;AAC5B,UAAI,IAAK,QAAO,QAAQ,GAAG;AAC3B,YAAM,SAAS,YAAY,QAAQ,QAAQ,IAAI,QAAQ,CAAC,EAAE,IAAI,UAAU;AACxE,YAAM,OAAO,SAAS,MAAM,UAAgB,QAAQ,MAAM,QAAQ,IAAI;AACtE,UAAI,SAAS,QAAQ,KAAK,SAAS,OAAQ,QAAO,QAAQ,KAAK,gBAAgB,0DAA0D;AACzI,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,mCAAmC,EAAE,OAAO,KAAK,OAAO,MAAM,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAW,QAAW,KAAK,aAAa,IAAI;AAC1K,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,SAAS,MAAM;AACnF,aAAO,SAAS,SAAS,IAAI,MAAM,CAAC,YAAY,YAAY,IAAI,MAAM,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,UAAU,KAAK,SAAS,CAAC;AAAA,IAClH;AACA,QAAI,UAAU,8BAA8B;AAC1C,UAAI,CAAC,QAAQ,EAAE,KAAK,EAAG,QAAO,QAAQ;AACtC,YAAM,MAAM,MAAM,IAAI,SAAS,QAAQ,8BAA8B,EAAE,OAAO,OAAO,EAAE,KAAK,EAAE,GAAG,QAAW,QAAW,MAAM,EAAE,QAAQ,CAAC;AACxI,UAAI,IAAI,MAAO,QAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,MAAM,IAAI,MAAM,OAAO;AAC3E,aAAO,SAAS,SAAS,IAAI,IAAI;AAAA,IACnC;AACA,WAAO;AAAA,EACT;AAGA,iBAAe,QAAQ,SAAqC;AAC1D,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,SAAS,IAAI,aAAa,YAAY,IAAI,SAAS,WAAW,GAAG,QAAQ,GAAG;AAClF,UAAM,QAAQ,SAAS,uBAAuB,IAAI,SAAS,MAAM,SAAS,MAAM,CAAC,KAAK,MAAM;AAC5F,QAAI,YAAY,UAAU,MAAM;AAC9B,YAAM,UAAU,MAAM,aAAa;AACnC,UAAI,QAAS,QAAO,OAAO,SAAS,KAAK;AAAA,IAC3C;AACA,QAAI;AACF,aAAO,OAAO,MAAM,MAAM,OAAO,GAAG,KAAK;AAAA,IAC3C,SAAS,KAAK;AACZ,UAAI,eAAe,mBAAoB,QAAO,OAAO,QAAQ,KAAK,kBAAkB,IAAI,OAAO,GAAG,KAAK;AACvG,YAAM;AAAA,IACR;AAAA,EACF;AAQA,iBAAe,eAAyC;AACtD,QAAI,CAAC,SAAU,QAAO;AACtB,UAAM,cAAc,MAAM,QAAQ,KAAK,eAAe,sDAAsD;AAC5G,QAAI,SAAS,QAAQ,EAAG,QAAO,YAAY;AAC3C,QAAI;AACJ,UAAM,SAAS,IAAI,QAAmB,CAACN,aAAY;AAAE,cAAQ,WAAW,MAAMA,SAAQ,SAAS,GAAG,cAAc;AAAA,IAAE,CAAC;AACnH,QAAI;AACF,YAAM,QAAQ,SAAS,MAAM;AAC7B,YAAM,MAAM,MAAM,QAAQ,KAAK,CAAC,MAAM,KAAK,MAAM,IAAa,GAAG,SAAS,QAAQ,EAAE,KAAK,QAAO,KAAK,OAAgB,QAAkB,GAAG,MAAM,CAAC;AAEjJ,UAAI,QAAQ,SAAU,OAAM,QAAQ,KAAK,CAAC,OAAO,QAAQ,QAAQ,CAAC,CAAC;AACnE,aAAO,QAAQ,OAAO,OAAO,YAAY;AAAA,IAC3C,SAAS,GAAG;AACV,aAAQ,EAAwB,SAAS,kBACrC,QAAQ,KAAK,iBAAiB,8EAAgF,IAC9G,YAAY;AAAA,IAClB,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF;AAEA,iBAAe,MAAM,SAAqC;AACxD,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,QAAI,IAAI,aAAa,YAAY,CAAC,IAAI,SAAS,WAAW,GAAG,QAAQ,GAAG,EAAG,QAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AAC3H,UAAM,QAAQ,uBAAuB,IAAI,SAAS,MAAM,SAAS,MAAM,CAAC,KAAK;AAC7E,UAAM,MAAM,QAAQ,WAAW,SAAS,QAAQ,WAAW;AAE3D,UAAM,OAAO,MAAM,SAAS,SAAS,KAAK,KAAK;AAC/C,QAAI,SAAS,KAAM,QAAO;AAI1B,QAAI,UAAU,0BAA2B,QAAO,WAAW,OAAO;AAElE,QAAI,UAAU,YAAY,IAAK,QAAO,MAAM,SAAS,GAAG;AACxD,QAAI,UAAU,eAAe,IAAK,QAAO,SAAS,SAAS,GAAG;AAC9D,QAAI,UAAU,cAAc,OAAO,QAAQ,WAAW,QAAS,QAAO,OAAO,OAAO;AAEpF,QAAI,UAAU,cAAc,KAAK;AAC/B,YAAM,IAAI,MAAMA,SAAQ,OAAO;AAC/B,YAAM,IAAI,IAAI,QAAQ;AACtB,iBAAW,KAAK,EAAE,QAAS,GAAE,OAAO,cAAc,CAAC;AACnD,aAAO,KAAK,EAAE,SAAS,EAAE,UAAU,MAAM,SAAS,EAAE,OAAO,IAAI,MAAM,QAAQ,EAAE,OAAO,GAAG,KAAK,CAAC;AAAA,IACjG;AAGA,QAAI,UAAU,cAAc,KAAK;AAC/B,YAAM,IAAI,MAAMA,SAAQ,OAAO;AAC/B,YAAM,OAAO,UAAU,IAAI,aAAa,IAAI,WAAW,GAAG,WAAW;AACrE,UAAI,EAAE,WAAW,kBAAmB,QAAO,SAAS,KAAK,OAAO,IAAI,GAAG,EAAE,OAAO;AAChF,UAAI,EAAE,WAAW,UAAW,QAAO,IAAI,SAAS,4DAA4D,EAAE,QAAQ,IAAI,CAAC;AAC3H,aAAO,SAAS,MAAM,EAAE,OAAO;AAAA,IACjC;AAEA,QAAI,UAAU,cAAc,KAAK;AAC/B,YAAM,IAAI,IAAI,gBAAgB,EAAE,WAAW,gBAAgB,EAAE,CAAC;AAC9D,YAAM,OAAO,UAAU,IAAI,aAAa,IAAI,WAAW,GAAG,EAAE;AAC5D,UAAI,SAAS,GAAI,GAAE,IAAI,aAAa,GAAG,SAAS,OAAO,CAAC,GAAG,IAAI,EAAE;AACjE,YAAM,SAAS,IAAI,aAAa,IAAI,QAAQ;AAC5C,UAAI,UAAU,oBAAoB,KAAK,MAAM,EAAG,GAAE,IAAI,cAAc,MAAM;AAC1E,aAAO,SAAS,GAAG,MAAM,qBAAqB,CAAC,EAAE;AAAA,IACnD;AACA,WAAO,IAAI,SAAS,aAAa,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClD;AAEA,iBAAe,WAAW,SAAqC;AAC7D,QAAI,QAAQ,WAAW,OAAQ,QAAO,IAAI,SAAS,sBAAsB,EAAE,QAAQ,KAAK,SAAS,EAAE,OAAO,OAAO,EAAE,CAAC;AACpH,UAAM,UAAU,qBAAqB,SAAS,yBAAyB;AACvE,QAAI,QAAS,QAAO;AACpB,QAAI,CAAC,WAAW,OAAO,EAAG,QAAO,QAAQ,KAAK,cAAc,kDAAkD;AAC9G,UAAM,IAAI,MAAM,KAAK,OAAO;AAC5B,QAAI,MAAM,KAAM,QAAO,QAAQ,KAAK,eAAe,4BAA4B;AAC/E,UAAM,QAAQ,MAAM,WAAW,OAAO;AACtC,QAAI,cAAc,MAAO,QAAO,MAAM;AACtC,UAAM,MAAM,OAAO,EAAE,mBAAmB,WAAW,EAAE,iBAAiB;AACtE,QAAI,CAACG,MAAK,KAAK,GAAG,EAAG,QAAO,QAAQ,KAAK,wBAAwB,2BAA2B,QAAW,MAAM,OAAO;AACpH,UAAM,QAAQ,CAAC,MAAe,OAAO,MAAM,YAAY,MAAM,MAAM,EAAE,UAAU;AAC/E,QAAI,CAAC,MAAM,EAAE,QAAQ,KAAK,CAAC,MAAM,EAAE,MAAM,EAAG,QAAO,QAAQ,KAAK,eAAe,kCAAkC,QAAW,MAAM,OAAO;AACzI,UAAMU,cAAa,EAAE;AACrB,QAAIA,gBAAe,WAAc,OAAOA,gBAAe,YAAYA,gBAAe,QAAQ,MAAM,QAAQA,WAAU,IAAI;AACpH,aAAO,QAAQ,KAAK,eAAe,iCAAiC,QAAW,MAAM,OAAO;AAAA,IAC9F;AACA,QAAI;AACF,YAAM,IAAI,MAAM,OAAO,MAAM,OAAO;AAAA,QAClC,cAAc;AAAA,QAAK,UAAU,EAAE;AAAA,QAAoB,QAAQ,EAAE;AAAA,QAC7D,GAAIA,gBAAe,SAAY,EAAE,YAAYA,YAAsC,IAAI,CAAC;AAAA,QACxF,GAAI,OAAO,EAAE,eAAe,WAAW,EAAE,YAAY,EAAE,WAAW,IAAI,CAAC;AAAA,QACvE,GAAI,OAAO,EAAE,YAAY,WAAW,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;AAAA,MAChE,CAAC;AACD,aAAO,KAAK,EAAE,QAAQ,WAAW,GAAG,EAAE,GAAG,KAAK,MAAM,OAAO;AAAA,IAC7D,SAAS,GAAG;AACV,YAAM,MAAM,aAAa,iBAAiB,IAAI,IAAI,eAAe,KAAK,eAAe,8BAA8B;AACnH,aAAO,QAAQ,IAAI,QAAQ,IAAI,MAAM,IAAI,QAAQ,QAAQ,sBAAsB,EAAE,GAAG,QAAW,MAAM,OAAO;AAAA,IAC9G;AAAA,EACF;AAEA,iBAAe,QAAQ,SAAkB;AACvC,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,OAAO;AACpC,QAAI,UAAU,QAAQ,MAAM,KAAK,EAAG,QAAO,EAAE,SAAS,UAAU,KAAK,EAAE;AACvE,UAAM,MAAM,IAAI,IAAI,QAAQ,GAAG;AAC/B,UAAM,QAAQ,UAAU,OAAO,SAAS;AAGxC,UAAM,OAAO,QAAQ,WAAW,UAAU,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,gBAAgB,eAChG,QAAQ,QAAQ,IAAI,QAAQ,KAAK,aAAa,SAAS,WAAW;AACrE,QAAI,CAAC,MAAM;AACT,aAAO,EAAE,UAAU,KAAK,EAAE,OAAO,mBAAmB,SAAS,MAAM,GAAG,KAAK,IAAI,QAAQ,EAAE,oBAAoB,MAAM,CAAC,CAAC,EAAE;AAAA,IACzH;AACA,UAAM,OAAO,IAAI,WAAW,IAAI;AAChC,UAAM,KAAK,UAAU,OAAO,KAAK,OAAO,IAAI,IAAI,GAAG,QAAQ,sBAAsB,mBAAmB,IAAI,CAAC;AACzG,WAAO,EAAE,UAAU,SAAS,EAAE,EAAE;AAAA,EAClC;AAIA,QAAM,SAAS,MAAM,iBAAiB,kBAAkB;AACxD,QAAM,gBAAyC,CAAC,IAAI,CAAC,MAAM;AAGzD,QAAI,UAAU;AACZ,UAAI;AACJ,aAAO,OAAO,SAAS;AACrB,cAAM,KAAK,MAAM,SAAS,MAAM;AAChC,YAAI,OAAO,SAAS,IAAI;AACtB,kBAAQ,EAAE,MAAM,IAAI,QAAQ,oBAAoB,EAAE,QAAQ,UAAU,GAAG,OAAO,IAAI,UAAU,GAAG,UAAU,OAAO,MAAM,OAAO,GAAG,EAAE,CAAC,EAAE;AAAA,QACvI;AACA,eAAO,MAAM,OAAO,IAAI;AAAA,MAC1B;AAAA,IACF;AACA,WAAO,oBAAoB;AAAA,MACzB;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,UAAU,MAAM;AAAA,MAChB,OAAO,MAAM;AAAA,MACb,GAAG;AAAA,IACL,CAAC;AAAA,EACH;AACA,QAAM,UAA6B,CAAC,SAAS,IAAI,CAAC,MAChD,cAAc,SAAS,EAAE,QAAQ,KAAK,EAAE,OAAO,GAAG,SAAS,OAAO,CAAC,GAAG,IAAI,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,MAAM,EAAE,MAAM,KAAK,EAAE,KAAK,OAAO,CAAC;AAG3I,QAAM,aAAa,OAAiB;AAAA,IAClC;AAAA,IAAQ,UAAU,MAAM,YAAYjB,KAAI,iBAAiB,KAAK;AAAA,IAAI,QAAQ,EAAE,IAAI,MAAM,YAAYA,KAAI,kBAAkB,KAAK,IAAI,MAAM,OAAO;AAAA,IAC9I;AAAA,IAAQ,WAAW;AAAA,IAAU,mBAAmB;AAAA,IAAU,UAAU,UAAU,CAAC,uBAAuB,OAAO,CAAC,IAAI,CAAC;AAAA,IAAG,eAAe,GAAG,QAAQ;AAAA,IAChJ,KAAK;AAAA,EACP;AAEA,SAAO;AAAA,IACL;AAAA,IACA,OAAO,YAAY;AACjB,UAAI,SAAU,QAAO,SAAS,MAAM;AACpC,YAAM,KAAK,WAAW;AACtB,aAAO,UAAU,EAAE,GAAG,IAAI,KAAK,EAAE,MAAM,MAAM,QAAQ,QAAQ,KAAK,YAAY,KAAK,EAAE,IAAI;AAAA,IAC3F;AAAA,IACA,YAAY,CAAC,WAAwB,WAAW,UAAU,MAAM;AAAA,IAChE;AAAA,IACA;AAAA,IACA,aAAa,OAAO,MAAM,MAAM,cAAc,CAAC,EAAE,IAAI;AAAA,IACrD,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA,SAAAI;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS,EAAE,QAAQ,UAAU,UAAU,aAAa,cAAc,WAAW;AAAA,EAC/E;AACF;AAOA,SAAS,QAAQ,QAAkD;AACjE,SAAO,CAAC,MAAM;AACZ,UAAM,MAAM,OAAO,GAAG,aAAa,WAAW,EAAE,SAAS,KAAK,IAAI;AAClE,QAAI,QAAQ,GAAI,QAAO,CAAC;AACxB,QAAI;AACF,YAAM,MAAM,IAAI,IAAI,IAAI,WAAW,GAAG,KAAK,CAAC,IAAI,WAAW,IAAI,IAAI,GAAG,MAAM,GAAG,GAAG,KAAK,GAAG;AAC1F,aAAO,IAAI,aAAa,YAAY,IAAI,aAAa,UAAU,EAAE,SAAS,IAAI,KAAK,IAAI,CAAC;AAAA,IAC1F,QAAQ;AACN,aAAO,CAAC;AAAA,IACV;AAAA,EACF;AACF;AAGA,SAAS,QAAQ,KAAiJ;AAChK,QAAM,YAAY,MAAM,QAAQ,KAAK,SAAS,IAAI,IAAI,YAAY,CAAC;AACnE,QAAM,WAAW,MAAM,QAAQ,KAAK,gBAAgB,IAAI,IAAI,mBAAmB,CAAC;AAChF,SAAO;AAAA,IACL,WAAW,UAAU,IAAI,CAAC,OAAY,EAAE,MAAM,OAAO,EAAE,QAAQ,EAAE,GAAG,SAAS,OAAO,EAAE,WAAW,EAAE,GAAG,KAAK,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;AAAA,IACjI,iBAAiB,SAAS,IAAI,CAAC,OAAY,EAAE,KAAK,OAAO,EAAE,OAAO,EAAE,GAAG,OAAO,OAAO,EAAE,SAAS,EAAE,GAAG,UAAU,EAAE,aAAa,KAAK,EAAE;AAAA,EACvI;AACF;AAGA,SAAS,WAAW,SAA0B;AAC5C,QAAM,IAAI,QAAQ,YAAY;AAC9B,SAAO,0CAA0C,KAAK,CAAC,KAAK,6BAA6B,KAAK,CAAC,KAC7F,MAAM,SAAS,SAAS,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,KAAK,EAAE,WAAW,aAAa,KAAK,MAAM;AACnG;;;AC59DA,SAAS,gBAAwB;AAC/B,QAAM,QAAQ,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC;AACvD,MAAI,IAAI;AACR,aAAW,KAAK,MAAO,MAAK,OAAO,aAAa,CAAC;AACjD,SAAO,KAAK,CAAC,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC1E;AAGA,eAAsB,cAAc,GAAuC;AACzE,aAAW,iBAAiB,wDAAwD;AACpF,QAAMc,OAAM,CAAC,MAAe,OAAO,YAAY,cAAc,QAAQ,MAAM,CAAC,IAAI;AAChF,QAAM,SAAS,uBAAuB,EAAE,UAAUA,KAAI,eAAe,KAAK,EAAE;AAC5E,QAAM,SAAS,EAAE,UAAUA,KAAI,eAAe,KAAK;AACnD,QAAM,QAAQ,EAAE,SAASA,KAAI,cAAc,KAAK;AAChD,aAAW,CAAC,MAAM,CAAC,KAAK,OAAO,QAAQ,EAAE,eAAe,QAAQ,eAAe,QAAQ,cAAc,MAAM,CAAC,GAAG;AAC7G,QAAI,MAAM,GAAI,OAAM,IAAI,MAAM,mBAAmB,IAAI,kCAAkC;AAAA,EACzF;AACA,QAAM,MAAM,MAAM,SAAS,EAAE,OAAO,EAAE,aAAa,mBAAmB,EAAE,GAAG,MAAM,eAAe;AAAA,IAC9F,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,KAAK,IAAI,gBAAgB,QAAQ,gBAAgB,mBAAmB;AAAA,IACxG,MAAM,KAAK,UAAU;AAAA,MAAE,QAAQ,EAAE;AAAA,MAAQ,SAAS,EAAE;AAAA,MAAQ,MAAM,EAAE;AAAA,MAAM,eAAe,EAAE;AAAA,MACzF,YAAY,EAAE;AAAA,MAAW,QAAQ,EAAE;AAAA,MAAQ,UAAU,EAAE;AAAA,IAAQ,CAAC;AAAA,EACpE,CAAC;AACD,QAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAK/C,MAAI,CAAC,IAAI,MAAM,CAAC,MAAM,MAAM;AAC1B,UAAM,OAAO,MAAM,UAAU,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,OAAO,EAAE,KAAK,IAAI,KAAK,IAAI;AACzF,UAAM,IAAI,MAAM,sDAAsD,IAAI,MAAM,MAAM,GAAG,EAAE;AAAA,EAC7F;AACA,QAAM,IAAI,KAAK;AACf,SAAO;AAAA,IAAE,QAAQ,EAAE;AAAA,IAAQ,UAAU,EAAE,OAAO;AAAA,IAAW,cAAc,EAAE;AAAA,IAAe,cAAc,EAAE,OAAO;AAAA,IAC7G,SAAS,EAAE;AAAA,IAAS,KAAK,EAAE,GAAG,EAAE,KAAK,eAAe,cAAc,EAAE;AAAA,EAAE;AAC1E;","names":["out","out","env","import_jose","out","env","fail","out","out","import_jose","out","out","env","import_jose","fail","out","enc","ASSERTION_TYPE","resolve","out","keysOf","env","env","urls","ASSERTION_TYPE","body","resolve","token","out","UUID","status","bearer","failed","callback","code","done","s","b","res","attributes","env"]}