@deuriib/better-dgii-ecf 0.0.0-stage → 0.0.0

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/errors.ts","../src/client-provider.ts","../src/persistence.ts","../src/tax-payer.ts","../src/resolution.ts","../src/xml.ts","../src/endpoints/shared.ts","../src/endpoints/documents.ts","../src/endpoints/inquiries.ts","../src/endpoints/status.ts","../src/endpoints/audit.ts","../src/plugin.ts"],"names":["defineErrorCodes","APIError","BetterAuthError","ECF","createHash","Environment","Signature","z","createAuthEndpoint","sessionMiddleware","scopeShape","z2","z3","StatusEnvironment","z4"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcO,IAAM,uBAAuBA,2BAAA,CAAiB;AAAA,EACnD,qBAAA,EAAuB,oDAAA;AAAA,EACvB,yBAAA,EACE,yHAAA;AAAA,EACF,wBAAA,EACE,6EAAA;AAAA,EACF,yBAAA,EACE,iGAAA;AAAA,EACF,0BAAA,EACE,2EAAA;AAAA,EACF,2BAAA,EAA6B,yCAAA;AAAA,EAC7B,0BAAA,EACE,4FAAA;AAAA,EACF,iBAAA,EAAmB,+DAAA;AAAA,EACnB,sBAAA,EACE,8EAAA;AAAA,EACF,4BAAA,EACE,4DAAA;AAAA,EACF,0BAAA,EACE,yFAAA;AAAA,EACF,4BAAA,EACE,qEAAA;AAAA,EACF,wBAAA,EACE,2EAAA;AAAA,EACF,mBAAA,EAAqB,4DAAA;AAAA,EACrB,mBAAA,EAAqB,yBAAA;AAAA,EACrB,yBAAA,EAA2B,sCAAA;AAAA,EAC3B,4BAAA,EACE,sEAAA;AAAA,EACF,0BAAA,EACE;AACJ,CAAC;AAaD,IAAM,mBAAA,GACJ;AAAA,EACE,WAAA,EAAa,aAAA;AAAA,EACb,OAAA,EAAS,aAAA;AAAA,EACT,UAAA,EAAY,aAAA;AAAA,EACZ,WAAA,EAAa,uBAAA;AAAA,EACb,WAAA,EAAa,UAAA;AAAA,EACb,IAAA,EAAM,aAAA;AAAA,EACN,IAAA,EAAM,aAAA;AAAA,EACN,OAAA,EAAS,aAAA;AAAA,EACT,YAAA,EAAc,aAAA;AAAA,EACd,OAAA,EAAS;AACX,CAAA;AAmBF,IAAM,eAAA,GAAkB,CAAC,KAAA,MAAyC;AAAA,EAChE,MAAM,KAAA,CAAM,IAAA;AAAA,EACZ,QAAQ,KAAA,CAAM,MAAA;AAAA,EACd,YAAY,KAAA,CAAM,UAAA;AAAA,EAClB,UAAU,KAAA,CAAM,QAAA;AAAA,EAChB,QAAQ,KAAA,CAAM,MAAA;AAAA,EACd,UAAU,KAAA,CAAM;AAClB,CAAA,CAAA;AAQO,IAAM,aAAa,CAAC,KAAA,EAAsB,OAAA,KAC/C,IAAIC,aAAS,aAAA,EAAe;AAAA,EAC1B,OAAA,EAAS,WAAW,KAAA,CAAM,OAAA;AAAA,EAC1B,MAAM,KAAA,CAAM;AACd,CAAC,CAAA;AAEI,IAAM,YAAY,CAAC,KAAA,EAAsB,OAAA,KAC9C,IAAIA,aAAS,WAAA,EAAa;AAAA,EACxB,OAAA,EAAS,WAAW,KAAA,CAAM,OAAA;AAAA,EAC1B,MAAM,KAAA,CAAM;AACd,CAAC,CAAA;AAEI,IAAM,WAAW,CAAC,KAAA,EAAsB,OAAA,KAC7C,IAAIA,aAAS,UAAA,EAAY;AAAA,EACvB,OAAA,EAAS,WAAW,KAAA,CAAM,OAAA;AAAA,EAC1B,MAAM,KAAA,CAAM;AACd,CAAC,CAAA;AAEI,IAAM,cAAc,CAAC,KAAA,EAAsB,OAAA,KAChD,IAAIA,aAAS,uBAAA,EAAyB;AAAA,EACpC,OAAA,EAAS,WAAW,KAAA,CAAM,OAAA;AAAA,EAC1B,MAAM,KAAA,CAAM;AACd,CAAC,CAAA;AAGI,IAAM,UAAA,GAAa,CAAC,KAAA,KACzB,IAAIA,aAAS,mBAAA,CAAoB,KAAA,CAAM,IAAI,CAAA,EAAG;AAAA,EAC5C,SAAS,KAAA,CAAM,OAAA;AAAA,EACf,IAAA,EAAM,qBAAqB,mBAAA,CAAoB,IAAA;AAAA,EAC/C,IAAA,EAAM,gBAAgB,KAAK;AAC7B,CAAC,CAAA;;;ACvGH,IAAM,gBAAA,GAAmB,EAAA;AACzB,IAAM,cAAA,GAAiB,KAAK,EAAA,GAAK,GAAA;AAEjC,IAAM,QAAA,GAAW,CAAC,KAAA,KAChB,CAAA,EAAG,MAAM,WAAW,CAAA,EAAA,EAAS,MAAM,UAAU,CAAA,CAAA;AAO/C,IAAM,WAAA,GAAc,CAAC,UAAA,KACnB,IAAIA,aAAS,uBAAA,EAAyB;AAAA,EACpC,OAAA,EAAS,kDAAkD,UAAU,CAAA,CAAA;AAAA,EACrE,IAAA,EAAM,qBAAqB,4BAAA,CAA6B;AAC1D,CAAC,CAAA;AAaI,IAAM,oBAAA,GAAuB,CAClC,OAAA,EACA,GAAA,GAAoB,KAAK,GAAA,KACC;AAC1B,EAAA,MAAM,YAAY,OAAA,CAAQ,SAAA;AAE1B,EAAA,IAAI,cAAc,MAAA,EAAW;AAC3B,IAAA,OAAO;AAAA,MACL,MAAM,IAAI,KAAA,EAAO;AACf,QAAA,MAAM,MAAA,GAAS,MAAM,SAAA,CAAU,KAAK,CAAA;AACpC,QAAA,IAAI,WAAW,IAAA,EAAM;AACnB,UAAA,MAAM,WAAA,CAAY,MAAM,UAAU,CAAA;AAAA,QACpC;AACA,QAAA,OAAO,MAAA;AAAA,MACT,CAAA;AAAA,MACA,UAAA,GAAa;AAAA,MAEb,CAAA;AAAA,MACA,IAAA,EAAM,CAAA;AAAA,MACN,iBAAA,EAAmB;AAAA,KACrB;AAAA,EACF;AAEA,EAAA,MAAM,qBAAqB,OAAA,CAAQ,WAAA;AACnC,EAAA,IAAI,uBAAuB,MAAA,EAAW;AACpC,IAAA,MAAM,IAAIC,qBAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,MAAM,UAAU,IAAA,CAAK,GAAA,CAAI,GAAG,OAAA,CAAQ,WAAA,EAAa,WAAW,gBAAgB,CAAA;AAC5E,EAAA,MAAM,QAAQ,IAAA,CAAK,GAAA,CAAI,GAAG,OAAA,CAAQ,WAAA,EAAa,SAAS,cAAc,CAAA;AACtE,EAAA,MAAM,KAAA,uBAAY,GAAA,EAAwB;AAE1C,EAAA,MAAM,YAAA,GAAe,CAAC,EAAA,KAAqB;AACzC,IAAA,KAAA,MAAW,CAAC,GAAA,EAAK,KAAK,CAAA,IAAK,KAAA,EAAO;AAChC,MAAA,IAAI,KAAA,CAAM,aAAa,EAAA,EAAI;AACzB,QAAA,KAAA,CAAM,OAAO,GAAG,CAAA;AAAA,MAClB;AAAA,IACF;AAAA,EACF,CAAA;AAEA,EAAA,OAAO;AAAA,IACL,MAAM,IAAI,KAAA,EAAO;AACf,MAAA,MAAM,KAAK,GAAA,EAAI;AACf,MAAA,YAAA,CAAa,EAAE,CAAA;AAEf,MAAA,MAAM,GAAA,GAAM,SAAS,KAAK,CAAA;AAC1B,MAAA,MAAM,MAAA,GAAS,KAAA,CAAM,GAAA,CAAI,GAAG,CAAA;AAC5B,MAAA,IAAI,MAAA,KAAW,MAAA,IAAa,MAAA,CAAO,SAAA,GAAY,EAAA,EAAI;AAEjD,QAAA,KAAA,CAAM,OAAO,GAAG,CAAA;AAChB,QAAA,KAAA,CAAM,GAAA,CAAI,KAAK,MAAM,CAAA;AACrB,QAAA,OAAO,MAAA,CAAO,MAAA;AAAA,MAChB;AAEA,MAAA,MAAM,QAAA,GAAW,MAAM,kBAAA,CAAmB,KAAK,CAAA;AAC/C,MAAA,IAAI,aAAa,IAAA,EAAM;AACrB,QAAA,MAAM,WAAA,CAAY,MAAM,UAAU,CAAA;AAAA,MACpC;AACA,MAAA,IAAI,QAAA,CAAS,GAAA,KAAQ,MAAA,IAAa,QAAA,CAAS,SAAS,MAAA,EAAW;AAC7D,QAAA,MAAM,IAAID,aAAS,uBAAA,EAAyB;AAAA,UAC1C,OAAA,EAAS,CAAA,sCAAA,EAAyC,KAAA,CAAM,UAAU,CAAA,2BAAA,CAAA;AAAA,UAClE,IAAA,EAAM,qBAAqB,4BAAA,CAA6B;AAAA,SACzD,CAAA;AAAA,MACH;AAEA,MAAA,MAAM,YAAA,GAAe,QAAQ,MAAA,EAAQ,MAAA;AACrC,MAAA,MAAM,MAAA,GAAS,IAAIE,aAAA,CAAI,QAAA,EAAU,MAAM,WAAA,EAAa;AAAA,QAClD,GAAI,QAAQ,SAAA,KAAc,MAAA,GAAY,EAAC,GAAI,EAAE,SAAA,EAAW,OAAA,CAAQ,SAAA,EAAU;AAAA,QAC1E,GAAI,YAAA,KAAiB,MAAA,GAAY,EAAC,GAAI,EAAE,YAAA;AAAa,OACtD,CAAA;AAED,MAAA,IAAI,QAAQ,CAAA,EAAG;AACb,QAAA,OAAO,KAAA,CAAM,QAAQ,OAAA,EAAS;AAC5B,UAAA,MAAM,MAAA,GAAS,KAAA,CAAM,IAAA,EAAK,CAAE,IAAA,EAAK;AACjC,UAAA,IAAI,MAAA,CAAO,SAAS,IAAA,EAAM;AACxB,YAAA;AAAA,UACF;AACA,UAAA,KAAA,CAAM,MAAA,CAAO,OAAO,KAAK,CAAA;AAAA,QAC3B;AACA,QAAA,KAAA,CAAM,IAAI,GAAA,EAAK,EAAE,QAAQ,SAAA,EAAW,EAAA,GAAK,OAAO,CAAA;AAAA,MAClD;AACA,MAAA,OAAO,MAAA;AAAA,IACT,CAAA;AAAA,IACA,WAAW,UAAA,EAAY;AACrB,MAAA,IAAI,eAAe,MAAA,EAAW;AAC5B,QAAA,KAAA,CAAM,KAAA,EAAM;AACZ,QAAA;AAAA,MACF;AACA,MAAA,KAAA,MAAW,GAAA,IAAO,KAAA,CAAM,IAAA,EAAK,EAAG;AAC9B,QAAA,IAAI,GAAA,CAAI,QAAA,CAAS,CAAA,EAAA,EAAS,UAAU,EAAE,CAAA,EAAG;AACvC,UAAA,KAAA,CAAM,OAAO,GAAG,CAAA;AAAA,QAClB;AAAA,MACF;AAAA,IACF,CAAA;AAAA,IACA,IAAI,IAAA,GAAO;AACT,MAAA,OAAO,KAAA,CAAM,IAAA;AAAA,IACf,CAAA;AAAA,IACA,iBAAA,EAAmB;AAAA,GACrB;AACF,CAAA;AC1IO,IAAM,gBAAA,GAAmB;AAuChC,IAAM,2BAAA,GAA8B,IAAA;AAG7B,IAAM,YAAA,GAAe,CAAC,GAAA,KAC3BC,iBAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,GAAA,EAAK,MAAM,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA;AAEvD,IAAM,iBAAA,GAAoB,CAAC,KAAA,EAAgB,SAAA,KAAqC;AAC9E,EAAA,IAAI,KAAA,KAAU,MAAA,IAAa,KAAA,KAAU,IAAA,EAAM;AACzC,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI,UAAA;AACJ,EAAA,IAAI;AACF,IAAA,UAAA,GAAa,IAAA,CAAK,UAAU,KAAK,CAAA;AAAA,EACnC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI,eAAe,MAAA,EAAW;AAC5B,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,OAAO,WAAW,MAAA,GAAS,SAAA,GAAY,WAAW,KAAA,CAAM,CAAA,EAAG,SAAS,CAAA,GAAI,UAAA;AAC1E,CAAA;AA8BA,IAAM,aAAA,GAAwC;AAAA,EAC5C,OAAA,EAAS,KAAA;AAAA,EACT,MAAM,UAAA,GAAa;AACjB,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAAA,EACA,MAAM,KAAA,GAAQ;AACZ,IAAA,OAAO,IAAA;AAAA,EACT,CAAA;AAAA,EACA,MAAM,QAAA,GAAW;AAAA,EAEjB,CAAA;AAAA,EACA,MAAM,IAAA,GAAO;AACX,IAAA,MAAM,IAAIH,aAAS,iBAAA,EAAmB;AAAA,MACpC,OAAA,EAAS,qBAAqB,4BAAA,CAA6B,OAAA;AAAA,MAC3D,IAAA,EAAM,qBAAqB,4BAAA,CAA6B;AAAA,KACzD,CAAA;AAAA,EACH;AACF,CAAA;AAUO,IAAM,qBAAA,GAAwB,CACnC,GAAA,EACA,OAAA,KAC2B;AAC3B,EAAA,IAAI,OAAA,EAAS,YAAY,KAAA,EAAO;AAC9B,IAAA,OAAO,aAAA;AAAA,EACT;AACA,EAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,OAAA;AAC5B,EAAA,MAAM,cAAA,GAAiB,SAAS,cAAA,IAAkB,IAAA;AAClD,EAAA,MAAM,iBAAA,GAAoB,SAAS,iBAAA,IAAqB,2BAAA;AAExD,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,IAAA;AAAA,IACT,MAAM,UAAA,CAAW,UAAA,EAAY,cAAA,EAAgB;AAG3C,MAAA,MAAM,IAAA,GAAO,MAAM,OAAA,CAAQ,QAAA,CAA2B;AAAA,QACpD,KAAA,EAAO,gBAAA;AAAA,QACP,KAAA,EAAO;AAAA,UACL,EAAE,KAAA,EAAO,YAAA,EAAc,KAAA,EAAO,UAAA,EAAW;AAAA,UACzC,EAAE,KAAA,EAAO,gBAAA,EAAkB,KAAA,EAAO,cAAA;AAAe,SACnD;AAAA,QACA,KAAA,EAAO,CAAA;AAAA,QACP,MAAA,EAAQ,EAAE,KAAA,EAAO,WAAA,EAAa,WAAW,MAAA;AAAO,OACjD,CAAA;AACD,MAAA,OAAO,IAAA,CAAK,CAAC,CAAA,IAAK,IAAA;AAAA,IACpB,CAAA;AAAA,IACA,MAAM,MAAM,KAAA,EAAO;AACjB,MAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,MAAA,CAAyB;AAAA,QACrD,KAAA,EAAO,gBAAA;AAAA,QACP,IAAA,EAAM;AAAA,UACJ,gBAAgB,KAAA,CAAM,cAAA;AAAA,UACtB,YAAY,KAAA,CAAM,UAAA;AAAA,UAClB,QAAQ,KAAA,CAAM,MAAA;AAAA,UACd,aAAa,KAAA,CAAM,WAAA;AAAA,UACnB,WAAW,KAAA,CAAM,SAAA;AAAA,UACjB,MAAA,EAAQ,SAAA;AAAA,UACR,gBAAgB,KAAA,CAAM,cAAA;AAAA,UACtB,MAAM,KAAA,CAAM,IAAA;AAAA,UACZ,OAAA,EAAS,IAAA;AAAA,UACT,cAAc,KAAA,CAAM,YAAA;AAAA,UACpB,SAAA,EAAW,IAAA;AAAA,UACX,QAAA,EAAU;AAAA;AACZ,OACD,CAAA;AACD,MAAA,OAAO,OAAA,CAAQ,EAAA;AAAA,IACjB,CAAA;AAAA,IACA,MAAM,QAAA,CAAS,EAAA,EAAI,OAAA,EAAS;AAC1B,MAAA,IAAI,OAAO,IAAA,EAAM;AACf,QAAA;AAAA,MACF;AACA,MAAA,MAAM,QAAQ,MAAA,CAAyB;AAAA,QACrC,KAAA,EAAO,gBAAA;AAAA,QACP,OAAO,CAAC,EAAE,OAAO,IAAA,EAAM,KAAA,EAAO,IAAI,CAAA;AAAA,QAClC,MAAA,EAAQ;AAAA,UACN,QAAQ,OAAA,CAAQ,MAAA;AAAA,UAChB,OAAA,EAAS,QAAQ,OAAA,IAAW,IAAA;AAAA,UAC5B,SAAA,EAAW,QAAQ,SAAA,IAAa,IAAA;AAAA,UAChC,UAAU,cAAA,GACN,iBAAA,CAAkB,OAAA,CAAQ,QAAA,EAAU,iBAAiB,CAAA,GACrD;AAAA;AACN,OACD,CAAA;AAAA,IACH,CAAA;AAAA,IACA,MAAM,IAAA,CAAK,EAAE,cAAA,EAAgB,UAAA,EAAY,OAAM,EAAG;AAChD,MAAA,MAAM,QAA4C,EAAC;AACnD,MAAA,IAAI,mBAAmB,IAAA,EAAM;AAC3B,QAAA,KAAA,CAAM,KAAK,EAAE,KAAA,EAAO,gBAAA,EAAkB,KAAA,EAAO,gBAAgB,CAAA;AAAA,MAC/D;AACA,MAAA,IAAI,eAAe,IAAA,EAAM;AACvB,QAAA,KAAA,CAAM,KAAK,EAAE,KAAA,EAAO,YAAA,EAAc,KAAA,EAAO,YAAY,CAAA;AAAA,MACvD;AACA,MAAA,OAAO,QAAQ,QAAA,CAA2B;AAAA,QACxC,KAAA,EAAO,gBAAA;AAAA,QACP,GAAI,KAAA,CAAM,MAAA,GAAS,IAAI,EAAE,KAAA,KAAU,EAAC;AAAA,QACpC,KAAA;AAAA,QACA,MAAA,EAAQ,EAAE,KAAA,EAAO,WAAA,EAAa,WAAW,MAAA;AAAO,OACjD,CAAA;AAAA,IACH;AAAA,GACF;AACF,CAAA;AAaO,IAAM,UAAA,GAAa,CACxB,MAAA,KAI0B;AAC1B,EAAA,IAAI,WAAW,IAAA,EAAM;AACnB,IAAA,OAAO,EAAE,MAAM,SAAA,EAAU;AAAA,EAC3B;AACA,EAAA,IAAI,MAAA,CAAO,WAAW,WAAA,EAAa;AACjC,IAAA,OAAO,EAAE,IAAA,EAAM,QAAA,EAAU,MAAA,EAAO;AAAA,EAClC;AACA,EAAA,IAAI,MAAA,CAAO,WAAW,SAAA,EAAW;AAC/B,IAAA,OAAO,EAAE,MAAM,UAAA,EAAW;AAAA,EAC5B;AACA,EAAA,OAAO,EAAE,MAAM,SAAA,EAAU;AAC3B,CAAA;AAGO,IAAM,mBAAA,GAAsB,CAAC,MAAA,KAAsC;AACxE,EAAA,MAAM,MAAM,MAAA,CAAO,QAAA;AACnB,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,EAAA,EAAI;AACzC,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACvB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF,CAAA;;;ACrPA,IAAM,UAAA,GAAa,YAAA;AAGnB,IAAM,KAAA,GAAQ,oBAAA;AAGP,IAAM,mBAAA,GAAsB,CAAC,KAAA,KAClC,KAAA,CAAM,QAAQ,UAAA,EAAY,EAAE,EAAE,IAAA;AAQzB,IAAM,iBAAA,GAAoB,CAAC,KAAA,KAA2B,KAAA,CAAM,KAAK,KAAK;AActE,IAAM,eAAA,GAAN,cAA8B,KAAA,CAAM;AAAA,EAChC,MAAA;AAAA,EAET,WAAA,CAAY,QAA4B,OAAA,EAAiB;AACvD,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AACZ,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AAAA,EAChB;AACF,CAAA;AAQO,IAAM,yBAAA,GAA4B,OACvC,GAAA,EACA,UAAA,KACoB;AACpB,EAAA,MAAM,UAAA,GAAa,oBAAoB,GAAG,CAAA;AAC1C,EAAA,IAAI,eAAe,EAAA,EAAI;AACrB,IAAA,MAAM,IAAI,eAAA,CAAgB,OAAA,EAAS,0BAA0B,CAAA;AAAA,EAC/D;AACA,EAAA,IAAI,eAAe,KAAA,EAAO;AACxB,IAAA,OAAO,UAAA;AAAA,EACT;AACA,EAAA,IAAI,eAAe,QAAA,EAAU;AAC3B,IAAA,IAAI,CAAC,iBAAA,CAAkB,UAAU,CAAA,EAAG;AAClC,MAAA,MAAM,IAAI,eAAA;AAAA,QACR,OAAA;AAAA,QACA,IAAI,GAAG,CAAA,uDAAA;AAAA,OACT;AAAA,IACF;AACA,IAAA,OAAO,UAAA;AAAA,EACT;AACA,EAAA,MAAM,OAAA,GAAU,MAAM,UAAA,CAAW,UAAU,CAAA;AAC3C,EAAA,IAAI,YAAY,KAAA,EAAO;AACrB,IAAA,MAAM,IAAI,eAAA,CAAgB,QAAA,EAAU,CAAA,CAAA,EAAI,GAAG,CAAA,+BAAA,CAAiC,CAAA;AAAA,EAC9E;AACA,EAAA,IAAI,OAAO,YAAY,QAAA,EAAU;AAC/B,IAAA,OAAO,oBAAoB,OAAO,CAAA;AAAA,EACpC;AACA,EAAA,OAAO,UAAA;AACT,CAAA;;;ACrEA,IAAM,kBAAA,GAAqB,cAAA;AAE3B,IAAM,YAAA,GAAe,QAAA;AAErB,IAAM,aAAA,GAAgB,CAAC,OAAA,EAAS,OAAO,CAAA;AA8BhC,IAAM,qBAAA,GAAwB,CAAC,GAAA,KAAA,CACnC,GAAA,CAAI,QAAQ,OAAA,CAAQ,OAAA,IAAW,EAAC,EAAG,IAAA,CAAK,CAAC,MAAA,KAAW,MAAA,CAAO,OAAO,cAAc,CAAA;AAEnF,IAAM,qBAAA,GAAwB,CAAC,GAAA,EAAsB,KAAA,KAAiC;AAGpF,EAAA,MAAM,MAAM,GAAA,CAAI,KAAK,CAAA,IAAK,GAAA,CAAI,cAAc,GAAA,CAAI,YAAA;AAChD,EAAA,IAAI,OAAO,QAAQ,QAAA,EAAU;AAC3B,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,UAAA,GAAa,oBAAoB,GAAG,CAAA;AAC1C,EAAA,OAAO,UAAA,KAAe,KAAK,IAAA,GAAO,UAAA;AACpC,CAAA;AAEA,IAAM,wBAAA,GAA2B,CAAC,OAAA,KAAoC;AACpE,EAAA,MAAM,MAAO,OAAA,CAA+C,oBAAA;AAC5D,EAAA,OAAO,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,KAAK,GAAA,GAAM,IAAA;AACvD,CAAA;AAEA,IAAM,OAAA,GAAU,CAAC,MAAA,KACf,MAAA,CAAO,OAAO,IAAA,IAAQ,EAAE,CAAA,CACrB,KAAA,CAAM,GAAG,CAAA,CACT,IAAI,CAAC,IAAA,KAAS,KAAK,IAAA,EAAM,EACzB,MAAA,CAAO,CAAC,IAAA,KAAS,IAAA,KAAS,EAAE,CAAA;AAQjC,IAAM,aAAA,GAAgB,OACpB,OAAA,EACA,KAAA,KACyB;AACzB,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,WAAA,IAAeI,qBAAA,CAAY,GAAA;AACtD,EAAA,IAAI,OAAO,eAAe,UAAA,EAAY;AACpC,IAAA,OAAO,UAAA,CAAW;AAAA,MAChB,YAAY,KAAA,CAAM,UAAA;AAAA,MAClB,gBAAgB,KAAA,CAAM,cAAA;AAAA,MACtB,MAAA,EAAQ,MAAM,IAAA,CAAK;AAAA,KACpB,CAAA;AAAA,EACH;AACA,EAAA,OAAO,UAAA;AACT,CAAA;AAgBO,IAAM,sBAAsB,OAAO;AAAA,EACxC,GAAA;AAAA,EACA,OAAA;AAAA,EACA;AACF,CAAA,KAAyD;AACvD,EAAA,MAAM,aAAA,GAAgB,IAAI,OAAA,CAAQ,OAAA;AAClC,EAAA,IAAI,kBAAkB,IAAA,EAAM;AAC1B,IAAA,MAAM,IAAIJ,aAAS,cAAA,EAAgB;AAAA,MACjC,OAAA,EAAS,qBAAqB,qBAAA,CAAsB,OAAA;AAAA,MACpD,IAAA,EAAM,qBAAqB,qBAAA,CAAsB;AAAA,KAClD,CAAA;AAAA,EACH;AACA,EAAA,MAAM,EAAE,IAAA,EAAM,OAAA,EAAQ,GAAI,aAAA;AAE1B,EAAA,MAAM,gBAAA,GAAmB,sBAAsB,GAAG,CAAA;AAClD,EAAA,MAAM,iBACJ,KAAA,CAAM,cAAA,KACL,gBAAA,GAAmB,wBAAA,CAAyB,OAAO,CAAA,GAAI,IAAA,CAAA;AAE1D,EAAA,IAAI,YAAA,GAAuC,IAAA;AAC3C,EAAA,IAAI,sBAAA,GAAwC,IAAA;AAC5C,EAAA,IAAI,gBAAA,IAAoB,mBAAmB,IAAA,EAAM;AAC/C,IAAA,YAAA,GAAe,MAAM,GAAA,CAAI,OAAA,CAAQ,OAAA,CAAQ,OAAA,CAAyB;AAAA,MAChE,KAAA,EAAO,kBAAA;AAAA,MACP,OAAO,CAAC,EAAE,OAAO,IAAA,EAAM,KAAA,EAAO,gBAAgB;AAAA,KAC/C,CAAA;AACD,IAAA,IAAI,iBAAiB,IAAA,EAAM;AACzB,MAAA,MAAM,IAAIA,aAAS,WAAA,EAAa;AAAA,QAC9B,OAAA,EAAS,qBAAqB,2BAAA,CAA4B,OAAA;AAAA,QAC1D,IAAA,EAAM,qBAAqB,2BAAA,CAA4B;AAAA,OACxD,CAAA;AAAA,IACH;AACA,IAAA,sBAAA,GAAyB,qBAAA;AAAA,MACvB,YAAA;AAAA,MACA,OAAA,CAAQ,cAAc,KAAA,IAAS;AAAA,KACjC;AAAA,EACF;AAEA,EAAA,MAAM,UAAA,GAAmC,QAAQ,kBAAA,IAAsB,QAAA;AACvE,EAAA,MAAM,WAAA,GAAc,OAAO,GAAA,KAAiC;AAC1D,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,yBAAA,CAA0B,GAAA,EAAK,UAAU,CAAA;AAAA,IACxD,SAAS,KAAA,EAAO;AACd,MAAA,IAAI,iBAAiB,eAAA,EAAiB;AACpC,QAAA,MAAM,UAAA,CAAW,oBAAA,CAAqB,wBAAA,EAA0B,KAAA,CAAM,OAAO,CAAA;AAAA,MAC/E;AACA,MAAA,MAAM,KAAA;AAAA,IACR;AAAA,EACF,CAAA;AAEA,EAAA,IAAI,UAAA,GAA4B,IAAA;AAChC,EAAA,IAAI,MAAA,GAAkC,SAAA;AAEtC,EAAA,IAAI,KAAA,CAAM,eAAe,MAAA,EAAW;AAClC,IAAA,UAAA,GAAa,MAAM,WAAA,CAAY,KAAA,CAAM,UAAU,CAAA;AAAA,EACjD,CAAA,MAAA,IAAW,2BAA2B,IAAA,EAAM;AAC1C,IAAA,UAAA,GAAa,MAAM,YAAY,sBAAsB,CAAA;AACrD,IAAA,MAAA,GAAS,cAAA;AAAA,EACX,CAAA,MAAO;AACL,IAAA,MAAM,WAAkD,OAAA,CAAQ,iBAAA;AAChE,IAAA,MAAM,YAAA,GACJ,QAAA,KAAa,MAAA,GAAY,IAAA,GAAO,MAAM,SAAS,EAAE,IAAA,EAAM,OAAA,EAAS,cAAA,EAAgB,CAAA;AAClF,IAAA,IAAI,iBAAiB,IAAA,EAAM;AACzB,MAAA,UAAA,GAAa,MAAM,YAAY,YAAY,CAAA;AAC3C,MAAA,MAAA,GAAS,UAAA;AAAA,IACX;AAAA,EACF;AAEA,EAAA,IAAI,eAAe,IAAA,EAAM;AACvB,IAAA,MAAM,UAAA,CAAW,qBAAqB,yBAAyB,CAAA;AAAA,EACjE;AAEA,EAAA,MAAM,SAAA,CAAU;AAAA,IACd,GAAA;AAAA,IACA,OAAA;AAAA,IACA,IAAA;AAAA,IACA,OAAA;AAAA,IACA,UAAA;AAAA,IACA,cAAA,EAAgB,mBAAmB,cAAA,GAAiB,IAAA;AAAA,IACpD,YAAA;AAAA,IACA,sBAAA;AAAA,IACA,MAAA;AAAA,IACA;AAAA,GACD,CAAA;AAED,EAAA,MAAM,QAAA,GAAqD;AAAA,IACzD,UAAA;AAAA,IACA,cAAA,EAAgB,mBAAmB,cAAA,GAAiB,IAAA;AAAA,IACpD,sBAAA;AAAA,IACA,MAAA;AAAA,IACA,QAAQ,IAAA,CAAK,EAAA;AAAA,IACb,IAAA;AAAA,IACA;AAAA,GACF;AAEA,EAAA,OAAO,EAAE,GAAG,QAAA,EAAU,WAAA,EAAa,MAAM,aAAA,CAAc,OAAA,EAAS,QAAQ,CAAA,EAAE;AAC5E,CAAA;AA6BA,IAAM,SAAA,GAAY,OAAO,KAAA,KAAyC;AAChE,EAAA,MAAM,MAAA,GAAS,MAAM,OAAA,CAAQ,SAAA;AAC7B,EAAA,IAAI,WAAW,MAAA,EAAW;AACxB,IAAA,MAAM,OAAA,GAAU,MAAM,MAAA,CAAO;AAAA,MAC3B,MAAM,KAAA,CAAM,IAAA;AAAA,MACZ,SAAS,KAAA,CAAM,OAAA;AAAA,MACf,YAAY,KAAA,CAAM,UAAA;AAAA,MAClB,gBAAgB,KAAA,CAAM,cAAA;AAAA,MACtB,wBAAwB,KAAA,CAAM,sBAAA;AAAA,MAC9B,QAAQ,KAAA,CAAM;AAAA,KACf,CAAA;AACD,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,SAAA,CAAU,qBAAqB,0BAA0B,CAAA;AAAA,IACjE;AACA,IAAA;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,MAAM,gBAAA,EAAkB;AAC3B,IAAA;AAAA,EACF;AAEA,EAAA,IAAI,KAAA,CAAM,cAAA,KAAmB,IAAA,IAAQ,KAAA,CAAM,iBAAiB,IAAA,EAAM;AAChE,IAAA,IAAI,MAAM,MAAA,KAAW,SAAA,IAAa,KAAA,CAAM,OAAA,CAAQ,6BAA6B,IAAA,EAAM;AACjF,MAAA;AAAA,IACF;AACA,IAAA,IAAI,KAAA,CAAM,WAAW,UAAA,EAAY;AAE/B,MAAA;AAAA,IACF;AACA,IAAA,MAAM,UAAA,CAAW,qBAAqB,0BAA0B,CAAA;AAAA,EAClE;AAEA,EAAA,MAAM,SAAS,MAAM,KAAA,CAAM,GAAA,CAAI,OAAA,CAAQ,QAAQ,OAAA,CAAmB;AAAA,IAChE,KAAA,EAAO,YAAA;AAAA,IACP,KAAA,EAAO;AAAA,MACL,EAAE,KAAA,EAAO,gBAAA,EAAkB,KAAA,EAAO,MAAM,cAAA,EAAe;AAAA,MACvD,EAAE,KAAA,EAAO,QAAA,EAAU,KAAA,EAAO,KAAA,CAAM,KAAK,EAAA;AAAG;AAC1C,GACD,CAAA;AACD,EAAA,IAAI,WAAW,IAAA,EAAM;AACnB,IAAA,MAAM,SAAA,CAAU,qBAAqB,iBAAiB,CAAA;AAAA,EACxD;AAEA,EAAA,MAAM,YAAA,GAAe,KAAA,CAAM,OAAA,CAAQ,KAAA,IAAS,aAAA;AAC5C,EAAA,MAAM,WAAA,GAAc,QAAQ,MAAM,CAAA;AAClC,EAAA,IAAI,CAAC,YAAY,IAAA,CAAK,CAAC,SAAS,YAAA,CAAa,QAAA,CAAS,IAAI,CAAC,CAAA,EAAG;AAC5D,IAAA,MAAM,SAAA;AAAA,MACJ,oBAAA,CAAqB,sBAAA;AAAA,MACrB,CAAA,EAAG,qBAAqB,sBAAA,CAAuB,OAAO,sBAAsB,YAAA,CAAa,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA;AAAA,KACrG;AAAA,EACF;AAEA,EAAA,IACE,MAAM,sBAAA,KAA2B,IAAA,IACjC,KAAA,CAAM,sBAAA,KAA2B,MAAM,UAAA,EACvC;AACA,IAAA,MAAM,SAAA;AAAA,MACJ,oBAAA,CAAqB,0BAAA;AAAA,MACrB,CAAA,aAAA,EAAgB,MAAM,cAAc,CAAA,cAAA,EAAiB,MAAM,sBAAsB,CAAA,MAAA,EAAS,MAAM,UAAU,CAAA;AAAA,KAC5G;AAAA,EACF;AACF,CAAA;;;ACrRA,IAAM,aAAA,uBAAoB,GAAA,EAAoB;AAM9C,IAAM,cAAA,GAAiB,CAAA,2BAAA,CAAA;AAEvB,IAAM,eAAe,CAAC,KAAA,KACpB,KAAA,CAAM,OAAA,CAAQ,uBAAuB,MAAM,CAAA;AAE7C,IAAM,cAAA,GAAiB,CAAC,GAAA,KAAwB;AAC9C,EAAA,MAAM,MAAA,GAAS,aAAA,CAAc,GAAA,CAAI,GAAG,CAAA;AACpC,EAAA,IAAI,WAAW,MAAA,EAAW;AACxB,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,MAAM,IAAA,GAAO,aAAa,GAAG,CAAA;AAC7B,EAAA,MAAM,MAAA,GAAS,gBAAA;AACf,EAAA,MAAM,UAAU,IAAI,MAAA;AAAA,IAClB,CAAA,CAAA,EAAI,MAAM,CAAA,EAAG,IAAI,GAAG,cAAc,CAAA,iBAAA,EAAoB,MAAM,CAAA,EAAG,IAAI,CAAA,KAAA;AAAA,GACrE;AACA,EAAA,aAAA,CAAc,GAAA,CAAI,KAAK,OAAO,CAAA;AAC9B,EAAA,OAAO,OAAA;AACT,CAAA;AAUA,IAAM,cAAA,GAAiB,CAAC,GAAA,EAAa,IAAA,KAAyB;AAC5D,EAAA,IAAI,GAAA,CAAI,UAAA,CAAW,MAAA,EAAQ,IAAI,CAAA,EAAG;AAChC,IAAA,MAAM,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,KAAA,EAAO,OAAO,CAAC,CAAA;AACvC,IAAA,OAAO,GAAA,KAAQ,EAAA,GAAK,GAAA,CAAI,MAAA,GAAS,GAAA,GAAM,CAAA;AAAA,EACzC;AACA,EAAA,IAAI,GAAA,CAAI,UAAA,CAAW,IAAA,EAAM,IAAI,CAAA,EAAG;AAC9B,IAAA,MAAM,GAAA,GAAM,GAAA,CAAI,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAC,CAAA;AACtC,IAAA,OAAO,GAAA,KAAQ,EAAA,GAAK,GAAA,CAAI,MAAA,GAAS,GAAA,GAAM,CAAA;AAAA,EACzC;AACA,EAAA,IAAI,GAAA,CAAI,UAAA,CAAW,IAAA,EAAM,IAAI,CAAA,EAAG;AAG9B,IAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,IAAA,KAAA,IAAS,SAAS,IAAA,GAAO,CAAA,EAAG,SAAS,GAAA,CAAI,MAAA,EAAQ,UAAU,CAAA,EAAG;AAC5D,MAAA,MAAM,SAAA,GAAY,IAAI,MAAM,CAAA;AAC5B,MAAA,IAAI,cAAc,GAAA,EAAK;AACrB,QAAA,KAAA,IAAS,CAAA;AAAA,MACX,CAAA,MAAA,IAAW,cAAc,GAAA,EAAK;AAC5B,QAAA,KAAA,GAAQ,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,KAAA,GAAQ,CAAC,CAAA;AAAA,MAC/B,CAAA,MAAA,IAAW,SAAA,KAAc,GAAA,IAAO,KAAA,KAAU,CAAA,EAAG;AAC3C,QAAA,OAAO,MAAA,GAAS,CAAA;AAAA,MAClB;AAAA,IACF;AACA,IAAA,OAAO,GAAA,CAAI,MAAA;AAAA,EACb;AACA,EAAA,OAAO,EAAA;AACT,CAAA;AAUA,IAAM,uBAAA,GAA0B,CAAC,GAAA,KAAwB;AACvD,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,IAAI,KAAA,GAAQ,CAAA;AACZ,EAAA,WAAS;AACP,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,OAAA,CAAQ,GAAA,EAAK,KAAK,CAAA;AACnC,IAAA,IAAI,SAAS,EAAA,EAAI;AACf,MAAA,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,KAAK,CAAC,CAAA;AAC3B,MAAA,OAAO,KAAA,CAAM,KAAK,EAAE,CAAA;AAAA,IACtB;AACA,IAAA,KAAA,CAAM,IAAA,CAAK,GAAA,CAAI,KAAA,CAAM,KAAA,EAAO,IAAI,CAAC,CAAA;AACjC,IAAA,MAAM,GAAA,GAAM,cAAA,CAAe,GAAA,EAAK,IAAI,CAAA;AACpC,IAAA,IAAI,QAAQ,EAAA,EAAI;AAGd,MAAA,KAAA,CAAM,KAAK,GAAG,CAAA;AACd,MAAA,KAAA,GAAQ,IAAA,GAAO,CAAA;AACf,MAAA;AAAA,IACF;AACA,IAAA,KAAA,GAAQ,GAAA;AAAA,EACV;AACF,CAAA;AAOO,IAAM,WAAA,GAAc,CAAC,GAAA,EAAa,GAAA,KAAoC;AAC3E,EAAA,MAAM,IAAA,GAAO,cAAA,CAAe,GAAG,CAAA,CAAE,IAAA,CAAK,uBAAA,CAAwB,GAAG,CAAC,CAAA,GAAI,CAAC,CAAA,EAAG,IAAA,EAAK;AAC/E,EAAA,OAAO,IAAA,KAAS,MAAA,IAAa,IAAA,KAAS,EAAA,GAAK,MAAA,GAAY,IAAA;AACzD,CAAA;AAEA,IAAM,YAAA,GAAe,oDAAA;AASd,IAAM,eAAA,GAAkB,CAAC,GAAA,KAC9B,YAAA,CAAa,KAAK,uBAAA,CAAwB,GAAG,CAAC,CAAA,GAAI,CAAC,CAAA;AAGrD,IAAM,WAAA,GAAc,CAAC,WAAA,EAAa,WAAW,CAAA;AAStC,IAAM,gBAAA,GAAmB,CAAC,GAAA,KAAoC;AACnE,EAAA,KAAA,MAAW,OAAO,WAAA,EAAa;AAC7B,IAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,GAAA,EAAK,GAAG,CAAA;AAClC,IAAA,IAAI,UAAU,MAAA,EAAW;AACvB,MAAA,OAAO,KAAA;AAAA,IACT;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT,CAAA;;;AC1GO,IAAM,OAAA,GAAU,OACrB,IAAA,EACA,GAAA,EACA,KAAA,KAC6B;AAC7B,EAAA,MAAM,KAAA,GAAQ,MAAM,mBAAA,CAAoB,EAAE,KAAK,OAAA,EAAS,IAAA,CAAK,OAAA,EAAS,KAAA,EAAO,CAAA;AAC7E,EAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,QAAA,CAAS,IAAI,KAAK,CAAA;AAC5C,EAAA,OAAO,EAAE,OAAO,MAAA,EAAO;AACzB,CAAA;AASO,IAAM,MAAA,GAAS,CAAI,MAAA,KAA6B;AACrD,EAAA,IAAI,MAAA,CAAO,OAAM,EAAG;AAClB,IAAA,MAAM,UAAA,CAAW,OAAO,KAAK,CAAA;AAAA,EAC/B;AACA,EAAA,OAAO,MAAA,CAAO,KAAA;AAChB,CAAA;AAWO,IAAM,YAAA,GAAe,CAAC,GAAA,EAAa,UAAA,KAA6B;AACrE,EAAA,MAAM,MAAA,GAAS,iBAAiB,GAAG,CAAA;AACnC,EAAA,IAAI,WAAW,MAAA,EAAW;AACxB,IAAA,MAAM,UAAA,CAAW,qBAAqB,wBAAwB,CAAA;AAAA,EAChE;AACA,EAAA,IAAI,mBAAA,CAAoB,MAAM,CAAA,KAAM,UAAA,EAAY;AAC9C,IAAA,MAAM,SAAA;AAAA,MACJ,oBAAA,CAAqB,yBAAA;AAAA,MACrB,CAAA,0BAAA,EAA6B,MAAM,CAAA,2BAAA,EAA8B,UAAU,CAAA;AAAA,KAC7E;AAAA,EACF;AACF,CAAA;AAUO,IAAM,YAAA,GAAe,OAC1B,IAAA,EACA,KAAA,EACA,GAAA,KACoB;AACpB,EAAA,MAAM,QAAA,GAAW,KAAK,OAAA,CAAQ,WAAA;AAC9B,EAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,IAAA,MAAM,WAAA;AAAA,MACJ,oBAAA,CAAqB,4BAAA;AAAA,MACrB;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,QAAA,GAAW,MAAM,QAAA,CAAS,KAAK,CAAA;AACrC,EAAA,IAAI,aAAa,IAAA,EAAM;AACrB,IAAA,MAAM,WAAA;AAAA,MACJ,oBAAA,CAAqB,4BAAA;AAAA,MACrB,CAAA,0CAAA,EAA6C,MAAM,UAAU,CAAA;AAAA,KAC/D;AAAA,EACF;AACA,EAAA,MAAM,EAAE,GAAA,EAAK,IAAA,EAAK,GAAI,QAAA;AACtB,EAAA,IAAI,GAAA,KAAQ,MAAA,IAAa,IAAA,KAAS,MAAA,EAAW;AAI3C,IAAA,MAAM,WAAA;AAAA,MACJ,oBAAA,CAAqB,4BAAA;AAAA,MACrB;AAAA,KACF;AAAA,EACF;AACA,EAAA,MAAM,SAAA,GAAY,IAAIK,mBAAA,CAAU,GAAA,EAAK,IAAI,CAAA;AACzC,EAAA,MAAM,IAAA,GAAO,gBAAgB,GAAG,CAAA;AAChC,EAAA,MAAM,MAAA,GACJ,IAAA,KAAS,MAAA,GAAY,SAAA,CAAU,OAAA,CAAQ,GAAG,CAAA,GAAI,SAAA,CAAU,OAAA,CAAQ,GAAA,EAAK,IAAI,CAAA;AAC3E,EAAA,IAAI,MAAA,CAAO,OAAM,EAAG;AAClB,IAAA,MAAM,IAAIL,aAAS,aAAA,EAAe;AAAA,MAChC,OAAA,EAAS,OAAO,KAAA,CAAM,OAAA;AAAA,MACtB,IAAA,EAAM,qBAAqB,mBAAA,CAAoB,IAAA;AAAA,MAC/C,IAAA,EAAM,EAAE,IAAA,EAAM,MAAA,CAAO,MAAM,IAAA;AAAK,KACjC,CAAA;AAAA,EACH;AACA,EAAA,OAAO,MAAA,CAAO,KAAA;AAChB,CAAA;AAGO,IAAM,YAAA,GAAe,CAAC,GAAA,KAC3B,WAAA,CAAY,KAAK,MAAM,CAAA,IACvB,WAAA,CAAY,GAAA,EAAK,oBAAoB,CAAA,IACrC,WAAA,CAAY,GAAA,EAAK,UAAU,CAAA,IAC3B,IAAA;AAwBF,IAAM,SAAA,GAAY,CAAC,KAAA,KAAkC;AACnD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,IAAA,EAAM;AAC/C,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,YAAa,KAAA,CAAgC,OAAA;AACnD,EAAA,OAAO,OAAO,SAAA,KAAc,QAAA,IAAY,SAAA,KAAc,KAAK,SAAA,GAAY,IAAA;AACzE,CAAA;AAUO,IAAM,gBAAgB,OAAU;AAAA,EACrC,GAAA;AAAA,EACA,IAAA;AAAA,EACA,KAAA;AAAA,EACA,SAAA;AAAA,EACA,GAAA;AAAA,EACA,cAAA;AAAA,EACA;AACF,CAAA,KAA4D;AAC1D,EAAA,MAAM,KAAA,GAAQ,qBAAA,CAAsB,GAAA,EAAK,IAAA,CAAK,QAAQ,WAAW,CAAA;AACjE,EAAA,MAAM,YAAA,GAAe,aAAa,GAAG,CAAA;AACrC,EAAA,MAAM,YAAY,cAAA,IAAkB,YAAA;AAEpC,EAAA,IAAI,MAAM,OAAA,EAAS;AACjB,IAAA,MAAM,WAAW,MAAM,KAAA,CAAM,UAAA,CAAW,KAAA,CAAM,YAAY,SAAS,CAAA;AACnE,IAAA,MAAM,QAAA,GAAW,WAAW,QAAQ,CAAA;AACpC,IAAA,IAAI,QAAA,CAAS,SAAS,UAAA,EAAY;AAChC,MAAA,MAAM,QAAA;AAAA,QACJ,oBAAA,CAAqB,0BAAA;AAAA,QACrB,CAAA,0DAAA,EAA6D,QAAA,EAAU,EAAA,IAAM,SAAS,CAAA,yCAAA;AAAA,OACxF;AAAA,IACF;AACA,IAAA,IAAI,QAAA,CAAS,SAAS,QAAA,EAAU;AAC9B,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,mBAAA,CAAoB,QAAA,CAAS,MAAM,CAAA;AAAA,QAC3C,QAAA,EAAU,IAAA;AAAA,QACV,YAAA,EAAc,SAAS,MAAA,CAAO;AAAA,OAChC;AAAA,IACF;AAAA,EACF;AAEA,EAAA,MAAM,YAAA,GAAe,MAAM,KAAA,CAAM,KAAA,CAAM;AAAA,IACrC,gBAAgB,KAAA,CAAM,cAAA;AAAA,IACtB,YAAY,KAAA,CAAM,UAAA;AAAA,IAClB,QAAQ,KAAA,CAAM,MAAA;AAAA,IACd,aAAa,KAAA,CAAM,WAAA;AAAA,IACnB,SAAA;AAAA,IACA,cAAA,EAAgB,SAAA;AAAA,IAChB,IAAA,EAAM,aAAa,GAAG,CAAA;AAAA,IACtB;AAAA,GACD,CAAA;AAED,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,MAAA,CAAO,MAAM,IAAA,EAAM,CAAA;AAAA,EAC9B,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,SAAA,GACJ,KAAA,YAAiBA,YAAAA,GACb,MAAA,CAAO,KAAA,CAAM,IAAA,EAAM,IAAA,IAAQ,KAAA,CAAM,MAAM,CAAA,GACvC,KAAA,YAAiB,KAAA,GACf,MAAM,IAAA,GACN,SAAA;AACR,IAAA,MAAM,MAAM,QAAA,CAAS,YAAA,EAAc,EAAE,MAAA,EAAQ,QAAA,EAAU,WAAW,CAAA;AAClE,IAAA,MAAM,KAAA;AAAA,EACR;AAEA,EAAA,MAAM,KAAA,CAAM,SAAS,YAAA,EAAc;AAAA,IACjC,MAAA,EAAQ,WAAA;AAAA,IACR,OAAA,EAAS,UAAU,MAAM,CAAA;AAAA,IACzB,QAAA,EAAU;AAAA,GACX,CAAA;AAED,EAAA,OAAO,EAAE,MAAA,EAAQ,QAAA,EAAU,KAAA,EAAO,YAAA,EAAa;AACjD,CAAA;AAGO,IAAM,SAAA,GAAY,CAAC,KAAA,MAAyB;AAAA,EACjD,YAAY,KAAA,CAAM,UAAA;AAAA,EAClB,gBAAgB,KAAA,CAAM,cAAA;AAAA,EACtB,aAAa,KAAA,CAAM;AACrB,CAAA,CAAA;;;ACvOA,IAAM,UAAA,GAAa;AAAA,EACjB,UAAA,EAAcM,qBAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,QAAA,GAAW,IAAA,CAAK;AAAA,IAC5C,WAAA,EACE;AAAA,GACH,CAAA;AAAA,EACD,cAAA,EAAkBA,qBAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,QAAA,GAAW,IAAA,CAAK;AAAA,IAChD,WAAA,EACE;AAAA,GACH;AACH,CAAA;AAEA,IAAM,aAAA,GAAgB;AAAA,EACpB,GAAG,UAAA;AAAA,EACH,GAAA,EAAOA,YAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,EAAE,IAAA,CAAK,EAAE,WAAA,EAAa,4BAAA,EAA8B,CAAA;AAAA,EACzE,QAAA,EAAYA,YAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAA,EAAS,CAAE,IAAA,CAAK;AAAA,IACnD,WAAA,EAAa;AAAA,GACd,CAAA;AAAA,EACD,IAAA,EAAQA,YAAA,CAAA,OAAA,EAAQ,CAAE,QAAA,GAAW,IAAA,CAAK;AAAA,IAChC,WAAA,EACE;AAAA,GACH,CAAA;AAAA,EACD,cAAA,EAAkBA,YAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAA,EAAS,CAAE,IAAA,CAAK;AAAA,IACzD,WAAA,EACE;AAAA,GACH;AACH,CAAA;AAEA,IAAM,WAAA,GAAc,CAAC,GAAA,EAAa,QAAA,KAA6B;AAC7D,EAAA,MAAM,IAAA,GAAO,aAAa,GAAG,CAAA;AAC7B,EAAA,OAAO,SAAS,IAAA,GAAO,CAAA,EAAG,QAAQ,CAAA,IAAA,CAAA,GAAS,GAAG,IAAI,CAAA,IAAA,CAAA;AACpD,CAAA;AAGO,IAAM,YAAA,GAAe,CAAC,IAAA,KAC3BC,sBAAA;AAAA,EACE,qBAAA;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,MAAA;AAAA,IACR,MAAQD,YAAA,CAAA,MAAA,CAAO;AAAA,MACb,GAAG,aAAA;AAAA,MACH,WAAaA,YAAA,CAAA,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,GAAW,IAAA,CAAK;AAAA,QAC1C,WAAA,EACE;AAAA,OACH;AAAA,KACF,CAAA;AAAA,IACD,GAAA,EAAK,CAACE,qBAAiB;AAAA,GACzB;AAAA,EACA,OAAO,GAAA,KAAQ;AACb,IAAA,MAAM,EAAE,OAAO,MAAA,EAAO,GAAI,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAA,EAAK,GAAA,CAAI,IAAI,CAAA;AAC3D,IAAA,MAAM,GAAA,GACJ,GAAA,CAAI,IAAA,CAAK,IAAA,KAAS,OACd,MAAM,YAAA,CAAa,IAAA,EAAM,KAAA,EAAO,GAAA,CAAI,IAAA,CAAK,GAAG,CAAA,GAC5C,IAAI,IAAA,CAAK,GAAA;AACf,IAAA,YAAA,CAAa,GAAA,EAAK,MAAM,UAAU,CAAA;AAElC,IAAA,MAAM,OAAA,GAAU,MAAM,aAAA,CAAc;AAAA,MAClC,GAAA;AAAA,MACA,IAAA;AAAA,MACA,KAAA;AAAA,MACA,SAAA,EAAW,cAAA;AAAA,MACX,GAAA;AAAA,MACA,cAAA,EAAgB,IAAI,IAAA,CAAK,cAAA;AAAA,MACzB,IAAA,EAAM,MACJ,MAAA,CAAO,YAAA;AAAA,QACL,GAAA;AAAA,QACA,GAAA,CAAI,IAAA,CAAK,QAAA,IAAY,WAAA,CAAY,KAAK,UAAU,CAAA;AAAA,QAChD,IAAI,IAAA,CAAK;AAAA;AACX,KACH,CAAA;AAED,IAAA,OAAO,IAAI,IAAA,CAAK;AAAA,MACd,GAAG,UAAU,KAAK,CAAA;AAAA,MAClB,cAAc,OAAA,CAAQ,YAAA;AAAA,MACtB,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,QAAQ,OAAA,CAAQ;AAAA,KACjB,CAAA;AAAA,EACH;AACF,CAAA;AAGK,IAAM,sBAAA,GAAyB,CAAC,IAAA,KACrCD,sBAAA;AAAA,EACE,gCAAA;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,MAAA;AAAA,IACR,MAAQD,YAAA,CAAA,MAAA,CAAO;AAAA,MACb,GAAG,aAAA;AAAA,MACH,SAAA,EAAaA,YAAA,CAAA,MAAA,EAAO,CAAE,GAAA,GAAM,QAAA;AAAS,KACtC,CAAA;AAAA,IACD,GAAA,EAAK,CAACE,qBAAiB;AAAA,GACzB;AAAA,EACA,OAAO,GAAA,KAAQ;AACb,IAAA,MAAM,EAAE,OAAO,MAAA,EAAO,GAAI,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAA,EAAK,GAAA,CAAI,IAAI,CAAA;AAC3D,IAAA,MAAM,GAAA,GACJ,GAAA,CAAI,IAAA,CAAK,IAAA,KAAS,OACd,MAAM,YAAA,CAAa,IAAA,EAAM,KAAA,EAAO,GAAA,CAAI,IAAA,CAAK,GAAG,CAAA,GAC5C,IAAI,IAAA,CAAK,GAAA;AACf,IAAA,YAAA,CAAa,GAAA,EAAK,MAAM,UAAU,CAAA;AAElC,IAAA,MAAM,OAAA,GAAU,MAAM,aAAA,CAA+B;AAAA,MACnD,GAAA;AAAA,MACA,IAAA;AAAA,MACA,KAAA;AAAA,MACA,SAAA,EAAW,wBAAA;AAAA,MACX,GAAA;AAAA,MACA,cAAA,EAAgB,IAAI,IAAA,CAAK,cAAA;AAAA,MACzB,IAAA,EAAM,MACJ,MAAA,CAAO,sBAAA;AAAA,QACL,GAAA;AAAA,QACA,GAAA,CAAI,IAAA,CAAK,QAAA,IAAY,WAAA,CAAY,KAAK,KAAK,CAAA;AAAA,QAC3C,IAAI,IAAA,CAAK;AAAA;AACX,KACH,CAAA;AAED,IAAA,OAAO,IAAI,IAAA,CAAK;AAAA,MACd,GAAG,UAAU,KAAK,CAAA;AAAA,MAClB,cAAc,OAAA,CAAQ,YAAA;AAAA,MACtB,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,QAAQ,OAAA,CAAQ;AAAA,KACjB,CAAA;AAAA,EACH;AACF,CAAA;AAGK,IAAM,WAAA,GAAc,CAAC,IAAA,KAC1BD,sBAAA;AAAA,EACE,6BAAA;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,MAAA;AAAA,IACR,IAAA,EAAQD,oBAAO,aAAa,CAAA;AAAA,IAC5B,GAAA,EAAK,CAACE,qBAAiB;AAAA,GACzB;AAAA,EACA,OAAO,GAAA,KAAQ;AACb,IAAA,MAAM,EAAE,OAAO,MAAA,EAAO,GAAI,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAA,EAAK,GAAA,CAAI,IAAI,CAAA;AAC3D,IAAA,MAAM,GAAA,GACJ,GAAA,CAAI,IAAA,CAAK,IAAA,KAAS,OACd,MAAM,YAAA,CAAa,IAAA,EAAM,KAAA,EAAO,GAAA,CAAI,IAAA,CAAK,GAAG,CAAA,GAC5C,IAAI,IAAA,CAAK,GAAA;AACf,IAAA,YAAA,CAAa,GAAA,EAAK,MAAM,UAAU,CAAA;AAElC,IAAA,MAAM,OAAA,GAAU,MAAM,aAAA,CAAc;AAAA,MAClC,GAAA;AAAA,MACA,IAAA;AAAA,MACA,KAAA;AAAA,MACA,SAAA,EAAW,aAAA;AAAA,MACX,GAAA;AAAA,MACA,cAAA,EAAgB,IAAI,IAAA,CAAK,cAAA;AAAA,MACzB,IAAA,EAAM,MACJ,MAAA,CAAO,WAAA,CAAY,GAAA,EAAK,GAAA,CAAI,IAAA,CAAK,QAAA,IAAY,WAAA,CAAY,GAAA,EAAK,SAAS,CAAC;AAAA,KAC3E,CAAA;AAED,IAAA,OAAO,IAAI,IAAA,CAAK;AAAA,MACd,GAAG,UAAU,KAAK,CAAA;AAAA,MAClB,cAAc,OAAA,CAAQ,YAAA;AAAA,MACtB,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,QAAQ,OAAA,CAAQ;AAAA,KACjB,CAAA;AAAA,EACH;AACF,CAAA;AAGK,IAAM,sBAAA,GAAyB,CAAC,IAAA,KACrCD,sBAAA;AAAA,EACE,yCAAA;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,MAAA;AAAA,IACR,MAAQD,YAAA,CAAA,MAAA,CAAO;AAAA,MACb,GAAG,aAAA;AAAA,MACH,WAAaA,YAAA,CAAA,MAAA,EAAO,CAAE,KAAI,CAAE,QAAA,GAAW,IAAA,CAAK;AAAA,QAC1C,WAAA,EAAa;AAAA,OACd;AAAA,KACF,CAAA;AAAA,IACD,GAAA,EAAK,CAACE,qBAAiB;AAAA,GACzB;AAAA,EACA,OAAO,GAAA,KAAQ;AACb,IAAA,MAAM,EAAE,OAAO,MAAA,EAAO,GAAI,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAA,EAAK,GAAA,CAAI,IAAI,CAAA;AAC3D,IAAA,MAAM,GAAA,GACJ,GAAA,CAAI,IAAA,CAAK,IAAA,KAAS,OACd,MAAM,YAAA,CAAa,IAAA,EAAM,KAAA,EAAO,GAAA,CAAI,IAAA,CAAK,GAAG,CAAA,GAC5C,IAAI,IAAA,CAAK,GAAA;AACf,IAAA,YAAA,CAAa,GAAA,EAAK,MAAM,UAAU,CAAA;AAElC,IAAA,MAAM,SAAA,GAAY,IAAI,IAAA,CAAK,SAAA;AAC3B,IAAA,MAAM,OAAA,GAAU,MAAM,aAAA,CAEpB;AAAA,MACA,GAAA;AAAA,MACA,IAAA;AAAA,MACA,KAAA;AAAA,MACA,SAAA,EAAW,wBAAA;AAAA,MACX,GAAA;AAAA,MACA,cAAA,EAAgB,IAAI,IAAA,CAAK,cAAA;AAAA,MACzB,MAAM,MAAM;AACV,QAAA,MAAM,WAAW,GAAA,CAAI,IAAA,CAAK,QAAA,IAAY,WAAA,CAAY,KAAK,UAAU,CAAA;AACjE,QAAA,OAAO,SAAA,KAAc,MAAA,GACjB,MAAA,CAAO,sBAAA,CAAuB,GAAA,EAAK,QAAQ,CAAA,GAC3C,MAAA,CAAO,sBAAA,CAAuB,GAAA,EAAK,QAAA,EAAU,SAAS,CAAA;AAAA,MAC5D;AAAA,KACD,CAAA;AAED,IAAA,OAAO,IAAI,IAAA,CAAK;AAAA,MACd,GAAG,UAAU,KAAK,CAAA;AAAA,MAClB,cAAc,OAAA,CAAQ,YAAA;AAAA,MACtB,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,QAAQ,OAAA,CAAQ;AAAA,KACjB,CAAA;AAAA,EACH;AACF,CAAA;AAGK,IAAM,QAAA,GAAW,CAAC,IAAA,KACvBD,sBAAA;AAAA,EACE,gCAAA;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,MAAA;AAAA,IACR,IAAA,EAAQD,oBAAO,aAAa,CAAA;AAAA,IAC5B,GAAA,EAAK,CAACE,qBAAiB;AAAA,GACzB;AAAA,EACA,OAAO,GAAA,KAAQ;AACb,IAAA,MAAM,EAAE,OAAO,MAAA,EAAO,GAAI,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAA,EAAK,GAAA,CAAI,IAAI,CAAA;AAC3D,IAAA,MAAM,GAAA,GACJ,GAAA,CAAI,IAAA,CAAK,IAAA,KAAS,OACd,MAAM,YAAA,CAAa,IAAA,EAAM,KAAA,EAAO,GAAA,CAAI,IAAA,CAAK,GAAG,CAAA,GAC5C,IAAI,IAAA,CAAK,GAAA;AACf,IAAA,YAAA,CAAa,GAAA,EAAK,MAAM,UAAU,CAAA;AAElC,IAAA,MAAM,OAAA,GAAU,MAAM,aAAA,CAAc;AAAA,MAClC,GAAA;AAAA,MACA,IAAA;AAAA,MACA,KAAA;AAAA,MACA,SAAA,EAAW,UAAA;AAAA,MACX,GAAA;AAAA,MACA,cAAA,EAAgB,IAAI,IAAA,CAAK,cAAA;AAAA,MACzB,IAAA,EAAM,MACJ,MAAA,CAAO,QAAA,CAAS,GAAA,EAAK,GAAA,CAAI,IAAA,CAAK,QAAA,IAAY,WAAA,CAAY,GAAA,EAAK,YAAY,CAAC;AAAA,KAC3E,CAAA;AAED,IAAA,OAAO,IAAI,IAAA,CAAK;AAAA,MACd,GAAG,UAAU,KAAK,CAAA;AAAA,MAClB,cAAc,OAAA,CAAQ,YAAA;AAAA,MACtB,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,QAAQ,OAAA,CAAQ;AAAA,KACjB,CAAA;AAAA,EACH;AACF,CAAA;AAUK,IAAM,mBAAA,GAAsB,CAAC,IAAA,KAClCD,sBAAA;AAAA,EACE,+BAAA;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,MAAA;AAAA,IACR,MAAQD,YAAA,CAAA,MAAA,CAAO;AAAA,MACb,GAAG,UAAA;AAAA,MACH,GAAA,EAAOA,YAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,EAAE,IAAA,CAAK,EAAE,WAAA,EAAa,8BAAA,EAAgC;AAAA,KAC5E,CAAA;AAAA,IACD,GAAA,EAAK,CAACE,qBAAiB;AAAA,GACzB;AAAA,EACA,OAAO,GAAA,KAAQ;AACb,IAAA,MAAM,EAAE,OAAO,MAAA,EAAO,GAAI,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAA,EAAK,GAAA,CAAI,IAAI,CAAA;AAC3D,IAAA,YAAA,CAAa,GAAA,CAAI,IAAA,CAAK,GAAA,EAAK,KAAA,CAAM,UAAU,CAAA;AAE3C,IAAA,MAAM,MAAA,GAAS,OAAO,MAAM,MAAA,CAAO,oBAAoB,GAAA,CAAI,IAAA,CAAK,GAAG,CAAC,CAAA;AACpE,IAAA,OAAO,GAAA,CAAI,KAAK,EAAE,GAAG,UAAU,KAAK,CAAA,EAAG,QAAQ,CAAA;AAAA,EACjD;AACF,CAAA;AC9RF,IAAMC,WAAAA,GAAa;AAAA,EACjB,UAAA,EAAcC,qBAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,QAAA,GAAW,IAAA,CAAK;AAAA,IAC5C,WAAA,EACE;AAAA,GACH,CAAA;AAAA,EACD,cAAA,EAAkBA,qBAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,QAAA,GAAW,IAAA,CAAK;AAAA,IAChD,WAAA,EACE;AAAA,GACH;AACH,CAAA;AAGO,IAAM,WAAA,GAAc,CAAC,IAAA,KAC1BH,sBAAAA;AAAA,EACE,kBAAA;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,KAAA;AAAA,IACR,OAASG,YAAA,CAAA,MAAA,CAAO;AAAA,MACd,GAAGD,WAAAA;AAAA,MACH,OAAA,EAAWC,YAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,EAAE,IAAA,CAAK,EAAE,WAAA,EAAa,gBAAA,EAAkB;AAAA,KAClE,CAAA;AAAA,IACD,GAAA,EAAK,CAACF,qBAAiB;AAAA,GACzB;AAAA,EACA,OAAO,GAAA,KAAQ;AACb,IAAA,MAAM,EAAE,OAAO,MAAA,EAAO,GAAI,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAA,EAAK,GAAA,CAAI,KAAK,CAAA;AAC5D,IAAA,MAAM,MAAA,GAAS,OAAO,MAAM,MAAA,CAAO,cAAc,GAAA,CAAI,KAAA,CAAM,OAAO,CAAC,CAAA;AACnE,IAAA,OAAO,GAAA,CAAI,KAAK,EAAE,GAAG,UAAU,KAAK,CAAA,EAAG,QAAQ,CAAA;AAAA,EACjD;AACF,CAAA;AAQK,IAAM,aAAA,GAAgB,CAAC,IAAA,KAC5BD,sBAAAA;AAAA,EACE,4BAAA;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,MAAA;AAAA,IACR,MAAQG,YAAA,CAAA,MAAA,CAAO;AAAA,MACb,GAAGD,WAAAA;AAAA,MACH,GAAA,EAAOC,YAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,EAAE,IAAA,CAAK,EAAE,WAAA,EAAa,uBAAA,EAAyB,CAAA;AAAA,MACpE,eAAA,EACGA,YAAA,CAAA,MAAA,EAAO,CACP,GAAA,CAAI,CAAC,CAAA,CACL,QAAA,EAAS,CACT,IAAA,CAAK,EAAE,WAAA,EAAa,gDAAA,EAAkD,CAAA;AAAA,MACzE,YAAA,EACGA,YAAA,CAAA,MAAA,EAAO,CACP,GAAA,CAAI,CAAC,CAAA,CACL,QAAA,EAAS,CACT,IAAA,CAAK,EAAE,WAAA,EAAa,0CAAA,EAA4C;AAAA,KACpE,CAAA;AAAA,IACD,GAAA,EAAK,CAACF,qBAAiB;AAAA,GACzB;AAAA,EACA,OAAO,GAAA,KAAQ;AACb,IAAA,MAAM,EAAE,OAAO,MAAA,EAAO,GAAI,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAA,EAAK,GAAA,CAAI,IAAI,CAAA;AAC3D,IAAA,MAAM,MAAA,GAAS,MAAA;AAAA,MACb,MAAM,MAAA,CAAO,aAAA;AAAA,QACX,KAAA,CAAM,UAAA;AAAA,QACN,IAAI,IAAA,CAAK,GAAA;AAAA,QACT,IAAI,IAAA,CAAK,eAAA;AAAA,QACT,IAAI,IAAA,CAAK;AAAA;AACX,KACF;AACA,IAAA,OAAO,GAAA,CAAI,KAAK,EAAE,GAAG,UAAU,KAAK,CAAA,EAAG,QAAQ,CAAA;AAAA,EACjD;AACF,CAAA;AAGK,IAAM,aAAA,GAAgB,CAAC,IAAA,KAC5BD,sBAAAA;AAAA,EACE,4BAAA;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,MAAA;AAAA,IACR,MAAQG,YAAA,CAAA,MAAA,CAAO;AAAA,MACb,GAAGD,WAAAA;AAAA,MACH,IAAA,EAAQC,YAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,EAAE,IAAA,CAAK,EAAE,WAAA,EAAa,+BAAA,EAAiC;AAAA,KAC9E,CAAA;AAAA,IACD,GAAA,EAAK,CAACF,qBAAiB;AAAA,GACzB;AAAA,EACA,OAAO,GAAA,KAAQ;AACb,IAAA,MAAM,EAAE,OAAO,MAAA,EAAO,GAAI,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAA,EAAK,GAAA,CAAI,IAAI,CAAA;AAC3D,IAAA,MAAM,MAAA,GAAS,MAAA;AAAA,MACb,MAAM,MAAA,CAAO,aAAA,CAAc,MAAM,UAAA,EAAY,GAAA,CAAI,KAAK,IAAI;AAAA,KAC5D;AACA,IAAA,OAAO,GAAA,CAAI,KAAK,EAAE,GAAG,UAAU,KAAK,CAAA,EAAG,QAAQ,CAAA;AAAA,EACjD;AACF,CAAA;AASK,IAAM,qBAAA,GAAwB,CAAC,IAAA,KACpCD,sBAAAA;AAAA,EACE,6BAAA;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,MAAA;AAAA,IACR,MAAQG,YAAA,CAAA,MAAA,CAAO;AAAA,MACb,GAAGD,WAAAA;AAAA,MACH,IAAA,EAAQC,YAAA,CAAA,MAAA,EAAO,CAAE,GAAA,CAAI,CAAC,EAAE,IAAA,CAAK,EAAE,WAAA,EAAa,4BAAA,EAA8B,CAAA;AAAA,MAC1E,YAAA,EACGA,YAAA,CAAA,MAAA,EAAO,CACP,GAAA,CAAI,CAAC,EACL,IAAA,CAAK,EAAE,WAAA,EAAa,iDAAA,EAAmD;AAAA,KAC3E,CAAA;AAAA,IACD,GAAA,EAAK,CAACF,qBAAiB;AAAA,GACzB;AAAA,EACA,OAAO,GAAA,KAAQ;AACb,IAAA,MAAM,EAAE,OAAO,MAAA,EAAO,GAAI,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAA,EAAK,GAAA,CAAI,IAAI,CAAA;AAC3D,IAAA,MAAM,MAAA,GAAS,MAAA;AAAA,MACb,MAAM,MAAA,CAAO,wBAAA;AAAA,QACX,KAAA,CAAM,UAAA;AAAA,QACN,IAAI,IAAA,CAAK,IAAA;AAAA,QACT,IAAI,IAAA,CAAK;AAAA;AACX,KACF;AACA,IAAA,OAAO,GAAA,CAAI,KAAK,EAAE,GAAG,UAAU,KAAK,CAAA,EAAG,QAAQ,CAAA;AAAA,EACjD;AACF,CAAA;AAGK,IAAM,iBAAA,GAAoB,CAAC,IAAA,KAChCD,sBAAAA;AAAA,EACE,iCAAA;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,KAAA;AAAA,IACR,OAASG,YAAA,CAAA,MAAA,CAAO;AAAA,MACd,GAAGD,WAAAA;AAAA,MACH,GAAA,EAAOC,qBAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,QAAA,GAAW,IAAA,CAAK;AAAA,QACrC,WAAA,EACE;AAAA,OACH;AAAA,KACF,CAAA;AAAA,IACD,GAAA,EAAK,CAACF,qBAAiB;AAAA,GACzB;AAAA,EACA,OAAO,GAAA,KAAQ;AACb,IAAA,MAAM,EAAE,OAAO,MAAA,EAAO,GAAI,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAA,EAAK,GAAA,CAAI,KAAK,CAAA;AAC5D,IAAA,MAAM,MAAA,GAAS,MAAA;AAAA,MACb,MAAM,MAAA,CAAO,oBAAA,CAAqB,IAAI,KAAA,CAAM,GAAA,IAAO,MAAM,UAAU;AAAA,KACrE;AACA,IAAA,OAAO,GAAA,CAAI,IAAA,CAAK,EAAE,GAAG,SAAA,CAAU,KAAK,CAAA,EAAG,MAAA,EAAQ,MAAA,IAAU,EAAC,EAAG,CAAA;AAAA,EAC/D;AACF,CAAA;AAGK,IAAM,gBAAA,GAAmB,CAAC,IAAA,KAC/BD,sBAAAA;AAAA,EACE,2BAAA;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,KAAA;AAAA,IACR,KAAA,EAASG,oBAAOD,WAAU,CAAA;AAAA,IAC1B,GAAA,EAAK,CAACD,qBAAiB;AAAA,GACzB;AAAA,EACA,OAAO,GAAA,KAAQ;AACb,IAAA,MAAM,EAAE,OAAO,MAAA,EAAO,GAAI,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAA,EAAK,GAAA,CAAI,KAAK,CAAA;AAC5D,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAM,MAAA,CAAO,qBAAqB,CAAA;AACxD,IAAA,OAAO,GAAA,CAAI,KAAK,EAAE,GAAG,UAAU,KAAK,CAAA,EAAG,QAAQ,CAAA;AAAA,EACjD;AACF,CAAA;ACnKF,IAAMC,WAAAA,GAAa;AAAA,EACjB,UAAA,EAAcE,qBAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,QAAA,GAAW,IAAA,CAAK;AAAA,IAC5C,WAAA,EACE;AAAA,GACH,CAAA;AAAA,EACD,cAAA,EAAkBA,qBAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,QAAA,GAAW,IAAA,CAAK;AAAA,IAChD,WAAA,EACE;AAAA,GACH;AACH,CAAA;AAGA,IAAM,mBAAA,GAAsB;AAAA,EAC1B,kBAAkBC,2BAAA,CAAkB,gBAAA;AAAA,EACpC,YAAYA,2BAAA,CAAkB,UAAA;AAAA,EAC9B,eAAeA,2BAAA,CAAkB;AACnC,CAAA;AAEA,IAAM,gBAAA,GAAmB,CAAC,IAAA,KAAoC;AAC5D,EAAA,IAAI,KAAK,QAAA,CAAS,iBAAA,IAAqB,KAAK,OAAA,CAAQ,MAAA,EAAQ,WAAW,MAAA,EAAW;AAChF,IAAA,MAAM,WAAA,CAAY,qBAAqB,4BAA4B,CAAA;AAAA,EACrE;AACF,CAAA;AAUO,IAAM,YAAA,GAAe,CAAC,IAAA,KAC3BL,sBAAAA;AAAA,EACE,wBAAA;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,MAAA;AAAA,IACR,MAAQI,YAAA,CAAA,MAAA,CAAO;AAAA,MACb,GAAGF,WAAAA;AAAA,MACH,SAAA,EACGE,YAAA,CAAA,MAAA,EAAO,CACP,GAAA,EAAI,CACJ,QAAA,EAAS,CACT,IAAA,CAAK,EAAE,WAAA,EAAa,yDAAA,EAAsD;AAAA,KAC9E,CAAA;AAAA,IACD,GAAA,EAAK,CAACH,qBAAiB;AAAA,GACzB;AAAA,EACA,OAAO,GAAA,KAAQ;AACb,IAAA,MAAM,EAAE,OAAO,MAAA,EAAO,GAAI,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAA,EAAK,GAAA,CAAI,IAAI,CAAA;AAC3D,IAAA,MAAM,KAAA,GAAQ,OAAO,MAAM,MAAA,CAAO,aAAa,GAAA,CAAI,IAAA,CAAK,SAAS,CAAC,CAAA;AAClE,IAAA,OAAO,IAAI,IAAA,CAAK;AAAA,MACd,GAAG,UAAU,KAAK,CAAA;AAAA,MAClB,UAAU,KAAA,CAAM,QAAA;AAAA,MAChB,WAAW,KAAA,CAAM;AAAA,KAClB,CAAA;AAAA,EACH;AACF,CAAA;AAGK,IAAM,aAAA,GAAgB,CAAC,IAAA,KAC5BD,sBAAAA;AAAA,EACE,0BAAA;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,KAAA;AAAA,IACR,KAAA,EAASI,oBAAOF,WAAU,CAAA;AAAA,IAC1B,GAAA,EAAK,CAACD,qBAAiB;AAAA,GACzB;AAAA,EACA,OAAO,GAAA,KAAQ;AACb,IAAA,gBAAA,CAAiB,IAAI,CAAA;AACrB,IAAA,MAAM,EAAE,OAAO,MAAA,EAAO,GAAI,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAA,EAAK,GAAA,CAAI,KAAK,CAAA;AAC5D,IAAA,MAAM,QAAA,GAAW,MAAA,CAAO,MAAM,MAAA,CAAO,kBAAkB,CAAA;AACvD,IAAA,OAAO,GAAA,CAAI,KAAK,EAAE,GAAG,UAAU,KAAK,CAAA,EAAG,UAAU,CAAA;AAAA,EACnD;AACF,CAAA;AAGK,IAAM,kBAAA,GAAqB,CAAC,IAAA,KACjCD,sBAAAA;AAAA,EACE,+BAAA;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,KAAA;AAAA,IACR,KAAA,EAASI,oBAAOF,WAAU,CAAA;AAAA,IAC1B,GAAA,EAAK,CAACD,qBAAiB;AAAA,GACzB;AAAA,EACA,OAAO,GAAA,KAAQ;AACb,IAAA,gBAAA,CAAiB,IAAI,CAAA;AACrB,IAAA,MAAM,EAAE,OAAO,MAAA,EAAO,GAAI,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAA,EAAK,GAAA,CAAI,KAAK,CAAA;AAC5D,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,MAAM,MAAA,CAAO,uBAAuB,CAAA;AAC3D,IAAA,OAAO,GAAA,CAAI,KAAK,EAAE,GAAG,UAAU,KAAK,CAAA,EAAG,SAAS,CAAA;AAAA,EAClD;AACF,CAAA;AAGK,IAAM,mBAAA,GAAsB,CAAC,IAAA,KAClCD,sBAAAA;AAAA,EACE,gCAAA;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,KAAA;AAAA,IACR,OAASI,YAAA,CAAA,MAAA,CAAO;AAAA,MACd,GAAGF,WAAAA;AAAA,MACH,WAAA,EACGE,YAAA,CAAA,IAAA,CAAK,CAAC,kBAAA,EAAoB,YAAA,EAAc,eAAe,CAAC,CAAA,CACxD,IAAA,CAAK,EAAE,WAAA,EAAa,4BAAA,EAA8B;AAAA,KACtD,CAAA;AAAA,IACD,GAAA,EAAK,CAACH,qBAAiB;AAAA,GACzB;AAAA,EACA,OAAO,GAAA,KAAQ;AACb,IAAA,gBAAA,CAAiB,IAAI,CAAA;AACrB,IAAA,MAAM,EAAE,OAAO,MAAA,EAAO,GAAI,MAAM,OAAA,CAAQ,IAAA,EAAM,GAAA,EAAK,GAAA,CAAI,KAAK,CAAA;AAC5D,IAAA,MAAM,MAAA,GAAS,MAAA;AAAA,MACb,MAAM,MAAA,CAAO,wBAAA;AAAA,QACX,mBAAA,CAAoB,GAAA,CAAI,KAAA,CAAM,WAAW;AAAA;AAC3C,KACF;AACA,IAAA,OAAO,IAAI,IAAA,CAAK;AAAA,MACd,GAAG,UAAU,KAAK,CAAA;AAAA,MAClB,kBAAA,EAAoB,IAAI,KAAA,CAAM,WAAA;AAAA,MAC9B,QAAQ,MAAA,CAAO;AAAA,KAChB,CAAA;AAAA,EACH;AACF,CAAA;AC3HF,IAAMC,WAAAA,GAAa;AAAA,EACjB,UAAA,EAAcI,qBAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,QAAA,GAAW,IAAA,CAAK;AAAA,IAC5C,WAAA,EACE;AAAA,GACH,CAAA;AAAA,EACD,cAAA,EAAkBA,qBAAO,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,QAAA,GAAW,IAAA,CAAK;AAAA,IAChD,WAAA,EACE;AAAA,GACH;AACH,CAAA;AASO,IAAM,eAAA,GAAkB,CAAC,IAAA,KAC9BN,sBAAAA;AAAA,EACE,oBAAA;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,KAAA;AAAA,IACR,KAAA,EAASM,oBAAOJ,WAAU,CAAA;AAAA,IAC1B,GAAA,EAAK,CAACD,qBAAiB;AAAA,GACzB;AAAA,EACA,OAAO,GAAA,KAAQ;AACb,IAAA,MAAM,EAAE,OAAM,GAAI,MAAM,QAAQ,IAAA,EAAM,GAAA,EAAK,IAAI,KAAK,CAAA;AACpD,IAAA,OAAO,IAAI,IAAA,CAAK;AAAA,MACd,YAAY,KAAA,CAAM,UAAA;AAAA,MAClB,gBAAgB,KAAA,CAAM,cAAA;AAAA,MACtB,wBAAwB,KAAA,CAAM,sBAAA;AAAA,MAC9B,QAAQ,KAAA,CAAM,MAAA;AAAA,MACd,aAAa,KAAA,CAAM;AAAA,KACpB,CAAA;AAAA,EACH;AACF,CAAA;AAGK,IAAM,eAAA,GAAkB,CAAC,IAAA,KAC9BD,sBAAAA;AAAA,EACE,uBAAA;AAAA,EACA;AAAA,IACE,MAAA,EAAQ,KAAA;AAAA,IACR,OAASM,YAAA,CAAA,MAAA,CAAO;AAAA,MACd,GAAGJ,WAAAA;AAAA,MACH,KAAA,EAASI,YAAA,CAAA,MAAA,CAAO,MAAA,EAAO,CAAE,KAAI,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,GAAA,CAAI,GAAG,CAAA,CAAE,QAAA,GAAW,IAAA,CAAK;AAAA,QAC7D,WAAA,EAAa;AAAA,OACd,CAAA;AAAA,MACD,MAAA,EACGA,YAAA,CAAA,IAAA,CAAK,CAAC,SAAA,EAAW,aAAa,QAAQ,CAAC,CAAA,CACvC,QAAA,EAAS,CACT,IAAA,CAAK,EAAE,WAAA,EAAa,4BAA4B;AAAA,KACpD,CAAA;AAAA,IACD,GAAA,EAAK,CAACL,qBAAiB;AAAA,GACzB;AAAA,EACA,OAAO,GAAA,KAAQ;AACb,IAAA,MAAM,EAAE,OAAM,GAAI,MAAM,QAAQ,IAAA,EAAM,GAAA,EAAK,IAAI,KAAK,CAAA;AACpD,IAAA,MAAM,KAAA,GAAQ,qBAAA,CAAsB,GAAA,EAAK,IAAA,CAAK,QAAQ,WAAW,CAAA;AAKjE,IAAA,MAAM,OAAA,GAAU,MAAM,KAAA,CAAM,IAAA,CAAK;AAAA,MAC/B,gBAAgB,KAAA,CAAM,cAAA;AAAA,MACtB,UAAA,EAAY,KAAA,CAAM,cAAA,KAAmB,IAAA,GAAO,MAAM,UAAA,GAAa,IAAA;AAAA,MAC/D,OAAO,IAAA,CAAK,GAAA,CAAI,IAAI,KAAA,CAAM,KAAA,IAAS,IAAI,GAAG;AAAA,KAC3C,CAAA;AAED,IAAA,MAAM,QAAA,GACJ,GAAA,CAAI,KAAA,CAAM,MAAA,KAAW,SACjB,OAAA,GACA,OAAA,CAAQ,MAAA,CAAO,CAAC,MAAA,KAAW,MAAA,CAAO,MAAA,KAAW,GAAA,CAAI,MAAM,MAAM,CAAA;AAEnE,IAAA,OAAO,IAAI,IAAA,CAAK;AAAA,MACd,GAAG,UAAU,KAAK,CAAA;AAAA,MAClB,WAAA,EAAa,QAAA,CAAS,GAAA,CAAI,CAAC,MAAA,MAAY;AAAA,QACrC,IAAI,MAAA,CAAO,EAAA;AAAA,QACX,WAAW,MAAA,CAAO,SAAA;AAAA,QAClB,QAAQ,MAAA,CAAO,MAAA;AAAA,QACf,YAAY,MAAA,CAAO,UAAA;AAAA,QACnB,cAAA,EAAgB,OAAO,cAAA,IAAkB,IAAA;AAAA,QACzC,aAAa,MAAA,CAAO,WAAA;AAAA,QACpB,IAAA,EAAM,OAAO,IAAA,IAAQ,IAAA;AAAA,QACrB,OAAA,EAAS,OAAO,OAAA,IAAW,IAAA;AAAA,QAC3B,YAAA,EAAc,OAAO,YAAA,IAAgB,IAAA;AAAA,QACrC,SAAA,EAAW,OAAO,SAAA,IAAa,IAAA;AAAA,QAC/B,SAAA,EAAW,OAAO,SAAA,IAAa;AAAA,OACjC,CAAE;AAAA,KACH,CAAA;AAAA,EACH;AACF,CAAA;;;ACnEF,IAAM,0BAA0B,OAAyB;AAAA,EACvD,IAAA,EAAM,QAAA;AAAA,EACN,QAAA,EAAU,KAAA;AAAA,EACV,KAAA,EAAO,KAAA;AAAA,EACP,QAAA,EAAU,IAAA;AAAA,EACV,MAAA,EAAQ;AACV,CAAA,CAAA;AAgBO,IAAM,yBAAA,GAA4B,CACvC,KAAA,GAAQ,YAAA,MAGJ;AAAA,EACJ,gBAAA,EAAkB;AAAA,IAChB,CAAC,KAAK,GAAG;AAAA,MACP,IAAA,EAAM,QAAA;AAAA,MACN,QAAA,EAAU,KAAA;AAAA;AAAA;AAAA,MAGV,KAAA,EAAO,IAAA;AAAA,MACP,QAAA,EAAU,IAAA;AAAA,MACV,MAAA,EAAQ;AAAA;AACV;AAEJ,CAAA;AAiBO,IAAM,OAAA,GAAU,CAAC,OAAA,GAA0B,EAAC,KAAM;AAEvD,EAAA,MAAM,QAAA,GAAW,qBAAqB,OAAO,CAAA;AAC7C,EAAA,MAAM,IAAA,GAAO,EAAE,OAAA,EAAS,QAAA,EAAS;AAEjC,EAAA,MAAM,MAAA,GAAkD;AAAA,IACtD,CAAC,gBAAgB,GAAG;AAAA,MAClB,SAAA,EAAW,gBAAA;AAAA,MACX,MAAA,EAAQ;AAAA,QACN,cAAA,EAAgB,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,KAAA,EAAM;AAAA,QAClD,UAAA,EAAY,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,IAAA,EAAK;AAAA,QAC7C,MAAA,EAAQ,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,IAAA,EAAK;AAAA,QACzC,WAAA,EAAa,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,IAAA,EAAK;AAAA,QAC9C,SAAA,EAAW,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,IAAA,EAAK;AAAA,QAC5C,MAAA,EAAQ,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,IAAA,EAAK;AAAA,QACzC,cAAA,EAAgB,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,KAAA,EAAM;AAAA,QAClD,IAAA,EAAM,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,KAAA,EAAM;AAAA,QACxC,OAAA,EAAS,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,KAAA,EAAM;AAAA,QAC3C,YAAA,EAAc,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,KAAA,EAAM;AAAA,QAChD,SAAA,EAAW,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,KAAA,EAAM;AAAA,QAC7C,QAAA,EAAU,EAAE,IAAA,EAAM,QAAA,EAAU,UAAU,KAAA,EAAM;AAAA;AAAA;AAAA;AAAA,QAI5C,SAAA,EAAW,EAAE,IAAA,EAAM,MAAA,EAAQ,QAAA,EAAU,MAAM,YAAA,EAAc,sBAAM,IAAI,IAAA,EAAK,EAAE;AAAA,QAC1E,SAAA,EAAW,EAAE,IAAA,EAAM,MAAA,EAAQ,QAAA,EAAU,OAAO,QAAA,EAAU,sBAAM,IAAI,IAAA,EAAK;AAAE,OACzE;AAAA,MACA,OAAA,EAAS;AAAA;AAAA,QAEP,EAAE,MAAA,EAAQ,CAAC,YAAA,EAAc,gBAAgB,CAAA,EAAE;AAAA;AAAA,QAE3C,EAAE,MAAA,EAAQ,CAAC,gBAAA,EAAkB,WAAW,CAAA;AAAE;AAC5C;AACF,GACF;AAEA,EAAA,IAAI,OAAA,CAAQ,YAAA,EAAc,YAAA,KAAiB,IAAA,EAAM;AAC/C,IAAA,MAAA,CAAO,YAAA,GAAe;AAAA,MACpB,MAAA,EAAQ;AAAA,QACN,CAAC,OAAA,CAAQ,YAAA,CAAa,KAAA,IAAS,YAAY,GAAG,uBAAA;AAAwB;AACxE,KACF;AAAA,EACF;AAKA,EAAA,MAAM,MAAA,GAAS;AAAA,IACb,EAAA,EAAI,UAAA;AAAA,IACJ,YAAA,EAAc,oBAAA;AAAA,IACd,MAAA;AAAA,IACA,SAAA,EAAW;AAAA;AAAA,MAET,sBAAA,EAAwB,gBAAgB,IAAI,CAAA;AAAA;AAAA,MAE5C,mBAAA,EAAqB,aAAa,IAAI,CAAA;AAAA;AAAA,MAEtC,mBAAA,EAAqB,aAAa,IAAI,CAAA;AAAA,MACtC,6BAAA,EAA+B,uBAAuB,IAAI,CAAA;AAAA,MAC1D,kBAAA,EAAoB,YAAY,IAAI,CAAA;AAAA,MACpC,6BAAA,EAA+B,uBAAuB,IAAI,CAAA;AAAA,MAC1D,eAAA,EAAiB,SAAS,IAAI,CAAA;AAAA,MAC9B,0BAAA,EAA4B,oBAAoB,IAAI,CAAA;AAAA;AAAA,MAEpD,kBAAA,EAAoB,YAAY,IAAI,CAAA;AAAA,MACpC,oBAAA,EAAsB,cAAc,IAAI,CAAA;AAAA,MACxC,oBAAA,EAAsB,cAAc,IAAI,CAAA;AAAA,MACxC,4BAAA,EAA8B,sBAAsB,IAAI,CAAA;AAAA,MACxD,wBAAA,EAA0B,kBAAkB,IAAI,CAAA;AAAA,MAChD,uBAAA,EAAyB,iBAAiB,IAAI,CAAA;AAAA;AAAA,MAE9C,oBAAA,EAAsB,cAAc,IAAI,CAAA;AAAA,MACxC,yBAAA,EAA2B,mBAAmB,IAAI,CAAA;AAAA,MAClD,0BAAA,EAA4B,oBAAoB,IAAI,CAAA;AAAA;AAAA,MAEpD,sBAAA,EAAwB,gBAAgB,IAAI;AAAA,KAC9C;AAAA,IACA,SAAA,EAAW;AAAA,MACT;AAAA;AAAA;AAAA,QAGE,MAAA,EAAQ,EAAA;AAAA,QACR,GAAA,EAAK,EAAA;AAAA,QACL,WAAA,EAAa,CAAC,IAAA,KAAiB,IAAA,CAAK,WAAW,WAAW;AAAA;AAC5D;AACF,GACF;AAEA,EAAA,OAAO,OAAO,MAAA,CAAO,MAAA,EAAQ,EAAE,cAAA,EAAgB,UAAU,CAAA;AAC3D","file":"index.cjs","sourcesContent":["import { APIError } from 'better-auth/api';\nimport { defineErrorCodes } from '@better-auth/core/utils/error-codes';\nimport type { DgiiError, DgiiErrorCode } from '@deuriib/dgii-ecf';\n\n/**\n * Error codes this plugin can return.\n *\n * They are declared through `defineErrorCodes` so they flow into Better Auth's\n * own type surface (`auth.$ERROR_CODES`, client `error.code`) and so the keys\n * are constrained to UPPER_SNAKE_CASE at compile time. Every code describes a\n * condition the plugin itself decided on; a failure DGII produced is reported\n * as {@link DGII_ECF_ERROR_CODES.DGII_REQUEST_FAILED} with the upstream detail\n * attached, never smuggled into a success payload.\n */\nexport const DGII_ECF_ERROR_CODES = defineErrorCodes({\n  DGII_SESSION_REQUIRED: 'A session is required to call a DGII e-CF endpoint',\n  DGII_TAXPAYER_ID_REQUIRED:\n    'No taxpayer id (RNC) could be resolved: send `taxPayerId`, set the organization field, or configure `resolveTaxPayerId`',\n  DGII_TAXPAYER_ID_INVALID:\n    'The taxpayer id is not a valid DGII RNC (9 digits) or cédula (11 digits)',\n  DGII_TAXPAYER_ID_MISMATCH:\n    'The signed document was issued under a taxpayer id other than the one resolved for this request',\n  DGII_TAXPAYER_ID_FORBIDDEN:\n    'This session is not allowed to act on behalf of the requested taxpayer id',\n  DGII_ORGANIZATION_NOT_FOUND: 'The organization in scope was not found',\n  DGII_ORGANIZATION_REQUIRED:\n    'This request needs an organization: send `organizationId` or select an active organization',\n  DGII_NOT_A_MEMBER: 'The session user is not a member of the organization in scope',\n  DGII_INSUFFICIENT_ROLE:\n    'The session user does not hold a role allowed to perform this DGII operation',\n  DGII_CREDENTIALS_UNAVAILABLE:\n    'No DGII credentials could be resolved for this taxpayer id',\n  DGII_CLIENT_NOT_CONFIGURED:\n    'The plugin was configured without `credentials` or `getClient`, so it cannot reach DGII',\n  DGII_STATUS_API_KEY_REQUIRED:\n    'The DGII status service needs an API key: configure `status.apiKey`',\n  DGII_DOCUMENT_UNREADABLE:\n    'The signed document carries no issuer taxpayer id (RNCEmisor / RncEmisor)',\n  DGII_SIGNING_FAILED: 'The document could not be signed with the organization key',\n  DGII_REQUEST_FAILED: 'The DGII request failed',\n  DGII_SUBMISSION_NOT_FOUND: 'No stored submission matches this id',\n  DGII_PERSISTENCE_UNAVAILABLE:\n    'Submission persistence is disabled, so this operation is unavailable',\n  DGII_IDEMPOTENCY_IN_FLIGHT:\n    'A submission with this idempotency key is still in flight or has an unknown outcome; reconcile it before retrying',\n});\n\nexport type DgiiEcfErrorCode = keyof typeof DGII_ECF_ERROR_CODES;\n\n/**\n * HTTP status for a failure the DGII SDK reported.\n *\n * The distinction matters to callers: a 400 means the request or the document\n * is wrong and resending it unchanged will fail again, while a 502 means DGII\n * (or the network to it) is the problem and the call is worth retrying. An\n * upstream credential problem is a 500: the application's server-side\n * configuration is broken and no retry from the client can fix it.\n */\nconst STATUS_BY_DGII_CODE: Record<DgiiErrorCode, Parameters<typeof APIError.from>[0]> =\n  {\n    INVALID_XML: 'BAD_REQUEST',\n    SIGNING: 'BAD_REQUEST',\n    VALIDATION: 'BAD_REQUEST',\n    CERTIFICATE: 'INTERNAL_SERVER_ERROR',\n    IDEMPOTENCY: 'CONFLICT',\n    AUTH: 'BAD_GATEWAY',\n    HTTP: 'BAD_GATEWAY',\n    TIMEOUT: 'BAD_GATEWAY',\n    CIRCUIT_OPEN: 'BAD_GATEWAY',\n    UNKNOWN: 'BAD_GATEWAY',\n  };\n\ninterface DgiiFailureDetail {\n  readonly code: DgiiErrorCode;\n  readonly status?: number | undefined;\n  readonly statusText?: string | undefined;\n  readonly resource?: string | undefined;\n  readonly method?: string | undefined;\n  readonly mensajes?: readonly { valor: string; codigo: number | string }[] | undefined;\n}\n\n/**\n * Shapes a {@link DgiiError} for the wire.\n *\n * `data` and `baseURL` are deliberately dropped. `data` is whatever body DGII\n * returned, and on the authentication endpoints that body carries the bearer\n * token — echoing it back in an error message would leak a credential into\n * logs, browser devtools and error trackers.\n */\nconst toFailureDetail = (error: DgiiError): DgiiFailureDetail => ({\n  code: error.code,\n  status: error.status,\n  statusText: error.statusText,\n  resource: error.resource,\n  method: error.method,\n  mensajes: error.mensajes,\n});\n\n/** The shape `defineErrorCodes` produces, without depending on its internals. */\nexport interface ErrorCodeLike {\n  readonly code: string;\n  readonly message: string;\n}\n\nexport const badRequest = (error: ErrorCodeLike, message?: string): APIError =>\n  new APIError('BAD_REQUEST', {\n    message: message ?? error.message,\n    code: error.code,\n  });\n\nexport const forbidden = (error: ErrorCodeLike, message?: string): APIError =>\n  new APIError('FORBIDDEN', {\n    message: message ?? error.message,\n    code: error.code,\n  });\n\nexport const conflict = (error: ErrorCodeLike, message?: string): APIError =>\n  new APIError('CONFLICT', {\n    message: message ?? error.message,\n    code: error.code,\n  });\n\nexport const serverError = (error: ErrorCodeLike, message?: string): APIError =>\n  new APIError('INTERNAL_SERVER_ERROR', {\n    message: message ?? error.message,\n    code: error.code,\n  });\n\n/** Translate a DGII SDK failure into an `APIError` the client can branch on. */\nexport const toApiError = (error: DgiiError): APIError =>\n  new APIError(STATUS_BY_DGII_CODE[error.code], {\n    message: error.message,\n    code: DGII_ECF_ERROR_CODES.DGII_REQUEST_FAILED.code,\n    dgii: toFailureDetail(error),\n  });\n","import { APIError } from 'better-auth/api';\nimport { BetterAuthError } from '@better-auth/core/error';\nimport { ECF } from '@deuriib/dgii-ecf';\nimport type { DgiiEcfOptions, DgiiEcfScope } from './types.js';\nimport { DGII_ECF_ERROR_CODES } from './errors.js';\n\n/**\n * Supplies the DGII client for a resolved scope.\n *\n * The plugin owns no key material of its own: the host resolves it per\n * taxpayer, over a callback that never sees the HTTP request. That is the whole\n * security model — a browser can call these endpoints, but it can never supply,\n * read or influence which certificate signs a document.\n */\nexport interface DgiiEcfClientProvider {\n  /** The client for this scope, or an `APIError` when none can be built. */\n  get(scope: DgiiEcfScope): Promise<ECF>;\n  /** Drop cached clients, all of them or only one taxpayer's. */\n  invalidate(taxPayerId?: string): void;\n  /** Number of cached clients; always 0 when `getClient` is configured. */\n  readonly size: number;\n  /**\n   * True when the plugin builds the `ECF` instances (the `credentials` mode).\n   *\n   * The status endpoints use it to decide whether the plugin's own\n   * `status.apiKey` is the authority: a host that supplies its own client kept\n   * the status key to itself too, so the plugin must not demand one.\n   */\n  readonly constructsClients: boolean;\n}\n\nconst DEFAULT_MAX_SIZE = 50;\nconst DEFAULT_TTL_MS = 10 * 60 * 1000;\n\nconst cacheKey = (scope: DgiiEcfScope): string =>\n  `${scope.environment}\\u0000${scope.taxPayerId}`;\n\ninterface CacheEntry {\n  readonly client: ECF;\n  readonly expiresAt: number;\n}\n\nconst unavailable = (taxPayerId: string): APIError =>\n  new APIError('INTERNAL_SERVER_ERROR', {\n    message: `No DGII credentials were resolved for taxpayer ${taxPayerId}`,\n    code: DGII_ECF_ERROR_CODES.DGII_CREDENTIALS_UNAVAILABLE.code,\n  });\n\n/**\n * Build the provider from the plugin options.\n *\n * `getClient` wins over `credentials` when both are present: a host that already\n * pools clients is the authority on their lifecycle, so the plugin refuses to\n * cache a second copy behind its back.\n *\n * Configuration is validated here rather than per request. A plugin instance\n * that cannot reach DGII at all should fail when `betterAuth()` is constructed,\n * not on the first invoice.\n */\nexport const createClientProvider = (\n  options: DgiiEcfOptions,\n  now: () => number = Date.now,\n): DgiiEcfClientProvider => {\n  const getClient = options.getClient;\n\n  if (getClient !== undefined) {\n    return {\n      async get(scope) {\n        const client = await getClient(scope);\n        if (client === null) {\n          throw unavailable(scope.taxPayerId);\n        }\n        return client;\n      },\n      invalidate() {\n        // Nothing is cached here; the resolver owns the instances.\n      },\n      size: 0,\n      constructsClients: false,\n    };\n  }\n\n  const resolveCredentials = options.credentials;\n  if (resolveCredentials === undefined) {\n    throw new BetterAuthError(\n      '[better-dgii-ecf] Configure `credentials` or `getClient` — the plugin cannot reach DGII without one of them.',\n    );\n  }\n\n  const maxSize = Math.max(1, options.clientCache?.maxSize ?? DEFAULT_MAX_SIZE);\n  const ttlMs = Math.max(0, options.clientCache?.ttlMs ?? DEFAULT_TTL_MS);\n  const cache = new Map<string, CacheEntry>();\n\n  const evictExpired = (at: number): void => {\n    for (const [key, entry] of cache) {\n      if (entry.expiresAt <= at) {\n        cache.delete(key);\n      }\n    }\n  };\n\n  return {\n    async get(scope) {\n      const at = now();\n      evictExpired(at);\n\n      const key = cacheKey(scope);\n      const cached = cache.get(key);\n      if (cached !== undefined && cached.expiresAt > at) {\n        // Refresh recency so the size cap evicts the least recently used entry.\n        cache.delete(key);\n        cache.set(key, cached);\n        return cached.client;\n      }\n\n      const material = await resolveCredentials(scope);\n      if (material === null) {\n        throw unavailable(scope.taxPayerId);\n      }\n      if (material.key === undefined || material.cert === undefined) {\n        throw new APIError('INTERNAL_SERVER_ERROR', {\n          message: `The credentials resolved for taxpayer ${scope.taxPayerId} carry no key/cert PEM pair`,\n          code: DGII_ECF_ERROR_CODES.DGII_CREDENTIALS_UNAVAILABLE.code,\n        });\n      }\n\n      const statusApiKey = options.status?.apiKey;\n      const client = new ECF(material, scope.environment, {\n        ...(options.timeoutMs === undefined ? {} : { timeoutMs: options.timeoutMs }),\n        ...(statusApiKey === undefined ? {} : { statusApiKey }),\n      });\n\n      if (ttlMs > 0) {\n        while (cache.size >= maxSize) {\n          const oldest = cache.keys().next();\n          if (oldest.done === true) {\n            break;\n          }\n          cache.delete(oldest.value);\n        }\n        cache.set(key, { client, expiresAt: at + ttlMs });\n      }\n      return client;\n    },\n    invalidate(taxPayerId) {\n      if (taxPayerId === undefined) {\n        cache.clear();\n        return;\n      }\n      for (const key of cache.keys()) {\n        if (key.endsWith(`\\u0000${taxPayerId}`)) {\n          cache.delete(key);\n        }\n      }\n    },\n    get size() {\n      return cache.size;\n    },\n    constructsClients: true,\n  };\n};\n","import { createHash } from 'node:crypto';\nimport { APIError } from 'better-auth/api';\nimport type { GenericEndpointContext } from '@better-auth/core';\nimport { DGII_ECF_ERROR_CODES } from './errors.js';\nimport type { DgiiEcfPersistenceOptions } from './types.js';\n\n/**\n * Submission persistence: the audit trail and the replay guard.\n *\n * Two problems are solved by the same row:\n *\n * 1. **Replay safety.** The DGII SDK keeps its idempotency markers in memory, so\n *    a restart or a second instance loses them and a retried POST can submit the\n *    same fiscal document twice. The row makes the guard durable.\n * 2. **Audit.** Who submitted what, under which taxpayer, with which track id\n *    and what DGII answered. Fiscal operations need that trail.\n *\n * Only derived data is stored: the SHA-256 of the signed document, never the\n * document, and never key material or a bearer token.\n */\n\n/** Model key of the table this plugin owns. */\nexport const SUBMISSION_MODEL = 'dgiiEcfSubmission';\n\nexport type SubmissionStatus = 'pending' | 'succeeded' | 'failed';\n\nexport interface SubmissionRecord extends Record<string, unknown> {\n  id: string;\n  organizationId?: string | null;\n  taxPayerId: string;\n  userId: string;\n  environment: string;\n  operation: string;\n  status: SubmissionStatus;\n  idempotencyKey?: string | null;\n  encf?: string | null;\n  trackId?: string | null;\n  documentHash?: string | null;\n  errorCode?: string | null;\n  response?: string | null;\n  createdAt?: Date | string;\n  updatedAt?: Date | string;\n}\n\nexport interface BeginSubmissionInput {\n  readonly organizationId: string | null;\n  readonly taxPayerId: string;\n  readonly userId: string;\n  readonly environment: string;\n  readonly operation: string;\n  readonly idempotencyKey: string;\n  readonly encf: string | null;\n  readonly documentHash: string | null;\n}\n\nexport interface ListSubmissionsInput {\n  readonly organizationId: string | null;\n  readonly taxPayerId: string | null;\n  readonly limit: number;\n}\n\nconst DEFAULT_MAX_RESPONSE_LENGTH = 8192;\n\n/** SHA-256 of a signed document, hex encoded — the replay key of last resort. */\nexport const hashDocument = (xml: string): string =>\n  createHash('sha256').update(xml, 'utf8').digest('hex');\n\nconst serializeResponse = (value: unknown, maxLength: number): string | null => {\n  if (value === undefined || value === null) {\n    return null;\n  }\n  let serialized: string;\n  try {\n    serialized = JSON.stringify(value);\n  } catch {\n    return null;\n  }\n  if (serialized === undefined) {\n    return null;\n  }\n  return serialized.length > maxLength ? serialized.slice(0, maxLength) : serialized;\n};\n\nexport interface DgiiEcfSubmissionStore {\n  readonly enabled: boolean;\n  /**\n   * A previously recorded submission for the same taxpayer and replay key.\n   *\n   * Returns the record whatever its status: the caller decides what a `pending`\n   * or `failed` record means for the attempt it is about to make.\n   */\n  findReplay(\n    taxPayerId: string,\n    idempotencyKey: string,\n  ): Promise<SubmissionRecord | null>;\n  /** Record the attempt before it is transmitted; `null` when persistence is off. */\n  begin(input: BeginSubmissionInput): Promise<string | null>;\n  /** Finish a recorded attempt, whatever its outcome. */\n  complete(\n    id: string | null,\n    outcome: {\n      status: Exclude<SubmissionStatus, 'pending'>;\n      trackId?: string | null;\n      response?: unknown;\n      errorCode?: string | null;\n    },\n  ): Promise<void>;\n  /** Audit listing for the organization (or taxpayer) in scope. */\n  list(input: ListSubmissionsInput): Promise<SubmissionRecord[]>;\n}\n\nconst disabledStore: DgiiEcfSubmissionStore = {\n  enabled: false,\n  async findReplay() {\n    return null;\n  },\n  async begin() {\n    return null;\n  },\n  async complete() {\n    // Persistence is off: there is no row to finish.\n  },\n  async list() {\n    throw new APIError('NOT_IMPLEMENTED', {\n      message: DGII_ECF_ERROR_CODES.DGII_PERSISTENCE_UNAVAILABLE.message,\n      code: DGII_ECF_ERROR_CODES.DGII_PERSISTENCE_UNAVAILABLE.code,\n    });\n  },\n};\n\n/**\n * Build the store over the Better Auth adapter.\n *\n * Failures to write are surfaced, not swallowed: a submission that cannot be\n * recorded must not be transmitted, because the record is the only thing that\n * makes the retry safe. The pending row is written *before* the request leaves,\n * so an interrupted send leaves a marker a later caller can reconcile.\n */\nexport const createSubmissionStore = (\n  ctx: GenericEndpointContext,\n  options: DgiiEcfPersistenceOptions | undefined,\n): DgiiEcfSubmissionStore => {\n  if (options?.enabled === false) {\n    return disabledStore;\n  }\n  const adapter = ctx.context.adapter;\n  const storeResponses = options?.storeResponses ?? true;\n  const maxResponseLength = options?.maxResponseLength ?? DEFAULT_MAX_RESPONSE_LENGTH;\n\n  return {\n    enabled: true,\n    async findReplay(taxPayerId, idempotencyKey) {\n      // `findOne` takes no ordering, and a key can legitimately repeat (a failed\n      // attempt followed by a new one), so the newest row is read explicitly.\n      const rows = await adapter.findMany<SubmissionRecord>({\n        model: SUBMISSION_MODEL,\n        where: [\n          { field: 'taxPayerId', value: taxPayerId },\n          { field: 'idempotencyKey', value: idempotencyKey },\n        ],\n        limit: 1,\n        sortBy: { field: 'createdAt', direction: 'desc' },\n      });\n      return rows[0] ?? null;\n    },\n    async begin(input) {\n      const created = await adapter.create<SubmissionRecord>({\n        model: SUBMISSION_MODEL,\n        data: {\n          organizationId: input.organizationId,\n          taxPayerId: input.taxPayerId,\n          userId: input.userId,\n          environment: input.environment,\n          operation: input.operation,\n          status: 'pending',\n          idempotencyKey: input.idempotencyKey,\n          encf: input.encf,\n          trackId: null,\n          documentHash: input.documentHash,\n          errorCode: null,\n          response: null,\n        },\n      });\n      return created.id;\n    },\n    async complete(id, outcome) {\n      if (id === null) {\n        return;\n      }\n      await adapter.update<SubmissionRecord>({\n        model: SUBMISSION_MODEL,\n        where: [{ field: 'id', value: id }],\n        update: {\n          status: outcome.status,\n          trackId: outcome.trackId ?? null,\n          errorCode: outcome.errorCode ?? null,\n          response: storeResponses\n            ? serializeResponse(outcome.response, maxResponseLength)\n            : null,\n        },\n      });\n    },\n    async list({ organizationId, taxPayerId, limit }) {\n      const where: { field: string; value: string }[] = [];\n      if (organizationId !== null) {\n        where.push({ field: 'organizationId', value: organizationId });\n      }\n      if (taxPayerId !== null) {\n        where.push({ field: 'taxPayerId', value: taxPayerId });\n      }\n      return adapter.findMany<SubmissionRecord>({\n        model: SUBMISSION_MODEL,\n        ...(where.length > 0 ? { where } : {}),\n        limit,\n        sortBy: { field: 'createdAt', direction: 'desc' },\n      });\n    },\n  };\n};\n\n/**\n * Replay decision for a submission about to be transmitted.\n *\n * - A `succeeded` record is returned as-is: the document already exists at\n *   DGII, so re-sending it cannot be the caller's intent.\n * - A `pending` record means an earlier attempt may have reached DGII. Refusing\n *   with a conflict is the only safe answer — the caller reconciles by e-NCF\n *   instead of gambling on a duplicate fiscal document.\n * - A `failed` record is not a replay: the previous attempt did not land, so the\n *   new one may proceed.\n */\nexport const planReplay = (\n  record: SubmissionRecord | null,\n):\n  | { kind: 'proceed' }\n  | { kind: 'replay'; record: SubmissionRecord }\n  | { kind: 'conflict' } => {\n  if (record === null) {\n    return { kind: 'proceed' };\n  }\n  if (record.status === 'succeeded') {\n    return { kind: 'replay', record };\n  }\n  if (record.status === 'pending') {\n    return { kind: 'conflict' };\n  }\n  return { kind: 'proceed' };\n};\n\n/** Parse a stored response back into the shape the caller originally received. */\nexport const parseStoredResponse = (record: SubmissionRecord): unknown => {\n  const raw = record.response;\n  if (typeof raw !== 'string' || raw === '') {\n    return null;\n  }\n  try {\n    return JSON.parse(raw) as unknown;\n  } catch {\n    return null;\n  }\n};\n","/**\n * Taxpayer id (RNC / cédula) handling for the DGII e-CF services.\n *\n * Two things are deliberately kept apart:\n *\n * - **Normalization** is unconditional. DGII accepts the identifier with or\n *   without separators, and a database that stores `1-31-12345-6` while the\n *   organization field stores `131123456` must not produce a mismatch.\n * - **Validation** is a policy. The only rule enforced by default is the\n *   documented shape: 9 digits for an RNC, 11 for a cédula. Anything stricter\n *   (a check digit, an allow-list of registered taxpayers) is the host's call,\n *   so it is injected rather than assumed.\n */\n\n/** Separators DGII tolerates in a taxpayer id: spaces, dashes and dots. */\nconst SEPARATORS = /[\\s.\\-–—]/g;\n\n/** 9 digits = RNC (legal entity), 11 digits = cédula (natural person). */\nconst SHAPE = /^(?:\\d{9}|\\d{11})$/;\n\n/** Strip the separators a human types so comparison and storage are stable. */\nexport const normalizeTaxPayerId = (value: string): string =>\n  value.replace(SEPARATORS, '').trim();\n\n/**\n * True when the value is a syntactically valid DGII identifier.\n *\n * The input is expected to be already normalized; call\n * {@link normalizeTaxPayerId} first when it comes from user input.\n */\nexport const isTaxPayerIdShape = (value: string): boolean => SHAPE.test(value);\n\n/**\n * Custom validation hook. Return `true` to accept, or a string to accept with\n * a normalized replacement (for example an alias resolved to its canonical\n * RNC). Returning `false` rejects.\n */\nexport type TaxPayerIdValidator = (\n  taxPayerId: string,\n) => boolean | string | Promise<boolean | string>;\n\n/** How strictly a resolved taxpayer id is checked. Defaults to `format`. */\nexport type TaxPayerIdValidation = 'format' | 'off' | TaxPayerIdValidator;\n\nexport class TaxPayerIdError extends Error {\n  readonly reason: 'shape' | 'custom';\n\n  constructor(reason: 'shape' | 'custom', message: string) {\n    super(message);\n    this.name = 'TaxPayerIdError';\n    this.reason = reason;\n  }\n}\n\n/**\n * Normalize and validate, returning the canonical id.\n *\n * Throws {@link TaxPayerIdError} so the endpoint layer can map the failure to a\n * single error code regardless of which rule rejected it.\n */\nexport const applyTaxPayerIdValidation = async (\n  raw: string,\n  validation: TaxPayerIdValidation,\n): Promise<string> => {\n  const normalized = normalizeTaxPayerId(raw);\n  if (normalized === '') {\n    throw new TaxPayerIdError('shape', 'The taxpayer id is empty');\n  }\n  if (validation === 'off') {\n    return normalized;\n  }\n  if (validation === 'format') {\n    if (!isTaxPayerIdShape(normalized)) {\n      throw new TaxPayerIdError(\n        'shape',\n        `\"${raw}\" is not a DGII RNC (9 digits) or cédula (11 digits)`,\n      );\n    }\n    return normalized;\n  }\n  const verdict = await validation(normalized);\n  if (verdict === false) {\n    throw new TaxPayerIdError('custom', `\"${raw}\" was rejected by the validator`);\n  }\n  if (typeof verdict === 'string') {\n    return normalizeTaxPayerId(verdict);\n  }\n  return normalized;\n};\n","import { APIError } from 'better-auth/api';\nimport { Environment } from '@deuriib/dgii-ecf';\nimport type { Session, User } from 'better-auth';\nimport type { GenericEndpointContext } from '@better-auth/core';\nimport { badRequest, DGII_ECF_ERROR_CODES, forbidden } from './errors.js';\nimport {\n  applyTaxPayerIdValidation,\n  normalizeTaxPayerId,\n  TaxPayerIdError,\n} from './tax-payer.js';\nimport type {\n  DgiiEcfOptions,\n  DgiiEcfScope,\n  DgiiEcfTaxPayerIdSource,\n  DgiiEcfTaxPayerIdResolver,\n  TaxPayerIdValidation,\n} from './types.js';\n\n/** Organization model key used by the Better Auth organization plugin. */\nconst ORGANIZATION_MODEL = 'organization';\n/** Membership model key used by the Better Auth organization plugin. */\nconst MEMBER_MODEL = 'member';\n\nconst DEFAULT_ROLES = ['owner', 'admin'];\n\n/** The identity behind a call, resolved once per request. */\nexport interface DgiiEcfRequestScope extends DgiiEcfScope {\n  readonly organizationTaxPayerId: string | null;\n  readonly source: DgiiEcfTaxPayerIdSource;\n  readonly user: User;\n  readonly session: Session;\n}\n\nexport interface DgiiEcfEndpointInput {\n  taxPayerId?: string | undefined;\n  organizationId?: string | undefined;\n}\n\ninterface OrganizationRow extends Record<string, unknown> {\n  id?: string;\n}\n\ninterface MemberRow extends Record<string, unknown> {\n  role?: unknown;\n}\n\n/**\n * True when the organization plugin is part of this Better Auth instance.\n *\n * The plugin never assumes it: without it there is no tenant model, and the\n * authorization policy degrades to the documented single-tenant mode instead of\n * silently failing every call.\n */\nexport const hasOrganizationPlugin = (ctx: GenericEndpointContext): boolean =>\n  (ctx.context.options.plugins ?? []).some((plugin) => plugin.id === 'organization');\n\nconst readOrganizationField = (row: OrganizationRow, field: string): string | null => {\n  // The declared field name wins; the snake_case spelling is accepted because a\n  // host may map the column with `fieldName`.\n  const raw = row[field] ?? row.taxPayerId ?? row.tax_payer_id;\n  if (typeof raw !== 'string') {\n    return null;\n  }\n  const normalized = normalizeTaxPayerId(raw);\n  return normalized === '' ? null : normalized;\n};\n\nconst readActiveOrganizationId = (session: Session): string | null => {\n  const raw = (session as { activeOrganizationId?: unknown }).activeOrganizationId;\n  return typeof raw === 'string' && raw !== '' ? raw : null;\n};\n\nconst rolesOf = (member: MemberRow): string[] =>\n  String(member.role ?? '')\n    .split(',')\n    .map((role) => role.trim())\n    .filter((role) => role !== '');\n\nexport interface ResolveScopeContext {\n  readonly ctx: GenericEndpointContext;\n  readonly options: DgiiEcfOptions;\n  readonly input: DgiiEcfEndpointInput;\n}\n\nconst environmentOf = async (\n  options: DgiiEcfOptions,\n  scope: Omit<DgiiEcfRequestScope, 'environment'>,\n): Promise<Environment> => {\n  const configured = options.environment ?? Environment.Dev;\n  if (typeof configured === 'function') {\n    return configured({\n      taxPayerId: scope.taxPayerId,\n      organizationId: scope.organizationId,\n      userId: scope.user.id,\n    });\n  }\n  return configured;\n};\n\n/**\n * Resolve (and authorize) the taxpayer a call acts for.\n *\n * Resolution order is fixed and observable to callers through the `source`\n * field returned by `GET /dgii-ecf/taxpayer`:\n *\n * 1. `taxPayerId` in the request — the per-call mode.\n * 2. The organization's stored field — the organization-plugin mode.\n * 3. The configured `resolveTaxPayerId` resolver — the user/tenant mapping mode.\n *\n * Authorization happens after resolution, never before: a request-supplied id is\n * checked against the organization's stored id and the caller's role, so naming\n * a taxpayer in the body cannot grant access to it.\n */\nexport const resolveRequestScope = async ({\n  ctx,\n  options,\n  input,\n}: ResolveScopeContext): Promise<DgiiEcfRequestScope> => {\n  const authenticated = ctx.context.session;\n  if (authenticated === null) {\n    throw new APIError('UNAUTHORIZED', {\n      message: DGII_ECF_ERROR_CODES.DGII_SESSION_REQUIRED.message,\n      code: DGII_ECF_ERROR_CODES.DGII_SESSION_REQUIRED.code,\n    });\n  }\n  const { user, session } = authenticated;\n\n  const withOrganization = hasOrganizationPlugin(ctx);\n  const organizationId =\n    input.organizationId ??\n    (withOrganization ? readActiveOrganizationId(session) : null);\n\n  let organization: OrganizationRow | null = null;\n  let organizationTaxPayerId: string | null = null;\n  if (withOrganization && organizationId !== null) {\n    organization = await ctx.context.adapter.findOne<OrganizationRow>({\n      model: ORGANIZATION_MODEL,\n      where: [{ field: 'id', value: organizationId }],\n    });\n    if (organization === null) {\n      throw new APIError('NOT_FOUND', {\n        message: DGII_ECF_ERROR_CODES.DGII_ORGANIZATION_NOT_FOUND.message,\n        code: DGII_ECF_ERROR_CODES.DGII_ORGANIZATION_NOT_FOUND.code,\n      });\n    }\n    organizationTaxPayerId = readOrganizationField(\n      organization,\n      options.organization?.field ?? 'taxPayerId',\n    );\n  }\n\n  const validation: TaxPayerIdValidation = options.validateTaxPayerId ?? 'format';\n  const toCanonical = async (raw: string): Promise<string> => {\n    try {\n      return await applyTaxPayerIdValidation(raw, validation);\n    } catch (error) {\n      if (error instanceof TaxPayerIdError) {\n        throw badRequest(DGII_ECF_ERROR_CODES.DGII_TAXPAYER_ID_INVALID, error.message);\n      }\n      throw error;\n    }\n  };\n\n  let taxPayerId: string | null = null;\n  let source: DgiiEcfTaxPayerIdSource = 'request';\n\n  if (input.taxPayerId !== undefined) {\n    taxPayerId = await toCanonical(input.taxPayerId);\n  } else if (organizationTaxPayerId !== null) {\n    taxPayerId = await toCanonical(organizationTaxPayerId);\n    source = 'organization';\n  } else {\n    const resolver: DgiiEcfTaxPayerIdResolver | undefined = options.resolveTaxPayerId;\n    const fromResolver =\n      resolver === undefined ? null : await resolver({ user, session, organizationId });\n    if (fromResolver !== null) {\n      taxPayerId = await toCanonical(fromResolver);\n      source = 'resolver';\n    }\n  }\n\n  if (taxPayerId === null) {\n    throw badRequest(DGII_ECF_ERROR_CODES.DGII_TAXPAYER_ID_REQUIRED);\n  }\n\n  await authorize({\n    ctx,\n    options,\n    user,\n    session,\n    taxPayerId,\n    organizationId: withOrganization ? organizationId : null,\n    organization,\n    organizationTaxPayerId,\n    source,\n    withOrganization,\n  });\n\n  const resolved: Omit<DgiiEcfRequestScope, 'environment'> = {\n    taxPayerId,\n    organizationId: withOrganization ? organizationId : null,\n    organizationTaxPayerId,\n    source,\n    userId: user.id,\n    user,\n    session,\n  };\n\n  return { ...resolved, environment: await environmentOf(options, resolved) };\n};\n\ninterface AuthorizeInput {\n  readonly ctx: GenericEndpointContext;\n  readonly options: DgiiEcfOptions;\n  readonly user: User;\n  readonly session: Session;\n  readonly taxPayerId: string;\n  readonly organizationId: string | null;\n  readonly organization: OrganizationRow | null;\n  readonly organizationTaxPayerId: string | null;\n  readonly source: DgiiEcfTaxPayerIdSource;\n  readonly withOrganization: boolean;\n}\n\n/**\n * The built-in policy.\n *\n * With the organization plugin installed the tenant is the unit of trust: the\n * caller must be a member of the organization in scope, hold an allowed role,\n * and — when the organization stores a taxpayer id — the resolved id must be\n * that one. A request may name a taxpayer, but it cannot name one that the\n * organization does not own.\n *\n * Without the organization plugin there is nothing to check against, so the\n * request-supplied id is accepted: this is the single-tenant mode documented in\n * SECURITY.md. Installing the organization plugin is what turns the strict\n * policy on.\n */\nconst authorize = async (input: AuthorizeInput): Promise<void> => {\n  const custom = input.options.authorize;\n  if (custom !== undefined) {\n    const allowed = await custom({\n      user: input.user,\n      session: input.session,\n      taxPayerId: input.taxPayerId,\n      organizationId: input.organizationId,\n      organizationTaxPayerId: input.organizationTaxPayerId,\n      source: input.source,\n    });\n    if (!allowed) {\n      throw forbidden(DGII_ECF_ERROR_CODES.DGII_TAXPAYER_ID_FORBIDDEN);\n    }\n    return;\n  }\n\n  if (!input.withOrganization) {\n    return;\n  }\n\n  if (input.organizationId === null || input.organization === null) {\n    if (input.source === 'request' && input.options.allowUntrustedTaxPayerId === true) {\n      return;\n    }\n    if (input.source === 'resolver') {\n      // A resolver is server-side configuration: the host decided this mapping.\n      return;\n    }\n    throw badRequest(DGII_ECF_ERROR_CODES.DGII_ORGANIZATION_REQUIRED);\n  }\n\n  const member = await input.ctx.context.adapter.findOne<MemberRow>({\n    model: MEMBER_MODEL,\n    where: [\n      { field: 'organizationId', value: input.organizationId },\n      { field: 'userId', value: input.user.id },\n    ],\n  });\n  if (member === null) {\n    throw forbidden(DGII_ECF_ERROR_CODES.DGII_NOT_A_MEMBER);\n  }\n\n  const allowedRoles = input.options.roles ?? DEFAULT_ROLES;\n  const memberRoles = rolesOf(member);\n  if (!memberRoles.some((role) => allowedRoles.includes(role))) {\n    throw forbidden(\n      DGII_ECF_ERROR_CODES.DGII_INSUFFICIENT_ROLE,\n      `${DGII_ECF_ERROR_CODES.DGII_INSUFFICIENT_ROLE.message} (required one of: ${allowedRoles.join(', ')})`,\n    );\n  }\n\n  if (\n    input.organizationTaxPayerId !== null &&\n    input.organizationTaxPayerId !== input.taxPayerId\n  ) {\n    throw forbidden(\n      DGII_ECF_ERROR_CODES.DGII_TAXPAYER_ID_FORBIDDEN,\n      `Organization ${input.organizationId} issues under ${input.organizationTaxPayerId}, not ${input.taxPayerId}`,\n    );\n  }\n};\n","/**\n * Minimal, tolerant readers for signed DGII XML.\n *\n * The plugin never parses a full document: it needs two facts — which taxpayer\n * issued it, and which root element it is — and both are readable with a single\n * match. This mirrors the DGII SDK's internal readers so both layers agree on\n * what a document says, without the plugin reaching into the SDK's non-public\n * modules.\n *\n * Two properties are load-bearing:\n *\n * 1. **Nothing is read from a comment.** A document is attacker-influenced input,\n *    and `<!-- <RNCEmisor>…</RNCEmisor> -->` would otherwise be observable as the\n *    issuer. That is not a cosmetic bug: the issuer check is what stops a member\n *    of one organization from submitting a document for another taxpayer, so a\n *    value an author can hide in a comment cannot be the value the check reads.\n * 2. **Tolerance, not sanitization.** Markup is skipped by scanning spans\n *    (comment, processing instruction, declaration) rather than by deleting\n *    patterns, because deleting markup and then searching the remainder is how\n *    residue becomes a false root or a false issuer.\n */\n\nconst PATTERN_CACHE = new Map<string, RegExp>();\n\n/**\n * An attribute span may contain `>` inside quotes (`nota=\"a > b\"`), so each\n * quoted form gets its own alternative instead of a blanket `[^>]*`.\n */\nconst ATTRIBUTE_SPAN = `(?:[^>\"']|\"[^\"]*\"|'[^']*')*`;\n\nconst escapeRegExp = (value: string): string =>\n  value.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\$&');\n\nconst elementPattern = (tag: string): RegExp => {\n  const cached = PATTERN_CACHE.get(tag);\n  if (cached !== undefined) {\n    return cached;\n  }\n  const name = escapeRegExp(tag);\n  const prefix = '(?:[\\\\w.-]+:)?';\n  const pattern = new RegExp(\n    `<${prefix}${name}${ATTRIBUTE_SPAN}>([\\\\s\\\\S]*?)<\\\\/${prefix}${name}\\\\s*>`,\n  );\n  PATTERN_CACHE.set(tag, pattern);\n  return pattern;\n};\n\n/**\n * End (exclusive) of the non-element span that starts at `open`, or `-1` when\n * the `<` begins an element.\n *\n * An unterminated span swallows the rest of the document: an unterminated\n * comment is a malformed document, and treating its contents as markup is\n * exactly the behaviour this function exists to prevent.\n */\nconst skipNonElement = (xml: string, open: number): number => {\n  if (xml.startsWith('<!--', open)) {\n    const end = xml.indexOf('-->', open + 4);\n    return end === -1 ? xml.length : end + 3;\n  }\n  if (xml.startsWith('<?', open)) {\n    const end = xml.indexOf('?>', open + 2);\n    return end === -1 ? xml.length : end + 2;\n  }\n  if (xml.startsWith('<!', open)) {\n    // A declaration (DOCTYPE, or a CDATA section). The internal subset of a\n    // DOCTYPE may contain `>` inside `[...]`, so the bracket depth is tracked.\n    let depth = 0;\n    for (let cursor = open + 2; cursor < xml.length; cursor += 1) {\n      const character = xml[cursor];\n      if (character === '[') {\n        depth += 1;\n      } else if (character === ']') {\n        depth = Math.max(0, depth - 1);\n      } else if (character === '>' && depth === 0) {\n        return cursor + 1;\n      }\n    }\n    return xml.length;\n  }\n  return -1;\n};\n\n/**\n * The document with every comment, processing instruction and declaration\n * removed — element markup untouched.\n *\n * Removing these spans means a later element match can only find real elements.\n * The scan is linear and allocation-light; DGII documents are small and a request\n * reads at most a handful of values from one.\n */\nconst withoutNonElementMarkup = (xml: string): string => {\n  const parts: string[] = [];\n  let index = 0;\n  for (;;) {\n    const open = xml.indexOf('<', index);\n    if (open === -1) {\n      parts.push(xml.slice(index));\n      return parts.join('');\n    }\n    parts.push(xml.slice(index, open));\n    const end = skipNonElement(xml, open);\n    if (end === -1) {\n      // A real element: keep the `<` and continue scanning after it, so a later\n      // comment inside the element (or after it) is still removed.\n      parts.push('<');\n      index = open + 1;\n      continue;\n    }\n    index = end;\n  }\n};\n\n/**\n * Text content of the first `<tag>` element, tolerating a namespace prefix and\n * attributes. Returns `undefined` when the element is absent, self-closing or\n * blank. Matching is case-sensitive, as XML element names are.\n */\nexport const elementText = (xml: string, tag: string): string | undefined => {\n  const text = elementPattern(tag).exec(withoutNonElementMarkup(xml))?.[1]?.trim();\n  return text === undefined || text === '' ? undefined : text;\n};\n\nconst ROOT_PATTERN = /<\\s*(?:[A-Za-z_][\\w.-]*:)?([A-Za-z_][\\w.-]*)[\\s/>]/;\n\n/**\n * Local name of the document's root element, ignoring the XML declaration, a\n * DOCTYPE and any leading comments.\n *\n * DGII routing depends on the root: `<ECF>` goes to the general reception and\n * `<RFCE>` to the consumption-summary reception.\n */\nexport const rootElementName = (xml: string): string | undefined =>\n  ROOT_PATTERN.exec(withoutNonElementMarkup(xml))?.[1];\n\n/** Issuer identifiers DGII uses across the e-CF, ACECF and ANECF schemas. */\nconst ISSUER_TAGS = ['RNCEmisor', 'RncEmisor'] as const;\n\n/**\n * The taxpayer id that issued the document, or `undefined` when the document\n * does not carry one.\n *\n * Both spellings are read because DGII's schemas disagree: the e-CF and ACECF\n * documents use `RNCEmisor` and the ANECF voiding request uses `RncEmisor`.\n */\nexport const issuerTaxPayerId = (xml: string): string | undefined => {\n  for (const tag of ISSUER_TAGS) {\n    const value = elementText(xml, tag);\n    if (value !== undefined) {\n      return value;\n    }\n  }\n  return undefined;\n};\n","import { APIError } from 'better-auth/api';\nimport type { GenericEndpointContext } from '@better-auth/core';\nimport type { DgiiResult, ECF } from '@deuriib/dgii-ecf';\nimport { Signature } from '@deuriib/dgii-ecf';\nimport {\n  badRequest,\n  conflict,\n  DGII_ECF_ERROR_CODES,\n  forbidden,\n  serverError,\n  toApiError,\n} from '../errors.js';\nimport type { DgiiEcfClientProvider } from '../client-provider.js';\nimport { type DgiiEcfRequestScope, resolveRequestScope } from '../resolution.js';\nimport {\n  createSubmissionStore,\n  hashDocument,\n  parseStoredResponse,\n  planReplay,\n} from '../persistence.js';\nimport { normalizeTaxPayerId } from '../tax-payer.js';\nimport type { DgiiEcfOptions, DgiiEcfScope } from '../types.js';\nimport { elementText, issuerTaxPayerId, rootElementName } from '../xml.js';\n\n/** What every endpoint handler needs from the plugin closure. */\nexport interface DgiiEcfEndpointDeps {\n  readonly options: DgiiEcfOptions;\n  readonly provider: DgiiEcfClientProvider;\n}\n\nexport interface EndpointInput {\n  taxPayerId?: string | undefined;\n  organizationId?: string | undefined;\n}\n\nexport interface PreparedRequest {\n  readonly scope: DgiiEcfRequestScope;\n  readonly client: ECF;\n}\n\n/**\n * Resolve the scope, then the client — in that order.\n *\n * Authorization is part of resolution, so a caller who may not act on behalf of\n * a taxpayer never reaches the credential resolver and cannot learn, from timing\n * or error shape, whether that taxpayer has credentials configured.\n */\nexport const prepare = async (\n  deps: DgiiEcfEndpointDeps,\n  ctx: GenericEndpointContext,\n  input: EndpointInput,\n): Promise<PreparedRequest> => {\n  const scope = await resolveRequestScope({ ctx, options: deps.options, input });\n  const client = await deps.provider.get(scope);\n  return { scope, client };\n};\n\n/**\n * Unwrap a DGII SDK result, mapping a failure to an `APIError`.\n *\n * The SDK never throws domain errors; it returns `Result`. This is the single\n * place that turns `Err` into an HTTP response, so the status mapping stays\n * consistent across every endpoint.\n */\nexport const unwrap = <T>(result: DgiiResult<T>): T => {\n  if (result.isErr()) {\n    throw toApiError(result.error);\n  }\n  return result.value;\n};\n\n/**\n * Refuse a document whose issuer is not the taxpayer this request acts for.\n *\n * Without this check a member of organization A could build a perfectly valid\n * document for RNC B, have it signed with A's certificate (which is merely a\n * signing key, not an authorization), and submit it under A's credentials. The\n * issuer is the fiscal identity of the document, so it must equal the identity\n * the caller was authorized for.\n */\nexport const assertIssuer = (xml: string, taxPayerId: string): void => {\n  const issuer = issuerTaxPayerId(xml);\n  if (issuer === undefined) {\n    throw badRequest(DGII_ECF_ERROR_CODES.DGII_DOCUMENT_UNREADABLE);\n  }\n  if (normalizeTaxPayerId(issuer) !== taxPayerId) {\n    throw forbidden(\n      DGII_ECF_ERROR_CODES.DGII_TAXPAYER_ID_MISMATCH,\n      `The document is issued by ${issuer} but this request acts for ${taxPayerId}`,\n    );\n  }\n};\n\n/**\n * Sign a document server-side with the organization's key.\n *\n * The signature is what makes the credential model work: the browser sends the\n * document body, the server signs it, and the private key never leaves the\n * process. Signing requires the `credentials` resolver — a host that supplies a\n * ready-made client has kept the key outside the plugin's reach on purpose.\n */\nexport const signDocument = async (\n  deps: DgiiEcfEndpointDeps,\n  scope: DgiiEcfScope,\n  xml: string,\n): Promise<string> => {\n  const resolver = deps.options.credentials;\n  if (resolver === undefined) {\n    throw serverError(\n      DGII_ECF_ERROR_CODES.DGII_CREDENTIALS_UNAVAILABLE,\n      'Server-side signing needs the `credentials` resolver; `getClient` hands the key to the host.',\n    );\n  }\n  const material = await resolver(scope);\n  if (material === null) {\n    throw serverError(\n      DGII_ECF_ERROR_CODES.DGII_CREDENTIALS_UNAVAILABLE,\n      `No credentials were resolved for taxpayer ${scope.taxPayerId}`,\n    );\n  }\n  const { key, cert } = material;\n  if (key === undefined || cert === undefined) {\n    // `P12ReaderData` keeps both fields optional, but a signature needs both.\n    // Failing here names the real problem instead of surfacing a CERTIFICATE\n    // error from underneath the signer.\n    throw serverError(\n      DGII_ECF_ERROR_CODES.DGII_CREDENTIALS_UNAVAILABLE,\n      'The resolved credentials carry no `key`/`cert` PEM pair, so the document cannot be signed',\n    );\n  }\n  const signature = new Signature(key, cert);\n  const root = rootElementName(xml);\n  const signed =\n    root === undefined ? signature.signXml(xml) : signature.signXml(xml, root);\n  if (signed.isErr()) {\n    throw new APIError('BAD_REQUEST', {\n      message: signed.error.message,\n      code: DGII_ECF_ERROR_CODES.DGII_SIGNING_FAILED.code,\n      dgii: { code: signed.error.code },\n    });\n  }\n  return signed.value;\n};\n\n/** The e-NCF a document refers to, used for the audit trail. */\nexport const documentEncf = (xml: string): string | null =>\n  elementText(xml, 'eNCF') ??\n  elementText(xml, 'SecuenciaeNCFDesde') ??\n  elementText(xml, 'RangoNCF') ??\n  null;\n\nexport interface RunSubmissionInput<T> {\n  readonly ctx: GenericEndpointContext;\n  readonly deps: DgiiEcfEndpointDeps;\n  readonly scope: DgiiEcfRequestScope;\n  /** Operation name recorded in the audit trail. */\n  readonly operation: string;\n  /** Signed XML about to be transmitted. */\n  readonly xml: string;\n  /** Caller-supplied idempotency key; defaults to the document hash. */\n  readonly idempotencyKey?: string | undefined;\n  /** The actual transmission. Only called when a replay is not possible. */\n  readonly send: () => Promise<DgiiResult<T>>;\n}\n\nexport interface SubmissionOutcome<T> {\n  readonly result: T;\n  /** True when the answer came from the stored record, not from DGII. */\n  readonly replayed: boolean;\n  /** Row id of the audit record, when persistence is enabled. */\n  readonly submissionId: string | null;\n}\n\nconst trackIdOf = (value: unknown): string | null => {\n  if (typeof value !== 'object' || value === null) {\n    return null;\n  }\n  const candidate = (value as { trackId?: unknown }).trackId;\n  return typeof candidate === 'string' && candidate !== '' ? candidate : null;\n};\n\n/**\n * Run a submission through the durable replay guard and the audit trail.\n *\n * Order matters and is the whole point: look for a replay, write the pending\n * row, transmit, then record the outcome. A crash between \"write pending\" and\n * \"record outcome\" leaves a row that makes the next attempt refuse instead of\n * guessing — a duplicate fiscal document is worse than a failed request.\n */\nexport const runSubmission = async <T>({\n  ctx,\n  deps,\n  scope,\n  operation,\n  xml,\n  idempotencyKey,\n  send,\n}: RunSubmissionInput<T>): Promise<SubmissionOutcome<T>> => {\n  const store = createSubmissionStore(ctx, deps.options.persistence);\n  const documentHash = hashDocument(xml);\n  const replayKey = idempotencyKey ?? documentHash;\n\n  if (store.enabled) {\n    const existing = await store.findReplay(scope.taxPayerId, replayKey);\n    const decision = planReplay(existing);\n    if (decision.kind === 'conflict') {\n      throw conflict(\n        DGII_ECF_ERROR_CODES.DGII_IDEMPOTENCY_IN_FLIGHT,\n        `A submission for this document is still in flight (record ${existing?.id ?? 'unknown'}). Reconcile it by e-NCF before retrying.`,\n      );\n    }\n    if (decision.kind === 'replay') {\n      return {\n        result: parseStoredResponse(decision.record) as T,\n        replayed: true,\n        submissionId: decision.record.id,\n      };\n    }\n  }\n\n  const submissionId = await store.begin({\n    organizationId: scope.organizationId,\n    taxPayerId: scope.taxPayerId,\n    userId: scope.userId,\n    environment: scope.environment,\n    operation,\n    idempotencyKey: replayKey,\n    encf: documentEncf(xml),\n    documentHash,\n  });\n\n  let result: T;\n  try {\n    result = unwrap(await send());\n  } catch (error) {\n    const errorCode =\n      error instanceof APIError\n        ? String(error.body?.code ?? error.status)\n        : error instanceof Error\n          ? error.name\n          : 'UNKNOWN';\n    await store.complete(submissionId, { status: 'failed', errorCode });\n    throw error;\n  }\n\n  await store.complete(submissionId, {\n    status: 'succeeded',\n    trackId: trackIdOf(result),\n    response: result,\n  });\n\n  return { result, replayed: false, submissionId };\n};\n\n/** The scope fields every response echoes back. */\nexport const scopeEcho = (scope: DgiiEcfScope) => ({\n  taxPayerId: scope.taxPayerId,\n  organizationId: scope.organizationId,\n  environment: scope.environment,\n});\n","import { createAuthEndpoint, sessionMiddleware } from 'better-auth/api';\nimport * as z from 'zod';\nimport type {\n  B2BCommercialApprovalResponse,\n  CommercialApprovalResponse,\n  InvoiceResponse,\n} from '@deuriib/dgii-ecf';\nimport {\n  assertIssuer,\n  type DgiiEcfEndpointDeps,\n  documentEncf,\n  prepare,\n  runSubmission,\n  scopeEcho,\n  signDocument,\n  unwrap,\n} from './shared.js';\n\n/**\n * Document transmission endpoints.\n *\n * Every one of them takes XML — signed already, or signable — never a JSON\n * invoice model: building a DGII document is a domain problem the host owns,\n * while signing and transmitting are the plugin's. `sign: true` moves the\n * signature server-side, next to the key, which is the reason a browser can call\n * these endpoints at all without ever holding a certificate.\n */\n\nconst scopeShape = {\n  taxPayerId: z.string().min(1).optional().meta({\n    description:\n      'Taxpayer id (RNC / cédula) to act for. Overrides the organization field for this request only.',\n  }),\n  organizationId: z.string().min(1).optional().meta({\n    description:\n      'Organization to act for. Defaults to the session active organization.',\n  }),\n};\n\nconst documentShape = {\n  ...scopeShape,\n  xml: z.string().min(1).meta({ description: 'The DGII document, as XML.' }),\n  fileName: z.string().min(1).max(255).optional().meta({\n    description: 'Multipart file name sent to DGII. Defaults to the document e-NCF.',\n  }),\n  sign: z.boolean().optional().meta({\n    description:\n      'Sign the XML server-side with the organization key before transmitting. Requires the `credentials` resolver.',\n  }),\n  idempotencyKey: z.string().min(1).max(200).optional().meta({\n    description:\n      'Replay guard key. Defaults to the SHA-256 of the document, so retrying the same document never double-issues.',\n  }),\n};\n\nconst fileNameFor = (xml: string, fallback: string): string => {\n  const encf = documentEncf(xml);\n  return encf === null ? `${fallback}.xml` : `${encf}.xml`;\n};\n\n/** POST /dgii-ecf/documents — route to the reception the document belongs to. */\nexport const sendDocument = (deps: DgiiEcfEndpointDeps) =>\n  createAuthEndpoint(\n    '/dgii-ecf/documents',\n    {\n      method: 'POST',\n      body: z.object({\n        ...documentShape,\n        buyerHost: z.string().url().optional().meta({\n          description:\n            'Deliver directly to the buyer Sender↔Receiver host instead of DGII.',\n        }),\n      }),\n      use: [sessionMiddleware],\n    },\n    async (ctx) => {\n      const { scope, client } = await prepare(deps, ctx, ctx.body);\n      const xml =\n        ctx.body.sign === true\n          ? await signDocument(deps, scope, ctx.body.xml)\n          : ctx.body.xml;\n      assertIssuer(xml, scope.taxPayerId);\n\n      const outcome = await runSubmission({\n        ctx,\n        deps,\n        scope,\n        operation: 'sendDocument',\n        xml,\n        idempotencyKey: ctx.body.idempotencyKey,\n        send: () =>\n          client.sendDocument(\n            xml,\n            ctx.body.fileName ?? fileNameFor(xml, 'document'),\n            ctx.body.buyerHost,\n          ),\n      });\n\n      return ctx.json({\n        ...scopeEcho(scope),\n        submissionId: outcome.submissionId,\n        replayed: outcome.replayed,\n        result: outcome.result,\n      });\n    },\n  );\n\n/** POST /dgii-ecf/documents/electronic — general e-CF reception only. */\nexport const sendElectronicDocument = (deps: DgiiEcfEndpointDeps) =>\n  createAuthEndpoint(\n    '/dgii-ecf/documents/electronic',\n    {\n      method: 'POST',\n      body: z.object({\n        ...documentShape,\n        buyerHost: z.string().url().optional(),\n      }),\n      use: [sessionMiddleware],\n    },\n    async (ctx) => {\n      const { scope, client } = await prepare(deps, ctx, ctx.body);\n      const xml =\n        ctx.body.sign === true\n          ? await signDocument(deps, scope, ctx.body.xml)\n          : ctx.body.xml;\n      assertIssuer(xml, scope.taxPayerId);\n\n      const outcome = await runSubmission<InvoiceResponse>({\n        ctx,\n        deps,\n        scope,\n        operation: 'sendElectronicDocument',\n        xml,\n        idempotencyKey: ctx.body.idempotencyKey,\n        send: () =>\n          client.sendElectronicDocument(\n            xml,\n            ctx.body.fileName ?? fileNameFor(xml, 'ecf'),\n            ctx.body.buyerHost,\n          ),\n      });\n\n      return ctx.json({\n        ...scopeEcho(scope),\n        submissionId: outcome.submissionId,\n        replayed: outcome.replayed,\n        result: outcome.result,\n      });\n    },\n  );\n\n/** POST /dgii-ecf/documents/summary — RFCE summary invoices only. */\nexport const sendSummary = (deps: DgiiEcfEndpointDeps) =>\n  createAuthEndpoint(\n    '/dgii-ecf/documents/summary',\n    {\n      method: 'POST',\n      body: z.object(documentShape),\n      use: [sessionMiddleware],\n    },\n    async (ctx) => {\n      const { scope, client } = await prepare(deps, ctx, ctx.body);\n      const xml =\n        ctx.body.sign === true\n          ? await signDocument(deps, scope, ctx.body.xml)\n          : ctx.body.xml;\n      assertIssuer(xml, scope.taxPayerId);\n\n      const outcome = await runSubmission({\n        ctx,\n        deps,\n        scope,\n        operation: 'sendSummary',\n        xml,\n        idempotencyKey: ctx.body.idempotencyKey,\n        send: () =>\n          client.sendSummary(xml, ctx.body.fileName ?? fileNameFor(xml, 'summary')),\n      });\n\n      return ctx.json({\n        ...scopeEcho(scope),\n        submissionId: outcome.submissionId,\n        replayed: outcome.replayed,\n        result: outcome.result,\n      });\n    },\n  );\n\n/** POST /dgii-ecf/documents/commercial-approval — ACECF. */\nexport const sendCommercialApproval = (deps: DgiiEcfEndpointDeps) =>\n  createAuthEndpoint(\n    '/dgii-ecf/documents/commercial-approval',\n    {\n      method: 'POST',\n      body: z.object({\n        ...documentShape,\n        buyerHost: z.string().url().optional().meta({\n          description: 'Deliver the approval directly to the issuer host.',\n        }),\n      }),\n      use: [sessionMiddleware],\n    },\n    async (ctx) => {\n      const { scope, client } = await prepare(deps, ctx, ctx.body);\n      const xml =\n        ctx.body.sign === true\n          ? await signDocument(deps, scope, ctx.body.xml)\n          : ctx.body.xml;\n      assertIssuer(xml, scope.taxPayerId);\n\n      const buyerHost = ctx.body.buyerHost;\n      const outcome = await runSubmission<\n        CommercialApprovalResponse | B2BCommercialApprovalResponse\n      >({\n        ctx,\n        deps,\n        scope,\n        operation: 'sendCommercialApproval',\n        xml,\n        idempotencyKey: ctx.body.idempotencyKey,\n        send: () => {\n          const fileName = ctx.body.fileName ?? fileNameFor(xml, 'approval');\n          return buyerHost === undefined\n            ? client.sendCommercialApproval(xml, fileName)\n            : client.sendCommercialApproval(xml, fileName, buyerHost);\n        },\n      });\n\n      return ctx.json({\n        ...scopeEcho(scope),\n        submissionId: outcome.submissionId,\n        replayed: outcome.replayed,\n        result: outcome.result,\n      });\n    },\n  );\n\n/** POST /dgii-ecf/documents/void-range — ANECF range voiding. */\nexport const voidENCF = (deps: DgiiEcfEndpointDeps) =>\n  createAuthEndpoint(\n    '/dgii-ecf/documents/void-range',\n    {\n      method: 'POST',\n      body: z.object(documentShape),\n      use: [sessionMiddleware],\n    },\n    async (ctx) => {\n      const { scope, client } = await prepare(deps, ctx, ctx.body);\n      const xml =\n        ctx.body.sign === true\n          ? await signDocument(deps, scope, ctx.body.xml)\n          : ctx.body.xml;\n      assertIssuer(xml, scope.taxPayerId);\n\n      const outcome = await runSubmission({\n        ctx,\n        deps,\n        scope,\n        operation: 'voidENCF',\n        xml,\n        idempotencyKey: ctx.body.idempotencyKey,\n        send: () =>\n          client.voidENCF(xml, ctx.body.fileName ?? fileNameFor(xml, 'void-range')),\n      });\n\n      return ctx.json({\n        ...scopeEcho(scope),\n        submissionId: outcome.submissionId,\n        replayed: outcome.replayed,\n        result: outcome.result,\n      });\n    },\n  );\n\n/**\n * POST /dgii-ecf/documents/reconcile — resolve a submission whose outcome is\n * unknown.\n *\n * This is the counterpart of the replay guard: when a pending record exists the\n * caller reconciles by e-NCF instead of re-sending, and DGII — not the plugin —\n * decides whether the document landed.\n */\nexport const reconcileSubmission = (deps: DgiiEcfEndpointDeps) =>\n  createAuthEndpoint(\n    '/dgii-ecf/documents/reconcile',\n    {\n      method: 'POST',\n      body: z.object({\n        ...scopeShape,\n        xml: z.string().min(1).meta({ description: 'The signed document, as XML.' }),\n      }),\n      use: [sessionMiddleware],\n    },\n    async (ctx) => {\n      const { scope, client } = await prepare(deps, ctx, ctx.body);\n      assertIssuer(ctx.body.xml, scope.taxPayerId);\n\n      const result = unwrap(await client.reconcileSubmission(ctx.body.xml));\n      return ctx.json({ ...scopeEcho(scope), result });\n    },\n  );\n","import { createAuthEndpoint, sessionMiddleware } from 'better-auth/api';\nimport * as z from 'zod';\nimport { type DgiiEcfEndpointDeps, prepare, scopeEcho, unwrap } from './shared.js';\n\n/**\n * Read-only DGII queries: tracking, existence checks and the service\n * directories.\n *\n * None of them mutate fiscal state, so none of them touch the replay guard, and\n * each one carries its own taxpayer scope check — a track id is not a secret, so\n * the only thing standing between organizations is the authorization performed\n * during scope resolution.\n */\n\nconst scopeShape = {\n  taxPayerId: z.string().min(1).optional().meta({\n    description:\n      'Taxpayer id (RNC / cédula) to act for. Overrides the organization field.',\n  }),\n  organizationId: z.string().min(1).optional().meta({\n    description:\n      'Organization to act for. Defaults to the session active organization.',\n  }),\n};\n\n/** GET /dgii-ecf/tracks — DGII per-track result (`consultaresultado`). */\nexport const trackStatus = (deps: DgiiEcfEndpointDeps) =>\n  createAuthEndpoint(\n    '/dgii-ecf/tracks',\n    {\n      method: 'GET',\n      query: z.object({\n        ...scopeShape,\n        trackId: z.string().min(1).meta({ description: 'DGII track id.' }),\n      }),\n      use: [sessionMiddleware],\n    },\n    async (ctx) => {\n      const { scope, client } = await prepare(deps, ctx, ctx.query);\n      const result = unwrap(await client.statusTrackId(ctx.query.trackId));\n      return ctx.json({ ...scopeEcho(scope), result });\n    },\n  );\n\n/**\n * POST /dgii-ecf/inquiries/status — DGII existence read (`consultaestado`).\n *\n * DGII answers \"No encontrado\" for a document it never received, so this is the\n * read a caller uses to decide whether a pending submission landed.\n */\nexport const inquiryStatus = (deps: DgiiEcfEndpointDeps) =>\n  createAuthEndpoint(\n    '/dgii-ecf/inquiries/status',\n    {\n      method: 'POST',\n      body: z.object({\n        ...scopeShape,\n        ncf: z.string().min(1).meta({ description: 'The e-NCF to look up.' }),\n        buyerTaxPayerId: z\n          .string()\n          .min(1)\n          .optional()\n          .meta({ description: 'Buyer RNC, when DGII needs it to disambiguate.' }),\n        securityCode: z\n          .string()\n          .min(1)\n          .optional()\n          .meta({ description: 'Six-digit security code of the document.' }),\n      }),\n      use: [sessionMiddleware],\n    },\n    async (ctx) => {\n      const { scope, client } = await prepare(deps, ctx, ctx.body);\n      const result = unwrap(\n        await client.inquiryStatus(\n          scope.taxPayerId,\n          ctx.body.ncf,\n          ctx.body.buyerTaxPayerId,\n          ctx.body.securityCode,\n        ),\n      );\n      return ctx.json({ ...scopeEcho(scope), result });\n    },\n  );\n\n/** POST /dgii-ecf/inquiries/tracks — every track DGII knows for an e-NCF. */\nexport const trackStatuses = (deps: DgiiEcfEndpointDeps) =>\n  createAuthEndpoint(\n    '/dgii-ecf/inquiries/tracks',\n    {\n      method: 'POST',\n      body: z.object({\n        ...scopeShape,\n        encf: z.string().min(1).meta({ description: 'The e-NCF to list tracks for.' }),\n      }),\n      use: [sessionMiddleware],\n    },\n    async (ctx) => {\n      const { scope, client } = await prepare(deps, ctx, ctx.body);\n      const result = unwrap(\n        await client.trackStatuses(scope.taxPayerId, ctx.body.encf),\n      );\n      return ctx.json({ ...scopeEcho(scope), result });\n    },\n  );\n\n/**\n * POST /dgii-ecf/inquiries/summary — RFCE inquiry.\n *\n * Production only: DGII does not publish the consumption-summary inquiry in the\n * certification environments, and the SDK refuses it there rather than returning\n * an empty answer that would read as \"not found\".\n */\nexport const summaryInvoiceInquiry = (deps: DgiiEcfEndpointDeps) =>\n  createAuthEndpoint(\n    '/dgii-ecf/inquiries/summary',\n    {\n      method: 'POST',\n      body: z.object({\n        ...scopeShape,\n        encf: z.string().min(1).meta({ description: 'The RFCE e-NCF to look up.' }),\n        securityCode: z\n          .string()\n          .min(1)\n          .meta({ description: 'Six-digit security code of the summary invoice.' }),\n      }),\n      use: [sessionMiddleware],\n    },\n    async (ctx) => {\n      const { scope, client } = await prepare(deps, ctx, ctx.body);\n      const result = unwrap(\n        await client.getSummaryInvoiceInquiry(\n          scope.taxPayerId,\n          ctx.body.encf,\n          ctx.body.securityCode,\n        ),\n      );\n      return ctx.json({ ...scopeEcho(scope), result });\n    },\n  );\n\n/** GET /dgii-ecf/directories/customers — the service directory for one RNC. */\nexport const customerDirectory = (deps: DgiiEcfEndpointDeps) =>\n  createAuthEndpoint(\n    '/dgii-ecf/directories/customers',\n    {\n      method: 'GET',\n      query: z.object({\n        ...scopeShape,\n        rnc: z.string().min(1).optional().meta({\n          description:\n            'RNC to look up. Defaults to the taxpayer this request acts for.',\n        }),\n      }),\n      use: [sessionMiddleware],\n    },\n    async (ctx) => {\n      const { scope, client } = await prepare(deps, ctx, ctx.query);\n      const result = unwrap(\n        await client.getCustomerDirectory(ctx.query.rnc ?? scope.taxPayerId),\n      );\n      return ctx.json({ ...scopeEcho(scope), result: result ?? [] });\n    },\n  );\n\n/** GET /dgii-ecf/directories — every receiver that publishes service URLs. */\nexport const directoryListing = (deps: DgiiEcfEndpointDeps) =>\n  createAuthEndpoint(\n    '/dgii-ecf/directories/all',\n    {\n      method: 'GET',\n      query: z.object(scopeShape),\n      use: [sessionMiddleware],\n    },\n    async (ctx) => {\n      const { scope, client } = await prepare(deps, ctx, ctx.query);\n      const result = unwrap(await client.getDirectoryListing());\n      return ctx.json({ ...scopeEcho(scope), result });\n    },\n  );\n","import { createAuthEndpoint, sessionMiddleware } from 'better-auth/api';\nimport * as z from 'zod';\nimport { StatusEnvironment } from '@deuriib/dgii-ecf';\nimport { type DgiiEcfEndpointDeps, prepare, scopeEcho, unwrap } from './shared.js';\nimport { DGII_ECF_ERROR_CODES, serverError } from '../errors.js';\n\n/**\n * DGII operational endpoints.\n *\n * The status service answers \"is DGII up right now\", which a back office needs\n * before it lets anybody transmit. It takes an API key instead of the bearer\n * token, so it works without a session against DGII — but it still needs the\n * plugin's own session, because where an application exposes DGII health is a\n * business decision, not a public endpoint's.\n */\n\nconst scopeShape = {\n  taxPayerId: z.string().min(1).optional().meta({\n    description:\n      'Taxpayer id (RNC / cédula) to act for. Overrides the organization field.',\n  }),\n  organizationId: z.string().min(1).optional().meta({\n    description:\n      'Organization to act for. Defaults to the session active organization.',\n  }),\n};\n\n/** Environments the status service names with its own numeric codes. */\nconst STATUS_ENVIRONMENTS = {\n  precertification: StatusEnvironment.PreCertification,\n  production: StatusEnvironment.Production,\n  certification: StatusEnvironment.Certification,\n} as const;\n\nconst requireStatusKey = (deps: DgiiEcfEndpointDeps): void => {\n  if (deps.provider.constructsClients && deps.options.status?.apiKey === undefined) {\n    throw serverError(DGII_ECF_ERROR_CODES.DGII_STATUS_API_KEY_REQUIRED);\n  }\n};\n\n/**\n * POST /dgii-ecf/authenticate — warm the DGII token for a taxpayer.\n *\n * The token itself is never returned. It is a bearer credential for DGII, valid\n * for the certificate that minted it; handing it to a browser would undo the\n * reason this plugin exists. Callers get the validity window instead, which is\n * what a UI actually shows.\n */\nexport const authenticate = (deps: DgiiEcfEndpointDeps) =>\n  createAuthEndpoint(\n    '/dgii-ecf/authenticate',\n    {\n      method: 'POST',\n      body: z.object({\n        ...scopeShape,\n        buyerHost: z\n          .string()\n          .url()\n          .optional()\n          .meta({ description: 'Authenticate against a buyer Sender↔Receiver host.' }),\n      }),\n      use: [sessionMiddleware],\n    },\n    async (ctx) => {\n      const { scope, client } = await prepare(deps, ctx, ctx.body);\n      const token = unwrap(await client.authenticate(ctx.body.buyerHost));\n      return ctx.json({\n        ...scopeEcho(scope),\n        issuedAt: token.expedido,\n        expiresAt: token.expira,\n      });\n    },\n  );\n\n/** GET /dgii-ecf/service-status — operational status of every DGII service. */\nexport const serviceStatus = (deps: DgiiEcfEndpointDeps) =>\n  createAuthEndpoint(\n    '/dgii-ecf/service-status',\n    {\n      method: 'GET',\n      query: z.object(scopeShape),\n      use: [sessionMiddleware],\n    },\n    async (ctx) => {\n      requireStatusKey(deps);\n      const { scope, client } = await prepare(deps, ctx, ctx.query);\n      const services = unwrap(await client.getServiceStatus());\n      return ctx.json({ ...scopeEcho(scope), services });\n    },\n  );\n\n/** GET /dgii-ecf/maintenance-windows — DGII scheduled maintenance. */\nexport const maintenanceWindows = (deps: DgiiEcfEndpointDeps) =>\n  createAuthEndpoint(\n    '/dgii-ecf/maintenance-windows',\n    {\n      method: 'GET',\n      query: z.object(scopeShape),\n      use: [sessionMiddleware],\n    },\n    async (ctx) => {\n      requireStatusKey(deps);\n      const { scope, client } = await prepare(deps, ctx, ctx.query);\n      const windows = unwrap(await client.getMaintenanceWindows());\n      return ctx.json({ ...scopeEcho(scope), windows });\n    },\n  );\n\n/** GET /dgii-ecf/service-availability — is one environment inside a window. */\nexport const serviceAvailability = (deps: DgiiEcfEndpointDeps) =>\n  createAuthEndpoint(\n    '/dgii-ecf/service-availability',\n    {\n      method: 'GET',\n      query: z.object({\n        ...scopeShape,\n        environment: z\n          .enum(['precertification', 'production', 'certification'])\n          .meta({ description: 'DGII environment to query.' }),\n      }),\n      use: [sessionMiddleware],\n    },\n    async (ctx) => {\n      requireStatusKey(deps);\n      const { scope, client } = await prepare(deps, ctx, ctx.query);\n      const result = unwrap(\n        await client.checkServiceAvailability(\n          STATUS_ENVIRONMENTS[ctx.query.environment],\n        ),\n      );\n      return ctx.json({\n        ...scopeEcho(scope),\n        environmentChecked: ctx.query.environment,\n        estado: result.estado,\n      });\n    },\n  );\n","import { createAuthEndpoint, sessionMiddleware } from 'better-auth/api';\nimport * as z from 'zod';\nimport { type DgiiEcfEndpointDeps, prepare, scopeEcho } from './shared.js';\nimport { createSubmissionStore } from '../persistence.js';\n\n/**\n * Introspection endpoints: \"which taxpayer will this call use\" and \"what has\n * already been submitted\".\n *\n * Both exist because the two hardest questions in a multi-tenant fiscal\n * integration are answered by the server, not by the client's own bookkeeping.\n */\n\nconst scopeShape = {\n  taxPayerId: z.string().min(1).optional().meta({\n    description:\n      'Taxpayer id (RNC / cédula) to act for. Overrides the organization field.',\n  }),\n  organizationId: z.string().min(1).optional().meta({\n    description:\n      'Organization to act for. Defaults to the session active organization.',\n  }),\n};\n\n/**\n * GET /dgii-ecf/taxpayer — the resolved identity of the next call.\n *\n * `source` says which of the three resolution modes answered, which is what a\n * UI needs to explain itself (\"this invoice will be issued as RNC … because your\n * organization stores it\") instead of guessing.\n */\nexport const resolveTaxPayer = (deps: DgiiEcfEndpointDeps) =>\n  createAuthEndpoint(\n    '/dgii-ecf/taxpayer',\n    {\n      method: 'GET',\n      query: z.object(scopeShape),\n      use: [sessionMiddleware],\n    },\n    async (ctx) => {\n      const { scope } = await prepare(deps, ctx, ctx.query);\n      return ctx.json({\n        taxPayerId: scope.taxPayerId,\n        organizationId: scope.organizationId,\n        organizationTaxPayerId: scope.organizationTaxPayerId,\n        source: scope.source,\n        environment: scope.environment,\n      });\n    },\n  );\n\n/** GET /dgii-ecf/submissions — the audit trail for the scope in question. */\nexport const listSubmissions = (deps: DgiiEcfEndpointDeps) =>\n  createAuthEndpoint(\n    '/dgii-ecf/submissions',\n    {\n      method: 'GET',\n      query: z.object({\n        ...scopeShape,\n        limit: z.coerce.number().int().min(1).max(100).optional().meta({\n          description: 'Maximum number of records to return. Defaults to 20.',\n        }),\n        status: z\n          .enum(['pending', 'succeeded', 'failed'])\n          .optional()\n          .meta({ description: 'Filter by record status.' }),\n      }),\n      use: [sessionMiddleware],\n    },\n    async (ctx) => {\n      const { scope } = await prepare(deps, ctx, ctx.query);\n      const store = createSubmissionStore(ctx, deps.options.persistence);\n\n      // Filtering happens here rather than in the query: the adapter's `where`\n      // set is built from authorized values only, so a caller cannot widen the\n      // listing by inventing an organization id.\n      const records = await store.list({\n        organizationId: scope.organizationId,\n        taxPayerId: scope.organizationId === null ? scope.taxPayerId : null,\n        limit: Math.min(ctx.query.limit ?? 20, 100),\n      });\n\n      const filtered =\n        ctx.query.status === undefined\n          ? records\n          : records.filter((record) => record.status === ctx.query.status);\n\n      return ctx.json({\n        ...scopeEcho(scope),\n        submissions: filtered.map((record) => ({\n          id: record.id,\n          operation: record.operation,\n          status: record.status,\n          taxPayerId: record.taxPayerId,\n          organizationId: record.organizationId ?? null,\n          environment: record.environment,\n          encf: record.encf ?? null,\n          trackId: record.trackId ?? null,\n          documentHash: record.documentHash ?? null,\n          errorCode: record.errorCode ?? null,\n          createdAt: record.createdAt ?? null,\n        })),\n      });\n    },\n  );\n","import type { BetterAuthPlugin } from 'better-auth';\nimport type { DBFieldAttribute } from '@better-auth/core/db';\nimport { createClientProvider, type DgiiEcfClientProvider } from './client-provider.js';\nimport { DGII_ECF_ERROR_CODES } from './errors.js';\nimport { SUBMISSION_MODEL } from './persistence.js';\nimport type { DgiiEcfOptions } from './types.js';\nimport {\n  sendCommercialApproval,\n  sendDocument,\n  sendElectronicDocument,\n  sendSummary,\n  reconcileSubmission,\n  voidENCF,\n} from './endpoints/documents.js';\nimport {\n  customerDirectory,\n  directoryListing,\n  inquiryStatus,\n  summaryInvoiceInquiry,\n  trackStatus,\n  trackStatuses,\n} from './endpoints/inquiries.js';\nimport {\n  authenticate,\n  maintenanceWindows,\n  serviceAvailability,\n  serviceStatus,\n} from './endpoints/status.js';\nimport { listSubmissions, resolveTaxPayer } from './endpoints/audit.js';\n\n/**\n * The `organization` field the plugin reads.\n *\n * `input: false` because this definition is used when *the plugin* registers the\n * field (the read-only `organization.extendSchema` mode): the value is written\n * by another system, so Better Auth's input parser must not accept it.\n */\nconst readonlyTaxPayerIdField = (): DBFieldAttribute => ({\n  type: 'string',\n  required: false,\n  input: false,\n  returned: true,\n  unique: false,\n});\n\n/**\n * Fragments to drop into `organization({ schema })`.\n *\n * Exported so an application declares the field exactly once, with exactly the\n * definition this plugin expects. This is the supported way to make the value\n * *writable*: the organization plugin builds its create/update schemas from its\n * own `additionalFields`, so a field registered only by this plugin's schema is\n * readable but not accepted by `organization.update`.\n *\n * @example\n * ```ts\n * organization({ schema: { organization: dgiiEcfOrganizationSchema() } })\n * ```\n */\nexport const dgiiEcfOrganizationSchema = (\n  field = 'taxPayerId',\n): {\n  additionalFields: Record<string, DBFieldAttribute>;\n} => ({\n  additionalFields: {\n    [field]: {\n      type: 'string',\n      required: false,\n      // Writable: this fragment is declared by the organization plugin, which\n      // is what makes `organization.create` / `organization.update` accept it.\n      input: true,\n      returned: true,\n      unique: false,\n    },\n  },\n});\n\n/**\n * Better Auth plugin wiring the DGII e-CF SDK into an authenticated API.\n *\n * Three responsibilities, and deliberately no fourth:\n *\n * 1. **Identity** — decide *which* taxpayer a call acts for: the request, the\n *    organization, or a server-side mapping, authorized in that order.\n * 2. **Credentials** — resolve key material per taxpayer through a server-side\n *    callback, so no certificate or bearer token ever reaches a browser.\n * 3. **Durability** — record submissions, so a retry is replay-safe across\n *    restarts and the fiscal audit trail survives the process.\n *\n * Document *content* stays the host's job: the plugin signs and transmits XML,\n * it does not model invoices.\n */\nexport const dgiiEcf = (options: DgiiEcfOptions = {}) => {\n  // Built once: the provider owns the client cache, so it must outlive requests.\n  const provider = createClientProvider(options);\n  const deps = { options, provider } as const;\n\n  const schema: NonNullable<BetterAuthPlugin['schema']> = {\n    [SUBMISSION_MODEL]: {\n      modelName: SUBMISSION_MODEL,\n      fields: {\n        organizationId: { type: 'string', required: false },\n        taxPayerId: { type: 'string', required: true },\n        userId: { type: 'string', required: true },\n        environment: { type: 'string', required: true },\n        operation: { type: 'string', required: true },\n        status: { type: 'string', required: true },\n        idempotencyKey: { type: 'string', required: false },\n        encf: { type: 'string', required: false },\n        trackId: { type: 'string', required: false },\n        documentHash: { type: 'string', required: false },\n        errorCode: { type: 'string', required: false },\n        response: { type: 'string', required: false },\n        // Better Auth does not add timestamps implicitly: a plugin table that\n        // wants them declares them. `createdAt` orders the replay lookup and the\n        // audit listing; `updatedAt` records when a submission was closed.\n        createdAt: { type: 'date', required: true, defaultValue: () => new Date() },\n        updatedAt: { type: 'date', required: false, onUpdate: () => new Date() },\n      },\n      indexes: [\n        // The replay lookup: taxpayer + key must be a cheap read.\n        { fields: ['taxPayerId', 'idempotencyKey'] },\n        // The audit listing: \"everything this organization submitted\".\n        { fields: ['organizationId', 'createdAt'] },\n      ],\n    },\n  };\n\n  if (options.organization?.extendSchema === true) {\n    schema.organization = {\n      fields: {\n        [options.organization.field ?? 'taxPayerId']: readonlyTaxPayerIdField(),\n      },\n    };\n  }\n\n  // The plugin literal stays exactly a `BetterAuthPlugin` so Better Auth can\n  // infer its endpoints; the provider is attached afterwards because widening\n  // the return type would erase that inference.\n  const plugin = {\n    id: 'dgii-ecf',\n    $ERROR_CODES: DGII_ECF_ERROR_CODES,\n    schema,\n    endpoints: {\n      // Identity\n      dgiiEcfResolveTaxPayer: resolveTaxPayer(deps),\n      // Session / token\n      dgiiEcfAuthenticate: authenticate(deps),\n      // Documents\n      dgiiEcfSendDocument: sendDocument(deps),\n      dgiiEcfSendElectronicDocument: sendElectronicDocument(deps),\n      dgiiEcfSendSummary: sendSummary(deps),\n      dgiiEcfSendCommercialApproval: sendCommercialApproval(deps),\n      dgiiEcfVoidENCF: voidENCF(deps),\n      dgiiEcfReconcileSubmission: reconcileSubmission(deps),\n      // Queries\n      dgiiEcfTrackStatus: trackStatus(deps),\n      dgiiEcfInquiryStatus: inquiryStatus(deps),\n      dgiiEcfTrackStatuses: trackStatuses(deps),\n      dgiiEcfSummaryInvoiceInquiry: summaryInvoiceInquiry(deps),\n      dgiiEcfCustomerDirectory: customerDirectory(deps),\n      dgiiEcfDirectoryListing: directoryListing(deps),\n      // DGII operations\n      dgiiEcfServiceStatus: serviceStatus(deps),\n      dgiiEcfMaintenanceWindows: maintenanceWindows(deps),\n      dgiiEcfServiceAvailability: serviceAvailability(deps),\n      // Audit\n      dgiiEcfListSubmissions: listSubmissions(deps),\n    },\n    rateLimit: [\n      {\n        // Fiscal transmissions are metered by DGII and expensive to retry, so\n        // the whole surface gets a conservative per-window budget.\n        window: 60,\n        max: 60,\n        pathMatcher: (path: string) => path.startsWith('/dgii-ecf'),\n      },\n    ],\n  } satisfies BetterAuthPlugin;\n\n  return Object.assign(plugin, { clientProvider: provider });\n};\n\n/**\n * Public type of the plugin.\n *\n * `ReturnType` rather than an interface on purpose: an explicit interface would\n * widen `endpoints` to an index signature and destroy the client-side inference\n * that makes a renamed path a compile error.\n */\nexport type DgiiEcfPlugin = ReturnType<typeof dgiiEcf>;\n\n/** Exposed so a host can drop a cached client after rotating a certificate. */\nexport type { DgiiEcfClientProvider };\n\ndeclare module '@better-auth/core' {\n  interface BetterAuthPluginRegistry<AuthOptions, Options> {\n    'dgii-ecf': {\n      creator: typeof dgiiEcf;\n    };\n  }\n}\n"]}

package/dist/index.d.cts

@@ -0,0 +1,40 @@
+export { a as DgiiEcfAuthorizer, b as DgiiEcfClientCacheOptions, c as DgiiEcfClientProvider, d as DgiiEcfClientResolver, e as DgiiEcfCredentialsResolver, f as DgiiEcfOptions, g as DgiiEcfOrganizationOptions, h as DgiiEcfPersistenceOptions, D as DgiiEcfPlugin, i as DgiiEcfScope, j as DgiiEcfStatusOptions, k as DgiiEcfSubmissionStore, l as DgiiEcfTaxPayerIdResolver, m as DgiiEcfTaxPayerIdSource, S as SUBMISSION_MODEL, n as SubmissionRecord, o as SubmissionStatus, T as TaxPayerIdValidation, p as TaxPayerIdValidator, q as dgiiEcf, r as dgiiEcfOrganizationSchema, s as isTaxPayerIdShape, t as normalizeTaxPayerId } from './plugin-BVYTmUJU.cjs';
+import * as _better_auth_core_utils_error_codes from '@better-auth/core/utils/error-codes';
+export { Environment } from '@deuriib/dgii-ecf';
+import 'better-auth';
+import 'zod/v4/core';
+import '@better-auth/core/db';
+
+/**
+ * Error codes this plugin can return.
+ *
+ * They are declared through `defineErrorCodes` so they flow into Better Auth's
+ * own type surface (`auth.$ERROR_CODES`, client `error.code`) and so the keys
+ * are constrained to UPPER_SNAKE_CASE at compile time. Every code describes a
+ * condition the plugin itself decided on; a failure DGII produced is reported
+ * as {@link DGII_ECF_ERROR_CODES.DGII_REQUEST_FAILED} with the upstream detail
+ * attached, never smuggled into a success payload.
+ */
+declare const DGII_ECF_ERROR_CODES: {
+    DGII_SESSION_REQUIRED: _better_auth_core_utils_error_codes.RawError<"DGII_SESSION_REQUIRED">;
+    DGII_TAXPAYER_ID_REQUIRED: _better_auth_core_utils_error_codes.RawError<"DGII_TAXPAYER_ID_REQUIRED">;
+    DGII_TAXPAYER_ID_INVALID: _better_auth_core_utils_error_codes.RawError<"DGII_TAXPAYER_ID_INVALID">;
+    DGII_TAXPAYER_ID_MISMATCH: _better_auth_core_utils_error_codes.RawError<"DGII_TAXPAYER_ID_MISMATCH">;
+    DGII_TAXPAYER_ID_FORBIDDEN: _better_auth_core_utils_error_codes.RawError<"DGII_TAXPAYER_ID_FORBIDDEN">;
+    DGII_ORGANIZATION_NOT_FOUND: _better_auth_core_utils_error_codes.RawError<"DGII_ORGANIZATION_NOT_FOUND">;
+    DGII_ORGANIZATION_REQUIRED: _better_auth_core_utils_error_codes.RawError<"DGII_ORGANIZATION_REQUIRED">;
+    DGII_NOT_A_MEMBER: _better_auth_core_utils_error_codes.RawError<"DGII_NOT_A_MEMBER">;
+    DGII_INSUFFICIENT_ROLE: _better_auth_core_utils_error_codes.RawError<"DGII_INSUFFICIENT_ROLE">;
+    DGII_CREDENTIALS_UNAVAILABLE: _better_auth_core_utils_error_codes.RawError<"DGII_CREDENTIALS_UNAVAILABLE">;
+    DGII_CLIENT_NOT_CONFIGURED: _better_auth_core_utils_error_codes.RawError<"DGII_CLIENT_NOT_CONFIGURED">;
+    DGII_STATUS_API_KEY_REQUIRED: _better_auth_core_utils_error_codes.RawError<"DGII_STATUS_API_KEY_REQUIRED">;
+    DGII_DOCUMENT_UNREADABLE: _better_auth_core_utils_error_codes.RawError<"DGII_DOCUMENT_UNREADABLE">;
+    DGII_SIGNING_FAILED: _better_auth_core_utils_error_codes.RawError<"DGII_SIGNING_FAILED">;
+    DGII_REQUEST_FAILED: _better_auth_core_utils_error_codes.RawError<"DGII_REQUEST_FAILED">;
+    DGII_SUBMISSION_NOT_FOUND: _better_auth_core_utils_error_codes.RawError<"DGII_SUBMISSION_NOT_FOUND">;
+    DGII_PERSISTENCE_UNAVAILABLE: _better_auth_core_utils_error_codes.RawError<"DGII_PERSISTENCE_UNAVAILABLE">;
+    DGII_IDEMPOTENCY_IN_FLIGHT: _better_auth_core_utils_error_codes.RawError<"DGII_IDEMPOTENCY_IN_FLIGHT">;
+};
+type DgiiEcfErrorCode = keyof typeof DGII_ECF_ERROR_CODES;
+
+export { DGII_ECF_ERROR_CODES, type DgiiEcfErrorCode };

package/dist/index.d.ts

@@ -0,0 +1,40 @@
+export { a as DgiiEcfAuthorizer, b as DgiiEcfClientCacheOptions, c as DgiiEcfClientProvider, d as DgiiEcfClientResolver, e as DgiiEcfCredentialsResolver, f as DgiiEcfOptions, g as DgiiEcfOrganizationOptions, h as DgiiEcfPersistenceOptions, D as DgiiEcfPlugin, i as DgiiEcfScope, j as DgiiEcfStatusOptions, k as DgiiEcfSubmissionStore, l as DgiiEcfTaxPayerIdResolver, m as DgiiEcfTaxPayerIdSource, S as SUBMISSION_MODEL, n as SubmissionRecord, o as SubmissionStatus, T as TaxPayerIdValidation, p as TaxPayerIdValidator, q as dgiiEcf, r as dgiiEcfOrganizationSchema, s as isTaxPayerIdShape, t as normalizeTaxPayerId } from './plugin-BVYTmUJU.js';
+import * as _better_auth_core_utils_error_codes from '@better-auth/core/utils/error-codes';
+export { Environment } from '@deuriib/dgii-ecf';
+import 'better-auth';
+import 'zod/v4/core';
+import '@better-auth/core/db';
+
+/**
+ * Error codes this plugin can return.
+ *
+ * They are declared through `defineErrorCodes` so they flow into Better Auth's
+ * own type surface (`auth.$ERROR_CODES`, client `error.code`) and so the keys
+ * are constrained to UPPER_SNAKE_CASE at compile time. Every code describes a
+ * condition the plugin itself decided on; a failure DGII produced is reported
+ * as {@link DGII_ECF_ERROR_CODES.DGII_REQUEST_FAILED} with the upstream detail
+ * attached, never smuggled into a success payload.
+ */
+declare const DGII_ECF_ERROR_CODES: {
+    DGII_SESSION_REQUIRED: _better_auth_core_utils_error_codes.RawError<"DGII_SESSION_REQUIRED">;
+    DGII_TAXPAYER_ID_REQUIRED: _better_auth_core_utils_error_codes.RawError<"DGII_TAXPAYER_ID_REQUIRED">;
+    DGII_TAXPAYER_ID_INVALID: _better_auth_core_utils_error_codes.RawError<"DGII_TAXPAYER_ID_INVALID">;
+    DGII_TAXPAYER_ID_MISMATCH: _better_auth_core_utils_error_codes.RawError<"DGII_TAXPAYER_ID_MISMATCH">;
+    DGII_TAXPAYER_ID_FORBIDDEN: _better_auth_core_utils_error_codes.RawError<"DGII_TAXPAYER_ID_FORBIDDEN">;
+    DGII_ORGANIZATION_NOT_FOUND: _better_auth_core_utils_error_codes.RawError<"DGII_ORGANIZATION_NOT_FOUND">;
+    DGII_ORGANIZATION_REQUIRED: _better_auth_core_utils_error_codes.RawError<"DGII_ORGANIZATION_REQUIRED">;
+    DGII_NOT_A_MEMBER: _better_auth_core_utils_error_codes.RawError<"DGII_NOT_A_MEMBER">;
+    DGII_INSUFFICIENT_ROLE: _better_auth_core_utils_error_codes.RawError<"DGII_INSUFFICIENT_ROLE">;
+    DGII_CREDENTIALS_UNAVAILABLE: _better_auth_core_utils_error_codes.RawError<"DGII_CREDENTIALS_UNAVAILABLE">;
+    DGII_CLIENT_NOT_CONFIGURED: _better_auth_core_utils_error_codes.RawError<"DGII_CLIENT_NOT_CONFIGURED">;
+    DGII_STATUS_API_KEY_REQUIRED: _better_auth_core_utils_error_codes.RawError<"DGII_STATUS_API_KEY_REQUIRED">;
+    DGII_DOCUMENT_UNREADABLE: _better_auth_core_utils_error_codes.RawError<"DGII_DOCUMENT_UNREADABLE">;
+    DGII_SIGNING_FAILED: _better_auth_core_utils_error_codes.RawError<"DGII_SIGNING_FAILED">;
+    DGII_REQUEST_FAILED: _better_auth_core_utils_error_codes.RawError<"DGII_REQUEST_FAILED">;
+    DGII_SUBMISSION_NOT_FOUND: _better_auth_core_utils_error_codes.RawError<"DGII_SUBMISSION_NOT_FOUND">;
+    DGII_PERSISTENCE_UNAVAILABLE: _better_auth_core_utils_error_codes.RawError<"DGII_PERSISTENCE_UNAVAILABLE">;
+    DGII_IDEMPOTENCY_IN_FLIGHT: _better_auth_core_utils_error_codes.RawError<"DGII_IDEMPOTENCY_IN_FLIGHT">;
+};
+type DgiiEcfErrorCode = keyof typeof DGII_ECF_ERROR_CODES;
+
+export { DGII_ECF_ERROR_CODES, type DgiiEcfErrorCode };